26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 62:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4c4,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win/malicious_confidence_60% Sample d44e6faaf3df… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample d44e6faaf3df…. Malware family: Win/malicious_confidence_60%. Threat score 100/100. 4/28 AV engines flagged this file. 11 malicious and 21 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/d44e6faaf3df358593a29faace64a071ab8de0a84c30a5232d8e9081dd668f1b","keywords":["Malicious","Win/malicious_confidence_60%","malware analysis","sandbox report","threat intelligence","d44e6faaf3df358593a29faace64a071ab8de0a84c30a5232d8e9081dd668f1b"],"about":{"@type":"SoftwareApplication","name":"file.exe","applicationCategory":["peexe","64bits","executable"],"identifier":"d44e6faaf3df358593a29faace64a071ab8de0a84c30a5232d8e9081dd668f1b","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Win/malicious_confidence_60%","antivirusDetections":{"malicious":4,"total":28},"behavioralIndicators":{"malicious":11,"suspicious":21},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T892,Found string ":\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" (Source: "00000000-00007296.00000000.339360.EF460000.00000004.mdmp, 00000000-00007296.00000001.339555.EF460000.00000004.mdmp, 00000000-00007296.00000001.339555.F3210000.00000004.mdmp") Found string ":\WINDOWS\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\6da01910c256231d1c50ad0aacee5941\System.Management.Automation.ni.dll" (Source: "00000000-00007296.00000000.339360.EF460000.00000004.mdmp, 00000000-00007296.00000001.339555.EF460000.00000004.mdmp") Found string "ile:///C:/WINDOWS/System32/WindowsPowerShell/v1.0/en-US/System.Management.Automation.resources/System.Management.Automation.resources.DLL" (Source: "00000000-00007296.00000000.339360.EF460000.00000004.mdmp") Found string "??\C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" (Source: "00000000-00007296.00000000.339360.EF460000.00000004.mdmp") Found string "ile:///C:/WINDOWS/System32/WindowsPowerShell/v1.0/en-US/System.Management.Automation.resources/System.Management.Automation.resources.EXE" (Source: "00000000-00007296.00000000.339360.EF460000.00000004.mdmp") Found string "System.Management.Automation.dll" (Source: "00000000-00007296.00000000.339360.EF460000.00000004.mdmp, 00000000-00007296.00000001.339555.EF460000.00000004.mdmp") Found string ".Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" (Source: "00000000-00007296.00000000.339360.F1720000.00000004.mdmp") Found string ":\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll" (Source: "00000000-00007296.00000000.339360.F1720000.00000004.mdmp") Found string "System.Management.Automation, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35, ProcessorArchitecture=MSIL" (Source: "00000000-00007296.00000000.339360.F1720000.00000004.mdmp") Found string "C:/WINDOWS/System32/WindowsPowerShell/v1.0/en-US/System.Management.Automation.r" (Source: "00000000-00007296.00000000.339360.F1720000.00000004.mdmp")28:T44f,Found reference to API "SetWaitableTimer" (Indicator: "SetWaitableTimer"; File: "RemusStealer.exe") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "RemusStealer.exe") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "RemusStealer.exe") Found reference to API "WaitForMultipleObjects error %d, GetLastError %d" (Indicator: "WaitForMultipleObjects"; File: "RemusStealer.exe") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; File: "RemusStealer.exe") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "RemusStealer.exe") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "RemusStealer.exe") Found reference to API "syscall.WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00000876.00000000.339071.02134000.00000002.mdmp") Found reference to API "syscall.procWaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00000876.00000000.339071.02134000.00000002.mdmp")29:T478,Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00000876.00000000.339071.00000000.00000004.mdmp, 00000000-00000876.00000001.340150.00000000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00000876.00000000.339071.00000000.00000004.mdmp, 00000000-00000876.00000001.340150.00000000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-"; Source: "00000000-00000876.00000000.339071.00000000.00000004.mdmp, 00000000-00000876.00000001.340150.00000000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_"; Source: "00000000-00000876.00000000.339071.00000000.00000004.mdmp, 00000000-00000876.00000001.340150.00000000.00000004.mdmp")2a:T7f5,file/memory contains long string with (Indicator: "SHA384"; File: "sslconf.exe") Found reference to "HashAlgorithm" (Indicator: "HashAlgorithm"; Source: "00000000-00007296-00000BC0-3538294110") Found reference to "crypto/aes.gcmAesFinish.abi0" (Indicator: "Aes"; Source: "00000000-00000876.00000000.339071.02134000.00000002.mdmp") Found reference to "crypto/aes.gcmAesInit.abi0" (Indicator: "Aes"; Source: "00000000-00000876.00000000.339071.02134000.00000002.mdmp") Found reference to "crypto/aes.gcmAesData.abi0" (Indicator: "Aes"; Source: "00000000-00000876.00000000.339071.02134000.00000002.mdmp") Found reference to "crypto/aes.gcmAesEnc.abi0" (Indicator: "Aes"; Source: "00000000-00000876.00000000.339071.02134000.00000002.mdmp") Found reference to "crypto/aes.gcmAesDec.abi0" (Indicator: "Aes"; Source: "00000000-00000876.00000000.339071.02134000.00000002.mdmp") Found reference to "crypto/des.NewTripleDESCipher" (Indicator: "TripleDES"; Source: "00000000-00000876.00000000.339071.02134000.00000002.mdmp") Found reference to "crypto/tls.aeadChaCha20Poly1305" (Indicator: "ChaCha20Poly1305"; Source: "00000000-00000876.00000000.339071.02134000.00000002.mdmp") Found reference to "runtime.useAeshash" (Indicator: "Aes"; Source: "00000000-00000876.00000000.339071.02134000.00000002.mdmp") Found reference to "crypto/x509.oidSHA384" (Indicator: "SHA384"; Source: "00000000-00000876.00000000.339071.02134000.00000002.mdmp") Found reference to "crypto/x509.oidSHA512" (Indicator: "SHA512"; Source: "00000000-00000876.00000000.339071.02134000.00000002.mdmp") Found reference to "crypto/x509.pssParametersSHA384" (Indicator: "SHA384"; Source: "00000000-00000876.00000000.339071.02134000.00000002.mdmp") Found reference to "crypto/x509.pssParametersSHA512" (Indicator: "SHA512"; Source: "00000000-00000876.00000000.339071.02134000.00000002.mdmp") Found reference to "SA/SHA384" (Indicator: "SHA384"; Source: "00000000-00007296.00000000.339360.F1720000.00000004.mdmp, 00000000-00007296.00000001.339555.F1720000.00000004.mdmp")2b:T5bb,"RemusStealer.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\APPLICATIONS\%1.EXE") "RemusStealer.exe" (Access type: "OPEN"; Path: "HKCU\EXEFILE\PROGID") "RemusStealer.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\EXEFILE\PROGID") "RemusStealer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\EXEFILE\SHELL\OPEN") "RemusStealer.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}\TREATAS") "RemusStealer.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}\TREATAS") "RemusStealer.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}\INPROCSERVER32") "RemusStealer.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}\INPROCSERVER32") "RemusStealer.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}\INPROCSERVER32") "RemusStealer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}\INPROCSERVER32") "RemusStealer.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}\INPROCHANDLER32") "RemusStealer.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}\INPROCHANDLER32") "RemusStealer.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}\INPROCHANDLER")2c:Ta1d,"RemusStealer.exe" queried SystemProcessInformation at 00000000-00000876-00000C15-3531906615 [PID: 876] "RemusStealer.exe" queried SystemProcessInformation at 00000000-00000876-00000C15-3531914424 [PID: 876] "RemusStealer.exe" queried SystemProcessInformation at 00000000-00000876-00000C15-3532060805 [PID: 876] "RemusStealer.exe" queried SystemProcessInformation at 00000000-00000876-00000C15-3532068730 [PID: 876] "RemusStealer.exe" queried SystemProcessInformation at 00000000-00000876-00000C15-3532159027 [PID: 876] "RemusStealer.exe" queried SystemProcessInformation at 00000000-00000876-00000C15-3532167218 [PID: 876] "RemusStealer.exe" queried SystemProcessInformation at 00000000-00000876-00000C15-3532346776 [PID: 876] "RemusStealer.exe" queried SystemProcessInformation at 00000000-00000876-00000C15-3532355809 [PID: 876] "RemusStealer.exe" queried SystemProcessInformation at 00000000-00000876-00000C15-3532664798 [PID: 876] "RemusStealer.exe" queried SystemProcessInformation at 00000000-00000876-00000C15-3532673191 [PID: 876] "RemusStealer.exe" queried SystemProcessInformation at 00000000-00000876-00000C15-3533511916 [PID: 876] "RemusStealer.exe" queried SystemProcessInformation at 00000000-00000876-00000C15-3533519634 [PID: 876] "RemusStealer.exe" queried SystemProcessInformation at 00000000-00000876-00000C15-3550934016 [PID: 876] "RemusStealer.exe" queried SystemProcessInformation at 00000000-00000876-00000C15-3550942368 [PID: 876] "OneDrive.exe" queried SystemProcessInformation at 00000000-00007456-00000C15-3533666607 [PID: 7456] "OneDrive.exe" queried SystemProcessInformation at 00000000-00007456-00000C15-3533680711 [PID: 7456] "OneDrive.exe" queried SystemProcessInformation at 00000000-00007456-00000C15-3533805987 [PID: 7456] "OneDrive.exe" queried SystemProcessInformation at 00000000-00007456-00000C15-3533814939 [PID: 7456] "OneDrive.exe" queried SystemProcessInformation at 00000000-00007456-00000C15-3533913269 [PID: 7456] "OneDrive.exe" queried SystemProcessInformation at 00000000-00007456-00000C15-3533921722 [PID: 7456] "OneDrive.exe" queried SystemProcessInformation at 00000000-00007456-00000C15-3534238656 [PID: 7456] "OneDrive.exe" queried SystemProcessInformation at 00000000-00007456-00000C15-3534246523 [PID: 7456] "OneDrive.exe" queried SystemProcessInformation at 00000000-00007456-00000C15-3534703451 [PID: 7456] "OneDrive.exe" queried SystemProcessInformation at 00000000-00007456-00000C15-3534711669 [PID: 7456] "sslconf.exe" queried SystemProcessInformation at 00000000-00002448-00000C15-3536695679 [PID: 2448]2d:T6aa,Found reference to API "encoding/hex.DecodeString" (Indicator: ".decodestring"; Source: "00000000-00000876.00000000.339071.02134000.00000002.mdmp") Found reference to API "crypto/aes.decryptBlockGo" (Indicator: ".decrypt"; Source: "00000000-00000876.00000000.339071.02134000.00000002.mdmp") Found reference to API "crypto/aes.(*aesCipher).Decrypt" (Indicator: ".decrypt"; Source: "00000000-00000876.00000000.339071.02134000.00000002.mdmp") Found reference to API "crypto/aes.(*aesCipherAsm).Decrypt" (Indicator: ".decrypt"; Source: "00000000-00000876.00000000.339071.02134000.00000002.mdmp") Found reference to API "crypto/aes.decryptBlockAsm.abi0" (Indicator: ".decrypt"; Source: "00000000-00000876.00000000.339071.02134000.00000002.mdmp") Found reference to API "crypto/aes.(*aesCipherGCM).Decrypt" (Indicator: ".decrypt"; Source: "00000000-00000876.00000000.339071.02134000.00000002.mdmp") Found reference to API "crypto/des.(*desCipher).Decrypt" (Indicator: ".decrypt"; Source: "00000000-00000876.00000000.339071.02134000.00000002.mdmp") Found reference to API "crypto/des.(*tripleDESCipher).Decrypt" (Indicator: ".decrypt"; Source: "00000000-00000876.00000000.339071.02134000.00000002.mdmp") Found reference to API "crypto/tls.(*halfConn).decrypt" (Indicator: ".decrypt"; Source: "00000000-00000876.00000000.339071.02134000.00000002.mdmp") Found reference to API "vendor/golang.org/x/net/http2/hpack.(*Decoder).decodeString" (Indicator: ".decodestring"; Source: "00000000-00000876.00000000.339071.02134000.00000002.mdmp") Found reference to API "tripledescryptoserviceprovider" (Indicator: "TripleDESCryptoServiceProvider"; Source: "00000000-00007296.00000001.339555.341C0000.00000004.mdmp")2e:Tb2e,Found string "compress/gzip.init" (Indicator: "compress/gzip"; Source: "00000000-00000876.00000000.339071.02134000.00000002.mdmp") Found string "compress/gzip.(*Reader).Reset" (Indicator: "compress/gzip"; Source: "00000000-00000876.00000000.339071.02134000.00000002.mdmp") Found string "compress/gzip.(*Reader).readString" (Indicator: "compress/gzip"; Source: "00000000-00000876.00000000.339071.02134000.00000002.mdmp") Found string "compress/gzip.(*Reader).readHeader" (Indicator: "compress/gzip"; Source: "00000000-00000876.00000000.339071.02134000.00000002.mdmp") Found string "compress/gzip.(*Reader).Read" (Indicator: "compress/gzip"; Source: "00000000-00000876.00000000.339071.02134000.00000002.mdmp") Found string "compress/gzip.(*Reader).Close" (Indicator: "compress/gzip"; Source: "00000000-00000876.00000000.339071.02134000.00000002.mdmp") Found string "compress/gzip..inittask" (Indicator: "compress/gzip"; Source: "00000000-00000876.00000000.339071.02134000.00000002.mdmp") Found string "compress/gzip.ErrChecksum" (Indicator: "compress/gzip"; Source: "00000000-00000876.00000000.339071.02134000.00000002.mdmp") Found string "compress/gzip.ErrHeader" (Indicator: "compress/gzip"; Source: "00000000-00000876.00000000.339071.02134000.00000002.mdmp") Found string "compress/gzip..typeAssert.0" (Indicator: "compress/gzip"; Source: "00000000-00000876.00000000.339071.02134000.00000002.mdmp") Found string "compress/gzip..typeAssert.1" (Indicator: "compress/gzip"; Source: "00000000-00000876.00000000.339071.02134000.00000002.mdmp") Found string "compress/gzip..typeAssert.2" (Indicator: "compress/gzip"; Source: "00000000-00000876.00000000.339071.02134000.00000002.mdmp") Found string "compress/gzip..typeAssert.3" (Indicator: "compress/gzip"; Source: "00000000-00000876.00000000.339071.02134000.00000002.mdmp") Found string "compress/gzip..typeAssert.4" (Indicator: "compress/gzip"; Source: "00000000-00000876.00000000.339071.02134000.00000002.mdmp") Found string "compress/gzip..typeAssert.5" (Indicator: "compress/gzip"; Source: "00000000-00000876.00000000.339071.02134000.00000002.mdmp") Found string "compress/gzip..typeAssert.6" (Indicator: "compress/gzip"; Source: "00000000-00000876.00000000.339071.02134000.00000002.mdmp") Found string "compress/gzip..typeAssert.7" (Indicator: "compress/gzip"; Source: "00000000-00000876.00000000.339071.02134000.00000002.mdmp") Found string "compress/gzip..typeAssert.8" (Indicator: "compress/gzip"; Source: "00000000-00000876.00000000.339071.02134000.00000002.mdmp") Found string "go:itab.*net/http.http2gzipReader,io.ReadCloser" (Indicator: "http.http2gzipreader"; Source: "00000000-00000876.00000000.339071.02134000.00000002.mdmp") Found string "go:itab.*net/http.gzipReader,io.ReadCloser" (Indicator: "http.gzipreader"; Source: "00000000-00000876.00000000.339071.02134000.00000002.mdmp")2f:Tb20,Found api reference "syscall.CertAddCertificateContextToStore" (Indicator: "CertAddCertificateContextToStore"; Source: "00000000-00000876.00000000.339071.02134000.00000002.mdmp") Found api reference "syscall.CertCloseStore" (Indicator: "CertCloseStore"; Source: "00000000-00000876.00000000.339071.02134000.00000002.mdmp") Found api reference "syscall.CertCreateCertificateContext" (Indicator: "CertCreateCertificateContext"; Source: "00000000-00000876.00000000.339071.02134000.00000002.mdmp") Found api reference "syscall.CertFreeCertificateChain" (Indicator: "CertFreeCertificateChain"; Source: "00000000-00000876.00000000.339071.02134000.00000002.mdmp") Found api reference "syscall.CertFreeCertificateContext" (Indicator: "CertFreeCertificateContext"; Source: "00000000-00000876.00000000.339071.02134000.00000002.mdmp") Found api reference "syscall.CertGetCertificateChain" (Indicator: "CertGetCertificateChain"; Source: "00000000-00000876.00000000.339071.02134000.00000002.mdmp") Found api reference "syscall.CertOpenStore" (Indicator: "CertOpenStore"; Source: "00000000-00000876.00000000.339071.02134000.00000002.mdmp") Found api reference "syscall.CertVerifyCertificateChainPolicy" (Indicator: "CertVerifyCertificateChainPolicy"; Source: "00000000-00000876.00000000.339071.02134000.00000002.mdmp") Found api reference "syscall.procCertAddCertificateContextToStore" (Indicator: "CertAddCertificateContextToStore"; Source: "00000000-00000876.00000000.339071.02134000.00000002.mdmp") Found api reference "syscall.procCertCloseStore" (Indicator: "CertCloseStore"; Source: "00000000-00000876.00000000.339071.02134000.00000002.mdmp") Found api reference "syscall.procCertCreateCertificateContext" (Indicator: "CertCreateCertificateContext"; Source: "00000000-00000876.00000000.339071.02134000.00000002.mdmp") Found api reference "syscall.procCertFreeCertificateChain" (Indicator: "CertFreeCertificateChain"; Source: "00000000-00000876.00000000.339071.02134000.00000002.mdmp") Found api reference "syscall.procCertFreeCertificateContext" (Indicator: "CertFreeCertificateContext"; Source: "00000000-00000876.00000000.339071.02134000.00000002.mdmp") Found api reference "syscall.procCertGetCertificateChain" (Indicator: "CertGetCertificateChain"; Source: "00000000-00000876.00000000.339071.02134000.00000002.mdmp") Found api reference "syscall.procCertOpenStore" (Indicator: "CertOpenStore"; Source: "00000000-00000876.00000000.339071.02134000.00000002.mdmp") Found api reference "syscall.procCertVerifyCertificateChainPolicy" (Indicator: "CertVerifyCertificateChainPolicy"; Source: "00000000-00000876.00000000.339071.02134000.00000002.mdmp") Found api reference "CryptExportKey" (Indicator: "CryptExportKey"; Source: "00000000-00007296.00000000.339360.F1720000.00000004.mdmp, 00000000-00007296.00000001.339555.F1720000.00000004.mdmp")30:T103f,Observed string: "crypto/subtle.XORBytes" (Indicator: "crypto/subtle.XORBytes") in Source: 00000000-00000876.00000000.339071.02134000.00000002.mdmp Observed string: "crypto/subtle.xorBytes.abi0" (Indicator: "crypto/subtle.xorBytes.abi0") in Source: 00000000-00000876.00000000.339071.02134000.00000002.mdmp Observed string: "crypto/cipher.newCBC" (Indicator: "crypto/cipher.newCBC") in Source: 00000000-00000876.00000000.339071.02134000.00000002.mdmp Observed string: "crypto/cipher.NewCBCEncrypter" (Indicator: "crypto/cipher.NewCBCEncrypter") in Source: 00000000-00000876.00000000.339071.02134000.00000002.mdmp Observed string: "crypto/cipher.(*cbcEncrypter).BlockSize" (Indicator: "crypto/cipher.(*cbcEncrypter).BlockSize") in Source: 00000000-00000876.00000000.339071.02134000.00000002.mdmp, Observed string: "crypto/cipher.(*cbcEncrypter).CryptBlocks" (Indicator: "crypto/cipher.(*cbcEncrypter).CryptBlocks") in Source: 00000000-00000876.00000000.339071.02134000.00000002.mdmp, Observed string: "crypto/cipher.(*cbcEncrypter).SetIV" (Indicator: "crypto/cipher.(*cbcEncrypter).SetIV") in Source: 00000000-00000876.00000000.339071.02134000.00000002.mdmp, Observed string: "crypto/cipher.NewCBCDecrypter" (Indicator: "crypto/cipher.NewCBCDecrypter") in Source: 00000000-00000876.00000000.339071.02134000.00000002.mdmp, Observed string: "crypto/cipher.(*cbcDecrypter).BlockSize" (Indicator: "crypto/cipher.(*cbcDecrypter).BlockSize") in Source: 00000000-00000876.00000000.339071.02134000.00000002.mdmp, Observed string: "crypto/cipher.(*cbcDecrypter).CryptBlocks" (Indicator: "crypto/cipher.(*cbcDecrypter).CryptBlocks") in Source: 00000000-00000876.00000000.339071.02134000.00000002.mdmp, Observed string: "crypto/cipher.(*cbcDecrypter).SetIV" (Indicator: "crypto/cipher.(*cbcDecrypter).SetIV") in Source: 00000000-00000876.00000000.339071.02134000.00000002.mdmp, Observed string: "crypto/cipher.newGCMWithNonceAndTagSize" (Indicator: "crypto/cipher.newGCMWithNonceAndTagSize") in Source: 00000000-00000876.00000000.339071.02134000.00000002.mdmp, Observed string: "crypto/cipher.(*gcm).NonceSize" (Indicator: "crypto/cipher.(*gcm).NonceSize") in Source: 00000000-00000876.00000000.339071.02134000.00000002.mdmp, Observed string: "crypto/cipher.(*gcm).Overhead" (Indicator: "crypto/cipher.(*gcm).Overhead") in Source: 00000000-00000876.00000000.339071.02134000.00000002.mdmp, Observed string: "crypto/cipher.(*gcm).Seal" (Indicator: "crypto/cipher.(*gcm).Seal") in Source: 00000000-00000876.00000000.339071.02134000.00000002.mdmp, Observed string: "crypto/cipher.(*gcm).Open" (Indicator: "crypto/cipher.(*gcm).Open") in Source: 00000000-00000876.00000000.339071.02134000.00000002.mdmp, Observed string: "crypto/cipher.(*gcm).mul" (Indicator: "crypto/cipher.(*gcm).mul") in Source: 00000000-00000876.00000000.339071.02134000.00000002.mdmp, Observed string: "crypto/cipher.(*gcm).updateBlocks" (Indicator: "crypto/cipher.(*gcm).updateBlocks") in Source: 00000000-00000876.00000000.339071.02134000.00000002.mdmp, Observed string: "crypto/cipher.(*gcm).update" (Indicator: "crypto/cipher.(*gcm).update") in Source: 00000000-00000876.00000000.339071.02134000.00000002.mdmp, Observed string: "crypto/cipher.(*gcm).counterCrypt" (Indicator: "crypto/cipher.(*gcm).counterCrypt") in Source: 00000000-00000876.00000000.339071.02134000.00000002.mdmp, Observed string: "crypto/cipher.(*gcm).deriveCounter" (Indicator: "crypto/cipher.(*gcm).deriveCounter") in Source: 00000000-00000876.00000000.339071.02134000.00000002.mdmp, Observed string: "crypto/cipher.(*gcm).auth" (Indicator: "crypto/cipher.(*gcm).auth") in Source: 00000000-00000876.00000000.339071.02134000.00000002.mdmp, Observed string: "type:.eq.crypto/cipher.gcm" (Indicator: "type:.eq.crypto/cipher.gcm") in Source: 00000000-00000876.00000000.339071.02134000.00000002.mdmp, Observed string: "crypto/internal/boring/sig.StandardCrypto.abi0" (Indicator: "crypto/internal/boring/sig.StandardCrypto.abi0") in Source: 00000000-00000876.00000000.339071.02134000.00000002.mdmp, Observed string: "crypto/aes.init" (Indicator: "crypto/aes.init") in Source: 00000000-00000876.00000000.339071.02134000.00000002.mdmp31:T6e6,The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings Matched sigs: Contains ability to perform AES/RC4 encryption (API string) Matched sigs: Able to access crypto-related API (String) Matched sigs: Contains ability to perform encryption (API string) Matched sigs: Contains key cryptographic functions (API string) Matched sigs: Contains ability to perform decryption (API string) Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Contains ability to perform Base64 encoding/decoding Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Able to decrypt/decode data Matched sigs: Contains possible references to Golang crypto modules Matched sigs: Contains reference to crypto DLLs Matched sigs: Contains reference to cryptographic keys Matched sigs: Contains ability to perform encryption/decryption using RSA algorithm Matched sigs: Calls an API typically used to import cryptographic keys into a CSP Matched sigs: Calls an API typically used to import asymmetric cryptographic keys into a CSP Matched sigs: Reads the cryptographic machine GUID Matched sigs: Calls an API typically used to decrypt a block of data Matched sigs: Calls an API typically used to encrypt a block of data Matched sigs: HTTP requests contain Base64 strings Matched sigs: Dropped file has high entropy (likely encrypted/compressed content) Matched sigs: Drops image files with high entropy (likely encrypted/compressed content) Matched sigs: YARA signature match - ChaCha20 encryption algorithm Matched sigs: YARA signature match – cryptographic algorithms Matched sigs: YARA signature match - AES encryption32:Tbdc6,Found XOR loop in file "RemusStealer.exe" at offset 76784; code bytes = 30d0 Found XOR loop in file "RemusStealer.exe" at offset 2964684; code bytes = 30d0 Found XOR loop in file "RemusStealer.exe" at offset 3362905; code bytes = 30d0 Found XOR loop in file "RemusStealer.exe" at offset 3363849; code bytes = 30d0 Found XOR loop in file "RemusStealer.exe" at offset 3462050; code bytes = 30d0 Found XOR loop in file "RemusStealer.exe" at offset 3467510; code bytes = 30d0 Found XOR loop in file "RemusStealer.exe" at offset 3842562; code bytes = 30d0 Found XOR loop in file "RemusStealer.exe" at offset 4667872; code bytes = 30d0 Found XOR loop in file "RemusStealer.exe" at offset 4668548; code bytes = 30d0 Found XOR loop in file "RemusStealer.exe" at offset 584681; code bytes = 33c1 Found XOR loop in file "RemusStealer.exe" at offset 4747861; code bytes = 33c1 Found XOR loop in file "RemusStealer.exe" at offset 4904259; code bytes = 33c1 Found XOR loop in file "RemusStealer.exe" at offset 165494; code bytes = 8030 Found XOR loop in file "RemusStealer.exe" at offset 369624; code bytes = 8030 Found XOR loop in file "RemusStealer.exe" at offset 405033; code bytes = 8030 Found XOR loop in file "RemusStealer.exe" at offset 573519; code bytes = 8030 Found XOR loop in file "RemusStealer.exe" at offset 573554; code bytes = 8030 Found XOR loop in file "RemusStealer.exe" at offset 749691; code bytes = 8030 Found XOR loop in file "RemusStealer.exe" at offset 1979704; code bytes = 8030 Found XOR loop in file "RemusStealer.exe" at offset 1979749; code bytes = 8030 Found XOR loop in file "RemusStealer.exe" at offset 2981140; code bytes = 8030 Found XOR loop in file "RemusStealer.exe" at offset 2981413; code bytes = 8030 Found XOR loop in file "RemusStealer.exe" at offset 3269807; code bytes = 8030 Found XOR loop in file "RemusStealer.exe" at offset 3333558; code bytes = 8030 Found XOR loop in file "RemusStealer.exe" at offset 3759485; code bytes = 8030 Found XOR loop in file "RemusStealer.exe" at offset 3759643; code bytes = 8030 Found XOR loop in file "RemusStealer.exe" at offset 4668668; code bytes = 8030 Found XOR loop in file "RemusStealer.exe" at offset 5043654; code bytes = 8030 Found XOR loop in file "RemusStealer.exe" at offset 5089667; code bytes = 8030 Found XOR loop in file "RemusStealer.exe" at offset 5162672; code bytes = 8030 Found XOR loop in file "tempdir.dll" at offset 121828; code bytes = 30d0 Found XOR loop in file "tempdir.dll" at offset 294750; code bytes = 30d0 Found XOR loop in file "tempdir.dll" at offset 422612; code bytes = 30d0 Found XOR loop in file "tempdir.dll" at offset 441311; code bytes = 30d0 Found XOR loop in file "tempdir.dll" at offset 454171; code bytes = 30d0 Found XOR loop in file "tempdir.dll" at offset 598396; code bytes = 30d0 Found XOR loop in file "tempdir.dll" at offset 626259; code bytes = 30d0 Found XOR loop in file "tempdir.dll" at offset 626822; code bytes = 30d0 Found XOR loop in file "tempdir.dll" at offset 669166; code bytes = 30d0 Found XOR loop in file "tempdir.dll" at offset 1119511; code bytes = 30d0 Found XOR loop in file "tempdir.dll" at offset 1191306; code bytes = 30d0 Found XOR loop in file "tempdir.dll" at offset 1210586; code bytes = 30d0 Found XOR loop in file "tempdir.dll" at offset 1364785; code bytes = 30d0 Found XOR loop in file "tempdir.dll" at offset 1413323; code bytes = 30d0 Found XOR loop in file "tempdir.dll" at offset 1473749; code bytes = 30d0 Found XOR loop in file "tempdir.dll" at offset 1503503; code bytes = 30d0 Found XOR loop in file "tempdir.dll" at offset 1508731; code bytes = 30d0 Found XOR loop in file "tempdir.dll" at offset 1556126; code bytes = 30d0 Found XOR loop in file "tempdir.dll" at offset 1639673; code bytes = 30d0 Found XOR loop in file "tempdir.dll" at offset 1852293; code bytes = 30d0 Found XOR loop in file "tempdir.dll" at offset 1873092; code bytes = 30d0 Found XOR loop in file "tempdir.dll" at offset 2043374; code bytes = 30d0 Found XOR loop in file "tempdir.dll" at offset 2078371; code bytes = 30d0 Found XOR loop in file "tempdir.dll" at offset 2079994; code bytes = 30d0 Found XOR loop in file "tempdir.dll" at offset 2084644; code bytes = 30d0 Found XOR loop in file "tempdir.dll" at offset 2110155; code bytes = 30d0 Found XOR loop in file "tempdir.dll" at offset 2164346; code bytes = 30d0 Found XOR loop in file "tempdir.dll" at offset 2209002; code bytes = 30d0 Found XOR loop in file "tempdir.dll" at offset 2226835; code bytes = 30d0 Found XOR loop in file "tempdir.dll" at offset 2302124; code bytes = 30d0 Found XOR loop in file "tempdir.dll" at offset 2303770; code bytes = 30d0 Found XOR loop in file "tempdir.dll" at offset 2412199; code bytes = 30d0 Found XOR loop in file "tempdir.dll" at offset 2429858; code bytes = 30d0 Found XOR loop in file "tempdir.dll" at offset 2438963; code bytes = 30d0 Found XOR loop in file "tempdir.dll" at offset 2445713; code bytes = 30d0 Found XOR loop in file "tempdir.dll" at offset 2451713; code bytes = 30d0 Found XOR loop in file "tempdir.dll" at offset 2466539; code bytes = 30d0 Found XOR loop in file "tempdir.dll" at offset 2539387; code bytes = 30d0 Found XOR loop in file "tempdir.dll" at offset 2555219; code bytes = 30d0 Found XOR loop in file "tempdir.dll" at offset 2615864; code bytes = 30d0 Found XOR loop in file "tempdir.dll" at offset 2659262; code bytes = 30d0 Found XOR loop in file "tempdir.dll" at offset 2664354; code bytes = 30d0 Found XOR loop in file "tempdir.dll" at offset 2846879; code bytes = 30d0 Found XOR loop in file "tempdir.dll" at offset 2850464; code bytes = 30d0 Found XOR loop in file "tempdir.dll" at offset 3023188; code bytes = 30d0 Found XOR loop in file "tempdir.dll" at offset 3062933; code bytes = 30d0 Found XOR loop in file "tempdir.dll" at offset 3071878; code bytes = 30d0 Found XOR loop in file "tempdir.dll" at offset 3110209; code bytes = 30d0 Found XOR loop in file "tempdir.dll" at offset 3208480; code bytes = 30d0 Found XOR loop in file "tempdir.dll" at offset 3333934; code bytes = 30d0 Found XOR loop in file "tempdir.dll" at offset 3395382; code bytes = 30d0 Found XOR loop in file "tempdir.dll" at offset 3455870; code bytes = 30d0 Found XOR loop in file "tempdir.dll" at offset 3457482; code bytes = 30d0 Found XOR loop in file "tempdir.dll" at offset 3486596; code bytes = 30d0 Found XOR loop in file "tempdir.dll" at offset 3550876; code bytes = 30d0 Found XOR loop in file "tempdir.dll" at offset 3635661; code bytes = 30d0 Found XOR loop in file "tempdir.dll" at offset 3693690; code bytes = 30d0 Found XOR loop in file "tempdir.dll" at offset 3768997; code bytes = 30d0 Found XOR loop in file "tempdir.dll" at offset 3899123; code bytes = 30d0 Found XOR loop in file "tempdir.dll" at offset 3908130; code bytes = 30d0 Found XOR loop in file "tempdir.dll" at offset 3940667; code bytes = 30d0 Found XOR loop in file "tempdir.dll" at offset 4064841; code bytes = 30d0 Found XOR loop in file "tempdir.dll" at offset 4352456; code bytes = 30d0 Found XOR loop in file "tempdir.dll" at offset 4418530; code bytes = 30d0 Found XOR loop in file "tempdir.dll" at offset 4510368; code bytes = 30d0 Found XOR loop in file "tempdir.dll" at offset 4538369; code bytes = 30d0 Found XOR loop in file "tempdir.dll" at offset 4610328; code bytes = 30d0 Found XOR loop in file "tempdir.dll" at offset 4685733; code bytes = 30d0 Found XOR loop in file "tempdir.dll" at offset 4732249; code bytes = 30d0 Found XOR loop in file "tempdir.dll" at offset 4810033; code bytes = 30d0 Found XOR loop in file "tempdir.dll" at offset 4909124; code bytes = 30d0 Found XOR loop in file "tempdir.dll" at offset 4974430; code bytes = 30d0 Found XOR loop in file "tempdir.dll" at offset 5072429; code bytes = 30d0 Found XOR loop in file "tempdir.dll" at offset 5118294; code bytes = 30d0 Found XOR loop in file "tempdir.dll" at offset 5126246; code bytes = 30d0 Found XOR loop in file "tempdir.dll" at offset 5184066; code bytes = 30d0 Found XOR loop in file "tempdir.dll" at offset 5231416; code bytes = 30d0 Found XOR loop in file "tempdir.dll" at offset 27850; code bytes = 33c1 Found XOR loop in file "tempdir.dll" at offset 54630; code bytes = 33c1 Found XOR loop in file "tempdir.dll" at offset 68333; code bytes = 33c1 Found XOR loop in file "tempdir.dll" at offset 168469; code bytes = 33c1 Found XOR loop in file "tempdir.dll" at offset 235726; code bytes = 33c1 Found XOR loop in file "tempdir.dll" at offset 253443; code bytes = 33c1 Found XOR loop in file "tempdir.dll" at offset 429410; code bytes = 33c1 Found XOR loop in file "tempdir.dll" at offset 467913; code bytes = 33c1 Found XOR loop in file "tempdir.dll" at offset 483851; code bytes = 33c1 Found XOR loop in file "tempdir.dll" at offset 541553; code bytes = 33c1 Found XOR loop in file "tempdir.dll" at offset 543800; code bytes = 33c1 Found XOR loop in file "tempdir.dll" at offset 564568; code bytes = 33c1 Found XOR loop in file "tempdir.dll" at offset 612003; code bytes = 33c1 Found XOR loop in file "tempdir.dll" at offset 663487; code bytes = 33c1 Found XOR loop in file "tempdir.dll" at offset 720847; code bytes = 33c1 Found XOR loop in file "tempdir.dll" at offset 741904; code bytes = 33c1 Found XOR loop in file "tempdir.dll" at offset 813561; code bytes = 33c1 Found XOR loop in file "tempdir.dll" at offset 839566; code bytes = 33c1 Found XOR loop in file "tempdir.dll" at offset 867742; code bytes = 33c1 Found XOR loop in file "tempdir.dll" at offset 938907; code bytes = 33c1 Found XOR loop in file "tempdir.dll" at offset 981909; code bytes = 33c1 Found XOR loop in file "tempdir.dll" at offset 1019621; code bytes = 33c1 Found XOR loop in file "tempdir.dll" at offset 1115511; code bytes = 33c1 Found XOR loop in file "tempdir.dll" at offset 1137404; code bytes = 33c1 Found XOR loop in file "tempdir.dll" at offset 1186689; code bytes = 33c1 Found XOR loop in file "tempdir.dll" at offset 1199832; code bytes = 33c1 Found XOR loop in file "tempdir.dll" at offset 1237449; code bytes = 33c1 Found XOR loop in file "tempdir.dll" at offset 1239366; code bytes = 33c1 Found XOR loop in file "tempdir.dll" at offset 1269818; code bytes = 33c1 Found XOR loop in file "tempdir.dll" at offset 1291046; code bytes = 33c1 Found XOR loop in file "tempdir.dll" at offset 1553512; code bytes = 33c1 Found XOR loop in file "tempdir.dll" at offset 1594825; code bytes = 33c1 Found XOR loop in file "tempdir.dll" at offset 1680166; code bytes = 33c1 Found XOR loop in file "tempdir.dll" at offset 1714271; code bytes = 33c1 Found XOR loop in file "tempdir.dll" at offset 1780323; code bytes = 33c1 Found XOR loop in file "tempdir.dll" at offset 1787258; code bytes = 33c1 Found XOR loop in file "tempdir.dll" at offset 1853206; code bytes = 33c1 Found XOR loop in file "tempdir.dll" at offset 1892741; code bytes = 33c1 Found XOR loop in file "tempdir.dll" at offset 1913112; code bytes = 33c1 Found XOR loop in file "tempdir.dll" at offset 2000666; code bytes = 33c1 Found XOR loop in file "tempdir.dll" at offset 2056805; code bytes = 33c1 Found XOR loop in file "tempdir.dll" at offset 2057310; code bytes = 33c1 Found XOR loop in file "tempdir.dll" at offset 2093149; code bytes = 33c1 Found XOR loop in file "tempdir.dll" at offset 2268556; code bytes = 33c1 Found XOR loop in file "tempdir.dll" at offset 2307762; code bytes = 33c1 Found XOR loop in file "tempdir.dll" at offset 2364106; code bytes = 33c1 Found XOR loop in file "tempdir.dll" at offset 2402180; code bytes = 33c1 Found XOR loop in file "tempdir.dll" at offset 2427690; code bytes = 33c1 Found XOR loop in file "tempdir.dll" at offset 2457632; code bytes = 33c1 Found XOR loop in file "tempdir.dll" at offset 2598815; code bytes = 33c1 Found XOR loop in file "tempdir.dll" at offset 2642283; code bytes = 33c1 Found XOR loop in file "tempdir.dll" at offset 2664161; code bytes = 33c1 Found XOR loop in file "tempdir.dll" at offset 2682794; code bytes = 33c1 Found XOR loop in file "tempdir.dll" at offset 2803489; code bytes = 33c1 Found XOR loop in file "tempdir.dll" at offset 2866294; code bytes = 33c1 Found XOR loop in file "tempdir.dll" at offset 2957669; code bytes = 33c1 Found XOR loop in file "tempdir.dll" at offset 3047096; code bytes = 33c1 Found XOR loop in file "tempdir.dll" at offset 3211459; code bytes = 33c1 Found XOR loop in file "tempdir.dll" at offset 3214073; code bytes = 33c1 Found XOR loop in file "tempdir.dll" at offset 3233292; code bytes = 33c1 Found XOR loop in file "tempdir.dll" at offset 3385428; code bytes = 33c1 Found XOR loop in file "tempdir.dll" at offset 3542302; code bytes = 33c1 Found XOR loop in file "tempdir.dll" at offset 3588308; code bytes = 33c1 Found XOR loop in file "tempdir.dll" at offset 3608688; code bytes = 33c1 Found XOR loop in file "tempdir.dll" at offset 3724951; code bytes = 33c1 Found XOR loop in file "tempdir.dll" at offset 3827782; code bytes = 33c1 Found XOR loop in file "tempdir.dll" at offset 3881587; code bytes = 33c1 Found XOR loop in file "tempdir.dll" at offset 3908326; code bytes = 33c1 Found XOR loop in file "tempdir.dll" at offset 3912440; code bytes = 33c1 Found XOR loop in file "tempdir.dll" at offset 3936125; code bytes = 33c1 Found XOR loop in file "tempdir.dll" at offset 3973763; code bytes = 33c1 Found XOR loop in file "tempdir.dll" at offset 4048956; code bytes = 33c1 Found XOR loop in file "tempdir.dll" at offset 4119601; code bytes = 33c1 Found XOR loop in file "tempdir.dll" at offset 4140814; code bytes = 33c1 Found XOR loop in file "tempdir.dll" at offset 4160749; code bytes = 33c1 Found XOR loop in file "tempdir.dll" at offset 4340649; code bytes = 33c1 Found XOR loop in file "tempdir.dll" at offset 4478495; code bytes = 33c1 Found XOR loop in file "tempdir.dll" at offset 4526122; code bytes = 33c1 Found XOR loop in file "tempdir.dll" at offset 4549466; code bytes = 33c1 Found XOR loop in file "tempdir.dll" at offset 4759248; code bytes = 33c1 Found XOR loop in file "tempdir.dll" at offset 4793279; code bytes = 33c1 Found XOR loop in file "tempdir.dll" at offset 4822756; code bytes = 33c1 Found XOR loop in file "tempdir.dll" at offset 4897626; code bytes = 33c1 Found XOR loop in file "tempdir.dll" at offset 5041976; code bytes = 33c1 Found XOR loop in file "tempdir.dll" at offset 5172990; code bytes = 33c1 Found XOR loop in file "tempdir.dll" at offset 18099; code bytes = 8030 Found XOR loop in file "tempdir.dll" at offset 30355; code bytes = 8030 Found XOR loop in file "tempdir.dll" at offset 55852; code bytes = 8030 Found XOR loop in file "tempdir.dll" at offset 106041; code bytes = 8030 Found XOR loop in file "tempdir.dll" at offset 135579; code bytes = 8030 Found XOR loop in file "tempdir.dll" at offset 232741; code bytes = 8030 Found XOR loop in file "tempdir.dll" at offset 299686; code bytes = 8030 Found XOR loop in file "tempdir.dll" at offset 329822; code bytes = 8030 Found XOR loop in file "tempdir.dll" at offset 386865; code bytes = 8030 Found XOR loop in file "tempdir.dll" at offset 421652; code bytes = 8030 Found XOR loop in file "tempdir.dll" at offset 426357; code bytes = 8030 Found XOR loop in file "tempdir.dll" at offset 450964; code bytes = 8030 Found XOR loop in file "tempdir.dll" at offset 578327; code bytes = 8030 Found XOR loop in file "tempdir.dll" at offset 661755; code bytes = 8030 Found XOR loop in file "tempdir.dll" at offset 739715; code bytes = 8030 Found XOR loop in file "tempdir.dll" at offset 747505; code bytes = 8030 Found XOR loop in file "tempdir.dll" at offset 807014; code bytes = 8030 Found XOR loop in file "tempdir.dll" at offset 899263; code bytes = 8030 Found XOR loop in file "tempdir.dll" at offset 918250; code bytes = 8030 Found XOR loop in file "tempdir.dll" at offset 948323; code bytes = 8030 Found XOR loop in file "tempdir.dll" at offset 1078481; code bytes = 8030 Found XOR loop in file "tempdir.dll" at offset 1285291; code bytes = 8030 Found XOR loop in file "tempdir.dll" at offset 1595716; code bytes = 8030 Found XOR loop in file "tempdir.dll" at offset 1624960; code bytes = 8030 Found XOR loop in file "tempdir.dll" at offset 1681245; code bytes = 8030 Found XOR loop in file "tempdir.dll" at offset 1720911; code bytes = 8030 Found XOR loop in file "tempdir.dll" at offset 1745463; code bytes = 8030 Found XOR loop in file "tempdir.dll" at offset 1780868; code bytes = 8030 Found XOR loop in file "tempdir.dll" at offset 2036449; code bytes = 8030 Found XOR loop in file "tempdir.dll" at offset 2072650; code bytes = 8030 Found XOR loop in file "tempdir.dll" at offset 2093104; code bytes = 8030 Found XOR loop in file "tempdir.dll" at offset 2137096; code bytes = 8030 Found XOR loop in file "tempdir.dll" at offset 2154814; code bytes = 8030 Found XOR loop in file "tempdir.dll" at offset 2282639; code bytes = 8030 Found XOR loop in file "tempdir.dll" at offset 2356061; code bytes = 8030 Found XOR loop in file "tempdir.dll" at offset 2394415; code bytes = 8030 Found XOR loop in file "tempdir.dll" at offset 2453943; code bytes = 8030 Found XOR loop in file "tempdir.dll" at offset 2565290; code bytes = 8030 Found XOR loop in file "tempdir.dll" at offset 2622799; code bytes = 8030 Found XOR loop in file "tempdir.dll" at offset 2651072; code bytes = 8030 Found XOR loop in file "tempdir.dll" at offset 2665505; code bytes = 8030 Found XOR loop in file "tempdir.dll" at offset 2794716; code bytes = 8030 Found XOR loop in file "tempdir.dll" at offset 2936790; code bytes = 8030 Found XOR loop in file "tempdir.dll" at offset 2979542; code bytes = 8030 Found XOR loop in file "tempdir.dll" at offset 3009322; code bytes = 8030 Found XOR loop in file "tempdir.dll" at offset 3086806; code bytes = 8030 Found XOR loop in file "tempdir.dll" at offset 3155606; code bytes = 8030 Found XOR loop in file "tempdir.dll" at offset 3275335; code bytes = 8030 Found XOR loop in file "tempdir.dll" at offset 3281614; code bytes = 8030 Found XOR loop in file "tempdir.dll" at offset 3299147; code bytes = 8030 Found XOR loop in file "tempdir.dll" at offset 3400995; code bytes = 8030 Found XOR loop in file "tempdir.dll" at offset 3500892; code bytes = 8030 Found XOR loop in file "tempdir.dll" at offset 3729399; code bytes = 8030 Found XOR loop in file "tempdir.dll" at offset 3730634; code bytes = 8030 Found XOR loop in file "tempdir.dll" at offset 3746310; code bytes = 8030 Found XOR loop in file "tempdir.dll" at offset 3885972; code bytes = 8030 Found XOR loop in file "tempdir.dll" at offset 3966380; code bytes = 8030 Found XOR loop in file "tempdir.dll" at offset 3968644; code bytes = 8030 Found XOR loop in file "tempdir.dll" at offset 3978613; code bytes = 8030 Found XOR loop in file "tempdir.dll" at offset 4042103; code bytes = 8030 Found XOR loop in file "tempdir.dll" at offset 4074192; code bytes = 8030 Found XOR loop in file "tempdir.dll" at offset 4180228; code bytes = 8030 Found XOR loop in file "tempdir.dll" at offset 4181990; code bytes = 8030 Found XOR loop in file "tempdir.dll" at offset 4247475; code bytes = 8030 Found XOR loop in file "tempdir.dll" at offset 4378465; code bytes = 8030 Found XOR loop in file "tempdir.dll" at offset 4392198; code bytes = 8030 Found XOR loop in file "tempdir.dll" at offset 4473071; code bytes = 8030 Found XOR loop in file "tempdir.dll" at offset 4473827; code bytes = 8030 Found XOR loop in file "tempdir.dll" at offset 4499526; code bytes = 8030 Found XOR loop in file "tempdir.dll" at offset 4508838; code bytes = 8030 Found XOR loop in file "tempdir.dll" at offset 4548270; code bytes = 8030 Found XOR loop in file "tempdir.dll" at offset 4659575; code bytes = 8030 Found XOR loop in file "tempdir.dll" at offset 4666129; code bytes = 8030 Found XOR loop in file "tempdir.dll" at offset 4673831; code bytes = 8030 Found XOR loop in file "tempdir.dll" at offset 4707656; code bytes = 8030 Found XOR loop in file "tempdir.dll" at offset 4732855; code bytes = 8030 Found XOR loop in file "tempdir.dll" at offset 4754499; code bytes = 8030 Found XOR loop in file "tempdir.dll" at offset 4970626; code bytes = 8030 Found XOR loop in file "tempdir.dll" at offset 5043782; code bytes = 8030 Found XOR loop in file "tempdir.dll" at offset 5154199; code bytes = 8030 Found XOR loop in file "tempdir.dll" at offset 5240017; code bytes = 8030 Found XOR loop in file "OneDrive.exe" at offset 435210; code bytes = 30d0 Found XOR loop in file "OneDrive.exe" at offset 484538; code bytes = 30d0 Found XOR loop in file "OneDrive.exe" at offset 495442; code bytes = 30d0 Found XOR loop in file "OneDrive.exe" at offset 544770; code bytes = 30d0 Found XOR loop in file "OneDrive.exe" at offset 649721; code bytes = 30d0 Found XOR loop in file "OneDrive.exe" at offset 700264; code bytes = 30d0 Found XOR loop in file "OneDrive.exe" at offset 700395; code bytes = 30d0 Found XOR loop in file "OneDrive.exe" at offset 786712; code bytes = 30d0 Found XOR loop in file "OneDrive.exe" at offset 907326; code bytes = 30d0 Found XOR loop in file "OneDrive.exe" at offset 908523; code bytes = 30d0 Found XOR loop in file "OneDrive.exe" at offset 981415; code bytes = 30d0 Found XOR loop in file "OneDrive.exe" at offset 1089378; code bytes = 30d0 Found XOR loop in file "OneDrive.exe" at offset 1146085; code bytes = 30d0 Found XOR loop in file "OneDrive.exe" at offset 1229078; code bytes = 30d0 Found XOR loop in file "OneDrive.exe" at offset 1264327; code bytes = 30d0 Found XOR loop in file "OneDrive.exe" at offset 1268823; code bytes = 30d0 Found XOR loop in file "OneDrive.exe" at offset 1272662; code bytes = 30d0 Found XOR loop in file "OneDrive.exe" at offset 1280984; code bytes = 30d0 Found XOR loop in file "OneDrive.exe" at offset 1515635; code bytes = 30d0 Found XOR loop in file "OneDrive.exe" at offset 1521015; code bytes = 30d0 Found XOR loop in file "OneDrive.exe" at offset 1575659; code bytes = 30d0 Found XOR loop in file "OneDrive.exe" at offset 1582011; code bytes = 30d0 Found XOR loop in file "OneDrive.exe" at offset 1621065; code bytes = 30d0 Found XOR loop in file "OneDrive.exe" at offset 1696537; code bytes = 30d0 Found XOR loop in file "OneDrive.exe" at offset 1778480; code bytes = 30d0 Found XOR loop in file "OneDrive.exe" at offset 1853999; code bytes = 30d0 Found XOR loop in file "OneDrive.exe" at offset 1874629; code bytes = 30d0 Found XOR loop in file "OneDrive.exe" at offset 1910107; code bytes = 30d0 Found XOR loop in file "OneDrive.exe" at offset 1929446; code bytes = 30d0 Found XOR loop in file "OneDrive.exe" at offset 2118442; code bytes = 30d0 Found XOR loop in file "OneDrive.exe" at offset 2173100; code bytes = 30d0 Found XOR loop in file "OneDrive.exe" at offset 2182470; code bytes = 30d0 Found XOR loop in file "OneDrive.exe" at offset 2224811; code bytes = 30d0 Found XOR loop in file "OneDrive.exe" at offset 2304651; code bytes = 30d0 Found XOR loop in file "OneDrive.exe" at offset 2344259; code bytes = 30d0 Found XOR loop in file "OneDrive.exe" at offset 2426154; code bytes = 30d0 Found XOR loop in file "OneDrive.exe" at offset 2478818; code bytes = 30d0 Found XOR loop in file "OneDrive.exe" at offset 2613885; code bytes = 30d0 Found XOR loop in file "OneDrive.exe" at offset 2687289; code bytes = 30d0 Found XOR loop in file "OneDrive.exe" at offset 2872352; code bytes = 30d0 Found XOR loop in file "OneDrive.exe" at offset 2884453; code bytes = 30d0 Found XOR loop in file "OneDrive.exe" at offset 2934119; code bytes = 30d0 Found XOR loop in file "OneDrive.exe" at offset 3051655; code bytes = 30d0 Found XOR loop in file "OneDrive.exe" at offset 3070665; code bytes = 30d0 Found XOR loop in file "OneDrive.exe" at offset 3118929; code bytes = 30d0 Found XOR loop in file "OneDrive.exe" at offset 3221321; code bytes = 30d0 Found XOR loop in file "OneDrive.exe" at offset 3303104; code bytes = 30d0 Found XOR loop in file "OneDrive.exe" at offset 3360102; code bytes = 30d0 Found XOR loop in file "OneDrive.exe" at offset 3549153; code bytes = 30d0 Found XOR loop in file "OneDrive.exe" at offset 3563064; code bytes = 30d0 Found XOR loop in file "OneDrive.exe" at offset 3574968; code bytes = 30d0 Found XOR loop in file "OneDrive.exe" at offset 3587758; code bytes = 30d0 Found XOR loop in file "OneDrive.exe" at offset 3750712; code bytes = 30d0 Found XOR loop in file "OneDrive.exe" at offset 3787375; code bytes = 30d0 Found XOR loop in file "OneDrive.exe" at offset 3930519; code bytes = 30d0 Found XOR loop in file "OneDrive.exe" at offset 3942250; code bytes = 30d0 Found XOR loop in file "OneDrive.exe" at offset 3964231; code bytes = 30d0 Found XOR loop in file "OneDrive.exe" at offset 4042277; code bytes = 30d0 Found XOR loop in file "OneDrive.exe" at offset 4107441; code bytes = 30d0 Found XOR loop in file "OneDrive.exe" at offset 4116397; code bytes = 30d0 Found XOR loop in file "OneDrive.exe" at offset 4118494; code bytes = 30d0 Found XOR loop in file "OneDrive.exe" at offset 4139378; code bytes = 30d0 Found XOR loop in file "OneDrive.exe" at offset 4287178; code bytes = 30d0 Found XOR loop in file "OneDrive.exe" at offset 4346152; code bytes = 30d0 Found XOR loop in file "OneDrive.exe" at offset 4379658; code bytes = 30d0 Found XOR loop in file "OneDrive.exe" at offset 4402255; code bytes = 30d0 Found XOR loop in file "OneDrive.exe" at offset 4489306; code bytes = 30d0 Found XOR loop in file "OneDrive.exe" at offset 4602428; code bytes = 30d0 Found XOR loop in file "OneDrive.exe" at offset 4680093; code bytes = 30d0 Found XOR loop in file "OneDrive.exe" at offset 4795730; code bytes = 30d0 Found XOR loop in file "OneDrive.exe" at offset 4844805; code bytes = 30d0 Found XOR loop in file "OneDrive.exe" at offset 5084042; code bytes = 30d0 Found XOR loop in file "OneDrive.exe" at offset 5121290; code bytes = 30d0 Found XOR loop in file "OneDrive.exe" at offset 5178006; code bytes = 30d0 Found XOR loop in file "OneDrive.exe" at offset 25498; code bytes = 33c1 Found XOR loop in file "OneDrive.exe" at offset 25662; code bytes = 33c1 Found XOR loop in file "OneDrive.exe" at offset 25789; code bytes = 33c1 Found XOR loop in file "OneDrive.exe" at offset 25944; code bytes = 33c1 Found XOR loop in file "OneDrive.exe" at offset 26036; code bytes = 33c1 Found XOR loop in file "OneDrive.exe" at offset 110400; code bytes = 33c1 Found XOR loop in file "OneDrive.exe" at offset 112457; code bytes = 33c1 Found XOR loop in file "OneDrive.exe" at offset 112596; code bytes = 33c1 Found XOR loop in file "OneDrive.exe" at offset 112613; code bytes = 33c1 Found XOR loop in file "OneDrive.exe" at offset 112728; code bytes = 33c1 Found XOR loop in file "OneDrive.exe" at offset 210503; code bytes = 33c1 Found XOR loop in file "OneDrive.exe" at offset 464738; code bytes = 33c1 Found XOR loop in file "OneDrive.exe" at offset 524970; code bytes = 33c1 Found XOR loop in file "OneDrive.exe" at offset 691143; code bytes = 33c1 Found XOR loop in file "OneDrive.exe" at offset 708972; code bytes = 33c1 Found XOR loop in file "OneDrive.exe" at offset 892852; code bytes = 33c1 Found XOR loop in file "OneDrive.exe" at offset 902034; code bytes = 33c1 Found XOR loop in file "OneDrive.exe" at offset 1081076; code bytes = 33c1 Found XOR loop in file "OneDrive.exe" at offset 1086611; code bytes = 33c1 Found XOR loop in file "OneDrive.exe" at offset 1258967; code bytes = 33c1 Found XOR loop in file "OneDrive.exe" at offset 1294572; code bytes = 33c1 Found XOR loop in file "OneDrive.exe" at offset 1346782; code bytes = 33c1 Found XOR loop in file "OneDrive.exe" at offset 1381637; code bytes = 33c1 Found XOR loop in file "OneDrive.exe" at offset 1398357; code bytes = 33c1 Found XOR loop in file "OneDrive.exe" at offset 1405781; code bytes = 33c1 Found XOR loop in file "OneDrive.exe" at offset 1575101; code bytes = 33c1 Found XOR loop in file "OneDrive.exe" at offset 1629141; code bytes = 33c1 Found XOR loop in file "OneDrive.exe" at offset 1642917; code bytes = 33c1 Found XOR loop in file "OneDrive.exe" at offset 1893143; code bytes = 33c1 Found XOR loop in file "OneDrive.exe" at offset 1953589; code bytes = 33c1 Found XOR loop in file "OneDrive.exe" at offset 1997777; code bytes = 33c1 Found XOR loop in file "OneDrive.exe" at offset 2147896; code bytes = 33c1 Found XOR loop in file "OneDrive.exe" at offset 2305496; code bytes = 33c1 Found XOR loop in file "OneDrive.exe" at offset 2387820; code bytes = 33c1 Found XOR loop in file "OneDrive.exe" at offset 2413852; code bytes = 33c1 Found XOR loop in file "OneDrive.exe" at offset 2493879; code bytes = 33c1 Found XOR loop in file "OneDrive.exe" at offset 2576455; code bytes = 33c1 Found XOR loop in file "OneDrive.exe" at offset 2661629; code bytes = 33c1 Found XOR loop in file "OneDrive.exe" at offset 2667170; code bytes = 33c1 Found XOR loop in file "OneDrive.exe" at offset 2756166; code bytes = 33c1 Found XOR loop in file "OneDrive.exe" at offset 2809681; code bytes = 33c1 Found XOR loop in file "OneDrive.exe" at offset 2810098; code bytes = 33c1 Found XOR loop in file "OneDrive.exe" at offset 2813765; code bytes = 33c1 Found XOR loop in file "OneDrive.exe" at offset 2852680; code bytes = 33c1 Found XOR loop in file "OneDrive.exe" at offset 2863646; code bytes = 33c1 Found XOR loop in file "OneDrive.exe" at offset 2874063; code bytes = 33c1 Found XOR loop in file "OneDrive.exe" at offset 2884611; code bytes = 33c1 Found XOR loop in file "OneDrive.exe" at offset 2903088; code bytes = 33c1 Found XOR loop in file "OneDrive.exe" at offset 2919703; code bytes = 33c1 Found XOR loop in file "OneDrive.exe" at offset 2921124; code bytes = 33c1 Found XOR loop in file "OneDrive.exe" at offset 2944108; code bytes = 33c1 Found XOR loop in file "OneDrive.exe" at offset 3272537; code bytes = 33c1 Found XOR loop in file "OneDrive.exe" at offset 3306783; code bytes = 33c1 Found XOR loop in file "OneDrive.exe" at offset 3372343; code bytes = 33c1 Found XOR loop in file "OneDrive.exe" at offset 3451386; code bytes = 33c1 Found XOR loop in file "OneDrive.exe" at offset 3514862; code bytes = 33c1 Found XOR loop in file "OneDrive.exe" at offset 3520786; code bytes = 33c1 Found XOR loop in file "OneDrive.exe" at offset 3566399; code bytes = 33c1 Found XOR loop in file "OneDrive.exe" at offset 3705415; code bytes = 33c1 Found XOR loop in file "OneDrive.exe" at offset 3727339; code bytes = 33c1 Found XOR loop in file "OneDrive.exe" at offset 3768045; code bytes = 33c1 Found XOR loop in file "OneDrive.exe" at offset 3778046; code bytes = 33c1 Found XOR loop in file "OneDrive.exe" at offset 3826152; code bytes = 33c1 Found XOR loop in file "OneDrive.exe" at offset 3922852; code bytes = 33c1 Found XOR loop in file "OneDrive.exe" at offset 4054570; code bytes = 33c1 Found XOR loop in file "OneDrive.exe" at offset 4063595; code bytes = 33c1 Found XOR loop in file "OneDrive.exe" at offset 4096331; code bytes = 33c1 Found XOR loop in file "OneDrive.exe" at offset 4109791; code bytes = 33c1 Found XOR loop in file "OneDrive.exe" at offset 4173254; code bytes = 33c1 Found XOR loop in file "OneDrive.exe" at offset 4228713; code bytes = 33c1 Found XOR loop in file "OneDrive.exe" at offset 4269136; code bytes = 33c1 Found XOR loop in file "OneDrive.exe" at offset 4289592; code bytes = 33c1 Found XOR loop in file "OneDrive.exe" at offset 4343476; code bytes = 33c1 Found XOR loop in file "OneDrive.exe" at offset 4351449; code bytes = 33c1 Found XOR loop in file "OneDrive.exe" at offset 4600580; code bytes = 33c1 Found XOR loop in file "OneDrive.exe" at offset 4689043; code bytes = 33c1 Found XOR loop in file "OneDrive.exe" at offset 4721702; code bytes = 33c1 Found XOR loop in file "OneDrive.exe" at offset 4725377; code bytes = 33c1 Found XOR loop in file "OneDrive.exe" at offset 4749690; code bytes = 33c1 Found XOR loop in file "OneDrive.exe" at offset 4792427; code bytes = 33c1 Found XOR loop in file "OneDrive.exe" at offset 4955788; code bytes = 33c1 Found XOR loop in file "OneDrive.exe" at offset 4969910; code bytes = 33c1 Found XOR loop in file "OneDrive.exe" at offset 5002248; code bytes = 33c1 Found XOR loop in file "OneDrive.exe" at offset 5031276; code bytes = 33c1 Found XOR loop in file "OneDrive.exe" at offset 5091663; code bytes = 33c1 Found XOR loop in file "OneDrive.exe" at offset 5142612; code bytes = 33c1 Found XOR loop in file "OneDrive.exe" at offset 5209935; code bytes = 33c1 Found XOR loop in file "OneDrive.exe" at offset 3102683; code bytes = 30040e Found XOR loop in file "OneDrive.exe" at offset 444277; code bytes = 8030 Found XOR loop in file "OneDrive.exe" at offset 474007; code bytes = 8030 Found XOR loop in file "OneDrive.exe" at offset 504509; code bytes = 8030 Found XOR loop in file "OneDrive.exe" at offset 534239; code bytes = 8030 Found XOR loop in file "OneDrive.exe" at offset 635746; code bytes = 8030 Found XOR loop in file "OneDrive.exe" at offset 661993; code bytes = 8030 Found XOR loop in file "OneDrive.exe" at offset 792557; code bytes = 8030 Found XOR loop in file "OneDrive.exe" at offset 867447; code bytes = 8030 Found XOR loop in file "OneDrive.exe" at offset 960221; code bytes = 8030 Found XOR loop in file "OneDrive.exe" at offset 1097751; code bytes = 8030 Found XOR loop in file "OneDrive.exe" at offset 1116931; code bytes = 8030 Found XOR loop in file "OneDrive.exe" at offset 1144005; code bytes = 8030 Found XOR loop in file "OneDrive.exe" at offset 1155625; code bytes = 8030 Found XOR loop in file "OneDrive.exe" at offset 1168167; code bytes = 8030 Found XOR loop in file "OneDrive.exe" at offset 1234596; code bytes = 8030 Found XOR loop in file "OneDrive.exe" at offset 1257647; code bytes = 8030 Found XOR loop in file "OneDrive.exe" at offset 1361957; code bytes = 8030 Found XOR loop in file "OneDrive.exe" at offset 1438264; code bytes = 8030 Found XOR loop in file "OneDrive.exe" at offset 1478450; code bytes = 8030 Found XOR loop in file "OneDrive.exe" at offset 1608412; code bytes = 8030 Found XOR loop in file "OneDrive.exe" at offset 1744334; code bytes = 8030 Found XOR loop in file "OneDrive.exe" at offset 1761091; code bytes = 8030 Found XOR loop in file "OneDrive.exe" at offset 1802892; code bytes = 8030 Found XOR loop in file "OneDrive.exe" at offset 1808309; code bytes = 8030 Found XOR loop in file "OneDrive.exe" at offset 1956234; code bytes = 8030 Found XOR loop in file "OneDrive.exe" at offset 1967985; code bytes = 8030 Found XOR loop in file "OneDrive.exe" at offset 2000481; code bytes = 8030 Found XOR loop in file "OneDrive.exe" at offset 2048305; code bytes = 8030 Found XOR loop in file "OneDrive.exe" at offset 2083757; code bytes = 8030 Found XOR loop in file "OneDrive.exe" at offset 2097312; code bytes = 8030 Found XOR loop in file "OneDrive.exe" at offset 2151569; code bytes = 8030 Found XOR loop in file "OneDrive.exe" at offset 2175501; code bytes = 8030 Found XOR loop in file "OneDrive.exe" at offset 2175682; code bytes = 8030 Found XOR loop in file "OneDrive.exe" at offset 2280108; code bytes = 8030 Found XOR loop in file "OneDrive.exe" at offset 2304233; code bytes = 8030 Found XOR loop in file "OneDrive.exe" at offset 2339214; code bytes = 8030 Found XOR loop in file "OneDrive.exe" at offset 2350719; code bytes = 8030 Found XOR loop in file "OneDrive.exe" at offset 2357016; code bytes = 8030 Found XOR loop in file "OneDrive.exe" at offset 2397243; code bytes = 8030 Found XOR loop in file "OneDrive.exe" at offset 2461605; code bytes = 8030 Found XOR loop in file "OneDrive.exe" at offset 2489385; code bytes = 8030 Found XOR loop in file "OneDrive.exe" at offset 2492819; code bytes = 8030 Found XOR loop in file "OneDrive.exe" at offset 2554642; code bytes = 8030 Found XOR loop in file "OneDrive.exe" at offset 2582334; code bytes = 8030 Found XOR loop in file "OneDrive.exe" at offset 2614083; code bytes = 8030 Found XOR loop in file "OneDrive.exe" at offset 2669495; code bytes = 8030 Found XOR loop in file "OneDrive.exe" at offset 2787136; code bytes = 8030 Found XOR loop in file "OneDrive.exe" at offset 2826442; code bytes = 8030 Found XOR loop in file "OneDrive.exe" at offset 2838866; code bytes = 8030 Found XOR loop in file "OneDrive.exe" at offset 2863958; code bytes = 8030 Found XOR loop in file "OneDrive.exe" at offset 2875317; code bytes = 8030 Found XOR loop in file "OneDrive.exe" at offset 2888110; code bytes = 8030 Found XOR loop in file "OneDrive.exe" at offset 2909113; code bytes = 8030 Found XOR loop in file "OneDrive.exe" at offset 2939572; code bytes = 8030 Found XOR loop in file "OneDrive.exe" at offset 2944896; code bytes = 8030 Found XOR loop in file "OneDrive.exe" at offset 2967868; code bytes = 8030 Found XOR loop in file "OneDrive.exe" at offset 2998030; code bytes = 8030 Found XOR loop in file "OneDrive.exe" at offset 3028169; code bytes = 8030 Found XOR loop in file "OneDrive.exe" at offset 3078383; code bytes = 8030 Found XOR loop in file "OneDrive.exe" at offset 3084062; code bytes = 8030 Found XOR loop in file "OneDrive.exe" at offset 3123878; code bytes = 8030 Found XOR loop in file "OneDrive.exe" at offset 3126671; code bytes = 8030 Found XOR loop in file "OneDrive.exe" at offset 3170684; code bytes = 8030 Found XOR loop in file "OneDrive.exe" at offset 3184849; code bytes = 8030 Found XOR loop in file "OneDrive.exe" at offset 3336005; code bytes = 8030 Found XOR loop in file "OneDrive.exe" at offset 3480179; code bytes = 8030 Found XOR loop in file "OneDrive.exe" at offset 3483135; code bytes = 8030 Found XOR loop in file "OneDrive.exe" at offset 3567904; code bytes = 8030 Found XOR loop in file "OneDrive.exe" at offset 3672324; code bytes = 8030 Found XOR loop in file "OneDrive.exe" at offset 3750589; code bytes = 8030 Found XOR loop in file "OneDrive.exe" at offset 3754075; code bytes = 8030 Found XOR loop in file "OneDrive.exe" at offset 3765323; code bytes = 8030 Found XOR loop in file "OneDrive.exe" at offset 3794433; code bytes = 8030 Found XOR loop in file "OneDrive.exe" at offset 3795585; code bytes = 8030 Found XOR loop in file "OneDrive.exe" at offset 4059294; code bytes = 8030 Found XOR loop in file "OneDrive.exe" at offset 4092244; code bytes = 8030 Found XOR loop in file "OneDrive.exe" at offset 4144375; code bytes = 8030 Found XOR loop in file "OneDrive.exe" at offset 4316404; code bytes = 8030 Found XOR loop in file "OneDrive.exe" at offset 4522365; code bytes = 8030 Found XOR loop in file "OneDrive.exe" at offset 4523624; code bytes = 8030 Found XOR loop in file "OneDrive.exe" at offset 4917285; code bytes = 8030 Found XOR loop in file "OneDrive.exe" at offset 227574; code bytes = 30d0 Found XOR loop in file "OneDrive.exe" at offset 697087; code bytes = 30d0 Found XOR loop in file "OneDrive.exe" at offset 697411; code bytes = 30d0 Found XOR loop in file "OneDrive.exe" at offset 697820; code bytes = 30d0 Found XOR loop in file "OneDrive.exe" at offset 700112; code bytes = 30d0 Found XOR loop in file "OneDrive.exe" at offset 701640; code bytes = 30d0 Found XOR loop in file "OneDrive.exe" at offset 702111; code bytes = 30d0 Found XOR loop in file "OneDrive.exe" at offset 707686; code bytes = 30d0 Found XOR loop in file "OneDrive.exe" at offset 709104; code bytes = 30d0 Found XOR loop in file "OneDrive.exe" at offset 709383; code bytes = 30d0 Found XOR loop in file "OneDrive.exe" at offset 709794; code bytes = 30d0 Found XOR loop in file "OneDrive.exe" at offset 710756; code bytes = 30d0 Found XOR loop in file "OneDrive.exe" at offset 712121; code bytes = 30d0 Found XOR loop in file "OneDrive.exe" at offset 714228; code bytes = 30d0 Found XOR loop in file "OneDrive.exe" at offset 718106; code bytes = 30d0 Found XOR loop in file "OneDrive.exe" at offset 718312; code bytes = 30d0 Found XOR loop in file "OneDrive.exe" at offset 720618; code bytes = 30d0 Found XOR loop in file "OneDrive.exe" at offset 720867; code bytes = 30d0 Found XOR loop in file "OneDrive.exe" at offset 775123; code bytes = 30d0 Found XOR loop in file "OneDrive.exe" at offset 775128; code bytes = 30d0 Found XOR loop in file "OneDrive.exe" at offset 779058; code bytes = 30d0 Found XOR loop in file "OneDrive.exe" at offset 787958; code bytes = 30d0 Found XOR loop in file "OneDrive.exe" at offset 790268; code bytes = 30d0 Found XOR loop in file "OneDrive.exe" at offset 790460; code bytes = 30d0 Found XOR loop in file "OneDrive.exe" at offset 790650; code bytes = 30d0 Found XOR loop in file "OneDrive.exe" at offset 790814; code bytes = 30d0 Found XOR loop in file "OneDrive.exe" at offset 878393; code bytes = 30d0 Found XOR loop in file "OneDrive.exe" at offset 878720; code bytes = 30d0 Found XOR loop in file "OneDrive.exe" at offset 886866; code bytes = 30d0 Found XOR loop in file "OneDrive.exe" at offset 887152; code bytes = 30d0 Found XOR loop in file "OneDrive.exe" at offset 887653; code bytes = 30d0 Found XOR loop in file "OneDrive.exe" at offset 888207; code bytes = 30d0 Found XOR loop in file "OneDrive.exe" at offset 888290; code bytes = 30d0 Found XOR loop in file "OneDrive.exe" at offset 891461; code bytes = 30d0 Found XOR loop in file "OneDrive.exe" at offset 892510; code bytes = 30d0 Found XOR loop in file "OneDrive.exe" at offset 892522; code bytes = 30d0 Found XOR loop in file "OneDrive.exe" at offset 895754; code bytes = 30d0 Found XOR loop in file "OneDrive.exe" at offset 899506; code bytes = 30d0 Found XOR loop in file "OneDrive.exe" at offset 902576; code bytes = 30d0 Found XOR loop in file "OneDrive.exe" at offset 902583; code bytes = 30d0 Found XOR loop in file "OneDrive.exe" at offset 905335; code bytes = 30d0 Found XOR loop in file "OneDrive.exe" at offset 905910; code bytes = 30d0 Found XOR loop in file "OneDrive.exe" at offset 909244; code bytes = 30d0 Found XOR loop in file "OneDrive.exe" at offset 909249; code bytes = 30d0 Found XOR loop in file "OneDrive.exe" at offset 910782; code bytes = 30d0 Found XOR loop in file "OneDrive.exe" at offset 155679; code bytes = 33c1 Found XOR loop in file "OneDrive.exe" at offset 175756; code bytes = 33c1 Found XOR loop in file "OneDrive.exe" at offset 179194; code bytes = 33c1 Found XOR loop in file "signed_j0TYyO.exe" at offset 155565; code bytes = 30d0 Found XOR loop in file "signed_j0TYyO.exe" at offset 158554; code bytes = 30d0 Found XOR loop in file "signed_j0TYyO.exe" at offset 443855; code bytes = 30d0 Found XOR loop in file "signed_j0TYyO.exe" at offset 443860; code bytes = 30d0 Found XOR loop in file "signed_j0TYyO.exe" at offset 443910; code bytes = 30d0 Found XOR loop in file "signed_j0TYyO.exe" at offset 498692; code bytes = 30d0 Found XOR loop in file "signed_j0TYyO.exe" at offset 499186; code bytes = 30d0 Found XOR loop in file "signed_j0TYyO.exe" at offset 505975; code bytes = 30d0 Found XOR loop in file "signed_j0TYyO.exe" at offset 507344; code bytes = 30d0 Found XOR loop in file "signed_j0TYyO.exe" at offset 510413; code bytes = 30d0 Found XOR loop in file "signed_j0TYyO.exe" at offset 510418; code bytes = 30d0 Found XOR loop in file "signed_j0TYyO.exe" at offset 517101; code bytes = 30d0 Found XOR loop in file "signed_j0TYyO.exe" at offset 517562; code bytes = 30d0 Found XOR loop in file "signed_j0TYyO.exe" at offset 517687; code bytes = 30d0 Found XOR loop in file "signed_j0TYyO.exe" at offset 518390; code bytes = 30d0 Found XOR loop in file "signed_j0TYyO.exe" at offset 523628; code bytes = 30d0 Found XOR loop in file "signed_j0TYyO.exe" at offset 524323; code bytes = 30d0 Found XOR loop in file "signed_j0TYyO.exe" at offset 524593; code bytes = 30d0 Found XOR loop in file "signed_j0TYyO.exe" at offset 524598; code bytes = 30d0 Found XOR loop in file "signed_j0TYyO.exe" at offset 524730; code bytes = 30d0 Found XOR loop in file "signed_j0TYyO.exe" at offset 168591; code bytes = 33c1 Found XOR loop in file "signed_j0TYyO.exe" at offset 533345; code bytes = 33c1 Found XOR loop in file "vcruntime140.dll" at offset 69487; code bytes = 33c1 Found XOR loop in file "vcruntime140.dll" at offset 108836; code bytes = 8030 Found XOR loop in file "vcruntime140.dll" at offset 119135; code bytes = 8030 Found XOR loop in file "vcruntime140.dll" at offset 129407; code bytes = 8030 Found XOR loop in file "vcruntime140.dll" at offset 131293; code bytes = 8030 Found XOR loop in file "sslconf.exe" at offset 6498; code bytes = 33c1 Found XOR loop in file "sslconf.exe" at offset 6632; code bytes = 33c1 Found XOR loop in file "sslconf.exe" at offset 22259; code bytes = 8030 Found XOR loop in file "sslconf.exe" at offset 25130; code bytes = 8030 Found XOR loop in file "svchost.exe" at offset 227574; code bytes = 30d0 Found XOR loop in file "svchost.exe" at offset 697087; code bytes = 30d0 Found XOR loop in file "svchost.exe" at offset 697411; code bytes = 30d0 Found XOR loop in file "svchost.exe" at offset 697820; code bytes = 30d0 Found XOR loop in file "svchost.exe" at offset 700112; code bytes = 30d0 Found XOR loop in file "svchost.exe" at offset 701640; code bytes = 30d0 Found XOR loop in file "svchost.exe" at offset 702111; code bytes = 30d0 Found XOR loop in file "svchost.exe" at offset 707686; code bytes = 30d0 Found XOR loop in file "svchost.exe" at offset 709104; code bytes = 30d0 Found XOR loop in file "svchost.exe" at offset 709383; code bytes = 30d0 Found XOR loop in file "svchost.exe" at offset 709794; code bytes = 30d0 Found XOR loop in file "svchost.exe" at offset 710756; code bytes = 30d0 Found XOR loop in file "svchost.exe" at offset 712121; code bytes = 30d0 Found XOR loop in file "svchost.exe" at offset 714228; code bytes = 30d0 Found XOR loop in file "svchost.exe" at offset 718106; code bytes = 30d0 Found XOR loop in file "svchost.exe" at offset 718312; code bytes = 30d0 Found XOR loop in file "svchost.exe" at offset 720618; code bytes = 30d0 Found XOR loop in file "svchost.exe" at offset 720867; code bytes = 30d0 Found XOR loop in file "svchost.exe" at offset 775123; code bytes = 30d0 Found XOR loop in file "svchost.exe" at offset 775128; code bytes = 30d0 Found XOR loop in file "svchost.exe" at offset 779058; code bytes = 30d0 Found XOR loop in file "svchost.exe" at offset 787958; code bytes = 30d0 Found XOR loop in file "svchost.exe" at offset 790268; code bytes = 30d0 Found XOR loop in file "svchost.exe" at offset 790460; code bytes = 30d0 Found XOR loop in file "svchost.exe" at offset 790650; code bytes = 30d0 Found XOR loop in file "svchost.exe" at offset 790814; code bytes = 30d0 Found XOR loop in file "svchost.exe" at offset 878393; code bytes = 30d0 Found XOR loop in file "svchost.exe" at offset 878720; code bytes = 30d0 Found XOR loop in file "svchost.exe" at offset 886866; code bytes = 30d0 Found XOR loop in file "svchost.exe" at offset 887152; code bytes = 30d0 Found XOR loop in file "svchost.exe" at offset 887653; code bytes = 30d0 Found XOR loop in file "svchost.exe" at offset 888207; code bytes = 30d0 Found XOR loop in file "svchost.exe" at offset 888290; code bytes = 30d0 Found XOR loop in file "svchost.exe" at offset 891461; code bytes = 30d0 Found XOR loop in file "svchost.exe" at offset 892510; code bytes = 30d0 Found XOR loop in file "svchost.exe" at offset 892522; code bytes = 30d0 Found XOR loop in file "svchost.exe" at offset 895754; code bytes = 30d0 Found XOR loop in file "svchost.exe" at offset 899506; code bytes = 30d0 Found XOR loop in file "svchost.exe" at offset 902576; code bytes = 30d0 Found XOR loop in file "svchost.exe" at offset 902583; code bytes = 30d0 Found XOR loop in file "svchost.exe" at offset 905335; code bytes = 30d0 Found XOR loop in file "svchost.exe" at offset 905910; code bytes = 30d0 Found XOR loop in file "svchost.exe" at offset 909244; code bytes = 30d0 Found XOR loop in file "svchost.exe" at offset 909249; code bytes = 30d0 Found XOR loop in file "svchost.exe" at offset 910782; code bytes = 30d0 Found XOR loop in file "svchost.exe" at offset 155679; code bytes = 33c1 Found XOR loop in file "svchost.exe" at offset 175756; code bytes = 33c1 Found XOR loop in file "svchost.exe" at offset 179194; code bytes = 33c133:T2cb6,"RemusStealer.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000000051a7a0b0f97f00000000000000000000000000000000000000e7ffac10000000000000000000000050e6ffac100000001033aeb0f97f000000000000000000009032aeb0f97f000004000000000000000000118fba01000000000000000000004009128fba01000018e7ffac1000000076c5a2b0f97f00000000000000000000000000000000000000ebffac100000000000000000000000f0e6ffac10000000650073007300740000007200000000000300000000000000080000000f00000001000000f97f00004009128fba010000a016118f0f00000018e7ffac10000000c3f09db0f97f00008073128fba010000e8849eb0f97f000070df118f (UID: 00000000-00000876) "RemusStealer.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00000876) "RemusStealer.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00000876) "RemusStealer.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000e0acb0d6ba010000000000000000000051eda1b0f97f000000000000f97f0000000000000000000022f026fcd6370000000001001a00010040ddb2b0f97f00008feca1b0f97f0000e0acb0d6ba010000e0acb0d6ba010000000000000000000000000000f97f0000ffffff7fb427000000000000000000000000000000000000d8cea4d6ba0100002a0000000000000069c35dd6ba0100003100000000000000340200000000000038020000000000001100011000000000c0edffac1000000003a309b0f97f0000c0edffac1000000000000000000000002b00000000000000000000000000000020b063d6ba010000b43f62d6ba010000e0cea4d6 (UID: 00000000-00000876) "RemusStealer.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000f039148fba0100004c25158fba0100003e0fe941c156334681c36e8bac8bdd7078ede9aff97f000000000000000000000100000000000000000000000000000090b2ffac100000001025158fba010000010000000100000070c5ffac1000000010c4f0aff97f0000b8bcffac100000002d62caaff97f0000000000000000000010c4f0aff97f000010c4f0aff97f00006c43c6aff97f000001000000000000000900000000000000cf32d608134600000000000000000000ffffffff00000000000000000000000080450053efffffff00a4d6aff97f0000000000000000000000000000000000000000000000000000ffffffff1000000000000000 (UID: 00000000-00000876) "RemusStealer.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000996a9fb0f97f00000000118fba010000000000000000000000000000000000000000118fba01000079da7a78a1ac0000d6679fb0f97f0000efbe0000000000000014138fba01000080d1148fba0100000014138fba010000000000000000000028e6158fba01000098b3ffac10000000b49d5dadf97f0000c010138fba010000d6679fb0f97f0000ffffffff00000000403f148fba0100000000000000000000000000000000000001000000000000000000000000000000f0e4158fba0100009c965eadf97f000080d1148fba0100000b935eadf97f0000e0b4ffac1000000031d478b0f97f00000000000000000000ffffffffa1ac000000000000 (UID: 00000000-00000876) "RemusStealer.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000996a9fb0f97f00000000118fba010000000000000000000000000000000000000000118fba01000079da7a78a1ac0000d6679fb0f97f0000efbe000000000000d01e168fba01000080d1148fba010000d01e168fba0100000000000000000000a827168fba01000098b3ffac10000000b49d5dadf97f00001011168fba010000d6679fb0f97f0000ffffffff00000000403f148fba01000000000000000000000000000000000000010000000000000000000000000000007026168fba0100009c965eadf97f000080d1148fba0100000b935eadf97f0000e0b4ffac1000000031d478b0f97f00000000000000000000ffffffffa1ac000000000000 (UID: 00000000-00000876) "RemusStealer.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000996a9fb0f97f00000000118fba010000000000000000000000000000000000000000118fba01000079da7a78a1ac0000d6679fb0f97f0000efbe000000000000d012168fba01000080d1148fba010000d012168fba0100000000000000000000c83a168fba01000098b3ffac10000000b49d5dadf97f00001011168fba010000d6679fb0f97f0000ffffffff00000000a029168fba01000000000000000000000000000000000000010000000000000000000000000000009039168fba0100009c965eadf97f000080d1148fba0100000b935eadf97f0000e0b4ffac1000000031d478b0f97f00000000000000000000ffffffffa1ac000000000000 (UID: 00000000-00000876) "RemusStealer.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000996a9fb0f97f00000000118fba010000000000000000000000000000000000000000118fba01000079da7a78a1ac0000d6679fb0f97f0000efbe000000000000d018168fba01000080d1148fba010000d018168fba0100000000000000000000b83f168fba01000098b3ffac10000000b49d5dadf97f00001011168fba010000d6679fb0f97f0000ffffffff000000001023168fba0100000000000000000000000000000000000001000000000000000000000000000000803e168fba0100009c965eadf97f000080d1148fba0100000b935eadf97f0000e0b4ffac1000000031d478b0f97f00000000000000000000ffffffffa1ac000000000000 (UID: 00000000-00000876) "RemusStealer.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000996a9fb0f97f00000000118fba010000000000000000000000000000000000000000118fba01000079da7a78a1ac0000d6679fb0f97f0000efbe0000000000005017168fba01000080d1148fba0100005017168fba01000000000000000000007845168fba01000098b3ffac10000000b49d5dadf97f00001011168fba010000d6679fb0f97f0000ffffffff00000000b023168fba01000000000000000000000000000000000000010000000000000000000000000000004044168fba0100009c965eadf97f000080d1148fba0100000b935eadf97f0000e0b4ffac1000000031d478b0f97f00000000000000000000ffffffffa1ac000000000000 (UID: 00000000-00000876) "RemusStealer.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000996a9fb0f97f00000000118fba010000000000000000000000000000000000000000118fba01000079da7a78a1ac0000d6679fb0f97f0000efbe000000000000901c168fba01000080d1148fba010000901c168fba01000000000000000000003851168fba01000098b3ffac10000000b49d5dadf97f00001011168fba010000d6679fb0f97f0000ffffffff000000000024168fba01000000000000000000000000000000000000010000000000000000000000000000000050168fba0100009c965eadf97f000080d1148fba0100000b935eadf97f0000e0b4ffac1000000031d478b0f97f00000000000000000000ffffffffa1ac000000000000 (UID: 00000000-00000876) "RemusStealer.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000000100000800ffffff0000000001000000000000003b000000000000003b00000000000000d801000000000000bdae148fba010000a9ae148fba0100000000fa28000000007f0300000100000048d4aaadf97f0000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000041d7ffff3900000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00000876) "RemusStealer.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00000876) "RemusStealer.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000360d00000000000020d4ffac10000000040000000000000060b916e2a901000006000000000000000300000000000000a7400badf97f0000a0d6ffac10000000ffffffff0000000000000000000000000101000000000000a090168fba0100000a0000000000000040000000000000007c700badf97f000043003a005c00550073006500720073000000ffac1000000000000000000000000000000000000000210000000f000000000000000000000004000000000000000000000000000000a0d6ffac10000000000000000000000068005fadf97f0000400000001000000004989fb0f97f000000000000000000006056198fba01000001000000 (UID: 00000000-00000876) "RemusStealer.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000000000b5ddacf97f00002400000000000000f8caffac100000008013318fba01000000000000f97f00000000318fba0100000040d1ac1000000008000000020000000000000000000000000000000000000066cdffac1000000028002a00f97f0000c00c318fba01000026000000000000004000000000000000c0ccffac1000000000000000000000000000000000000000000000000000000000000000000000000400000000000000400000000000000032000000000000000000118fba01000032899fb0f97f000040000000000000000000000000000000320000000000000000000000000000000000000000000000ffffffff0000000000000000 (UID: 00000000-00000876) "RemusStealer.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000000032899fb0f97f000040000000000000000000000000000000320000000000000000000000000000000000000000000000ffffffff000000000000000000000000000000000000000030c2188fba01000000e0ffac10000000842a198fba01000060cd168fba01000000000000000000000000000000000000000000000000000000000000000000000000000000000000f01c198fba010000041d198fba010000f01c198fba010000feffffffffffffff00000000000000005224198fba01000000000000000000000000000000000000000000000000000090cdffac100000003200000000000000c0ccffac10000000e0ccffac100000000000118f (UID: 00000000-00000876) "RemusStealer.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000360d00000000000040bdffac100000000400000000000000f01717e2a901000006000000000000000300000000000000a7400badf97f0000000000000000000000000000000000000000000000000000010100000000000010ce168fba0100000a000000000000000000000000000000000000000000000043003a005c005500730065007200730000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000062a026fcd6370000000000000000000000000000000000000600000000000000f0c9ffac1000000004989fb0f97f000020bfffac10000000f3040badf97f000000000000 (UID: 00000000-00000876) "RemusStealer.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000000000b5ddacf97f0000240000000000000018b4ffac100000005025128fba0100000219cc87f97f0000c0b9ffac10000000020000000700000008000000020000000000000000000000000000000000000086b6ffac1000000001000000017f0000fa98deacf97f0000c017cc87f97f0000b050ebacf97f000090b5ffac10000000004068adf97f00001e091a8fba01000000000100000000000f00000000000000000000000000000048baffac10000000b050ebacf97f0000103f128fba01000000ffffff000000002400000000000000d8b4ffac1000000000000000000000007a19cc87f97f00000000000000000000ffffffff0700000000000000 (UID: 00000000-00000876)34:T55b,"RemusStealer.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "RemusStealer.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "OneDrive.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "OneDrive.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "sslconf.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "sslconf.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LEVELS") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "DEFAULTLEVEL") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "SAFERFLAGS") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "POLICYSCOPE") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LOGFILENAME")35:T425,"RemusStealer.exe" queries volume information of "C:\RemusStealer.exe" at 00000000-00000876-00000C17-3534019790 "RemusStealer.exe" queries volume information of an entire harddrive"C:\" at 00000000-00000876-00000C17-3534975634 "sslconf.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\RarSFX0\vcruntime140.dll" at 00000000-00002448-00000C17-3545156846 "sslconf.exe" queries volume information of "C:\ProgramData\TomatoIndigo" at 00000000-00002448-00000C17-3545164210 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00007296-00000C17-3540731158 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00007296-00000C17-3542270088 "powershell.exe" queries volume information of an entire harddrive"C:\" at 00000000-00007296-00000C17-354260108136:T951,"RemusStealer.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\ONEDRIVE.EXE") "RemusStealer.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\REMUSSTEALER.EXE") "RemusStealer.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL") "RemusStealer.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\40078385-F676-4C61-9A9C-F9028599D6D3_IS1") "RemusStealer.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\40078385-F676-4C61-9A9C-F9028599D6D3_IS1"; Key: "DISPLAYNAME") "RemusStealer.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADDRESSBOOK") "RemusStealer.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADDRESSBOOK"; Key: "DISPLAYNAME") "RemusStealer.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\CONNECTION MANAGER") "RemusStealer.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\CONNECTION MANAGER"; Key: "DISPLAYNAME") "RemusStealer.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\DIRECTDRAWEX") "RemusStealer.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\DIRECTDRAWEX"; Key: "DISPLAYNAME") "RemusStealer.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\DXM_RUNTIME") "RemusStealer.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\DXM_RUNTIME"; Key: "DISPLAYNAME") "RemusStealer.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\FONTCORE") "RemusStealer.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\FONTCORE"; Key: "DISPLAYNAME") "RemusStealer.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IE40") "RemusStealer.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IE40"; Key: "DISPLAYNAME") "RemusStealer.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IE4DATA") "RemusStealer.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IE4DATA"; Key: "DISPLAYNAME") "RemusStealer.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IE5BAKEX") "RemusStealer.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IE5BAKEX"; Key: "DISPLAYNAME") "RemusStealer.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IEDATA")37:T50b,"powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\043E4AD5D7CD1251BED7D5DEB038CDA7ED1481B7"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\104C63D2546B8021DD105E9FBA5A8D78169F6B32"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\247106A405B288A46E70A0262717162D0903E734"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\27AC9369FAF25207BB2627CEFACCBE4EF9C319B8"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\339CDD57CFD5B141169B615FF31428782D1DA639"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\4C27431717565A3A07F3E6D0032C4258949CF9EC"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\525C47FB3A5E0655FBD4BE963CA1E94D5FECB43D"; Key: "BLOB")38:T3ea4,"RemusStealer.exe" called "LoadLibrary" with a parameter bcryptprimitives.dll (UID: 00000000-00000876) "RemusStealer.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00000876) "RemusStealer.exe" called "LoadLibrary" with a parameter winmm.dll (UID: 00000000-00000876) "RemusStealer.exe" called "LoadLibrary" with a parameter powrprof.dll (UID: 00000000-00000876) "RemusStealer.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00000876) "RemusStealer.exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00000876) "RemusStealer.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00000876) "RemusStealer.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00000876) "RemusStealer.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00000876) "RemusStealer.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00000876) "RemusStealer.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00000876) "RemusStealer.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00000876) "RemusStealer.exe" called "LoadLibrary" with a parameter GDI32.dll (UID: 00000000-00000876) "RemusStealer.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00000876) "RemusStealer.exe" called "LoadLibrary" with a parameter winhttp.dll (UID: 00000000-00000876) "OneDrive.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007456) "OneDrive.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007456) "OneDrive.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-2 (UID: 00000000-00007456) "OneDrive.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007456) "OneDrive.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007456) "OneDrive.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00007456) "OneDrive.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\DXGIDebug.dll (UID: 00000000-00007456) "OneDrive.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\sfc_os.dll (UID: 00000000-00007456) "OneDrive.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\SSPICLI.DLL (UID: 00000000-00007456) "OneDrive.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\rsaenh.dll (UID: 00000000-00007456) "OneDrive.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\UXTheme.dll (UID: 00000000-00007456) "OneDrive.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\dwmapi.dll (UID: 00000000-00007456) "OneDrive.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\cryptbase.dll (UID: 00000000-00007456) "OneDrive.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00007456) "OneDrive.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\riched20.dll (UID: 00000000-00007456) "OneDrive.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00007456) "OneDrive.exe" called "LoadLibrary" with a parameter COMCTL32.dll (UID: 00000000-00007456) "OneDrive.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00007456) "OneDrive.exe" called "LoadLibrary" with a parameter GDI32.dll (UID: 00000000-00007456) "OneDrive.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00007456) "sslconf.exe" called "LoadLibrary" with a parameter winhttp.dll (UID: 00000000-00002448) "sslconf.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00002448) "sslconf.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00002448) "sslconf.exe" called "LoadLibrary" with a parameter setupapi.dll (UID: 00000000-00002448) "sslconf.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00002448) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00007296) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007296) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007296) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007296) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00007296) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00007296) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00007296) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00007296) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00007296) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00007296) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00007296) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00007296) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00007296) "powershell.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00007296) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00007296) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00007296) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll (UID: 00000000-00007296) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00007296) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00007296) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00007296) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00007296) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00007296) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00007296) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll (UID: 00000000-00007296) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll (UID: 00000000-00007296) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\b5ba37e1558ced178a99011a1d659b52\Microsoft.PowerShell.ConsoleH (UID: 00000000-00007296) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll (UID: 00000000-00007296) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00007296) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\6da01910c256231d1c50ad0aacee5941\System.Management.Automation. (UID: 00000000-00007296) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00007296) "powershell.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00007296) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00007296) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00007296) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00007296) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00007296) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00007296) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00007296) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00007296) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00007296) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00007296) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00007296) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00007296) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00007296) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00007296) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00007296) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll (UID: 00000000-00007296) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll (UID: 00000000-00007296) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll (UID: 00000000-00007296) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00007296) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00007296) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00007296) "powershell.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00007296) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007296) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll (UID: 00000000-00007296) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Mf49f6405#\7b1f35fb0c2d6955ce5af2bd372c65f2\Microsoft.Management.Infrastr (UID: 00000000-00007296) "powershell.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00007296) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Management\b221af81285c1305324612e6dc9c88ff\System.Management.ni.dll (UID: 00000000-00007296) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00007296) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Dired13b18a9#\8ad4c0af5b3d51a0f3a4dac0d44d85d4\System.DirectoryServices.ni.d (UID: 00000000-00007296) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\5ee35debfc22f727e70e4479ddcbc045\System.Xml.ni.dll (UID: 00000000-00007296) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Numerics\86cfd69ce1261baf4740e7606cade014\System.Numerics.ni.dll (UID: 00000000-00007296) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Data\7bed49c46de9295a8453db205c60a028\System.Data.ni.dll (UID: 00000000-00007296) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00007296) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00007296) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll (UID: 00000000-00007296) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P6f792626#\7ff5199e757cb8af9ad949453f698d09\Microsoft.PowerShell.Security (UID: 00000000-00007296) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Configuration\4beb1eeca20b27d4bd1bb9880f03cc2a\System.Configuration.ni.dll (UID: 00000000-00007296) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Transactions\604272b0faec2e09d53d38e03bc89c6c\System.Transactions.ni.dll (UID: 00000000-00007296) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00007296) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00007296) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00007296) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll (UID: 00000000-00007296) "powershell.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00007296) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll (UID: 00000000-00007296) "powershell.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00007296) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MPCLIENT.DLL (UID: 00000000-00007296) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MsMpLics.dll (UID: 00000000-00007296) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00007296) "powershell.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00007296) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00007296) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00007296) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00007296) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00007296) "powershell.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00007296) "sslconf.exe" called "LoadLibrary" with a parameter winhttp.dll (UID: 00000000-00007376) "sslconf.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00007376) "sslconf.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00007376) "OneDrive.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00002620) "OneDrive.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00002620)39:Tdba5,"RemusStealer.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00000876) "RemusStealer.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00000876) "RemusStealer.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00000876) "RemusStealer.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00000876) "RemusStealer.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00000876) "RemusStealer.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00000876) "RemusStealer.exe" called "GetProcAddress" with a parameter ProcessPrng (UID: 00000000-00000876) "RemusStealer.exe" called "GetProcAddress" with a parameter NtCreateWaitCompletionPacket (UID: 00000000-00000876) "RemusStealer.exe" called "GetProcAddress" with a parameter NtAssociateWaitCompletionPacket (UID: 00000000-00000876) "RemusStealer.exe" called "GetProcAddress" with a parameter NtCancelWaitCompletionPacket (UID: 00000000-00000876) "RemusStealer.exe" called "GetProcAddress" with a parameter RtlGetCurrentPeb (UID: 00000000-00000876) "RemusStealer.exe" called "GetProcAddress" with a parameter timeBeginPeriod (UID: 00000000-00000876) "RemusStealer.exe" called "GetProcAddress" with a parameter timeEndPeriod (UID: 00000000-00000876) "RemusStealer.exe" called "GetProcAddress" with a parameter PowerRegisterSuspendResumeNotification (UID: 00000000-00000876) "RemusStealer.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00000876) "RemusStealer.exe" called "GetProcAddress" with a parameter GetStdHandle (UID: 00000000-00000876) "RemusStealer.exe" called "GetProcAddress" with a parameter GetConsoleMode (UID: 00000000-00000876) "RemusStealer.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00000876) "RemusStealer.exe" called "GetProcAddress" with a parameter GetCommandLineW (UID: 00000000-00000876) "RemusStealer.exe" called "GetProcAddress" with a parameter WSAStartup (UID: 00000000-00000876) "RemusStealer.exe" called "GetProcAddress" with a parameter SetFileCompletionNotificationModes (UID: 00000000-00000876) "RemusStealer.exe" called "GetProcAddress" with a parameter WSAEnumProtocolsW (UID: 00000000-00000876) "RemusStealer.exe" called "GetProcAddress" with a parameter GetEnvironmentVariableW (UID: 00000000-00000876) "RemusStealer.exe" called "GetProcAddress" with a parameter GetTempPathW (UID: 00000000-00000876) "RemusStealer.exe" called "GetProcAddress" with a parameter lstrcatW (UID: 00000000-00000876) "RemusStealer.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00000876) "RemusStealer.exe" called "GetProcAddress" with a parameter WriteFile (UID: 00000000-00000876) "RemusStealer.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00000876) "RemusStealer.exe" called "GetProcAddress" with a parameter ShellExecuteW (UID: 00000000-00000876) "RemusStealer.exe" called "GetProcAddress" with a parameter GetModuleFileNameW (UID: 00000000-00000876) "RemusStealer.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00000876) "RemusStealer.exe" called "GetProcAddress" with a parameter CreateDirectoryW (UID: 00000000-00000876) "RemusStealer.exe" called "GetProcAddress" with a parameter GetFileInformationByHandle (UID: 00000000-00000876) "RemusStealer.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00000876) "RemusStealer.exe" called "GetProcAddress" with a parameter CoInitialize (UID: 00000000-00000876) "RemusStealer.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00000876) "RemusStealer.exe" called "GetProcAddress" with a parameter MessageBoxW (UID: 00000000-00000876) "RemusStealer.exe" called "GetProcAddress" with a parameter GetEnvironmentStringsW (UID: 00000000-00000876) "RemusStealer.exe" called "GetProcAddress" with a parameter FreeEnvironmentStringsW (UID: 00000000-00000876) "RemusStealer.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00000876) "RemusStealer.exe" called "GetProcAddress" with a parameter DuplicateHandle (UID: 00000000-00000876) "RemusStealer.exe" called "GetProcAddress" with a parameter InitializeProcThreadAttributeList (UID: 00000000-00000876) "RemusStealer.exe" called "GetProcAddress" with a parameter UpdateProcThreadAttribute (UID: 00000000-00000876) "RemusStealer.exe" called "GetProcAddress" with a parameter CreateProcessW (UID: 00000000-00000876) "RemusStealer.exe" called "GetProcAddress" with a parameter DeleteProcThreadAttributeList (UID: 00000000-00000876) "RemusStealer.exe" called "GetProcAddress" with a parameter WaitForSingleObject (UID: 00000000-00000876) "RemusStealer.exe" called "GetProcAddress" with a parameter GetExitCodeProcess (UID: 00000000-00000876) "RemusStealer.exe" called "GetProcAddress" with a parameter GetProcessTimes (UID: 00000000-00000876) "RemusStealer.exe" called "GetProcAddress" with a parameter GetProcessHeap (UID: 00000000-00000876) "RemusStealer.exe" called "GetProcAddress" with a parameter TlsAlloc (UID: 00000000-00000876) "RemusStealer.exe" called "GetProcAddress" with a parameter LoadLibraryW (UID: 00000000-00000876) "RemusStealer.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00000876) "RemusStealer.exe" called "GetProcAddress" with a parameter VirtualAlloc (UID: 00000000-00000876) "RemusStealer.exe" called "GetProcAddress" with a parameter ExitProcess (UID: 00000000-00000876) "RemusStealer.exe" called "GetProcAddress" with a parameter GetComputerNameA (UID: 00000000-00000876) "RemusStealer.exe" called "GetProcAddress" with a parameter GetComputerNameExA (UID: 00000000-00000876) "RemusStealer.exe" called "GetProcAddress" with a parameter GlobalLock (UID: 00000000-00000876) "RemusStealer.exe" called "GetProcAddress" with a parameter GlobalUnlock (UID: 00000000-00000876) "RemusStealer.exe" called "GetProcAddress" with a parameter LocalFree (UID: 00000000-00000876) "RemusStealer.exe" called "GetProcAddress" with a parameter CoInitializeSecurity (UID: 00000000-00000876) "RemusStealer.exe" called "GetProcAddress" with a parameter CoSetProxyBlanket (UID: 00000000-00000876) "RemusStealer.exe" called "GetProcAddress" with a parameter CloseDesktop (UID: 00000000-00000876) "RemusStealer.exe" called "GetProcAddress" with a parameter CreateDesktopW (UID: 00000000-00000876) "RemusStealer.exe" called "GetProcAddress" with a parameter EnumDisplaySettingsW (UID: 00000000-00000876) "RemusStealer.exe" called "GetProcAddress" with a parameter GetClientRect (UID: 00000000-00000876) "RemusStealer.exe" called "GetProcAddress" with a parameter GetDC (UID: 00000000-00000876) "RemusStealer.exe" called "GetProcAddress" with a parameter GetKeyboardLayout (UID: 00000000-00000876) "RemusStealer.exe" called "GetProcAddress" with a parameter GetSystemMetrics (UID: 00000000-00000876) "RemusStealer.exe" called "GetProcAddress" with a parameter GetWindowDC (UID: 00000000-00000876) "RemusStealer.exe" called "GetProcAddress" with a parameter GetWindowRect (UID: 00000000-00000876) "RemusStealer.exe" called "GetProcAddress" with a parameter OpenDesktopW (UID: 00000000-00000876) "RemusStealer.exe" called "GetProcAddress" with a parameter ReleaseDC (UID: 00000000-00000876) "RemusStealer.exe" called "GetProcAddress" with a parameter GetUserNameA (UID: 00000000-00000876) "RemusStealer.exe" called "GetProcAddress" with a parameter LookupPrivilegeValueW (UID: 00000000-00000876) "RemusStealer.exe" called "GetProcAddress" with a parameter BitBlt (UID: 00000000-00000876) "RemusStealer.exe" called "GetProcAddress" with a parameter CreateCompatibleBitmap (UID: 00000000-00000876) "RemusStealer.exe" called "GetProcAddress" with a parameter CreateCompatibleDC (UID: 00000000-00000876) "RemusStealer.exe" called "GetProcAddress" with a parameter DeleteDC (UID: 00000000-00000876) "RemusStealer.exe" called "GetProcAddress" with a parameter DeleteObject (UID: 00000000-00000876) "RemusStealer.exe" called "GetProcAddress" with a parameter GetCurrentObject (UID: 00000000-00000876) "RemusStealer.exe" called "GetProcAddress" with a parameter GetDIBits (UID: 00000000-00000876) "RemusStealer.exe" called "GetProcAddress" with a parameter GetObjectW (UID: 00000000-00000876) "RemusStealer.exe" called "GetProcAddress" with a parameter SelectObject (UID: 00000000-00000876) "RemusStealer.exe" called "GetProcAddress" with a parameter CreateActCtxW (UID: 00000000-00000876) "OneDrive.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00007456) "OneDrive.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00007456) "OneDrive.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00007456) "OneDrive.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00007456) "OneDrive.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00007456) "OneDrive.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00007456) "OneDrive.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00007456) "OneDrive.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00007456) "OneDrive.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00007456) "OneDrive.exe" called "GetProcAddress" with a parameter FlsGetValue2 (UID: 00000000-00007456) "OneDrive.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00007456) "OneDrive.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00007456) "OneDrive.exe" called "GetProcAddress" with a parameter SetDllDirectoryW (UID: 00000000-00007456) "OneDrive.exe" called "GetProcAddress" with a parameter SetDefaultDllDirectories (UID: 00000000-00007456) "OneDrive.exe" called "GetProcAddress" with a parameter SetUserObjectInformationW (UID: 00000000-00007456) "OneDrive.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00007456) "OneDrive.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00007456) "OneDrive.exe" called "GetProcAddress" with a parameter OleInitialize (UID: 00000000-00007456) "OneDrive.exe" called "GetProcAddress" with a parameter InitCommonControlsEx (UID: 00000000-00007456) "OneDrive.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00007456) "OneDrive.exe" called "GetProcAddress" with a parameter SHGetMalloc (UID: 00000000-00007456) "OneDrive.exe" called "GetProcAddress" with a parameter LoadIconW (UID: 00000000-00007456) "OneDrive.exe" called "GetProcAddress" with a parameter LoadBitmapW (UID: 00000000-00007456) "OneDrive.exe" called "GetProcAddress" with a parameter CreateStreamOnHGlobal (UID: 00000000-00007456) "OneDrive.exe" called "GetProcAddress" with a parameter GetObjectW (UID: 00000000-00007456) "OneDrive.exe" called "GetProcAddress" with a parameter GetDC (UID: 00000000-00007456) "OneDrive.exe" called "GetProcAddress" with a parameter GetDeviceCaps (UID: 00000000-00007456) "OneDrive.exe" called "GetProcAddress" with a parameter ReleaseDC (UID: 00000000-00007456) "OneDrive.exe" called "GetProcAddress" with a parameter DialogBoxParamW (UID: 00000000-00007456) "OneDrive.exe" called "GetProcAddress" with a parameter GetWindowRect (UID: 00000000-00007456) "OneDrive.exe" called "GetProcAddress" with a parameter GetClientRect (UID: 00000000-00007456) "OneDrive.exe" called "GetProcAddress" with a parameter GetSystemMetrics (UID: 00000000-00007456) "OneDrive.exe" called "GetProcAddress" with a parameter GetWindow (UID: 00000000-00007456) "OneDrive.exe" called "GetProcAddress" with a parameter SendMessageW (UID: 00000000-00007456) "OneDrive.exe" called "GetProcAddress" with a parameter SendDlgItemMessageW (UID: 00000000-00007456) "OneDrive.exe" called "GetProcAddress" with a parameter GetDlgItem (UID: 00000000-00007456) "OneDrive.exe" called "GetProcAddress" with a parameter SetWindowTextW (UID: 00000000-00007456) "OneDrive.exe" called "GetProcAddress" with a parameter GetClassNameW (UID: 00000000-00007456) "OneDrive.exe" called "GetProcAddress" with a parameter FindWindowExW (UID: 00000000-00007456) "OneDrive.exe" called "GetProcAddress" with a parameter SHAutoComplete (UID: 00000000-00007456) "OneDrive.exe" called "GetProcAddress" with a parameter PeekMessageW (UID: 00000000-00007456) "OneDrive.exe" called "GetProcAddress" with a parameter GetMessageW (UID: 00000000-00007456) "OneDrive.exe" called "GetProcAddress" with a parameter IsDialogMessageW (UID: 00000000-00007456) "OneDrive.exe" called "GetProcAddress" with a parameter TranslateMessage (UID: 00000000-00007456) "OneDrive.exe" called "GetProcAddress" with a parameter DispatchMessageW (UID: 00000000-00007456) "OneDrive.exe" called "GetProcAddress" with a parameter SetDlgItemTextW (UID: 00000000-00007456) "OneDrive.exe" called "GetProcAddress" with a parameter EnableWindow (UID: 00000000-00007456) "OneDrive.exe" called "GetProcAddress" with a parameter GetWindowTextLengthW (UID: 00000000-00007456) "OneDrive.exe" called "GetProcAddress" with a parameter GetWindowTextW (UID: 00000000-00007456) "OneDrive.exe" called "GetProcAddress" with a parameter SetFocus (UID: 00000000-00007456) "OneDrive.exe" called "GetProcAddress" with a parameter LoadStringW (UID: 00000000-00007456) "OneDrive.exe" called "GetProcAddress" with a parameter ShowWindow (UID: 00000000-00007456) "OneDrive.exe" called "GetProcAddress" with a parameter GetWindowLongPtrW (UID: 00000000-00007456) "OneDrive.exe" called "GetProcAddress" with a parameter SetWindowLongPtrW (UID: 00000000-00007456) "OneDrive.exe" called "GetProcAddress" with a parameter ShellExecuteExW (UID: 00000000-00007456) "OneDrive.exe" called "GetProcAddress" with a parameter CharUpperW (UID: 00000000-00007456) "OneDrive.exe" called "GetProcAddress" with a parameter IsWindowVisible (UID: 00000000-00007456) "OneDrive.exe" called "GetProcAddress" with a parameter WaitForInputIdle (UID: 00000000-00007456) "sslconf.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00002448) "sslconf.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00002448) "sslconf.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00002448) "sslconf.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00002448) "sslconf.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00002448) "sslconf.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00002448) "sslconf.exe" called "GetProcAddress" with a parameter ShowWindow (UID: 00000000-00002448) "sslconf.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00002448) "sslconf.exe" called "GetProcAddress" with a parameter BCryptGenRandom (UID: 00000000-00002448) "sslconf.exe" called "GetProcAddress" with a parameter VFS_GetHandle (UID: 00000000-00002448) "sslconf.exe" called "GetProcAddress" with a parameter VFS_GetLength (UID: 00000000-00002448) "sslconf.exe" called "GetProcAddress" with a parameter VFS_MapViewOfFile (UID: 00000000-00002448) "sslconf.exe" called "GetProcAddress" with a parameter VFS_MoveFile (UID: 00000000-00002448) "sslconf.exe" called "GetProcAddress" with a parameter VFS_Open (UID: 00000000-00002448) "sslconf.exe" called "GetProcAddress" with a parameter VFS_Read (UID: 00000000-00002448) "sslconf.exe" called "GetProcAddress" with a parameter VFS_SetAttrib (UID: 00000000-00002448) "sslconf.exe" called "GetProcAddress" with a parameter VFS_SetCurrentDir (UID: 00000000-00002448) "sslconf.exe" called "GetProcAddress" with a parameter VFS_SetLength (UID: 00000000-00002448) "sslconf.exe" called "GetProcAddress" with a parameter VFS_UnmapViewOfFile (UID: 00000000-00002448) "sslconf.exe" called "GetProcAddress" with a parameter VFS_Write (UID: 00000000-00002448) "sslconf.exe" called "GetProcAddress" with a parameter MpAddToScanQueue (UID: 00000000-00002448) "sslconf.exe" called "GetProcAddress" with a parameter MpCreateMemoryAliasing (UID: 00000000-00002448) "sslconf.exe" called "GetProcAddress" with a parameter MpCallPostEntryPointCode (UID: 00000000-00002448) "sslconf.exe" called "GetProcAddress" with a parameter MpCallPreEntryPointCode (UID: 00000000-00002448) "sslconf.exe" called "GetProcAddress" with a parameter MpDispatchException (UID: 00000000-00002448) "sslconf.exe" called "GetProcAddress" with a parameter MpExitThread (UID: 00000000-00002448) "sslconf.exe" called "GetProcAddress" with a parameter MpFinalize (UID: 00000000-00002448) "sslconf.exe" called "GetProcAddress" with a parameter MpGetCurrentThreadHandle (UID: 00000000-00002448) "sslconf.exe" called "GetProcAddress" with a parameter MpGetCurrentThreadId (UID: 00000000-00002448) "sslconf.exe" called "GetProcAddress" with a parameter MpGetLastSwitchResult (UID: 00000000-00002448) "sslconf.exe" called "GetProcAddress" with a parameter MpGetPseudoThreadHandle (UID: 00000000-00002448) "sslconf.exe" called "GetProcAddress" with a parameter MpGetSelectorBase (UID: 00000000-00002448) "sslconf.exe" called "GetProcAddress" with a parameter MpGetVStoreFileHandle (UID: 00000000-00002448) "sslconf.exe" called "GetProcAddress" with a parameter MpHandlerCodePost (UID: 00000000-00002448) "sslconf.exe" called "GetProcAddress" with a parameter MpIntHandler (UID: 00000000-00002448) "sslconf.exe" called "GetProcAddress" with a parameter MpIntHandlerParam (UID: 00000000-00002448) "sslconf.exe" called "GetProcAddress" with a parameter MpIntHandlerReturnAddress (UID: 00000000-00002448) "sslconf.exe" called "GetProcAddress" with a parameter MpNtdllDatatSection (UID: 00000000-00002448) "sslconf.exe" called "GetProcAddress" with a parameter MpReportEvent (UID: 00000000-00002448) "sslconf.exe" called "GetProcAddress" with a parameter MpReportEventEx (UID: 00000000-00002448) "sslconf.exe" called "GetProcAddress" with a parameter MpReportEventW (UID: 00000000-00002448) "sslconf.exe" called "GetProcAddress" with a parameter MpSehHandler (UID: 00000000-00002448) "sslconf.exe" called "GetProcAddress" with a parameter MpSetSelectorBase (UID: 00000000-00002448) "sslconf.exe" called "GetProcAddress" with a parameter MpStartProcess (UID: 00000000-00002448) "sslconf.exe" called "GetProcAddress" with a parameter MpSwitchToNextThread (UID: 00000000-00002448) "sslconf.exe" called "GetProcAddress" with a parameter MpSwitchToNextThread_WithCheck (UID: 00000000-00002448) "sslconf.exe" called "GetProcAddress" with a parameter MpSwitchToNextThread_NewObjManager (UID: 00000000-00002448) "sslconf.exe" called "GetProcAddress" with a parameter MpTimerEvent (UID: 00000000-00002448) "sslconf.exe" called "GetProcAddress" with a parameter MpTimerEventData (UID: 00000000-00002448) "sslconf.exe" called "GetProcAddress" with a parameter MpUfsMetadataOp (UID: 00000000-00002448) "sslconf.exe" called "GetProcAddress" with a parameter MpValidateVFSHandle (UID: 00000000-00002448) "sslconf.exe" called "GetProcAddress" with a parameter MpVmp32FastEnter (UID: 00000000-00002448) "powershell.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter RegisterShimImplCallback (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter RegisterShimImplCleanupCallback (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter SetShellShimInstance (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter OnShimDllMainCalled (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter CorBindToRuntimeEx_RetAddr (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter CorBindToRuntimeEx (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter UrlIsW (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter AppPolicyGetClrCompat (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentPackageInfo (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentPackagePath (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter SetRuntimeInfo (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter DllGetClassObjectInternal (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter QuirkIsEnabled3 (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter QuirkGetData2 (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter CreateConfigStream (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter CreateConfigStream_RetAddr (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter GetNumaHighestNodeNumber (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter RtlVirtualUnwind (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter GetSystemWindowsDirectoryW (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter AddAccessAllowedAce (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter RoInitialize (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter AddSIDToBoundaryDescriptor (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter CreateBoundaryDescriptorW (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter CreatePrivateNamespaceW (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter OpenPrivateNamespaceW (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter DeleteBoundaryDescriptor (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter WerRegisterRuntimeExceptionModule (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter RaiseException (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter GetProcessMemoryInfo (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter RoUninitialize (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap_RetAddr (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter SysStringByteLen (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter RoGetActivationFactory (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter WindowsCreateStringReference (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter CoGetContextToken (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter WindowsDeleteString (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter WindowsCreateString (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter NtQueryInformationThread (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter CreateWaitableTimerExW (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter SetWaitableTimerEx (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter EventActivityIdControl (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter EventWriteTransfer (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter RegOpenKeyEx (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter LocalFree (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter LocalAlloc (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter GetFullPathNameW (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter SetThreadErrorMode (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributesEx (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSize (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfo (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter VerQueryValue (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter GetUserPreferredUILanguages (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter VerLanguageName (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter VerLanguageNameW (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessId (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessIdW (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter LookupPrivilegeValue (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter LookupPrivilegeValueW (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter OpenProcessTokenW (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter AdjustTokenPrivileges (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter AdjustTokenPrivilegesW (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter OpenProcess (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter OpenProcessW (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter FindNLSStringEx (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter RegQueryValueEx (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter EnumProcessModules (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter EnumProcessModulesW (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter GetModuleInformation (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter GetModuleInformationW (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter GetModuleBaseName (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter GetModuleBaseNameW (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileNameEx (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileNameExW (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter GetExitCodeProcess (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter GetExitCodeProcessW (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter EnumWindows (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter EnumWindowsW (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter GetWindowThreadProcessId (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter GetWindowThreadProcessIdW (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter ResolveLocaleName (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter CompareStringOrdinal (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter GetFullPathName (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter SHGetFolderPath (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributes (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributesW (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter GetEnvironmentVariable (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter GetEnvironmentVariableW (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter CreateFile (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter NtQuerySystemInformationW (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter WerSetFlags (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter SetThreadPreferredUILanguages (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter SetThreadPreferredUILanguagesW (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter GetThreadPreferredUILanguages (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter GetThreadPreferredUILanguagesW (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleNameW (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter WTGetSignatureInfo (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter CoCreateGuid (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter AmsiInitialize (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleCP (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleCPW (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeExW (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoExW (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentConsoleFontEx (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentConsoleFontExW (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter CertFreeCertificateContext (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleMode (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleModeW (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleScreenBufferInfo (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleScreenBufferInfoW (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleMode (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleModeW (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandler (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandlerW (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter GetStdHandle (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter GetProcessTimes (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter GetProcessTimesW (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter GetDynamicTimeZoneInformation (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateContext (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter CertGetCertificateContextProperty (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateContextW (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter WTHelperProvDataFromStateData (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter WTHelperProvDataFromStateDataW (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvSignerFromChain (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvSignerFromChainW (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvCertFromChain (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvCertFromChainW (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter WinVerifyTrust (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter WinVerifyTrustW (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter CertFreeCertificateContextW (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessW (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter GetTokenInformationW (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter LocalAllocW (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter DuplicateTokenEx (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter DuplicateTokenExW (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter CheckTokenMembership (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter CheckTokenMembershipW (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleTitle (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleTitleW (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter GetFileMUIPath (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter LoadLibraryEx (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter FreeLibrary (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter FreeLibraryW (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter LoadStringW (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTitle (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTitleW (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter CreateWellKnownSid (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter CreateNamedPipe (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter CreateNamedPipeW (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter CreateEvent (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter CreateEventW (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter ConnectNamedPipe (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter SetEnvironmentVariable (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter SetEnvironmentVariableW (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter _CorDllMain_RetAddr (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter _CorDllMain (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter GetTokenForVTableEntry (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter SetTargetForVTableEntry (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter GetTargetForVTableEntry (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter GetTokenForVTableEntry_RetAddr (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter SetTargetForVTableEntry_RetAddr (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter GetEnabledXStateFeatures (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter sxsJitStartup (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter jitStartup (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter getJit (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter ExpandEnvironmentStrings (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter ExpandEnvironmentStringsW (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter GetTimeZoneInformation (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter RegQueryInfoKey (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter RegEnumKeyEx (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter GetUserNameEx (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter GetUserNameExW (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter GetUserName (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter GetUserNameW (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter LookupAccountName (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter LookupAccountNameW (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter EnumCalendarInfoExEx (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter GetCalendarInfoEx (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter EnumTimeFormatsEx (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter ReleaseMutex (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter RegisterEventSource (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter RegisterEventSourceW (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter DeregisterEventSource (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter ReportEvent (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter ReportEventW (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter GetLogicalDrives (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter GetDriveType (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter GetDriveTypeW (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter GetVolumeInformation (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter GetVolumeInformationW (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter PathIsNetworkPath (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter PathIsNetworkPathW (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentDirectoryW (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter GetSystemDirectory (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter GetSystemDirectoryW (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter WldpGetLockdownPolicy (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter GetTempPath (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter GetTempPathW (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter WriteFile (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter SaferIdentifyLevel (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter SaferComputeTokenFromLevel (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter SaferCloseLevel (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter DeleteFile (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter DeleteFileW (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter GetSystemInfo (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter SetEvent (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter CoWaitForMultipleHandles (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter SetThreadUILanguage (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter SetThreadUILanguageW (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter AmsiOpenSession (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter AmsiScanBuffer (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter MpManagerOpen (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter MpHandleClose (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter MpFreeMemory (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter MpScanStart (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter MpMemoryScanStart (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter MpScanResult (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter MpThreatOpen (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter MpThreatEnumerate (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter MpConfigOpen (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter MpConfigGetValue (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter MpConfigGetValueAlloc (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter MpConfigClose (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter MpFastMemoryScanOpen (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter MpFastMemoryScan (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter MpTelemetryInitialize (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter MpTelemetryUninitialize (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter MpTelemetryAddToAverageDWORD (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter MpAmsiScan (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter MpAmsiCloseSession (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter MpConfigRegisterForNotifications (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter MpConfigUnregisterNotifications (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter MpClientUtilExportFunctions (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter MpManagerVersionQuery (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter EventWrite (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter IsWow64Process (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter RegisterGPNotification (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter UnregisterGPNotification (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter RoGetParameterizedTypeInstanceIID (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileName (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileNameW (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter BCryptGetFipsAlgorithmMode (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter GetFileSize (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter AmsiCloseSession (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter AmsiUninitialize (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter CorExitProcess_RetAddr (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter CorExitProcess (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter CreateActCtxW (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter AddRefActCtx (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter ReleaseActCtx (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter ActivateActCtx (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter DeactivateActCtx (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentActCtx (UID: 00000000-00007296) "powershell.exe" called "GetProcAddress" with a parameter QueryActCtxW (UID: 00000000-00007296) "sslconf.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00007376) "sslconf.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00007376) "sslconf.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00007376) "sslconf.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00007376) "sslconf.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00007376) "sslconf.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00007376) "sslconf.exe" called "GetProcAddress" with a parameter ShowWindow (UID: 00000000-00007376) "sslconf.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00007376) "sslconf.exe" called "GetProcAddress" with a parameter BCryptGenRandom (UID: 00000000-00007376) "OneDrive.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00002620) "OneDrive.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00002620) "OneDrive.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00002620) "OneDrive.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00002620) "OneDrive.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00002620) "OneDrive.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00002620)3a:T36dc,Found reference to API (Indicator: "GetEnvironmentStringsW"; File: "RemusStealer.exe") Found reference to API (Indicator: "ExitProcess"; File: "RemusStealer.exe") Found reference to API (Indicator: "SetThreadContext"; File: "RemusStealer.exe") Found reference to API (Indicator: "TlsAlloc"; File: "RemusStealer.exe") Found reference to API (Indicator: "VirtualFree"; File: "RemusStealer.exe") Found reference to API (Indicator: "VirtualAlloc"; File: "RemusStealer.exe") Found reference to API (Indicator: "CreateIoCompletionPort"; File: "RemusStealer.exe") Found reference to API (Indicator: "DuplicateHandle"; File: "RemusStealer.exe") Found reference to API (Indicator: "RaiseFailFastException"; File: "RemusStealer.exe") Found reference to API (Indicator: "WerGetFlags"; File: "RemusStealer.exe") Found reference to API (Indicator: "SetWaitableTimer"; File: "RemusStealer.exe") Found reference to API (Indicator: "ResumeThread"; File: "RemusStealer.exe") Found reference to API (Indicator: "GetSystemInfo"; File: "RemusStealer.exe") Found reference to API (Indicator: "GetThreadContext"; File: "RemusStealer.exe") Found reference to API (Indicator: "SuspendThread"; File: "RemusStealer.exe") Found reference to API (Indicator: "WerSetFlags"; File: "RemusStealer.exe") Found reference to API (Indicator: "LoadLibraryW"; File: "RemusStealer.exe") Found reference to API (Indicator: "GetErrorMode"; File: "RemusStealer.exe") Found reference to API (Indicator: "GetSystemDirectoryA"; File: "RemusStealer.exe") Found reference to API (Indicator: "SetErrorMode"; File: "RemusStealer.exe") Found reference to API (Indicator: "SetEvent"; File: "RemusStealer.exe") Found reference to API (Indicator: "SetProcessPriorityBoost"; File: "RemusStealer.exe") Found reference to API (Indicator: "CloseHandle"; File: "RemusStealer.exe") Found reference to API (Indicator: "RtlVirtualUnwind"; File: "RemusStealer.exe") Found reference to API (Indicator: "VirtualQuery"; File: "RemusStealer.exe") Found reference to API (Indicator: "GetConsoleMode"; File: "RemusStealer.exe") Found reference to API (Indicator: "CreateThread"; File: "RemusStealer.exe") Found reference to API (Indicator: "CreateWaitableTimerExW"; File: "RemusStealer.exe") Found reference to API (Indicator: "SwitchToThread"; File: "RemusStealer.exe") Found reference to API (Indicator: "RtlLookupFunctionEntry"; File: "RemusStealer.exe") Found reference to API (Indicator: "SetConsoleCtrlHandler"; File: "RemusStealer.exe") Found reference to API (Indicator: "FreeEnvironmentStringsW"; File: "RemusStealer.exe") Found reference to API (Indicator: "PostQueuedCompletionStatus"; File: "RemusStealer.exe") Found reference to API (Indicator: "CreateEventA"; File: "RemusStealer.exe") Found reference to API (Indicator: "WaitForMultipleObjects"; File: "RemusStealer.exe") Found reference to API (Indicator: "WaitForSingleObject"; File: "RemusStealer.exe") Found reference to API (Indicator: "WriteConsoleW"; File: "RemusStealer.exe") Found reference to API (Indicator: "WriteFile"; File: "RemusStealer.exe") Found reference to API (Indicator: "LoadLibraryExW"; File: "RemusStealer.exe") Found reference to API (Indicator: "GetQueuedCompletionStatusEx"; File: "RemusStealer.exe") Found reference to API (Indicator: "GetStdHandle"; File: "RemusStealer.exe") Found reference to API (Indicator: "GetProcAddress"; File: "RemusStealer.exe") Found reference to API (Indicator: "GetCurrentThreadId"; File: "RemusStealer.exe") Found reference to API (Indicator: "GetProcessAffinityMask"; File: "RemusStealer.exe") Found reference to API (Indicator: "AddVectoredContinueHandler"; File: "RemusStealer.exe") Found reference to API (Indicator: "AddVectoredExceptionHandler"; File: "RemusStealer.exe") Found reference to API (Indicator: "WSAIoctl"; File: "RemusStealer.exe") Found reference to API (Indicator: "GetProcessVersion"; File: "RemusStealer.exe") Found reference to API (Indicator: "GetSystemDefaultLCID"; File: "RemusStealer.exe") Found reference to API (Indicator: "GetActiveProcessorGroupCount"; File: "RemusStealer.exe") Found reference to API (Indicator: "IsProcessorFeaturePresent"; File: "RemusStealer.exe") Found reference to API (Indicator: "GetConsoleWindow"; File: "RemusStealer.exe") Found reference to API (Indicator: "GetACP"; File: "RemusStealer.exe") Found reference to API (Indicator: "GetConsoleCP"; File: "RemusStealer.exe") Found reference to API (Indicator: "GetLastError"; File: "RemusStealer.exe") Found reference to API (Indicator: "GetSysColorBrush"; File: "RemusStealer.exe") Found reference to API (Indicator: "IsWindow"; File: "RemusStealer.exe") Found reference to API (Indicator: "GetCursor"; File: "RemusStealer.exe") Found reference to API (Indicator: "GetKeyboardType"; File: "RemusStealer.exe") Found reference to API (Indicator: "GetSysColor"; File: "RemusStealer.exe") Found reference to API (Indicator: "GetKeyboardLayout"; File: "RemusStealer.exe") Found reference to API (Indicator: "GetActiveWindow"; File: "RemusStealer.exe") Found reference to API (Indicator: "GetModuleHandleW"; File: "RemusStealer.exe") Found reference to API (Indicator: "GetThreadLocale"; File: "RemusStealer.exe") Found reference to API (Indicator: "GetCommandLineW"; File: "RemusStealer.exe") Found reference to API (Indicator: "GetTickCount64"; File: "RemusStealer.exe") Found reference to API (Indicator: "GetUserDefaultLangID"; File: "RemusStealer.exe") Found reference to API (Indicator: "GetCapture"; File: "RemusStealer.exe") Found reference to API (Indicator: "GetShellWindow"; File: "RemusStealer.exe") Found reference to API (Indicator: "GetDesktopWindow"; File: "RemusStealer.exe") Found reference to API (Indicator: "GetProcessWindowStation"; File: "RemusStealer.exe") Found reference to API (Indicator: "QueryPerformanceCounter"; File: "RemusStealer.exe") Found reference to API (Indicator: "InterlockedFlushSList"; File: "RemusStealer.exe") Found reference to API (Indicator: "EnterCriticalSection"; File: "RemusStealer.exe") Found reference to API (Indicator: "InitializeCriticalSectionEx"; File: "RemusStealer.exe") Found reference to API (Indicator: "InterlockedPushEntrySList"; File: "RemusStealer.exe") Found reference to API (Indicator: "FlsFree"; File: "RemusStealer.exe") Found reference to API (Indicator: "LeaveCriticalSection"; File: "RemusStealer.exe") Found reference to API (Indicator: "FlsGetValue"; File: "RemusStealer.exe") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; File: "RemusStealer.exe") Found reference to API (Indicator: "GetCurrentProcessId"; File: "RemusStealer.exe") Found reference to API (Indicator: "RtlUnwind"; File: "RemusStealer.exe") Found reference to API (Indicator: "EncodePointer"; File: "RemusStealer.exe") Found reference to API (Indicator: "GetModuleFileNameW"; File: "RemusStealer.exe") Found reference to API (Indicator: "SetLastError"; File: "RemusStealer.exe") Found reference to API (Indicator: "FlsAlloc"; File: "RemusStealer.exe") Found reference to API (Indicator: "FlsSetValue"; File: "RemusStealer.exe") Found reference to API (Indicator: "RtlPcToFileHeader"; File: "RemusStealer.exe") Found reference to API (Indicator: "DeleteCriticalSection"; File: "RemusStealer.exe") Found reference to API (Indicator: "RaiseException"; File: "RemusStealer.exe") Found reference to API (Indicator: "WaitNamedPipeA"; File: "RemusStealer.exe") Found reference to API (Indicator: "InitializeSListHead"; File: "RemusStealer.exe") Found reference to API (Indicator: "GetCurrentProcess"; File: "RemusStealer.exe") Found reference to API (Indicator: "CreateFileA"; File: "RemusStealer.exe") Found reference to API (Indicator: "RtlCaptureContext"; File: "RemusStealer.exe") Found reference to API (Indicator: "GetModuleHandleA"; File: "RemusStealer.exe") Found reference to API (Indicator: "TerminateProcess"; File: "RemusStealer.exe") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; File: "RemusStealer.exe") Found reference to API (Indicator: "IsDebuggerPresent"; File: "RemusStealer.exe") Found reference to API (Indicator: "UnhandledExceptionFilter"; File: "RemusStealer.exe") Found reference to API (Indicator: "GetStartupInfoW"; File: "RemusStealer.exe") Found reference to API (Indicator: "SetWindowTextA"; File: "RemusStealer.exe") Found reference to API (Indicator: "CoInitialize"; Source: "00000000-00000876.00000000.339071.00000000.00000004.mdmp, 00000000-00000876.00000001.340150.00000000.00000004.mdmp, 00000000-00000876.00000001.340150.40000000.00000040.mdmp") Found reference to API (Indicator: "CoUninitialize"; Source: "00000000-00000876.00000000.339071.00000000.00000004.mdmp, 00000000-00000876.00000001.340150.00000000.00000004.mdmp, 00000000-00000876.00000001.340150.40000000.00000040.mdmp") Found reference to API (Indicator: "MessageBoxW"; Source: "00000000-00000876.00000000.339071.00000000.00000004.mdmp, 00000000-00000876.00000001.340150.00000000.00000004.mdmp") Found reference to API (Indicator: "FreeEnvironmentStringsW"; Source: "00000000-00000876.00000000.339071.00000000.00000004.mdmp, 00000000-00000876.00000001.340150.00000000.00000004.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00000876.00000000.339071.00000000.00000004.mdmp, 00000000-00000876.00000001.340150.00000000.00000004.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00000876.00000000.339071.00000000.00000004.mdmp, 00000000-00000876.00000001.340150.00000000.00000004.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00000876.00000000.339071.00000000.00000004.mdmp, 00000000-00000876.00000001.340150.00000000.00000004.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00000876.00000000.339071.00000000.00000004.mdmp, 00000000-00000876.00000001.340150.00000000.00000004.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00000876.00000000.339071.00000000.00000004.mdmp, 00000000-00000876.00000001.340150.00000000.00000004.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00000876.00000001.340150.40000000.00000040.mdmp") Found reference to API (Indicator: "GetCommandLineW"; Source: "00000000-00000876.00000001.340150.40000000.00000040.mdmp") Found reference to API (Indicator: "GetComputerNameA"; Source: "00000000-00000876.00000001.340150.40000000.00000040.mdmp") Found reference to API (Indicator: "GetComputerNameExA"; Source: "00000000-00000876.00000001.340150.40000000.00000040.mdmp") Found reference to API (Indicator: "GlobalLock"; Source: "00000000-00000876.00000001.340150.40000000.00000040.mdmp") Found reference to API (Indicator: "GlobalUnlock"; Source: "00000000-00000876.00000001.340150.40000000.00000040.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00000876.00000001.340150.40000000.00000040.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00000876.00000001.340150.40000000.00000040.mdmp") Found reference to API (Indicator: "CoInitializeSecurity"; Source: "00000000-00000876.00000001.340150.40000000.00000040.mdmp") Found reference to API (Indicator: "CloseDesktop"; Source: "00000000-00000876.00000001.340150.40000000.00000040.mdmp") Found reference to API (Indicator: "CreateDesktopW"; Source: "00000000-00000876.00000001.340150.40000000.00000040.mdmp") Found reference to API (Indicator: "GetClientRect"; Source: "00000000-00000876.00000001.340150.40000000.00000040.mdmp") Found reference to API (Indicator: "GetDC"; Source: "00000000-00000876.00000001.340150.40000000.00000040.mdmp") Found reference to API (Indicator: "GetKeyboardLayout"; Source: "00000000-00000876.00000001.340150.40000000.00000040.mdmp") Found reference to API (Indicator: "GetSystemMetrics"; Source: "00000000-00000876.00000001.340150.40000000.00000040.mdmp") Found reference to API (Indicator: "GetWindowDC"; Source: "00000000-00000876.00000001.340150.40000000.00000040.mdmp") Found reference to API (Indicator: "GetWindowRect"; Source: "00000000-00000876.00000001.340150.40000000.00000040.mdmp") Found reference to API (Indicator: "OpenDesktopW"; Source: "00000000-00000876.00000001.340150.40000000.00000040.mdmp") Found reference to API (Indicator: "ReleaseDC"; Source: "00000000-00000876.00000001.340150.40000000.00000040.mdmp") Found reference to API (Indicator: "GetUserNameA"; Source: "00000000-00000876.00000001.340150.40000000.00000040.mdmp") Found reference to API (Indicator: "LookupPrivilegeValueW"; Source: "00000000-00000876.00000001.340150.40000000.00000040.mdmp") Found reference to API (Indicator: "BitBlt"; Source: "00000000-00000876.00000001.340150.40000000.00000040.mdmp") Found reference to API (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00000876.00000001.340150.40000000.00000040.mdmp") Found reference to API (Indicator: "CreateCompatibleDC"; Source: "00000000-00000876.00000001.340150.40000000.00000040.mdmp") Found reference to API (Indicator: "DeleteDC"; Source: "00000000-00000876.00000001.340150.40000000.00000040.mdmp") Found reference to API (Indicator: "DeleteObject"; Source: "00000000-00000876.00000001.340150.40000000.00000040.mdmp") Found reference to API (Indicator: "GetCurrentObject"; Source: "00000000-00000876.00000001.340150.40000000.00000040.mdmp") Found reference to API (Indicator: "GetDIBits"; Source: "00000000-00000876.00000001.340150.40000000.00000040.mdmp") Found reference to API (Indicator: "GetObjectW"; Source: "00000000-00000876.00000001.340150.40000000.00000040.mdmp") Found reference to API (Indicator: "SelectObject"; Source: "00000000-00000876.00000001.340150.40000000.00000040.mdmp") Found reference to API (Indicator: "SeDebugPrivilege"; Source: "00000000-00007296.00000000.339360.EF460000.00000004.mdmp") Found reference to API (Indicator: "CryptExportKey"; Source: "00000000-00007296.00000000.339360.F1720000.00000004.mdmp, 00000000-00007296.00000001.339555.F1720000.00000004.mdmp")3b:T8c0,"vcruntime140.dll" contains export function called "_CreateFrameInfo" at ordinal 1 "vcruntime140.dll" contains export function called "_CxxThrowException" at ordinal 2 "vcruntime140.dll" contains export function called "_FindAndUnlinkFrame" at ordinal 3 "vcruntime140.dll" contains export function called "_IsExceptionObjectToBeDestroyed" at ordinal 4 "vcruntime140.dll" contains export function called "_SetWinRTOutOfMemoryExceptionCallback" at ordinal 5 "vcruntime140.dll" contains export function called "__AdjustPointer" at ordinal 6 "vcruntime140.dll" contains export function called "__BuildCatchObject" at ordinal 7 "vcruntime140.dll" contains export function called "__BuildCatchObjectHelper" at ordinal 8 "vcruntime140.dll" contains export function called "__C_specific_handler" at ordinal 9 "vcruntime140.dll" contains export function called "__C_specific_handler_noexcept" at ordinal 10 "vcruntime140.dll" contains export function called "__CxxDetectRethrow" at ordinal 11 "vcruntime140.dll" contains export function called "__CxxExceptionFilter" at ordinal 12 "vcruntime140.dll" contains export function called "__CxxFrameHandler" at ordinal 13 "vcruntime140.dll" contains export function called "__CxxFrameHandler2" at ordinal 14 "vcruntime140.dll" contains export function called "__CxxFrameHandler3" at ordinal 15 "vcruntime140.dll" contains export function called "__CxxQueryExceptionSize" at ordinal 16 "vcruntime140.dll" contains export function called "__CxxRegisterExceptionObject" at ordinal 17 "vcruntime140.dll" contains export function called "__CxxUnregisterExceptionObject" at ordinal 18 "vcruntime140.dll" contains export function called "__DestructExceptionObject" at ordinal 19 "vcruntime140.dll" contains export function called "__FrameUnwindFilter" at ordinal 20 "vcruntime140.dll" contains export function called "__GetPlatformExceptionInfo" at ordinal 21 "vcruntime140.dll" contains export function called "__NLG_Dispatch2" at ordinal 22 "vcruntime140.dll" contains export function called "__NLG_Return2" at ordinal 23 "vcruntime140.dll" contains export function called "__RTCastToVoid" at ordinal 24 "vcruntime140.dll" contains export function called "__RTDynamicCast" at ordinal 253c:T488,"C:\Users\24cvHmM\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RemusStealer.lnk" (Indicator: "c:\users\24cvhmm\appdata\roaming\microsoft\windows\start menu\programs\startup\remusstealer.lnk") in Source: 00000000-00000876.00000000.339071.00000000.00000004.mdmp 00000000-00000876.00000001.340150.00000000.00000004.mdmp ":\Users\24cvHmM\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup" (Indicator: ":\users\24cvhmm\appdata\roaming\microsoft\windows\start menu\programs\startup") in Source: 00000000-00000876.00000000.339071.8F110000.00000004.mdmp 00000000-00000876.00000001.340150.8F110000.00000004.mdmp "\24cvHmM\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RemusStealer.lnk" (Indicator: "\24cvhmm\appdata\roaming\microsoft\windows\start menu\programs\startup\remusstealer.lnk") in Source: 00000000-00000876.00000000.339071.8F110000.00000004.mdmp ":\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup" (Indicator: ":\programdata\microsoft\windows\start menu\programs\startup") in Source: 00000000-00000876.00000000.339071.8F110000.00000004.mdmp 00000000-00000876.00000001.340150.8F110000.00000004.mdmp3d:Ta71,"Software\Microsoft\Windows\CurrentVersion" in Source: RemusStealer.exe "Software\WinRAR SFX" in Source: RemusStealer.exe "e\Software\C" in Source: 00000000-00000876.00000000.339071.8F110000.00000004.mdmp 00000000-00000876.00000001.340150.8F110000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00000876.00000000.339071.8F110000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00000876.00000000.339071.8F110000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00000876.00000000.339071.8F110000.00000004.mdmp 00000000-00000876.00000001.340150.8F110000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00000876.00000000.339071.8F110000.00000004.mdmp 00000000-00000876.00000001.340150.8F110000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00000876.00000000.339071.8F110000.00000004.mdmp 00000000-00000876.00000001.340150.8F110000.00000004.mdmp "\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00000876.00000001.340150.8F194000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00000876.00000001.340150.8F194000.00000004.mdmp "574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{8" in Source: 00000000-00000876.00000001.340150.8F1C4000.00000004.mdmp "Win32Registry|System\CurrentControlSet\Services\Class\" in Source: 00000000-00000876.00000001.340150.8F1C4000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000" in Source: 00000000-00000876.00000001.340150.8F1C4000.00000004.mdmp "ry\Machine\Software\Classes\WOW6432Node\CLSID\{08" in Source: 00000000-00007296.00000000.339360.EF460000.00000004.mdmp 00000000-00007296.00000001.339555.EF460000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00007296.00000000.339360.EF460000.00000004.mdmp 00000000-00007296.00000001.339555.EF460000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00007296.00000000.339360.F1720000.00000004.mdmp 00000000-00007296.00000001.339555.F1720000.00000004.mdmp3e:T94a,Process RemusStealer.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:876:304:WilStaging_02" Process RemusStealer.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:876:304:WilStaging_02" Process RemusStealer.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:876:120:WilError_01" Process RemusStealer.exe created mutex with name "\BaseNamedObjects\SyncRootManager" Process RemusStealer.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:876:120:WilError_01" Process RemusStealer.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesCacheCounterMutex" Process RemusStealer.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesLockedCacheCounterMutex" Process RemusStealer.exe created mutex with name "Local\SM0:876:120:WilError_01" Process RemusStealer.exe created mutex with name "Local\SM0:876:304:WilStaging_02" Process RemusStealer.exe created mutex with name "Local\ZonesCacheCounterMutex" Process RemusStealer.exe created mutex with name "SM0:876:120:WilError_01" Process RemusStealer.exe created mutex with name "Local\ZonesLockedCacheCounterMutex" Process RemusStealer.exe created mutex with name "SM0:876:304:WilStaging_02" Process OneDrive.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:7456:304:WilStaging_02" Process OneDrive.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:7456:304:WilStaging_02" Process OneDrive.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:7456:120:WilError_01" Process OneDrive.exe created mutex with name "\BaseNamedObjects\SyncRootManager" Process OneDrive.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:7456:120:WilError_01" Process OneDrive.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesCacheCounterMutex" Process OneDrive.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesLockedCacheCounterMutex" Process OneDrive.exe created mutex with name "Local\SM0:7456:120:WilError_01" Process OneDrive.exe created mutex with name "Local\ZonesCacheCounterMutex" Process OneDrive.exe created mutex with name "Local\ZonesLockedCacheCounterMutex" Process OneDrive.exe created mutex with name "Local\SM0:7456:304:WilStaging_02" Process OneDrive.exe created mutex with name "SM0:7456:304:WilStaging_02"3f:Tcb5,"OneDrive.exe" failed to load missing module "%WINDIR%\system32\DXGIDebug.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135]40:Tfa1,"e\Software\C" in Source: 00000000-00000876.00000000.339071.8F110000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00000876.00000000.339071.8F110000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00000876.00000000.339071.8F110000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00000876.00000000.339071.8F110000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00000876.00000000.339071.8F110000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00000876.00000000.339071.8F110000.00000004.mdmp "e\Software\C" in Source: 00000000-00000876.00000001.340150.8F110000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00000876.00000001.340150.8F110000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00000876.00000001.340150.8F110000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00000876.00000001.340150.8F110000.00000004.mdmp "\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00000876.00000001.340150.8F194000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00000876.00000001.340150.8F194000.00000004.mdmp "Win32Registry|System\CurrentControlSet\Services\Class\" in Source: 00000000-00000876.00000001.340150.8F1C4000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000" in Source: 00000000-00000876.00000001.340150.8F1C4000.00000004.mdmp "574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{8" in Source: 00000000-00000876.00000001.340150.8F1C4000.00000004.mdmp "ry\Machine\Software\Classes\WOW6432Node\CLSID\{08" in Source: 00000000-00007296.00000000.339360.EF460000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00007296.00000000.339360.EF460000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00007296.00000000.339360.F1720000.00000004.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 00000000-00007296.00000001.339555.AEB2A000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell" in Source: 00000000-00007296.00000001.339555.AEB2A000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 00000000-00007296.00000001.339555.AEB2A000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 00000000-00007296.00000001.339555.AEB2A000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\3" in Source: 00000000-00007296.00000001.339555.AEB2A000.00000002.mdmp "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00007296.00000001.339555.AEB2A000.00000002.mdmp "ry\Machine\Software\Classes\WOW6432Node\CLSID\{08" in Source: 00000000-00007296.00000001.339555.EF460000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00007296.00000001.339555.EF460000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00007296.00000001.339555.F1720000.00000004.mdmp "SYSTEM\CurrentControlSet\Enum\PCI" in Source: 00000000-00007376.00000001.341856.9A020000.00000004.mdmp41:Tf28,"GET /line/?fields=country HTTP/1.1 Host: ip-api.com Cache-Control: no-cache" Response ==> HTTP/1.1 200 OK Date: Sun 18 Oct 2026 03:53:33 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 14 Access-Control-Allow-Origin: * X-Ttl: 60 X-Rl: 44 with response body ==>556E69746564205374617465730A....... "GET / HTTP/1.1 Host: api.ipify.org Cache-Control: no-cache" Response ==> HTTP/1.1 200 OK Date: Sun 18 Oct 2026 03:53:34 GMT Content-Type: text/plain Content-Length: 13 Connection: keep-alive Server: cloudflare Vary: Origin cf-cache-status: DYNAMIC CF-RAY: a4c498c56ca1cf0e-SJC with response body ==>36342E3132342E31322E313632....... "GET /line/?fields=country HTTP/1.1 Host: ip-api.com Cache-Control: no-cache" Response ==> HTTP/1.1 200 OK Date: Sun 18 Oct 2026 03:54:03 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 14 Access-Control-Allow-Origin: * X-Ttl: 29 X-Rl: 43 with response body ==>556E69746564205374617465730A....... "GET / HTTP/1.1 Host: api.ipify.org Cache-Control: no-cache" Response ==> HTTP/1.1 200 OK Date: Sun 18 Oct 2026 03:54:04 GMT Content-Type: text/plain Content-Length: 13 Connection: keep-alive Server: cloudflare Vary: Origin cf-cache-status: DYNAMIC CF-RAY: a4c499836a3fcf0e-SJC with response body ==>36342E3132342E31322E313632....... "GET /line/?fields=country HTTP/1.1 Host: ip-api.com Cache-Control: no-cache" Response ==> HTTP/1.1 200 OK Date: Sun 18 Oct 2026 03:54:34 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 14 Access-Control-Allow-Origin: * X-Ttl: 60 X-Rl: 44 with response body ==>556E69746564205374617465730A....... "GET / HTTP/1.1 Host: api.ipify.org Cache-Control: no-cache" Response ==> HTTP/1.1 200 OK Date: Sun 18 Oct 2026 03:54:35 GMT Content-Type: text/plain Content-Length: 13 Connection: keep-alive Server: cloudflare Vary: Origin cf-cache-status: DYNAMIC CF-RAY: a4c49a40fcc122c6-SJC with response body ==>36342E3132342E31322E313632....... "GET /line/?fields=country HTTP/1.1 Host: ip-api.com Cache-Control: no-cache" Response ==> HTTP/1.1 200 OK Date: Sun 18 Oct 2026 03:55:04 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 14 Access-Control-Allow-Origin: * X-Ttl: 29 X-Rl: 43 with response body ==>556E69746564205374617465730A....... "GET / HTTP/1.1 Host: api.ipify.org Cache-Control: no-cache" Response ==> HTTP/1.1 200 OK Date: Sun 18 Oct 2026 03:55:05 GMT Content-Type: text/plain Content-Length: 13 Connection: keep-alive Server: cloudflare Vary: Origin cf-cache-status: DYNAMIC CF-RAY: a4c49afd2e18f953-SJC with response body ==>36342E3132342E31322E313632....... "GET /line/?fields=country HTTP/1.1 Host: ip-api.com Cache-Control: no-cache" Response ==> HTTP/1.1 200 OK Date: Sun 18 Oct 2026 03:55:34 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 14 Access-Control-Allow-Origin: * X-Ttl: 60 X-Rl: 44 with response body ==>556E69746564205374617465730A....... "GET / HTTP/1.1 Host: api.ipify.org Cache-Control: no-cache" Response ==> HTTP/1.1 200 OK Date: Sun 18 Oct 2026 03:55:35 GMT Content-Type: text/plain Content-Length: 13 Connection: keep-alive Server: cloudflare Vary: Origin cf-cache-status: DYNAMIC CF-RAY: a4c49bb8bb7feb35-SJC with response body ==>36342E3132342E31322E313632....... "GET /line/?fields=country HTTP/1.1 Host: ip-api.com Cache-Control: no-cache" Response ==> HTTP/1.1 200 OK Date: Sun 18 Oct 2026 03:56:04 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 14 Access-Control-Allow-Origin: * X-Ttl: 60 X-Rl: 44 with response body ==>556E69746564205374617465730A....... "GET / HTTP/1.1 Host: api.ipify.org Cache-Control: no-cache" Response ==> HTTP/1.1 200 OK Date: Sun 18 Oct 2026 03:56:05 GMT Content-Type: text/plain Content-Length: 13 Connection: keep-alive Server: cloudflare Vary: Origin cf-cache-status: DYNAMIC CF-RAY: a4c49c74df82cf0e-SJC with response body ==>36342E3132342E31322E313632.......42:T3572,"RemusStealer.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ff989f00000 "RemusStealer.exe" loaded module "BCRYPTPRIMITIVES.DLL" at base 7ff9ade20000 "RemusStealer.exe" loaded module "NTDLL.DLL" at base 7ff9b09d0000 "RemusStealer.exe" loaded module "WINMM.DLL" at base 7ff9a4f00000 "RemusStealer.exe" loaded module "POWRPROF.DLL" at base 7ff9acd40000 "RemusStealer.exe" loaded module "KERNEL32.DLL" at base 7ff9b0560000 "RemusStealer.exe" loaded module "WS2_32.DLL" at base 7ff9ae040000 "RemusStealer.exe" loaded module "SHELL32.DLL" at base 1bad6520000 "RemusStealer.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7ff9ab360000 "RemusStealer.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 7ff9a9420000 "RemusStealer.exe" loaded module "RPCRT4.DLL" at base 7ff9ae490000 "RemusStealer.exe" loaded module "USER32.DLL" at base 7ff9ae300000 "RemusStealer.exe" loaded module "%WINDIR%\SYSTEM32\\WINDOWS.STATEREPOSITORYPS.DLL" at base 7ff99ee90000 "RemusStealer.exe" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 1bad6520000 "RemusStealer.exe" loaded module "%WINDIR%\SYSTEM32\URLMON.DLL" at base 7ff9a2200000 "RemusStealer.exe" loaded module "MSISO.DLL" at base 7ff99efd0000 "RemusStealer.exe" loaded module "SSPICLI.DLL" at base 7ff9acc20000 "RemusStealer.exe" loaded module "API-MS-WIN-CORE-URL-L1-1-0.DLL" at base 7ff9ad070000 "RemusStealer.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 7ff9ad500000 "RemusStealer.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 7ff9ab120000 "RemusStealer.exe" loaded module "OLE32.DLL" at base 7ff9b0780000 "RemusStealer.exe" loaded module "CSCAPI.DLL" at base 7ff99f230000 "RemusStealer.exe" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 7ff9b0610000 "RemusStealer.exe" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 7ff9b0780000 "RemusStealer.exe" loaded module "ADVAPI32.DLL" at base 1ba90c80000 "RemusStealer.exe" loaded module "GDI32.DLL" at base 7ff9b0010000 "RemusStealer.exe" loaded module "OLEAUT32.DLL" at base 7ff9b08d0000 "RemusStealer.exe" loaded module "WINHTTP.DLL" at base 7ff9a9600000 "OneDrive.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ff989f00000 "OneDrive.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ff9ad070000 "OneDrive.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ff9ad070000 "OneDrive.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-2" at base 7ff9ad070000 "OneDrive.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ff9ad070000 "OneDrive.exe" loaded module "KERNEL32" at base 7ff9b0560000 "OneDrive.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 7ff9a4f50000 "OneDrive.exe" loaded module "KERNEL32.DLL" at base 7ff9b0560000 "OneDrive.exe" loaded module "%WINDIR%\SYSTEM32\SFC_OS.DLL" at base 7ff999050000 "OneDrive.exe" loaded module "%WINDIR%\SYSTEM32\SSPICLI.DLL" at base 7ff9acc20000 "OneDrive.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 7ff9ac1c0000 "OneDrive.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7ff9ab360000 "OneDrive.exe" loaded module "%WINDIR%\SYSTEM32\DWMAPI.DLL" at base 7ff9ab5d0000 "OneDrive.exe" loaded module "%WINDIR%\SYSTEM32\CRYPTBASE.DLL" at base 7ff9ac790000 "OneDrive.exe" loaded module "USER32.DLL" at base 7ff9ae300000 "OneDrive.exe" loaded module "%WINDIR%\SYSTEM32\RICHED20.DLL" at base 7ff989d10000 "OneDrive.exe" loaded module "OLE32.DLL" at base 7ff9b0780000 "OneDrive.exe" loaded module "COMCTL32.DLL" at base 7ff99b190000 "OneDrive.exe" loaded module "%WINDIR%\WINSXS\AMD64_MICROSOFT.WINDOWS.GDIPLUS_6595B64144CCF1DF_1.1.16299.248_NONE_46B9C4E9EDF1CFA5\GDIPLUS.DLL" at base 7ff98a110000 "OneDrive.exe" loaded module "SHELL32.DLL" at base 22261310000 "OneDrive.exe" loaded module "WINDOWSCODECS.DLL" at base 7ff9a9230000 "OneDrive.exe" loaded module "GDI32.DLL" at base 7ff9b0010000 "OneDrive.exe" loaded module "COMCTL32" at base 7ff99b190000 "OneDrive.exe" loaded module "SHLWAPI.DLL" at base 7ff9ae5c0000 "OneDrive.exe" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 22261310000 "OneDrive.exe" loaded module "%COMMONPROGRAMFILES%\MICROSOFT SHARED\INK\TIPTSF.DLL" at base 7ff987b80000 "OneDrive.exe" loaded module "RPCRT4.DLL" at base 7ff9ae490000 "OneDrive.exe" loaded module "OLEAUT32.DLL" at base 7ff9b08d0000 "OneDrive.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-WINDOW-EXT-L1-1-0.DLL" at base 7ff9ae300000 "OneDrive.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-INTEGRATION-L1-1-0.DLL" at base 7ff9ae300000 "OneDrive.exe" loaded module "API-MS-WIN-CORE-COM-L1-1-0.DLL" at base 7ff9afc50000 "OneDrive.exe" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 7ff9b0610000 "OneDrive.exe" loaded module "%WINDIR%\SYSTEM32\ONECOREUAPCOMMONPROXYSTUB.DLL" at base 7ff9a7d60000 "OneDrive.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 7ff9ad500000 "OneDrive.exe" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 7ff9b0780000 "OneDrive.exe" loaded module "NTDLL.DLL" at base 7ff9b09d0000 "OneDrive.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 7ff9a9420000 "OneDrive.exe" loaded module "%WINDIR%\SYSTEM32\\WINDOWS.STATEREPOSITORYPS.DLL" at base 7ff99ee90000 "OneDrive.exe" loaded module "%WINDIR%\SYSTEM32\URLMON.DLL" at base 7ff9a2200000 "OneDrive.exe" loaded module "MSISO.DLL" at base 7ff99efd0000 "OneDrive.exe" loaded module "SSPICLI.DLL" at base 7ff9acc20000 "OneDrive.exe" loaded module "API-MS-WIN-CORE-URL-L1-1-0.DLL" at base 7ff9ad070000 "OneDrive.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 7ff9ab120000 "sslconf.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ff989f00000 "sslconf.exe" loaded module "WINHTTP.DLL" at base 7ff9a9600000 "sslconf.exe" loaded module "%WINDIR%\SYSTEM32\ONDEMANDCONNROUTEHELPER.DLL" at base 7ff98eb90000 "sslconf.exe" loaded module "RPCRT4.DLL" at base 7ff9ae490000 "sslconf.exe" loaded module "BCRYPT.DLL" at base 7ff9ac880000 "sslconf.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 7ff9ade20000 "sslconf.exe" loaded module "SHELL32.DLL" at base 25d971d0000 "sslconf.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 7ff9ac5b0000 "sslconf.exe" loaded module "SSPICLI.DLL" at base 7ff9acc20000 "sslconf.exe" loaded module "KERNEL32.DLL" at base 7ff9b0560000 "sslconf.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 7ff9a5770000 "sslconf.exe" loaded module "SETUPAPI.DLL" at base 25d98950000 "sslconf.exe" loaded module "PSAPI.DLL" at base 7ff9adea0000 "sslconf.exe" loaded module "NTDLL.DLL" at base 7ff9b09d0000 "sslconf.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 7ff9ab120000 "powershell.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ff989f00000 "powershell.exe" loaded module "KERNEL32.DLL" at base 7ff9b0560000 "powershell.exe" loaded module "ADVAPI32.DLL" at base 7ff9ae250000 "powershell.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ff9ad070000 "powershell.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ff9ad070000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ff9ad070000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSCOREEI.DLL" at base 7ff980310000 "powershell.exe" loaded module "SHLWAPI.DLL" at base 7ff9ae5c0000 "powershell.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 7ff9acdb0000 "powershell.exe" loaded module "VERSION.DLL" at base 7ff9a4f50000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLR.DLL" at base 7ff9935f0000 "powershell.exe" loaded module "USER32.DLL" at base 7ff9ae300000 "powershell.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 7ff9ad070000 "powershell.exe" loaded module "MSCOREE.DLL" at base 7ff98ed60000 "powershell.exe" loaded module "NTDLL" at base 7ff9b09d0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 7ff9afc50000 "powershell.exe" loaded module "PSAPI.DLL" at base 7ff9adea0000 "powershell.exe" loaded module "RPCRT4.DLL" at base 7ff9ae490000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MSCORLIB\FE2524177EB3088C77BE666722039F52\MSCORLIB.NI.DLL" at base 7ff97ed10000 "powershell.exe" loaded module "OLE32.DLL" at base 7ff9b0780000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 7ff9afc50000 "powershell.exe" loaded module "OLEAUT32.DLL" at base 7ff9b08d0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM\E43DD9C73AB5615E461BF5109C3FACD6\SYSTEM.NI.DLL" at base 7ff97e0a0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CORE\0D59B0E237D7519417DE10CD84BDA4E7\SYSTEM.CORE.NI.DLL" at base 7ff97d620000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.PB378EC07#\B5BA37E1558CED178A99011A1D659B52\MICROSOFT.POWERSHELL.CONSOLEHOST.NI.DLL" at base 7ff991730000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 7ff9ac1c0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 7ff9ade20000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.MANAA57FC8CC#\6DA01910C256231D1C50AD0AACEE5941\SYSTEM.MANAGEMENT.AUTOMATION.NI.DLL" at base 7ff97b5b0000 "powershell.exe" loaded module "COMBASE.DLL" at base 7ff9afc50000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 7ff9afc50000 "powershell.exe" loaded module "NTDLL.DLL" at base 7ff9b09d0000 "powershell.exe" loaded module "SHELL32.DLL" at base 258f18f0000 "powershell.exe" loaded module "WINTRUST.DLL" at base 7ff9ad2e0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WINTRUST.DLL" at base 7ff9ad2e0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 7ff9adc50000 "powershell.exe" loaded module "CRYPT32.DLL" at base 7ff9adc50000 "powershell.exe" loaded module "AMSI.DLL" at base 7ff99d6a0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 7ff9a4f50000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\MPOAV.DLL" at base 7ff997e90000 "powershell.exe" loaded module "KERNEL32" at base 7ff9b0560000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\D1TDHSUH.DLL" at base 7ff9944c0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.MF49F6405#\7B1F35FB0C2D6955CE5AF2BD372C65F2\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NI.DLL" at base 7ff991a00000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.MANAGEMENT\B221AF81285C1305324612E6DC9C88FF\SYSTEM.MANAGEMENT.NI.DLL" at base 7ff97b440000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DIRED13B18A9#\8AD4C0AF5B3D51A0F3A4DAC0D44D85D4\SYSTEM.DIRECTORYSERVICES.NI.DLL" at base 7ff97b2d0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.XML\5EE35DEBFC22F727E70E4479DDCBC045\SYSTEM.XML.NI.DLL" at base 7ff97aa20000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.NUMERICS\86CFD69CE1261BAF4740E7606CADE014\SYSTEM.NUMERICS.NI.DLL" at base 7ff9919a0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DATA\7BED49C46DE9295A8453DB205C60A028\SYSTEM.DATA.NI.DLL" at base 7ff97a0b0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\SYSTEM.DATA\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.DATA.DLL" at base 7ff979d40000 "powershell.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 7ff9ad070000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLRJIT.DLL" at base 7ff979bf0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.P6F792626#\7FF5199E757CB8AF9AD949453F698D09\MICROSOFT.POWERSHELL.SECURITY.NI.DLL" at base 7ff98e340000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFIGURATION\4BEB1EECA20B27D4BD1BB9880F03CC2A\SYSTEM.CONFIGURATION.NI.DLL" at base 7ff979ab0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.TRANSACTIONS\604272B0FAEC2E09D53D38E03BC89C6C\SYSTEM.TRANSACTIONS.NI.DLL" at base 7ff9799d0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\SYSTEM.TRANSACTIONS\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.TRANSACTIONS.DLL" at base 7ff993290000 "powershell.exe" loaded module "SECUR32.DLL" at base 7ff9a3f90000 "powershell.exe" loaded module "SSPICLI.DLL" at base 7ff9acc20000 "powershell.exe" loaded module "WLDP.DLL" at base 7ff9abe10000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7ff9ab360000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\MPCLIENT.DLL" at base 7ff9798f0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\KERNEL32.DLL" at base 7ff9b0560000 "powershell.exe" loaded module "USERENV.DLL" at base 7ff9acc50000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 7ff9ae250000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-ROPARAMETERIZEDIID-L1-1-0.DLL" at base 7ff9afc50000 "powershell.exe" loaded module "BCRYPT.DLL" at base 7ff9ac880000 "sslconf.exe" loaded module "SHELL32.DLL" at base 20d9beb0000 "OneDrive.exe" loaded module "AMSI.DLL" at base 7ff99d7a0000 "OneDrive.exe" loaded module "ONDEMANDCONNROUTEHELPER.DLL" at base 7ff98eb90000 "OneDrive.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 7ff9a5cd000043:T14bb,"RemusStealer.exe" touched "Computer" (Path: "HKCU\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "RemusStealer.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\TREATAS") "RemusStealer.exe" touched "Sync root manager" (Path: "HKCU\CLSID\{F324E4F9-8496-40B2-A1FF-9617C1C9AFFE}\INSTANCE") "RemusStealer.exe" touched "Property System Both Class Factory" (Path: "HKCU\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\TREATAS") "RemusStealer.exe" touched "Security Manager" (Path: "HKCU\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\TREATAS") "RemusStealer.exe" touched "ShellItemArray Shell Namespace helper" (Path: "HKCU\CLSID\{CDC82860-468D-4D4E-B7E7-C298FF23AB2C}\TREATAS") "RemusStealer.exe" touched "ShellItem Shell Namespace helper" (Path: "HKCU\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}\TREATAS") "RemusStealer.exe" touched "Shortcut" (Path: "HKCU\CLSID\{00021401-0000-0000-C000-000000000046}\TREATAS") "RemusStealer.exe" touched "WBEM Locator" (Path: "HKCU\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\INPROCSERVER32") "RemusStealer.exe" touched "Windows Management and Instrumentation" (Path: "HKCU\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\INPROCHANDLER32") "RemusStealer.exe" touched "PSFactoryBuffer" (Path: "HKCU\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\INPROCHANDLER32") "OneDrive.exe" touched "Microsoft Multiple AutoComplete List Container" (Path: "HKCU\CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062}") "OneDrive.exe" touched "Microsoft Shell Folder AutoComplete List" (Path: "HKCU\CLSID\{03C036F1-A186-11D0-824A-00AA005B4383}\TREATAS") "OneDrive.exe" touched "Microsoft AutoComplete" (Path: "HKCU\CLSID\{00BB2763-6A77-11D0-A535-00C04FD7D062}\TREATAS") "OneDrive.exe" touched "Microsoft TipAutoCompleteClient Control" (Path: "HKCU\CLSID\{807C1E6C-1D00-453F-B920-B61BB7CDD997}\TREATAS") "OneDrive.exe" touched "Network" (Path: "HKCU\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\SHELLFOLDER") "OneDrive.exe" touched "Recycle Bin" (Path: "HKCU\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\SHELLFOLDER") "OneDrive.exe" touched "Control Panel" (Path: "HKCU\CLSID\{26EE0668-A00A-44D7-9371-BEB064C98683}\SHELLFOLDER") "OneDrive.exe" touched "UsersFiles" (Path: "HKCU\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\SHELLFOLDER") "OneDrive.exe" touched "UsersLibraries" (Path: "HKCU\CLSID\{031E4825-7B94-4DC3-B131-E946B44C8DD5}\SHELLFOLDER") "OneDrive.exe" touched "CLSID_SearchFolder" (Path: "HKCU\CLSID\{04731B67-D933-450A-90E6-4ACD2E9408FE}\SHELLFOLDER") "OneDrive.exe" touched "Microsoft OneNote Namespace Extension for Windows Desktop Search" (Path: "HKCU\CLSID\{0875DCB6-C686-4243-9432-ADCCF0B9F2D7}\SHELLFOLDER") "OneDrive.exe" touched "IE History and Feeds Shell Data Source for Windows Search" (Path: "HKCU\CLSID\{11016101-E366-4D22-BC06-4ADA335C892B}\SHELLFOLDER") "OneDrive.exe" touched "@C:\Program Files (x86)\Microsoft Office\Office15\MAPISHELL.DLL,-110" (Path: "HKCU\CLSID\{138508BC-1E03-49EA-9C8F-EA9E1D05D65D}\SHELLFOLDER") "OneDrive.exe" touched "Public Folder" (Path: "HKCU\CLSID\{4336A54D-038B-4685-AB02-99BB52D3FB8B}\SHELLFOLDER") "OneDrive.exe" touched "Control Panel command object for Start menu and desktop" (Path: "HKCU\CLSID\{5399E694-6CE5-4D6C-8FCE-1D8870FDCBA0}\SHELLFOLDER") "OneDrive.exe" touched "This Device" (Path: "HKCU\CLSID\{5B934B42-522B-4C34-BBFE-37A3EF7B9C90}\SHELLFOLDER") "OneDrive.exe" touched "CLSID_AppInstanceFolder" (Path: "HKCU\CLSID\{64693913-1C21-4F30-A98F-4E52906D3B56}\SHELLFOLDER") "OneDrive.exe" touched "@%systemroot%\system32\mssvp.dll,-110" (Path: "HKCU\CLSID\{89D83576-6BD1-4C86-9454-BEB04E94C819}\SHELLFOLDER") "OneDrive.exe" touched "DXP" (Path: "HKCU\CLSID\{8FD8B88D-30E1-4F25-AC2B-553D3D65F0EA}\SHELLFOLDER") "OneDrive.exe" touched "CLSID_SearchHome" (Path: "HKCU\CLSID\{9343812E-1C37-4A49-A12E-4B2D810D956B}\SHELLFOLDER") "OneDrive.exe" touched "CLSID_StartMenuLauncherProviderFolder" (Path: "HKCU\CLSID\{98F275B4-4FFF-11E0-89E2-7B86DFD72085}\SHELLFOLDER") "OneDrive.exe" touched "CLSID_StartMenuCommandingProviderFolder" (Path: "HKCU\CLSID\{A00EE528-EBD9-48B8-944A-8942113D46AC}\SHELLFOLDER") "OneDrive.exe" touched "Other Users Folder" (Path: "HKCU\CLSID\{B4FB3F98-C1EA-428D-A78A-D1F5659CBA93}\SHELLFOLDER") "OneDrive.exe" touched "@%systemroot%\system32\mssvp.dll,-112" (Path: "HKCU\CLSID\{BD7A2E7B-21CB-41B2-A086-B309680C6B7E}\SHELLFOLDER") "OneDrive.exe" touched "CLSID_StartMenuProviderFolder" (Path: "HKCU\CLSID\{DAF95313-E44D-46AF-BE1B-CBACEA2C3065}\SHELLFOLDER") "OneDrive.exe" touched "CLSID_StartMenuPathCompleteProviderFolder" (Path: "HKCU\CLSID\{E345F35F-9397-435C-8F95-4E922C26259E}\SHELLFOLDER") "OneDrive.exe" touched "Games Explorer" (Path: "HKCU\CLSID\{ED228FDF-9EA8-4870-83B1-96B02CFE0D52}\SHELLFOLDER") "OneDrive.exe" touched "StreamBackedFolder" (Path: "HKCU\CLSID\{EDC978D6-4D53-4B2F-A265-5805674BE568}\SHELLFOLDER") "OneDrive.exe" touched "Computers and Devices" (Path: "HKCU\CLSID\{F02C1A0D-BE21-4350-88B0-7367FC96EF3C}\SHELLFOLDER") "OneDrive.exe" touched "Removable Drives" (Path: "HKCU\CLSID\{F5FB2C77-0E2F-4A16-A381-3E560C68BC83}\SHELLFOLDER") "powershell.exe" touched "Windows Defender IOfficeAntiVirus implementation" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{2781761E-28E0-4109-99FE-B9D127C57AFE}\INPROCSERVER32")44:Ta12,"RemusStealer.exe" file has an entrypoint instructions - "jmp 0x470720,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,push rbp,mov rbp, rsp,pushfq ,cld ,sub rsp, 0xe0,mov qword ptr [rsp], rdi,mov qword ptr [rsp + 8], rsi,mov qword ptr [rsp + 0x10], rbp,mov qword ptr [rsp + 0x18], rbx,mov qword ptr [rsp + 0x20], r12,mov qword ptr [rsp + 0x28], r13,mov qword ptr [rsp + 0x30], r14,mov qword ptr [rsp + 0x38], r15,movups xmmword ptr [rsp + 0x40], xmm6,movups xmmword ptr [rsp + 0x50], xmm7,movups xmmword ptr [rsp + 0x60], xmm8," "OneDrive.exe" file has an entrypoint instructions - "push r15,push r14,push r13,push r12,push rsi,push rdi,push rbp,push rbx,sub rsp, 0x178,movabs rsi, 0xe28ec494ee01ce50,movabs r10, 0xc51d8929dc039ca0,mov rax, qword ptr [rip + 0x42729],mov qword ptr [rsp + 0x120], rax,mov r8, qword ptr [rip + 0x42a12],sub r8, qword ptr [rip + 0x42a0b],movabs rax, 0x1d713b6b11fe31af,mov rcx, r8,not rcx,add rax, -0x612a929,mov r9, r8,xor r9, rax,lea rdx, [rcx + rcx]," "signed_j0TYyO.exe" file has an entrypoint instructions - "push r15,push r14,push r13,push r12,push rsi,push rdi,push rbp,push rbx,sub rsp, 0x168,movabs r12, 0x3ffffffffffffffe,mov rax, qword ptr [rip + 0x2795b],mov qword ptr [rsp + 0x110], rax,mov rax, qword ptr [rip + 0x27a8c],mov rcx, qword ptr [rip + 0x27a85],mov r8, rax,not r8,lea rdx, [r8 + r8*2],mov r11, r8,xor r11, rcx,lea r8, [r11 + r11*2],lea r9, [rcx*4],mov rsi, r8,and rsi, r9,shl rsi, 3,mov rdi, r9," "vcruntime140.dll" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x20,mov rdi, r8,mov ebx, edx,mov rsi, rcx,cmp edx, 1,jne 0x180010481,call 0x180011afc,mov r8, rdi,mov edx, ebx,mov rcx, rsi,mov rbx, qword ptr [rsp + 0x30],mov rsi, qword ptr [rsp + 0x38],add rsp, 0x20,pop rdi,jmp 0x1800103f0,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,nop word ptr [rax + rax],int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,nop word ptr [rax + rax],int3 ,int3 ,int3 ,int3 ," "sslconf.exe" file has an entrypoint instructions - "sub rsp, 0x28,call 0x140002578,add rsp, 0x28,jmp 0x14000192c,int3 ,int3 ,push rbx,sub rsp, 0x20,mov rbx, rcx,xor ecx, ecx,call qword ptr [rip + 0x14f3],mov rcx, rbx,call qword ptr [rip + 0x14f2],call qword ptr [rip + 0x14dc],mov rcx, rax,mov edx, 0xc0000409,add rsp, 0x20,pop rbx,jmp qword ptr [rip + 0x1480],mov qword ptr [rsp + 8], rcx,sub rsp, 0x38,mov ecx, 0x17,call 0x140002c54,test eax, eax,je 0x140001b9e,mov ecx, 2,"45:T446,"RemusStealer.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "RemusStealer.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "RemusStealer.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "OneDrive.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "OneDrive.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "OneDrive.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN") "powershell.exe" (Path: "HKCU\CONTROL PANEL\INTERNATIONAL"; Key: "SYEARMONTH") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409")46:Te36,Observed system executable string:"%WINDIR%\system32\version.dll" [Source: 00000000-00007456-00000C2B-3534117688] Observed system executable string:"%WINDIR%\system32\DXGIDebug.dll" [Source: 00000000-00007456-00000C2B-3534141247] Observed system executable string:"%WINDIR%\system32\sfc_os.dll" [Source: 00000000-00007456-00000C2B-3534161232] Observed system executable string:"%WINDIR%\system32\SSPICLI.DLL" [Source: 00000000-00007456-00000C2B-3534188936] Observed system executable string:"%WINDIR%\system32\rsaenh.dll" [Source: 00000000-00007456-00000C2B-3534216135] Observed system executable string:"%WINDIR%\system32\UXTheme.dll" [Source: 00000000-00007456-00000C2B-3534314634] Observed system executable string:"%WINDIR%\system32\dwmapi.dll" [Source: 00000000-00007456-00000C2B-3534335368] Observed system executable string:"%WINDIR%\system32\cryptbase.dll" [Source: 00000000-00007456-00000C2B-3534355747] Observed system executable string:"%WINDIR%\system32\riched20.dll" [Source: 00000000-00007456-00000C2B-3534588150] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" [Source: 00000000-00007296-00000C2E-817384450] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll" [Source: 00000000-00007296-00000C2B-3537684515] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" [Source: 00000000-00007296-00000C2B-3537781762] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00007296-00000C2B-3537899157] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll" [Source: 00000000-00007296-00000C2B-3538275827] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" [Source: 00000000-00007296-00000C2B-3538315834] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" [Source: 00000000-00007296-00000C2B-3538366495] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" [Source: 00000000-00007296-00000C2B-3538466039] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll" [Source: 00000000-00007296-00000C2B-3538590322] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll" [Source: 00000000-00007296-00000C2B-3538660160] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll" [Source: 00000000-00007296-00000C2B-3538771111] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" [Source: 00000000-00007296-00000C2B-3538973346] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" [Source: 00000000-00007296-00000C2B-3539181895] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" [Source: 00000000-00007296-00000C2B-3539382635] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" [Source: 00000000-00007296-00000C2B-3539448125] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" [Source: 00000000-00007296-00000C2B-3539477052]47:T429,"RemusStealer.exe" writes to a file "C:\Users\%OSUSER%\AppData\Local\Temp\OneDrive.exe" "OneDrive.exe" writes to a file "C:\Users\%OSUSER%\AppData\Local\Temp\RarSFX0\OneDrive.exe" "OneDrive.exe" writes to a file "C:\Users\%OSUSER%\AppData\Local\Temp\RarSFX0\signed_j0TYyO.exe" "OneDrive.exe" writes to a file "C:\Users\%OSUSER%\AppData\Local\Temp\RarSFX0\sslconf.exe" "OneDrive.exe" writes to a file "C:\Users\%OSUSER%\AppData\Local\Temp\RarSFX0\tempdir.dll" "OneDrive.exe" writes to a file "C:\Users\%OSUSER%\AppData\Local\Temp\RarSFX0\vcruntime140.dll" "OneDrive.exe" writes to a file "C:\Users\%OSUSER%\AppData\Local\Temp\RarSFX0\onedrive.ico" "OneDrive.exe" writes to a file "C:\Users\%OSUSER%\AppData\Local\Temp\RarSFX0\OneDriveMedTile.scale-100.png" "OneDrive.exe" writes to a file "C:\Users\%OSUSER%\AppData\Local\Temp\RarSFX0\OneDriveSmallTile.scale-100.png" "OneDrive.exe" writes to a file "C:\Users\%OSUSER%\AppData\Local\Temp\RarSFX0\PhotosStoreLogo.png" "sslconf.exe" writes to a file "C:\Users\%OSUSER%\AppData\Local\Temp\RarSFX0\tempdir.dll"48:T10a1,"RemusStealer.exe" has type "PE32+ executable for MS Windows 6.01 (GUI) x86-64 9 sections"- Location: [%LOCALAPPDATA%\RemusStealer\RemusStealer.exe]- [targetUID: 00000000-00000876] "tempdir.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 (stripped to external PDB) 3 sections"- Location: [%TEMP%\RarSFX0\tempdir.dll]- [targetUID: 00000000-00002448] "OneDrive.exe" has type "PE32+ executable for MS Windows 6.00 (GUI) x86-64 8 sections"- Location: [%TEMP%\OneDrive.exe]- [targetUID: 00000000-00000876] "OneDrive.exe" has type "PE32+ executable for MS Windows 6.00 (GUI) x86-64 6 sections"- Location: [%TEMP%\RarSFX0\OneDrive.exe]- [targetUID: 00000000-00000876] "signed_j0TYyO.exe" has type "PE32+ executable for MS Windows 6.00 (GUI) x86-64 6 sections"- Location: [%TEMP%\RarSFX0\signed_j0TYyO.exe]- [targetUID: 00000000-00007456] "vcruntime140.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 8 sections"- Location: [%ALLUSERSPROFILE%\TomatoIndigo\vcruntime140.dll]- [targetUID: 00000000-00002448] "sslconf.exe" has type "PE32+ executable for MS Windows 6.00 (console) x86-64 6 sections"- Location: [%ALLUSERSPROFILE%\TomatoIndigo\sslconf.exe]- [targetUID: 00000000-00002448] "RemusStealer.lnk" has type "MS Windows shortcut Item id list present Points to a file or directory Has Relative path Has Working directory Unicoded MachineID l0wofth5slhy6mc KnownFolderID 0762D272-C50A-4BB0-A382-697DCD729B80 Archive ctime=Sun Oct 18 03:53:09 2026 atime=Sun Oct 18 03:53:09 2026 mtime=Sun Oct 18 03:53:09 2026 length=20099512 window=normal IDListSize 0x0273 Root folder "20D04FE0-3AEA-1069-A2D8-08002B30309D" Volume "C:\" LocalBasePath "C:\Users\24cvHmM\AppData\Local\RemusStealer\RemusStealer.exe""- Location: [%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\RemusStealer.lnk]- [targetUID: 00000000-00000876] "onedrive.ico" has type "MS Windows icon resource - 1 icon 128x128 32 bits/pixel"- Location: [%TEMP%\RarSFX0\onedrive.ico]- [targetUID: 00000000-00007456] "PhotosStoreLogo.png" has type "PNG image data 256 x 256 8-bit/color RGBA non-interlaced"- Location: [%TEMP%\RarSFX0\PhotosStoreLogo.png]- [targetUID: 00000000-00007456] "OneDriveMedTile.scale-100.png" has type "PNG image data 150 x 150 8-bit/color RGBA non-interlaced"- Location: [%TEMP%\RarSFX0\OneDriveMedTile.scale-100.png]- [targetUID: 00000000-00007456] "OneDriveSmallTile.scale-100.png" has type "PNG image data 70 x 70 8-bit/color RGBA non-interlaced"- Location: [%TEMP%\RarSFX0\OneDriveSmallTile.scale-100.png]- [targetUID: 00000000-00007456] "MsEdgeUpdate.xml" has type "XML 1.0 document Unicode text UTF-16 little-endian text with CRLF line terminators"- Location: [%TEMP%\MsEdgeUpdate.xml]- [targetUID: 00000000-00002620] "StartupProfileData-NonInteractive" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive]- [targetUID: 00000000-00007296] "line_1_.txt" has type "Unknown"- [targetUID: N/A] "CCT1SUID.txt" has type "ASCII text with no line terminators"- [targetUID: N/A] "tempdir.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 (stripped to external PDB) 3 sections"- Location: [%ALLUSERSPROFILE%\TomatoIndigo\tempdir.dll]- [targetUID: 00000000-00002448] "svchost.exe" has type "PE32+ executable for MS Windows 6.00 (GUI) x86-64 6 sections"- Location: [%LOCALAPPDATA%\Microsoft\svchost.exe]- [targetUID: 00000000-00002620] "vcruntime140.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 8 sections"- Location: [%TEMP%\RarSFX0\vcruntime140.dll]- [targetUID: 00000000-00002448] "sslconf.exe" has type "PE32+ executable for MS Windows 6.00 (console) x86-64 6 sections"- Location: [%TEMP%\RarSFX0\sslconf.exe]- [targetUID: 00000000-00002448] "M6PV7QVM.txt" has type "ASCII text with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Windows\INetCache\IE\LSCBY323\M6PV7QVM.txt]- [targetUID: 00000000-00002620] "88DXV2Y8.txt" has type "ASCII text with no line terminators"- [targetUID: N/A] "3PPYWVT8.txt" has type "ASCII text with no line terminators"- [targetUID: N/A] "YQHXZQG3.txt" has type "ASCII text with no line terminators"- [targetUID: N/A] "2JQWPLDB.txt" has type "ASCII text with no line terminators"- [targetUID: N/A]49:T750,"RemusStealer.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\DEVICECLASSES\{53F5630D-B6BF-11D0-94F2-00A0C91EFB8B}"; Key: ""; Value: "") "RemusStealer.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\DEVICECLASSES\{53F5630D-B6BF-11D0-94F2-00A0C91EFB8B}\PROPERTIES"; Key: ""; Value: "") "RemusStealer.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME"; Key: ""; Value: "") "RemusStealer.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{815EAD30-0000-0000-0000-100000000000}\"; Key: ""; Value: "") "RemusStealer.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{815EAD30-0000-0000-0000-501F00000000}\"; Key: ""; Value: "") "RemusStealer.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: ""; Value: "") "RemusStealer.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE\ALTERNATE SORTS"; Key: ""; Value: "") "RemusStealer.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE GROUPS"; Key: ""; Value: "") "RemusStealer.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "RemusStealer.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CTF\COMPATIBILITY\REMUSSTEALER.EXE"; Key: ""; Value: "") "RemusStealer.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CTF\"; Key: ""; Value: "") "RemusStealer.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\FONTLINK\SYSTEMLINK"; Key: ""; Value: "") "RemusStealer.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\LANGUAGEPACK\DATASTORE_V1.0"; Key: ""; Value: "")4a:T462,"RemusStealer.exe" queries basic process information of the "C:\RemusStealer.exe" (UID: 876) "RemusStealer.exe" queries basic process information of the "C:\Users\%OSUSER%\AppData\Local\Temp\OneDrive.exe" (UID: 876) "RemusStealer.exe" queries basic process information of the "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" (UID: 876) "OneDrive.exe" queries basic process information of the "C:\Users\%OSUSER%\AppData\Local\Temp\OneDrive.exe" (UID: 7456) "OneDrive.exe" queries basic process information of the "C:\Users\%OSUSER%\AppData\Local\Temp\RarSFX0\sslconf.exe" (UID: 7456) "OneDrive.exe" queries basic process information of the "C:\Users\%OSUSER%\AppData\Local\Temp\RarSFX0\OneDrive.exe" (UID: 7456) "sslconf.exe" queries basic process information of the "C:\Users\%OSUSER%\AppData\Local\Temp\RarSFX0\sslconf.exe" (UID: 2448) "sslconf.exe" queries basic process information of the "C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" (UID: 2448) "sslconf.exe" queries basic process information of the "C:\ProgramData\TomatoIndigo\sslconf.exe" (UID: 2448)4b:Te0b,"RemusStealer.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{815EAD30-0000-0000-0000-100000000000}"; Key: "DATA"; Value: "") "RemusStealer.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{815EAD30-0000-0000-0000-100000000000}"; Key: "GENERATION"; Value: "") "RemusStealer.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{815EAD30-0000-0000-0000-501F00000000}"; Key: "DATA"; Value: "") "RemusStealer.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{815EAD30-0000-0000-0000-501F00000000}"; Key: "GENERATION"; Value: "") "RemusStealer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409"; Value: "") "RemusStealer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE GROUPS"; Key: "1"; Value: "") "RemusStealer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "RemusStealer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\CTF"; Key: "ENABLEANCHORCONTEXT"; Value: "") "RemusStealer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\LANGUAGEPACK\DATASTORE_V1.0"; Key: "DISABLE"; Value: "") "RemusStealer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\LANGUAGEPACK\DATASTORE_V1.0"; Key: "DATAFILEPATH"; Value: "") "RemusStealer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\LANGUAGEPACK\SURROGATEFALLBACK"; Key: "PLANE1"; Value: "") "RemusStealer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\LANGUAGEPACK\SURROGATEFALLBACK"; Key: "PLANE2"; Value: "") "RemusStealer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\LANGUAGEPACK\SURROGATEFALLBACK"; Key: "PLANE3"; Value: "") "RemusStealer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\LANGUAGEPACK\SURROGATEFALLBACK"; Key: "PLANE4"; Value: "") "RemusStealer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\LANGUAGEPACK\SURROGATEFALLBACK"; Key: "PLANE5"; Value: "") "RemusStealer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\LANGUAGEPACK\SURROGATEFALLBACK"; Key: "PLANE6"; Value: "") "RemusStealer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\LANGUAGEPACK\SURROGATEFALLBACK"; Key: "PLANE7"; Value: "") "RemusStealer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\LANGUAGEPACK\SURROGATEFALLBACK"; Key: "PLANE8"; Value: "") "RemusStealer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\LANGUAGEPACK\SURROGATEFALLBACK"; Key: "PLANE9"; Value: "") "RemusStealer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\LANGUAGEPACK\SURROGATEFALLBACK"; Key: "PLANE10"; Value: "") "RemusStealer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\LANGUAGEPACK\SURROGATEFALLBACK"; Key: "PLANE11"; Value: "") "RemusStealer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\LANGUAGEPACK\SURROGATEFALLBACK"; Key: "PLANE12"; Value: "")4c:T4b7,The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string) Matched sigs: Reference to an external IP address lookup service identified Matched sigs: Able to identify virtual environment by using user activity (API string) Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string) Matched sigs: Able to identify virtual environment by using API string Matched sigs: Queries process mitigation policy via NtQueryInformationProcess Matched sigs: Observed a high volume of repeated registry API calls (API Hammering) Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques Matched sigs: Calls an API typically used to find device information Matched sigs: Calls an API typically used to enumerate device information Matched sigs: Calls an API typically used to retrieve a specified Plug and Play device property (anti-VM) Matched sigs: Contains ability to detect virtual environment Matched sigs: Attempts to identify external IP address4d:T4ba,"RemusStealer.exe" trying to access non-existent file "C:\FLTLIB.DLL" "RemusStealer.exe" trying to access non-existent file "C:\MSVCP140.DLL" "RemusStealer.exe" trying to access non-existent file "C:\MSVCP140.dll" "RemusStealer.exe" trying to access non-existent file "C:\VCRUNTIME140.DLL" "RemusStealer.exe" trying to access non-existent file "C:\VCRUNTIME140.dll" "RemusStealer.exe" trying to access non-existent file "C:\VCRUNTIME140_1.DLL" "RemusStealer.exe" trying to access non-existent file "C:\VCRUNTIME140_1.dll" "RemusStealer.exe" trying to access non-existent file "C:\CRYPTSP.DLL" "RemusStealer.exe" trying to access non-existent file "C:\CSCAPI.DLL" "RemusStealer.exe" trying to access non-existent file "C:\cscapi.dll" "RemusStealer.exe" trying to access non-existent file "C:\powershell.exe" "RemusStealer.exe" trying to access non-existent file "C:\ProgramData\Oracle\Java\javapath_target_114250\POWERSHELL.EXE" "RemusStealer.exe" trying to access non-existent file "C:\Windows\System32\POWERSHELL.EXE" "RemusStealer.exe" trying to access non-existent file "C:\Windows\POWERSHELL.EXE" "RemusStealer.exe" trying to access non-existent file "C:\Windows\System32\wbem\POWERSHELL.EXE"4e:T52e,"RemusStealer.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\OneDrive.exe:ZONE.IDENTIFIER" "RemusStealer.exe" trying to access non-existent file "C:\Users\24cvHmM\AppData\Local\Temp\OneDrive.exe:Zone.Identifier" "RemusStealer.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\REMUSSTEALER" "RemusStealer.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\REMUSSTEALER.LNK" "RemusStealer.exe" trying to access non-existent file "C:\Users\24cvHmM\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RemusStealer.lnk" "RemusStealer.exe" trying to access non-existent file "C:\powershell.com" "RemusStealer.exe" trying to access non-existent file "C:\powershell.bat" "RemusStealer.exe" trying to access non-existent file "C:\powershell.cmd" "RemusStealer.exe" trying to access non-existent file "C:\powershell.vbs" "RemusStealer.exe" trying to access non-existent file "C:\powershell.vbe" "RemusStealer.exe" trying to access non-existent file "C:\powershell.js" "RemusStealer.exe" trying to access non-existent file "C:\powershell.jse" "RemusStealer.exe" trying to access non-existent file "C:\powershell.wsf" "RemusStealer.exe" trying to access non-existent file "C:\powershell.wsh"4f:T477,"RemusStealer.exe" writes file "c:\users\%osuser%\appdata\local\temp\onedrive.exe" "RemusStealer.exe" writes file "c:\users\%osuser%\appdata\local\remusstealer\remusstealer.exe" "RemusStealer.exe" writes file "\device\namedpipe\srvsvc" "RemusStealer.exe" writes file "c:\users\%osuser%\appdata\roaming\microsoft\windows\start menu\programs\startup\remusstealer.lnk" "RemusStealer.exe" writes file "%temp%\onedrive.exe" "RemusStealer.exe" writes file "%localappdata%\remusstealer\remusstealer.exe" "RemusStealer.exe" writes file "%appdata%\microsoft\windows\start menu\programs\startup\remusstealer.lnk" "OneDrive.exe" writes file "c:\users\%osuser%\appdata\local\temp\rarsfx0\onedrive.exe" "OneDrive.exe" writes file "c:\users\%osuser%\appdata\local\temp\rarsfx0\signed_j0tyyo.exe" "OneDrive.exe" writes file "c:\users\%osuser%\appdata\local\temp\rarsfx0\sslconf.exe" "OneDrive.exe" writes file "c:\users\%osuser%\appdata\local\temp\rarsfx0\tempdir.dll" "OneDrive.exe" writes file "c:\users\%osuser%\appdata\local\temp\rarsfx0\vcruntime140.dll" "OneDrive.exe" writes file "c:\users\%osuser%\appdata\local\temp\rarsfx0\onedrive.ico"50:T43b,Found reference to API "WSAStartup" (Indicator: "wsastartup"; Source: "00000000-00000876-00000C2C-3532467262") Found reference to API "syscall.WSAStartup" (Indicator: "wsastartup"; Source: "00000000-00000876.00000000.339071.02134000.00000002.mdmp") Found reference to API "syscall.procWSAStartup" (Indicator: "wsastartup"; Source: "00000000-00000876.00000000.339071.02134000.00000002.mdmp") Found reference to API "net.getHostname" (Indicator: "gethostname"; Source: "00000000-00000876.00000000.339071.02134000.00000002.mdmp") Found reference to API "ote: There is some performance penalty associated with assembly bind failure logging." (Indicator: " bind "; Source: "00000000-00007296.00000000.339360.F1720000.00000004.mdmp, 00000000-00007296.00000001.339555.F1720000.00000004.mdmp") Found reference to API "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." (Indicator: " bind "; Source: "00000000-00007296.00000000.339360.F1720000.00000004.mdmp, 00000000-00007296.00000001.339555.F1720000.00000004.mdmp")51:T8bb1,Heuristic match: "*big.int" Heuristic match: "*xml.name" Pattern match: "www.microsoft.com/pkiops/crl/microsoft%20windows%20third%20party%20component%20ca%202013.crl0u0s0qehttp://www.microsoft.com/pkiops/certs/microsoft%20windows%20third%20party%20component%20ca%202013.crt0g" Pattern match: "http://ocsp.digicert.com0a5http://cacerts.digicert.com/digicerttrustedrootg4.crt0c" Pattern match: "7.ons/iyc{3gk9e%uoj" Pattern match: "htf1w.zd/uel" Heuristic match: "ip-api.com" Heuristic match: "api.ipify.org" Heuristic match: "rg1k98tivqqmmjm238ntbg0tkwo5ejnwecwn1.com" Heuristic match: "c:\windows\powershell.com" Heuristic match: "powershell.com" Heuristic match: "c:\windows\system32\powershell.com" Heuristic match: "c:\windows\system32\wbem\powershell.com" Heuristic match: "c:\programdata\oracle\java\javapath\powershell.com" Heuristic match: "c:\windows\system32\windowspowershell\v1.0\powershell.com" Heuristic match: "internal/abi.name.name" Heuristic match: "runtime.(*bucket).mp" Heuristic match: "runtime.(*func).name" Pattern match: "eq.sync/atomic.bool" Pattern match: "eq.sync/atomic.int32" Pattern match: "eq.sync/atomic.int64" Pattern match: "eq.sync/atomic.uint32" Pattern match: "eq.sync/atomic.uint64" Heuristic match: "type:.eq.internal/godebugs.info" Heuristic match: "internal/reflectlite.name.name" Heuristic match: "internal/reflectlite.rtype.name" Heuristic match: "internal/reflectlite.(*rtype).name" Heuristic match: "errors.is" Heuristic match: "errors.as" Heuristic match: "sync.(*once).do" Pattern match: "eq.sync/atomic.pointer[sync.poolchainelt" Pattern match: "eq.sync/atomic.pointer[interface" Pattern match: "eq.sync/atomic.pointer[sync.readonly" Heuristic match: "unicode.is" Heuristic match: "unicode.to" Heuristic match: "reflect.(*rtype).name" Pattern match: "eq.sync/atomic.pointer[internal/bisect.dedup" Pattern match: "eq.sync/atomic.pointer[internal/godebug.value" Heuristic match: "syscall.errno.is" Heuristic match: "syscall.(*errno).is" Pattern match: "eq.io/fs.patherror" Heuristic match: "os.(*file).name" Heuristic match: "os.(*filestat).name" Pattern match: "eq.sync/atomic.pointer[os.dirinfo" Heuristic match: "os.filewithoutreadfrom.name" Heuristic match: "os.(*filewithoutreadfrom).name" Heuristic match: "os.filewithoutwriteto.name" Heuristic match: "os.(*filewithoutwriteto).name" Heuristic match: "encoding/xml.(*decoder).name" Heuristic match: "type:.eq.encoding/xml.name" Pattern match: "eq.math/rand.rand" Pattern match: "golang.org/x/crypto/cryptobyte.init" Pattern match: "golang.org/x/crypto/cryptobyte.(*string).readasn1boolean" Pattern match: "golang.org/x/crypto/cryptobyte.(*string).readasn1integer" Pattern match: "golang.org/x/crypto/cryptobyte.(*string).readasn1bigint" Pattern match: "golang.org/x/crypto/cryptobyte.(*string).readasn1bytes" Pattern match: "golang.org/x/crypto/cryptobyte.(*string).readasn1int64" Pattern match: "golang.org/x/crypto/cryptobyte.(*string).readasn1uint64" Pattern match: "golang.org/x/crypto/cryptobyte.(*string).readbase128int" Pattern match: "golang.org/x/crypto/cryptobyte.(*string).readasn1objectidentifier" Pattern match: "golang.org/x/crypto/cryptobyte.(*string).readasn1generalizedtime" Pattern match: "golang.org/x/crypto/cryptobyte.(*string).readasn1utctime" Pattern match: "golang.org/x/crypto/cryptobyte.(*string).readasn1bitstring" Pattern match: "golang.org/x/crypto/cryptobyte.(*string).readasn1" Pattern match: "golang.org/x/crypto/cryptobyte.(*string).readasn1element" Pattern match: "golang.org/x/crypto/cryptobyte.(*string).readoptionalasn1" Pattern match: "golang.org/x/crypto/cryptobyte.(*string).skipoptionalasn1" Pattern match: "golang.org/x/crypto/cryptobyte.(*string).readoptionalasn1integer" Pattern match: "golang.org/x/crypto/cryptobyte.(*builder).adduint8" Pattern match: "golang.org/x/crypto/cryptobyte.(*builder).adduint16" Pattern match: "golang.org/x/crypto/cryptobyte.(*builder).adduint32" Pattern match: "golang.org/x/crypto/cryptobyte.(*builder).addbytes" Pattern match: "golang.org/x/crypto/cryptobyte.(*builder).adduint16lengthprefixed" Pattern match: "golang.org/x/crypto/cryptobyte.(*builder).adduint24lengthprefixed" Pattern match: "golang.org/x/crypto/cryptobyte.(*builder).callcontinuation" Pattern match: "golang.org/x/crypto/cryptobyte.(*builder).callcontinuation.func1" Pattern match: "golang.org/x/crypto/cryptobyte.(*builder).addlengthprefixed" Pattern match: "golang.org/x/crypto/cryptobyte.(*builder).flushchild" Pattern match: "golang.org/x/crypto/cryptobyte.(*string).readlengthprefixed" Pattern match: "eq.sync/atomic.pointer[internal/concurrent.entry[*internal/abi.type,interface" Pattern match: "eq.sync/atomic.pointer[internal/concurrent.node[*internal/abi.type,interface" Pattern match: "eq.sync/atomic.pointer[go.shape.struct" Pattern match: "eq.sync/atomic.pointer[internal/concurrent.entry[go.shape.*internal/abi.type,go.shape.interface" Pattern match: "eq.net/netip.parseaddrerror" Pattern match: "eq.net/netip.addrdetail" Pattern match: "eq.sync/atomic.pointer[internal/concurrent.entry[net/netip.addrdetail,internal/weak.pointer[net/netip.addrdetail" Pattern match: "eq.sync/atomic.pointer[internal/concurrent.node[net/netip.addrdetail,internal/weak.pointer[net/netip.addrdetail" Pattern match: "hash.net/netip.addrdetail" Pattern match: "eq.sync/atomic.pointer[internal/concurrent.entry[go.shape.struct" Pattern match: "golang.org/x/net/dns/dnsmessage.(*nestederror).error" Pattern match: "golang.org/x/net/dns/dnsmessage.(*header).pack" Pattern match: "golang.org/x/net/dns/dnsmessage.(*header).unpack" Pattern match: "golang.org/x/net/dns/dnsmessage.(*parser).start" Pattern match: "golang.org/x/net/dns/dnsmessage.(*parser).resourceheader" Pattern match: "golang.org/x/net/dns/dnsmessage.(*parser).skipresource" Pattern match: "golang.org/x/net/dns/dnsmessage.(*parser).question" Pattern match: "golang.org/x/net/dns/dnsmessage.(*parser).skipquestion" Pattern match: "golang.org/x/net/dns/dnsmessage.(*parser).cnameresource" Pattern match: "golang.org/x/net/dns/dnsmessage.(*parser).aresource" Pattern match: "golang.org/x/net/dns/dnsmessage.(*parser).aaaaresource" Pattern match: "golang.org/x/net/dns/dnsmessage.newbuilder" Pattern match: "golang.org/x/net/dns/dnsmessage.(*builder).question" Pattern match: "golang.org/x/net/dns/dnsmessage.(*builder).optresource" Pattern match: "golang.org/x/net/dns/dnsmessage.(*builder).finish" Pattern match: "golang.org/x/net/dns/dnsmessage.(*resourceheader).pack" Pattern match: "golang.org/x/net/dns/dnsmessage.(*resourceheader).unpack" Pattern match: "golang.org/x/net/dns/dnsmessage.skipresource" Pattern match: "golang.org/x/net/dns/dnsmessage.(*name).pack" Pattern match: "golang.org/x/net/dns/dnsmessage.(*name).unpack" Pattern match: "golang.org/x/net/dns/dnsmessage.(*question).pack" Pattern match: "golang.org/x/net/dns/dnsmessage.unpackcnameresource" Pattern match: "golang.org/x/net/dns/dnsmessage.init" Pattern match: "golang.org/x/net/dns/dnsmessage.nestederror" Heuristic match: "net.(*ipv6zonecache).name" Heuristic match: "net.cancelederror.is" Heuristic match: "net.(*timeouterror).is" Heuristic match: "net.(*cancelederror).is" Pattern match: "eq.net/url.error" Pattern match: "eq.net/url.url" Pattern match: "eq.net/url.userinfo" Pattern match: "golang.org/x/sys/cpu.init.0" Pattern match: "golang.org/x/sys/cpu.processoptions" Pattern match: "golang.org/x/sys/cpu.initoptions" Pattern match: "golang.org/x/sys/cpu.archinit" Pattern match: "golang.org/x/sys/cpu.init.1" Pattern match: "golang.org/x/sys/cpu.cpuid.abi0" Pattern match: "golang.org/x/sys/cpu.xgetbv.abi0" Pattern match: "golang.org/x/sys/cpu.option" Pattern match: "golang.org/x/crypto/chacha20.newunauthenticatedcipher" Pattern match: "golang.org/x/crypto/chacha20.(*cipher).xorkeystream" Pattern match: "golang.org/x/crypto/chacha20.(*cipher).xorkeystreamblocksgeneric" Pattern match: "golang.org/x/crypto/chacha20.hchacha20" Pattern match: "golang.org/x/crypto/internal/poly1305.(*mac).verify" Pattern match: "golang.org/x/crypto/internal/poly1305.(*mac).write" Pattern match: "golang.org/x/crypto/internal/poly1305.(*mac).sum" Pattern match: "golang.org/x/crypto/internal/poly1305.finalize" Pattern match: "golang.org/x/crypto/internal/poly1305.update.abi0" Pattern match: "golang.org/x/crypto/chacha20poly1305.init" Pattern match: "golang.org/x/crypto/chacha20poly1305.new" Pattern match: "golang.org/x/crypto/chacha20poly1305.(*chacha20poly1305).noncesize" Pattern match: "golang.org/x/crypto/chacha20poly1305.(*chacha20poly1305).overhead" Pattern match: "golang.org/x/crypto/chacha20poly1305.(*chacha20poly1305).seal" Pattern match: "golang.org/x/crypto/chacha20poly1305.(*chacha20poly1305).open" Pattern match: "golang.org/x/crypto/chacha20poly1305.setupstate" Pattern match: "golang.org/x/crypto/chacha20poly1305.writewithpadding" Pattern match: "golang.org/x/crypto/chacha20poly1305.writeuint64" Pattern match: "golang.org/x/crypto/chacha20poly1305.(*chacha20poly1305).sealgeneric" Pattern match: "golang.org/x/crypto/chacha20poly1305.(*chacha20poly1305).opengeneric" Pattern match: "golang.org/x/crypto/chacha20poly1305.chacha20poly1305open.abi0" Pattern match: "golang.org/x/crypto/chacha20poly1305.chacha20poly1305seal.abi0" Pattern match: "golang.org/x/crypto/hkdf.extract" Pattern match: "golang.org/x/crypto/hkdf.(*hkdf).read" Pattern match: "golang.org/x/crypto/hkdf.expand" Pattern match: "golang.org/x/crypto/sha3.new224" Pattern match: "golang.org/x/crypto/sha3.new256" Pattern match: "golang.org/x/crypto/sha3.new384" Pattern match: "golang.org/x/crypto/sha3.new512" Pattern match: "golang.org/x/crypto/sha3.sum256" Pattern match: "golang.org/x/crypto/sha3.sum512" Pattern match: "golang.org/x/crypto/sha3.init.0" Pattern match: "golang.org/x/crypto/sha3.(*state).blocksize" Pattern match: "golang.org/x/crypto/sha3.(*state).size" Pattern match: "golang.org/x/crypto/sha3.(*state).reset" Pattern match: "golang.org/x/crypto/sha3.(*state).permute" Pattern match: "golang.org/x/crypto/sha3.(*state).padandpermute" Pattern match: "golang.org/x/crypto/sha3.(*state).write" Pattern match: "golang.org/x/crypto/sha3.(*state).read" Pattern match: "golang.org/x/crypto/sha3.(*state).sum" Pattern match: "golang.org/x/crypto/sha3.keccakf1600.abi0" Pattern match: "golang.org/x/crypto/sha3.state" Pattern match: "eq.sync/atomic.pointer[string" Pattern match: "eq.net/http/httptrace.gotconninfo" Pattern match: "golang.org/x/text/unicode/bidi.lookuprune" Pattern match: "golang.org/x/text/unicode/bidi.lookup" Pattern match: "golang.org/x/text/unicode/bidi.lookupstring" Pattern match: "golang.org/x/text/secure/bidirule.directionstring" Pattern match: "golang.org/x/text/secure/bidirule.validstring" Pattern match: "golang.org/x/text/secure/bidirule.init.0" Pattern match: "golang.org/x/text/secure/bidirule.(*transformer).advancestring" Pattern match: "golang.org/x/text/unicode/norm.init" Pattern match: "golang.org/x/text/unicode/norm.(*reorderbuffer).doflush" Pattern match: "golang.org/x/text/unicode/norm.appendflush" Pattern match: "golang.org/x/text/unicode/norm.(*reorderbuffer).insertflush" Pattern match: "golang.org/x/text/unicode/norm.(*reorderbuffer).insertunsafe" Pattern match: "golang.org/x/text/unicode/norm.(*reorderbuffer).insertdecomposed" Pattern match: "golang.org/x/text/unicode/norm.(*reorderbuffer).insertsingle" Pattern match: "golang.org/x/text/unicode/norm.(*reorderbuffer).appendrune" Pattern match: "golang.org/x/text/unicode/norm.(*reorderbuffer).assignrune" Pattern match: "golang.org/x/text/unicode/norm.(*reorderbuffer).runeat" Pattern match: "golang.org/x/text/unicode/norm.decomposehangul" Pattern match: "golang.org/x/text/unicode/norm.(*reorderbuffer).decomposehangul" Pattern match: "golang.org/x/text/unicode/norm.(*reorderbuffer).combinehangul" Pattern match: "golang.org/x/text/unicode/norm.(*reorderbuffer).compose" Pattern match: "golang.org/x/text/unicode/norm.buildrecompmap" Pattern match: "golang.org/x/text/unicode/norm.lookupinfonfc" Pattern match: "golang.org/x/text/unicode/norm.lookupinfonfkc" Pattern match: "golang.org/x/text/unicode/norm.compinfo" Pattern match: "golang.org/x/text/unicode/norm.(*input).charinfonfc" Pattern match: "golang.org/x/text/unicode/norm.(*input).charinfonfkc" Pattern match: "golang.org/x/text/unicode/norm.(*input).hangul" Pattern match: "golang.org/x/text/unicode/norm.nexthangul" Pattern match: "golang.org/x/text/unicode/norm.nextdone" Pattern match: "golang.org/x/text/unicode/norm.nextmulti" Pattern match: "golang.org/x/text/unicode/norm.nextmultinorm" Pattern match: "golang.org/x/text/unicode/norm.nextdecomposed" Pattern match: "golang.org/x/text/unicode/norm.donormdecomposed" Pattern match: "golang.org/x/text/unicode/norm.nextcgjdecompose" Pattern match: "golang.org/x/text/unicode/norm.nextcomposed" Pattern match: "golang.org/x/text/unicode/norm.donormcomposed" Pattern match: "golang.org/x/text/unicode/norm.nextcgjcompose" Pattern match: "golang.org/x/text/unicode/norm.form.bytes" Pattern match: "golang.org/x/text/unicode/norm.form.string" Pattern match: "golang.org/x/text/unicode/norm.form.isnormalstring" Pattern match: "golang.org/x/text/unicode/norm.form.isnormalstring.func1" Pattern match: "golang.org/x/text/unicode/norm.appendquick" Pattern match: "golang.org/x/text/unicode/norm.doappendinner" Pattern match: "golang.org/x/text/unicode/norm.(*forminfo).quickspan" Pattern match: "golang.org/x/text/unicode/norm.decomposesegment" Pattern match: "golang.org/x/text/unicode/norm.(*nfctrie).lookup" Pattern match: "golang.org/x/text/unicode/norm.(*nfctrie).lookupstring" Pattern match: "golang.org/x/text/unicode/norm.(*nfctrie).lookupvalue" Pattern match: "golang.org/x/text/unicode/norm.(*nfkctrie).lookup" Pattern match: "golang.org/x/text/unicode/norm.(*nfkctrie).lookupstring" Pattern match: "golang.org/x/text/unicode/norm.(*nfkctrie).lookupvalue" Pattern match: "golang.org/x/text/unicode/norm.(*sparseblocks).lookup" Pattern match: "golang.org/x/net/idna.init" Pattern match: "golang.org/x/net/idna.labelerror.error" Pattern match: "golang.org/x/net/idna.runeerror.error" Pattern match: "golang.org/x/net/idna.(*profile).process" Pattern match: "golang.org/x/net/idna.info.isbidi" Pattern match: "golang.org/x/net/idna.validateandmap" Pattern match: "golang.org/x/net/idna.(*labeliter).label" Pattern match: "golang.org/x/net/idna.(*labeliter).set" Pattern match: "golang.org/x/net/idna.validatefrompunycode" Pattern match: "golang.org/x/net/idna.(*profile).validatelabel" Pattern match: "golang.org/x/net/idna.decode" Pattern match: "golang.org/x/net/idna.encode" Pattern match: "golang.org/x/net/idna.(*idnatrie).lookupstring" Pattern match: "golang.org/x/net/idna.(*idnatrie).lookupvalue" Pattern match: "golang.org/x/net/idna.(*sparseblocks).lookup" Pattern match: "golang.org/x/net/idna.info.appendmapping" Pattern match: "golang.org/x/net/idna.labelerror" Pattern match: "golang.org/x/net/idna.(*labelerror).error" Pattern match: "golang.org/x/net/idna.(*runeerror).error" Pattern match: "golang.org/x/net/http/httpguts.headervaluecontainstoken" Pattern match: "golang.org/x/net/http/httpguts.punycodehostport" Pattern match: "golang.org/x/net/http/httpguts.init" Pattern match: "golang.org/x/net/http2/hpack.init" Pattern match: "golang.org/x/net/http2/hpack.init.func1" Pattern match: "golang.org/x/net/http2/hpack.newencoder" Pattern match: "golang.org/x/net/http2/hpack.(*encoder).writefield" Pattern match: "golang.org/x/net/http2/hpack.(*encoder).searchtable" Pattern match: "golang.org/x/net/http2/hpack.(*encoder).setmaxdynamictablesize" Pattern match: "golang.org/x/net/http2/hpack.appendnewname" Pattern match: "golang.org/x/net/http2/hpack.appendindexedname" Pattern match: "golang.org/x/net/http2/hpack.appendhpackstring" Pattern match: "golang.org/x/net/http2/hpack.decodingerror.error" Pattern match: "golang.org/x/net/http2/hpack.invalidindexerror.error" Pattern match: "golang.org/x/net/http2/hpack.headerfield.string" Pattern match: "golang.org/x/net/http2/hpack.newdecoder" Pattern match: "golang.org/x/net/http2/hpack.(*decoder).setemitfunc" Pattern match: "golang.org/x/net/http2/hpack.(*dynamictable).add" Pattern match: "golang.org/x/net/http2/hpack.(*dynamictable).evict" Pattern match: "golang.org/x/net/http2/hpack.(*decoder).close" Pattern match: "golang.org/x/net/http2/hpack.(*decoder).write" Pattern match: "golang.org/x/net/http2/hpack.(*decoder).parseheaderfieldrepr" Pattern match: "golang.org/x/net/http2/hpack.(*decoder).parsefieldindexed" Pattern match: "golang.org/x/net/http2/hpack.(*decoder).parsefieldliteral" Pattern match: "golang.org/x/net/http2/hpack.(*decoder).callemit" Pattern match: "golang.org/x/net/http2/hpack.(*decoder).parsedynamictablesizeupdate" Pattern match: "golang.org/x/net/http2/hpack.readvarint" Pattern match: "golang.org/x/net/http2/hpack.(*decoder).readstring" Pattern match: "golang.org/x/net/http2/hpack.(*decoder).decodestring" Pattern match: "golang.org/x/net/http2/hpack.huffmandecode" Pattern match: "golang.org/x/net/http2/hpack.buildroothuffmannode" Pattern match: "golang.org/x/net/http2/hpack.appendhuffmanstring" Pattern match: "golang.org/x/net/http2/hpack.(*headerfieldtable).evictoldest" Pattern match: "golang.org/x/net/http2/hpack.(*headerfieldtable).search" Pattern match: "golang.org/x/net/http2/hpack.(*headerfieldtable).idtoindex" Pattern match: "golang.org/x/net/http2/hpack.(*decodingerror).error" Pattern match: "golang.org/x/net/http2/hpack.(*headerfield).string" Pattern match: "golang.org/x/net/http2/hpack.(*invalidindexerror).error" Pattern match: "golang.org/x/net/http2/hpack.headerfield" Pattern match: "golang.org/x/net/http2/hpack.pairnamevalue" Pattern match: "eq.net/http/internal.chunkedreader" Pattern match: "golang.org/x/net/http/httpproxy.init" Pattern match: "golang.org/x/net/http/httpproxy.fromenvironment" Pattern match: "golang.org/x/net/http/httpproxy.(*config).proxyforurl" Pattern match: "golang.org/x/net/http/httpproxy.parseproxy" Pattern match: "golang.org/x/net/http/httpproxy.(*config).useproxy" Pattern match: "golang.org/x/net/http/httpproxy.(*config).init" Pattern match: "golang.org/x/net/http/httpproxy.canonicaladdr" Pattern match: "golang.org/x/net/http/httpproxy.idnaascii" Pattern match: "golang.org/x/net/http/httpproxy.allmatch.match" Pattern match: "golang.org/x/net/http/httpproxy.cidrmatch.match" Pattern match: "golang.org/x/net/http/httpproxy.ipmatch.match" Pattern match: "golang.org/x/net/http/httpproxy.domainmatch.match" Pattern match: "golang.org/x/net/http/httpproxy.domainmatch" Pattern match: "golang.org/x/net/http/httpproxy.(*config).proxyforurl-fm" Pattern match: "golang.org/x/net/http/httpproxy.(*allmatch).match" Pattern match: "golang.org/x/net/http/httpproxy.(*cidrmatch).match" Pattern match: "golang.org/x/net/http/httpproxy.(*ipmatch).match" Pattern match: "golang.org/x/net/http/httpproxy.(*domainmatch).match" Pattern match: "golang.org/x/net/http/httpproxy.config" Heuristic match: "net/http.(*client).do" Heuristic match: "net/http.http2streamerror.as" Heuristic match: "net/http.(*timeouterror).is" Pattern match: "eq.net/http.http2priorityparam" Pattern match: "eq.net/http.http2frameheader" Pattern match: "eq.net/http.http2setting" Pattern match: "eq.net/http.segment" Pattern match: "eq.net/http.http2pingframe" Pattern match: "eq.net/http.http2priorityframe" Pattern match: "eq.net/http.http2rststreamframe" Pattern match: "eq.net/http.http2windowupdateframe" Pattern match: "eq.net/http.http2streamerror" Pattern match: "eq.net/http.readtrackingbody" Pattern match: "eq.net/http.connectmethodkey" Pattern match: "hash.net/http.connectmethodkey" Pattern match: "eq.net/http.connorerror" Pattern match: "eq.net/http.http2goawayerror" Pattern match: "eq.net/http.http2connerror" Pattern match: "eq.net/http.http2stickyerrwriter" Heuristic match: "net/http.(*http2streamerror).as" Pattern match: "eq.net/http.socksusernamepassword" Pattern match: "eq.os/exec.error" Pattern match: "eq.os/exec.wrappederror" Pattern match: "eq.os/exec.ctxresult" Pattern match: "eq.os/exec.goroutinestatus" Heuristic match: "net/textproto.nl" Pattern match: "golang.org/x/net/http/httpguts..inittask" Pattern match: "golang.org/x/net/http/httpguts.istokentable" Pattern match: "golang.org/x/net/http/httpguts.validhostbyte" Pattern match: "golang.org/x/net/http2/hpack..inittask" Pattern match: "golang.org/x/net/http2/hpack.errstringlength" Pattern match: "golang.org/x/net/http2/hpack.errneedmore" Pattern match: "golang.org/x/net/http2/hpack.errvarintoverflow" Pattern match: "golang.org/x/net/http2/hpack.bufpool" Pattern match: "golang.org/x/net/http2/hpack.errinvalidhuffman" Pattern match: "golang.org/x/net/http2/hpack.buildrootonce" Pattern match: "golang.org/x/net/http2/hpack.lazyroothuffmannode" Pattern match: "golang.org/x/net/http2/hpack.statictable" Pattern match: "golang.org/x/net/http2/hpack.huffmancodes" Pattern match: "golang.org/x/net/http2/hpack.huffmancodelen" Pattern match: "golang.org/x/net/idna..inittask" Pattern match: "golang.org/x/net/idna.punycode" Pattern match: "golang.org/x/net/idna.lookup" Pattern match: "golang.org/x/net/idna.joinstates" Pattern match: "golang.org/x/net/idna.mappings" Pattern match: "golang.org/x/net/idna.mappingindex" Pattern match: "golang.org/x/net/idna.xordata" Pattern match: "golang.org/x/net/idna.idnavalues" Pattern match: "golang.org/x/net/idna.idnaindex" Pattern match: "golang.org/x/net/idna.idnasparseoffset" Pattern match: "golang.org/x/net/idna.idnasparsevalues" Pattern match: "golang.org/x/net/idna.idnasparse" Pattern match: "golang.org/x/net/idna.trie" Pattern match: "golang.org/x/net/http/httpproxy..inittask" Pattern match: "golang.org/x/net/http/httpproxy.portmap" Pattern match: "golang.org/x/crypto/chacha20poly1305..inittask" Pattern match: "golang.org/x/crypto/chacha20poly1305.erropen" Pattern match: "golang.org/x/crypto/chacha20poly1305.useavx2" Pattern match: "golang.org/x/crypto/chacha20poly1305.chacha20constants" Pattern match: "golang.org/x/crypto/chacha20poly1305.rol16" Pattern match: "golang.org/x/crypto/chacha20poly1305.rol8" Pattern match: "golang.org/x/crypto/chacha20poly1305.sseincmask" Pattern match: "golang.org/x/crypto/chacha20poly1305.avx2incmask" Pattern match: "golang.org/x/crypto/chacha20poly1305.avx2initmask" Pattern match: "golang.org/x/crypto/chacha20poly1305.polyclampmask" Pattern match: "golang.org/x/crypto/chacha20poly1305.andmask" Pattern match: "golang.org/x/crypto/cryptobyte..inittask" Pattern match: "golang.org/x/crypto/cryptobyte.bigone" Pattern match: "golang.org/x/crypto/sha3..inittask" Pattern match: "golang.org/x/net/dns/dnsmessage..inittask" Pattern match: "golang.org/x/net/dns/dnsmessage.classnames" Pattern match: "golang.org/x/net/dns/dnsmessage.rcodenames" Pattern match: "golang.org/x/net/dns/dnsmessage.errnotstarted" Pattern match: "golang.org/x/net/dns/dnsmessage.errsectiondone" Pattern match: "golang.org/x/net/dns/dnsmessage.errbaselen" Pattern match: "golang.org/x/net/dns/dnsmessage.errcalclen" Pattern match: "golang.org/x/net/dns/dnsmessage.errreserved" Pattern match: "golang.org/x/net/dns/dnsmessage.errtoomanyptr" Pattern match: "golang.org/x/net/dns/dnsmessage.errinvalidptr" Pattern match: "golang.org/x/net/dns/dnsmessage.errinvalidname" Pattern match: "golang.org/x/net/dns/dnsmessage.errresourcelen" Pattern match: "golang.org/x/net/dns/dnsmessage.errsegtoolong" Pattern match: "golang.org/x/net/dns/dnsmessage.errnametoolong" Pattern match: "golang.org/x/net/dns/dnsmessage.errzeroseglen" Pattern match: "golang.org/x/net/dns/dnsmessage.errrestoolong" Pattern match: "golang.org/x/net/dns/dnsmessage.errtoomanyquestions" Pattern match: "golang.org/x/net/dns/dnsmessage.errtoomanyanswers" Pattern match: "golang.org/x/net/dns/dnsmessage.errtoomanyauthorities" Pattern match: "golang.org/x/net/dns/dnsmessage.errtoomanyadditionals" Pattern match: "golang.org/x/net/dns/dnsmessage.errnoncanonicalname" Pattern match: "golang.org/x/net/dns/dnsmessage.sectionnames" Pattern match: "golang.org/x/text/secure/bidirule..inittask" Pattern match: "golang.org/x/text/secure/bidirule.transitions" Pattern match: "golang.org/x/text/secure/bidirule.asciitable" Pattern match: "golang.org/x/text/unicode/bidi.controlbytetoclass" Pattern match: "golang.org/x/text/unicode/bidi.bidivalues" Pattern match: "golang.org/x/text/unicode/bidi.bidiindex" Pattern match: "golang.org/x/text/unicode/norm..inittask" Pattern match: "golang.org/x/text/unicode/norm.formtable" Pattern match: "golang.org/x/text/unicode/norm.decomps" Pattern match: "golang.org/x/text/unicode/norm.nfcvalues" Pattern match: "golang.org/x/text/unicode/norm.nfcindex" Pattern match: "golang.org/x/text/unicode/norm.nfcsparseoffset" Pattern match: "golang.org/x/text/unicode/norm.nfcsparsevalues" Pattern match: "golang.org/x/text/unicode/norm.nfkcvalues" Pattern match: "golang.org/x/text/unicode/norm.nfkcindex" Pattern match: "golang.org/x/text/unicode/norm.nfkcsparseoffset" Pattern match: "golang.org/x/text/unicode/norm.nfkcsparsevalues" Pattern match: "golang.org/x/text/unicode/norm.recompmap" Pattern match: "golang.org/x/text/unicode/norm.recompmaponce" Pattern match: "golang.org/x/text/unicode/norm.nfcsparse" Pattern match: "golang.org/x/text/unicode/norm.nfkcsparse" Pattern match: "golang.org/x/text/unicode/norm.nfcdata" Pattern match: "golang.org/x/text/unicode/norm.nfkcdata" Pattern match: "golang.org/x/sys/cpu..inittask" Pattern match: "golang.org/x/sys/cpu.initialized" Pattern match: "golang.org/x/sys/cpu.x86" Pattern match: "golang.org/x/sys/cpu.options" Pattern match: "golang.org/x/sys/cpu.getauxvfn" Pattern match: "golang.org/x/text/transform.errshortdst" Pattern match: "golang.org/x/text/transform.errshortsrc" Pattern match: "itab.net/http.nobody,io.readcloser" Pattern match: "itab.net/http.bodylocked,io.reader" Pattern match: "itab.net/http.bufioflushwriter,io.writer" Pattern match: "itab.net/http.errorreader,io.reader" Pattern match: "itab.net/http.finishasyncbyteread,io.reader" Pattern match: "itab.net/http.http2nodialh2roundtripper,net/http.roundtripper" Pattern match: "itab.net/http.http2connectionerror,error" Pattern match: "itab.net/http.http2streamerror,error" Pattern match: "itab.net/http.http2missingbody,io.readcloser" Pattern match: "itab.net/http.http2transportresponsebody,io.readcloser" Pattern match: "itab.net/http.http2goawayerror,error" Pattern match: "itab.net/http.http2nodialclientconnpool,net/http.http2clientconnpool" Pattern match: "itab.net/http.http2erringroundtripper,net/http.roundtripper" Pattern match: "itab.net/http.http2pseudoheadererror,error" Pattern match: "itab.net/http.http2duplicatepseudoheadererror,error" Pattern match: "itab.net/http.http2timetimer,interface" Pattern match: "itab.net/http.http2connerror,error" Pattern match: "itab.net/http.http2headerfieldvalueerror,error" Pattern match: "itab.net/http.http2headerfieldnameerror,error" Pattern match: "itab.net/http.http2stickyerrwriter,io.writer" Pattern match: "itab.net/http.persistconnwriter,io.writer" Pattern match: "itab.net/http.nothingwrittenerror,error" Pattern match: "itab.net/http.transportreadfromservererror,error" Pattern match: "itab.net/http.requestbodyreaderror,error" Pattern match: "itab.net/http.tlshandshaketimeouterror,error" Pattern match: "itab.net/http.stringwriter,io.stringwriter" Pattern match: "golang.org/x/net/http2/hpack.decodingerror,error" Pattern match: "itab.net/http.http2nocachedconnerror,error" Pattern match: "itab.net/http.http2nobodyreader,io.readcloser" Pattern match: "itab.net/http.fakelocker,sync.locker" Pattern match: "itab.os/exec.wrappederror,error" Pattern match: "golang.org/x/crypto/chacha20poly1305.chacha20poly1305,crypto/cipher.aead" Pattern match: "itab.net/url.escapeerror,error" Pattern match: "itab.net/url.invalidhosterror,error" Pattern match: "itab.net/textproto.protocolerror,error" Pattern match: "golang.org/x/net/http2/hpack.invalidindexerror,error" Pattern match: "golang.org/x/net/idna.labelerror,error" Pattern match: "golang.org/x/net/idna.runeerror,error" Pattern match: "golang.org/x/net/http/httpproxy.allmatch,vendor/golang.org/x/net/http/httpproxy.matcher" Pattern match: "golang.org/x/net/http/httpproxy.cidrmatch,vendor/golang.org/x/net/http/httpproxy.matcher" Pattern match: "golang.org/x/net/http/httpproxy.ipmatch,vendor/golang.org/x/net/http/httpproxy.matcher" Pattern match: "golang.org/x/net/http/httpproxy.domainmatch,vendor/golang.org/x/net/http/httpproxy.matcher" Pattern match: "golang.org/x/crypto/sha3.state,hash.hash" Pattern match: "golang.org/x/crypto/hkdf.hkdf,io.reader" Pattern match: "itab.net/netip.parseaddrerror,error" Pattern match: "golang.org/x/net/dns/dnsmessage.nestederror,error" Pattern match: "itab.math/rand/v2.runtimesource,math/rand/v2.source" Heuristic match: "??\c:\programdata\oracle\java\javapath\powershell.com" Heuristic match: "??\c:\windows\system32\windowspowershell\v1.0\powershell.com" Heuristic match: "??\c:\windows\powershell.com" Heuristic match: "??\c:\powershell.com" Pattern match: "http://www.w3.org/2001/xmlschema-instance" Heuristic match: "system.activityhistory.id" Heuristic match: "system.identityprovider.name" Heuristic match: "system.sam.name" Heuristic match: "system.structuredquery.virtual.cc" Heuristic match: "system.structuredquery.virtual.to" Heuristic match: "system.structuredquery.is" Heuristic match: "system.protocol.name" Heuristic match: "system.appusermodel.id" Heuristic match: "system.structuredquerytype.implicit.is" Heuristic match: "d$.gf" Heuristic match: "cim_system.name" Heuristic match: "ystem.activityhistory.id" Heuristic match: "ystem.appusermodel.id" Heuristic match: "ystem.identityprovider.name" Heuristic match: "ystem.protocol.name" Heuristic match: "ystem.sam.name" Heuristic match: "ystem.structuredquery.is" Heuristic match: "ystem.structuredquery.virtual.cc" Heuristic match: "ystem.structuredquery.virtual.to" Pattern match: "http://schemas.microsoft.com/smi/2016/windowssettings" Pattern match: "http://www.microsoft.com/windows" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0z" Pattern match: "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0" Pattern match: "www.microsoft.com/pki/docs/cps/default.htm0@" Pattern match: "crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0z" Pattern match: "http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0" Pattern match: "microsoft.net/framework64/v4.0.30319/" Heuristic match: "microsoft-windows-client-features-package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Heuristic match: "microsoft-windows-client-features-wow64-package0017~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Pattern match: "microsoft.net/assembly/gac_msil/system/v4.0_4.0.0.0__b77a5c561934e089/system.dll" Heuristic match: ":\windows\system32\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\microsoft-windows-client-features-package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Heuristic match: ":\windows\system32\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\microsoft-windows-client-features-wow64-package0017~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Heuristic match: "??\c:\windows\system32\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\microsoft-windows-client-features-package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Pattern match: "0www.entrust.net/cps" Pattern match: "crl.comodoca.com/aaacertificateservices.crl06" Pattern match: "crl.comodo.net/aaacertificateservices.crl0" Pattern match: "http://repository.swisssign.com/0" Pattern match: "www.digicert.com1!0" Pattern match: "www.digicert.com1" Heuristic match: "ntrust.net" Heuristic match: "c:\windows\system32\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\microsoft-windows-client-features-package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Pattern match: "www.digicert.com1$0" Pattern match: "www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0a" Pattern match: "www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^" Pattern match: "www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0" Pattern match: "http://crl.comodoca.com/comodorsacertificationauthority.crl0q" Pattern match: "http://crt.comodoca.com/comodorsaaddtrustca.crt0$" Pattern match: "http://ocsp.comodoca.com0" Pattern match: "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0v" Pattern match: "crt.usertrust.com/usertrustrsaaddtrustca.crt0%" Pattern match: "http://ocsp.usertrust.com0" Pattern match: "http://certs.godaddy.com/repository/1301" Pattern match: "http://ocsp.godaddy.com/05" Pattern match: "http://crl.godaddy.com/gdroot-g2.crl0f" Pattern match: "https://certs.godaddy.com/repository/0" Pattern match: "http://crl.globalsignw" Pattern match: "https://www.alphassl.com/repository/03" Pattern match: "http://crl.globalsign.net/root.crl0=" Pattern match: "http://ocsp.globalsign.com/rootr10" Pattern match: "http://g1.symcb.com/crls/gtglobal.crl0/" Pattern match: "http://g2.symcb.com0l" Pattern match: "http://www.geotrust.com/resources/cps0" Pattern match: "http://crl.thawt\" Pattern match: "http://ocsp.thawte.com0" Pattern match: "https://www.thawte.com/cps07" Pattern match: "http://crl.thawte.com/thawtepca-g3.crl0" Pattern match: "https://www.globalsign.com/repository/03" Pattern match: "www.digicert.com1+0" Pattern match: "www.digicert.com1/0-" Pattern match: "http://ocsp.digicert.com0k" Pattern match: "http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=" Pattern match: "https://www.digicert.com/cps0" Pattern match: "http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=" Pattern match: "http://www.microsoft.com0" Pattern match: "http://s2.symcb.com0" Pattern match: "http://www.symauth.com/cps0" Pattern match: "http://www.symauth.com/rpa00" Pattern match: "http://s1.symcb.com/pca3-g5.crl0" Pattern match: "crl.usertrust.com/addtrustexternalcaroot.crl05" Pattern match: "http://s2.symcb.com0k" Pattern match: "http://www.symauth.com/rpa0" Pattern match: "www.verisign.com/cps" Pattern match: "https://www.verisign.com/cps04" Pattern match: "http://crl.verisign.com/pca3.crl0" Pattern match: "www.microsoft.com/pkiops/docs/repository.htm" Pattern match: "http://logo.verisign.com/vslogo.gif0" Pattern match: "http://cert.startcom.org/sfsca-crl.crl0+" Pattern match: "http://crl.startcom.org/sfsca-crl.crl0" Pattern match: "http://cert.startcom.org/policy.pdf05" Pattern match: "http://cert.startcom.org/intermediate.pdf0" Pattern match: "http://cert.startcom.org/policy.pdf0" Pattern match: "7www.entrust.net/cps_2048" Pattern match: "http://crl.globalsign.net/root-r2.crl0" Pattern match: "http://crl.securetrust.com/stca.crl0" Pattern match: "http://www.certplus.com/crl/class2.crl0" Pattern match: "www.entrust.net/legal-terms1907" Pattern match: "crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0" Pattern match: "www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0" Pattern match: "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07" Heuristic match: "ty.ao" Heuristic match: "em.sn" Pattern match: "http://www.microsoft.com/windows0"52:T4678,Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00000876.00000000.339071.8F110000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00000876.00000001.340150.8F110000.00000004.mdmp") Found URL "http://www.microsoft.com/windows1.3.6.1.4.1.311.3.3.1a+zt20170929123018.134z0washington1redmond1microsoft" - Source: "00000000-00007296.00000000.339360.EF450000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00007296.00000000.339360.EF450000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00007296.00000000.339360.EF450000.00000004.mdmp") Found URL "http://crl.comodoca.com/aaacertificateservices.crl060http://crl.comodo.net/aaacertificateservices.crl0l7u" - Source: "00000000-00007296.00000000.339360.EF460000.00000004.mdmp") Found URL "http://repository.swisssign.com/02z" - Source: "00000000-00007296.00000000.339360.EF460000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt08.ek@26vtlp0xr!s4zs9_>washington1redmond1microsoft" - Source: "00000000-00007296.00000000.339360.F1720000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt08.ek@26vtlp0xr!s4zs9_>suuuhhsmwashington1redmond1microsoft" - Source: "00000000-00007296.00000000.339360.F1720000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0-%3_j=sm" - Source: "00000000-00007296.00000000.339360.F1720000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00007296.00000000.339360.F1720000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00007296.00000000.339360.F1720000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00007296.00000000.339360.F1720000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00007296.00000000.339360.F1720000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00007296.00000000.339360.F1720000.00000004.mdmp") Found URL "http://crl.globalsignwglobalsign" - Source: "00000000-00007296.00000000.339360.F1720000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00007296.00000000.339360.F1720000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00007296.00000000.339360.F1720000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.9iqmgvw,czc" - Source: "00000000-00007296.00000000.339360.F1720000.00000004.mdmp") Found URL "http://crl.thawt\thawte," - Source: "00000000-00007296.00000000.339360.F1720000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eglobalsign" - Source: "00000000-00007296.00000000.339360.F1720000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00007296.00000000.339360.F1720000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00007296.00000000.339360.F1720000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00007296.00000000.339360.F1720000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00007296.00000000.339360.F1720000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*le0c0wgeotrust" - Source: "00000000-00007296.00000000.339360.F1720000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00007296.00000000.339360.F1720000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;2.5.29.1addtrust" - Source: "00000000-00007296.00000000.339360.F1720000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00007296.00000000.339360.F1720000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00007296.00000000.339360.F1720000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00007296.00000000.339360.F1720000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00007296.00000000.339360.F1720000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00007296.00000000.339360.F1720000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00007296.00000000.339360.F1720000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0uz_]userdomain_roamingprofile=desktop-fvvf82a1.3.6.1.5.5.7.1.12pkcs1.2.840.113533.7.65.0microsoft" - Source: "00000000-00007296.00000000.339360.F1720000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00007296.00000000.339360.F1720000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?ign.vslosecom" - Source: "00000000-00007296.00000000.339360.F1720000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00007296.00000000.339360.F1720000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00007296.00000000.339360.F1720000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00007296.00000000.339360.F1720000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00007296.00000000.339360.F1720000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lwashington1redmond1microsoft" - Source: "00000000-00007296.00000000.339360.F1720000.00000004.mdmp") Found URL "http://www.microsoft.com/windows0qst*&pj>e" - Source: "00000000-00007296.00000000.339360.F1720000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00007296.00000000.339360.F1720000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00007296.00000000.339360.F1720000.00000004.mdmp") Found URL "http://www.validationtest.contoso.com/test%d.htmlmpoav_forcedeepscan" - Source: "00000000-00007296.00000001.339555.97EA2000.00000002.mdmp") Found URL "http://www.microsoft.com/windows1.3.6.1.4.1.311.3.3.129123018.134z0corporher" - Source: "00000000-00007296.00000001.339555.EF450000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pkps/default.htm0@$vkt7" - Source: "00000000-00007296.00000001.339555.EF450000.00000004.mdmp") Found URL "http://crl.comodoca.com/aaacertificateservices.crl060http://crl.comodo.net/aaacertificateservices.crl0l7u" - Source: "00000000-00007296.00000001.339555.EF460000.00000004.mdmp") Found URL "http://repository.swisssign.com/02z" - Source: "00000000-00007296.00000001.339555.EF460000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0f9iqmgvw,czc" - Source: "00000000-00007296.00000001.339555.F1720000.00000004.mdmp") Found URL "http://crl.thawt\thawte," - Source: "00000000-00007296.00000001.339555.F1720000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eglobalsign" - Source: "00000000-00007296.00000001.339555.F1720000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00007296.00000001.339555.F1720000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00007296.00000001.339555.F1720000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00007296.00000001.339555.F1720000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00007296.00000001.339555.F1720000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*le0c0wgeotrust" - Source: "00000000-00007296.00000001.339555.F1720000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00007296.00000001.339555.F1720000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;2.5.29.1addtrust" - Source: "00000000-00007296.00000001.339555.F1720000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00007296.00000001.339555.F1720000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00007296.00000001.339555.F1720000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00007296.00000001.339555.F1720000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00007296.00000001.339555.F1720000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00007296.00000001.339555.F1720000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00007296.00000001.339555.F1720000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0uz_]userdomain_roamingprofile=desktop-fvvf82a1.3.6.1.5.5.7.1.12pkcs1.2.840.113533.7.65.0microsoft" - Source: "00000000-00007296.00000001.339555.F1720000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00007296.00000001.339555.F1720000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?ign.vslosecom" - Source: "00000000-00007296.00000001.339555.F1720000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00007296.00000001.339555.F1720000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00007296.00000001.339555.F1720000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00007296.00000001.339555.F1720000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00007296.00000001.339555.F1720000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lwashington1redmond1microsoft" - Source: "00000000-00007296.00000001.339555.F1720000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00007296.00000001.339555.F1720000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=42127" - Source: "00000000-00007296.00000001.339555.F1720000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=42127" - Source: "00000000-00007296.00000001.339555.F3210000.00000004.mdmp")53:T656,Found string "9ncalrpc:[epmapper,Security=Impersonation Dynamic False]" (Indicator: "ncalrpc"; Source: "00000000-00000876.00000000.339071.8F110000.00000004.mdmp, 00000000-00000876.00000001.340150.8F110000.00000004.mdmp") Found string "+ncalrpc:[OLEDA57235202321E741EE1F1846229]" (Indicator: "ncalrpc"; Source: "00000000-00000876.00000000.339071.8F110000.00000004.mdmp, 00000000-00000876.00000001.340150.8F110000.00000004.mdmp") Found string "+ncalrpc:[OLE24EACA2DDE3C0735B21B5D51F368]" (Indicator: "ncalrpc"; Source: "00000000-00000876.00000000.339071.8F110000.00000004.mdmp, 00000000-00000876.00000001.340150.8F110000.00000004.mdmp") Found string "B+ncalrpc:[OLEDA57235202321E741EE1F1846229]" (Indicator: "ncalrpc"; Source: "00000000-00000876.00000000.339071.8F110000.00000004.mdmp") Found string "ncacn_np" (Indicator: "ncacn_np"; Source: "00000000-00000876.00000000.339071.8F110000.00000004.mdmp, 00000000-00000876.00000001.340150.8F110000.00000004.mdmp") Found string "B+ncalrpc:[OLED4D8A952028C864CCBC11616AF83]" (Indicator: "ncalrpc"; Source: "00000000-00000876.00000001.340150.8F110000.00000004.mdmp") Found string "+ncalrpc:[OLED4D8A952028C864CCBC11616AF83]" (Indicator: "ncalrpc"; Source: "00000000-00000876.00000001.340150.8F110000.00000004.mdmp") Found string "-+ncalrpc:[OLE24EACA2DDE3C0735B21B5D51F368]" (Indicator: "ncalrpc"; Source: "00000000-00000876.00000001.340150.8F194000.00000004.mdmp") Found string "+ncalrpc:[OLED30EB9F23EE43614C155BE44AB8D]" (Indicator: "ncalrpc"; Source: "00000000-00007296.00000000.339360.EF460000.00000004.mdmp, 00000000-00007296.00000001.339555.EF460000.00000004.mdmp")54:T9ec,"OneDrive.exe" called "FindFirstFileW" with parameter %TEMP%\OneDrive.exe (UID: 00000000-00007456) "OneDrive.exe" called "FindFirstFileW" with parameter OneDrive.exe (UID: 00000000-00007456) "OneDrive.exe" called "FindFirstFileW" with parameter \\?\%TEMP%\RarSFX0\OneDrive.exe (UID: 00000000-00007456) "OneDrive.exe" called "FindFirstFileW" with parameter signed_j0TYyO.exe (UID: 00000000-00007456) "OneDrive.exe" called "FindFirstFileW" with parameter \\?\%TEMP%\RarSFX0\signed_j0TYyO.exe (UID: 00000000-00007456) "OneDrive.exe" called "FindFirstFileW" with parameter sslconf.exe (UID: 00000000-00007456) "OneDrive.exe" called "FindFirstFileW" with parameter \\?\%TEMP%\RarSFX0\sslconf.exe (UID: 00000000-00007456) "OneDrive.exe" called "FindFirstFileW" with parameter tempdir.dll (UID: 00000000-00007456) "OneDrive.exe" called "FindFirstFileW" with parameter \\?\%TEMP%\RarSFX0\tempdir.dll (UID: 00000000-00007456) "OneDrive.exe" called "FindFirstFileW" with parameter vcruntime140.dll (UID: 00000000-00007456) "OneDrive.exe" called "FindFirstFileW" with parameter \\?\%TEMP%\RarSFX0\vcruntime140.dll (UID: 00000000-00007456) "OneDrive.exe" called "FindFirstFileW" with parameter onedrive.ico (UID: 00000000-00007456) "OneDrive.exe" called "FindFirstFileW" with parameter \\?\%TEMP%\RarSFX0\onedrive.ico (UID: 00000000-00007456) "OneDrive.exe" called "FindFirstFileW" with parameter OneDriveMedTile.scale-100.png (UID: 00000000-00007456) "OneDrive.exe" called "FindFirstFileW" with parameter \\?\%TEMP%\RarSFX0\OneDriveMedTile.scale-100.png (UID: 00000000-00007456) "OneDrive.exe" called "FindFirstFileW" with parameter OneDriveSmallTile.scale-100.png (UID: 00000000-00007456) "OneDrive.exe" called "FindFirstFileW" with parameter \\?\%TEMP%\RarSFX0\OneDriveSmallTile.scale-100.png (UID: 00000000-00007456) "OneDrive.exe" called "FindFirstFileW" with parameter PhotosStoreLogo.png (UID: 00000000-00007456) "OneDrive.exe" called "FindFirstFileW" with parameter \\?\%TEMP%\RarSFX0\PhotosStoreLogo.png (UID: 00000000-00007456) "sslconf.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00002448) "sslconf.exe" called "FindNextFileW" with parameter sslconf.exe (UID: 00000000-00002448) "sslconf.exe" called "FindNextFileW" with parameter tempdir.dll (UID: 00000000-00002448) "sslconf.exe" called "FindNextFileW" with parameter vcruntime140.dll (UID: 00000000-00002448) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00007296)55:T1016,Found string "aesKey" (Indicator: "aes"; File: "RemusStealer.exe") Found string "chacha8" (Indicator: "chacha"; File: "RemusStealer.exe") Found string "internal/chacha8rand.(*State).Init" (Indicator: "chacha"; Source: "00000000-00000876.00000000.339071.02134000.00000002.mdmp") Found string "internal/chacha8rand.(*State).Refill" (Indicator: "chacha"; Source: "00000000-00000876.00000000.339071.02134000.00000002.mdmp") Found string "internal/chacha8rand.(*State).Reseed" (Indicator: "chacha"; Source: "00000000-00000876.00000000.339071.02134000.00000002.mdmp") Found string "internal/chacha8rand.block" (Indicator: "chacha"; Source: "00000000-00000876.00000000.339071.02134000.00000002.mdmp") Found string "type:.eq.internal/chacha8rand.State" (Indicator: "chacha"; Source: "00000000-00000876.00000000.339071.02134000.00000002.mdmp") Found string "aeshashbody" (Indicator: "aes"; Source: "00000000-00000876.00000000.339071.02134000.00000002.mdmp") Found string "crypto/aes.init" (Indicator: "aes"; Source: "00000000-00000876.00000000.339071.02134000.00000002.mdmp") Found string "crypto/aes.(*aesCipherGCM).NewGCM" (Indicator: "aes"; Source: "00000000-00000876.00000000.339071.02134000.00000002.mdmp") Found string "crypto/aes.(*gcmAsm).NonceSize" (Indicator: "aes"; Source: "00000000-00000876.00000000.339071.02134000.00000002.mdmp") Found string "crypto/aes.(*gcmAsm).Overhead" (Indicator: "aes"; Source: "00000000-00000876.00000000.339071.02134000.00000002.mdmp") Found string "crypto/aes.(*gcmAsm).Seal" (Indicator: "aes"; Source: "00000000-00000876.00000000.339071.02134000.00000002.mdmp") Found string "crypto/aes.(*gcmAsm).Open" (Indicator: "aes"; Source: "00000000-00000876.00000000.339071.02134000.00000002.mdmp") Found string "crypto/aes.encryptBlockGo" (Indicator: "aes"; Source: "00000000-00000876.00000000.339071.02134000.00000002.mdmp") Found string "crypto/aes.encryptBlockGo" (Indicator: ".encrypt"; Source: "00000000-00000876.00000000.339071.02134000.00000002.mdmp") Found string "crypto/aes.decryptBlockGo" (Indicator: "aes"; Source: "00000000-00000876.00000000.339071.02134000.00000002.mdmp") Found string "crypto/aes.decryptBlockGo" (Indicator: ".decrypt"; Source: "00000000-00000876.00000000.339071.02134000.00000002.mdmp") Found string "crypto/aes.expandKeyGo" (Indicator: "aes"; Source: "00000000-00000876.00000000.339071.02134000.00000002.mdmp") Found string "crypto/aes.KeySizeError.Error" (Indicator: "aes"; Source: "00000000-00000876.00000000.339071.02134000.00000002.mdmp") Found string "crypto/aes.NewCipher" (Indicator: "aes"; Source: "00000000-00000876.00000000.339071.02134000.00000002.mdmp") Found string "crypto/aes.NewCipher" (Indicator: "aes.new"; Source: "00000000-00000876.00000000.339071.02134000.00000002.mdmp") Found string "crypto/aes.newCipherGeneric" (Indicator: "aes"; Source: "00000000-00000876.00000000.339071.02134000.00000002.mdmp") Found string "crypto/aes.newCipherGeneric" (Indicator: "aes.new"; Source: "00000000-00000876.00000000.339071.02134000.00000002.mdmp") Found string "crypto/aes.(*aesCipher).BlockSize" (Indicator: "aes"; Source: "00000000-00000876.00000000.339071.02134000.00000002.mdmp") Found string "crypto/aes.(*aesCipher).Encrypt" (Indicator: "aes"; Source: "00000000-00000876.00000000.339071.02134000.00000002.mdmp") Found string "crypto/aes.(*aesCipher).Encrypt" (Indicator: ".encrypt"; Source: "00000000-00000876.00000000.339071.02134000.00000002.mdmp") Found string "crypto/aes.(*aesCipher).Decrypt" (Indicator: "aes"; Source: "00000000-00000876.00000000.339071.02134000.00000002.mdmp") Found string "crypto/aes.(*aesCipher).Decrypt" (Indicator: ".decrypt"; Source: "00000000-00000876.00000000.339071.02134000.00000002.mdmp") Found string "crypto/aes.newCipher" (Indicator: "aes"; Source: "00000000-00000876.00000000.339071.02134000.00000002.mdmp") Found string "crypto/aes.newCipher" (Indicator: "aes.new"; Source: "00000000-00000876.00000000.339071.02134000.00000002.mdmp") Found string "crypto/aes.(*aesCipherAsm).BlockSize" (Indicator: "aes"; Source: "00000000-00000876.00000000.339071.02134000.00000002.mdmp")56:T63a,Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "RemusStealer.exe") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "RemusStealer.exe") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "RemusStealer.exe") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "RemusStealer.exe") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "RemusStealer.exe") Found reference to API "uncovered 46-49 pronics GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00000876.00000000.339071.00000000.00000004.mdmp, 00000000-00000876.00000001.340150.00000000.00000004.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00000876.00000000.339071.00000000.00000004.mdmp, 00000000-00000876.00000001.340150.00000000.00000004.mdmp") Found reference to API "syscall.GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00000876.00000000.339071.02134000.00000002.mdmp") Found reference to API "syscall.GetEnvironmentStrings" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00000876.00000000.339071.02134000.00000002.mdmp") Found reference to API "syscall.procGetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00000876.00000000.339071.02134000.00000002.mdmp") Found reference to API "syscall.procGetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00000876.00000000.339071.02134000.00000002.mdmp")57:T7dd,Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; File: "RemusStealer.exe") Found reference to API "internal/syscall/windows.GetSystemDirectory" (Indicator: "GetSystemDirectory"; Source: "00000000-00000876.00000000.339071.02134000.00000002.mdmp") Found reference to API "syscall.GetCurrentDirectory" (Indicator: "GetCurrentDirectory"; Source: "00000000-00000876.00000000.339071.02134000.00000002.mdmp") Found reference to API "syscall.GetFileAttributesEx" (Indicator: "GetFileAttributes"; Source: "00000000-00000876.00000000.339071.02134000.00000002.mdmp") Found reference to API "syscall.GetFileInformationByHandle" (Indicator: "GetFileInformationByHandle"; Source: "00000000-00000876.00000000.339071.02134000.00000002.mdmp") Found reference to API "internal/syscall/windows.GetFileInformationByHandleEx" (Indicator: "GetFileInformationByHandle"; Source: "00000000-00000876.00000000.339071.02134000.00000002.mdmp") Found reference to API "os.newFileStatFromGetFileInformationByHandle" (Indicator: "GetFileInformationByHandle"; Source: "00000000-00000876.00000000.339071.02134000.00000002.mdmp") Found reference to API "syscall.procGetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; Source: "00000000-00000876.00000000.339071.02134000.00000002.mdmp") Found reference to API "syscall.procGetFileAttributesExW" (Indicator: "GetFileAttributes"; Source: "00000000-00000876.00000000.339071.02134000.00000002.mdmp") Found reference to API "syscall.procGetFileInformationByHandle" (Indicator: "GetFileInformationByHandle"; Source: "00000000-00000876.00000000.339071.02134000.00000002.mdmp") Found reference to API "internal/syscall/windows.procGetFileInformationByHandleEx" (Indicator: "GetFileInformationByHandle"; Source: "00000000-00000876.00000000.339071.02134000.00000002.mdmp") Found reference to API "Win32API|File Installation Library Functions|GetFileVersionInfo" (Indicator: "GetFileVersionInfo"; Source: "00000000-00000876.00000001.340150.8F1C4000.00000004.mdmp")58:T55e,Found string "secret" (Indicator: "secret"; File: "RemusStealer.exe") Found string "password" (Indicator: "password"; File: "RemusStealer.exe") Found string "Enter password" (Indicator: "password"; File: "RemusStealer.exe") Found string "&Enter password for the encrypted file:" (Indicator: "password"; File: "RemusStealer.exe") Found string "Cannot create folder %sHChecksum error in the encrypted file %s. Corrupt file or wrong password." (Indicator: "password"; File: "RemusStealer.exe") Found string "Unknown encryption method in %s$The specified password is incorrect." (Indicator: "password"; File: "RemusStealer.exe") Found string "Incorrect password for %s" (Indicator: "password"; File: "RemusStealer.exe") Found string "passwordderivebytes" (Indicator: "password"; Source: "00000000-00007296.00000001.339555.341C0000.00000004.mdmp") Found string "sha1fornonsecretpurposes" (Indicator: "secret"; Source: "00000000-00007296.00000001.339555.341E0000.00000004.mdmp") Found string "passwordpropertytextattribute" (Indicator: "password"; Source: "00000000-00007296.00000001.339555.341E0000.00000004.mdmp") Found string "secretagreementflags" (Indicator: "secret"; Source: "00000000-00007296.00000001.339555.34200000.00000004.mdmp") Found string "safencryptsecrethandle" (Indicator: "secret"; Source: "00000000-00007296.00000001.339555.34200000.00000004.mdmp")59:T450,Found string "SELECT * FROM AntiVirusProduct" (Indicator: "antivirusproduct"; Source: "00000000-00000876-00002713-3552696392") Found string "M Win32_OperatingSystem" (Indicator: " Win32_OperatingSystem"; Source: "00000000-00000876.00000001.340150.8F110000.00000004.mdmp") Found string "ELECT * FROM ANTIVIRUSPRODUCT" (Indicator: "antivirusproduct"; Source: "00000000-00000876.00000001.340150.8F110000.00000004.mdmp") Found string "SELECT * FROM ANTIVIRUSPRODUCT" (Indicator: "antivirusproduct"; Source: "00000000-00000876.00000001.340150.8F110000.00000004.mdmp") Found string "AntiVirusProduct" (Indicator: "antivirusproduct"; Source: "00000000-00000876.00000001.340150.8F110000.00000004.mdmp, 00000000-00000876.00000001.340150.8F194000.00000004.mdmp, 00000000-00000876.00000001.340150.8F1C4000.00000004.mdmp") Found string "SELECT * FROM AntiVirusProduct" (Indicator: "antivirusproduct"; Source: "00000000-00000876.00000001.340150.8F194000.00000004.mdmp") Found string "CIM_PCVideoController" (Indicator: "CIM_PCVideoController"; Source: "00000000-00000876.00000001.340150.8F1C4000.00000004.mdmp")5a:Ta06,"RemusStealer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") "RemusStealer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "NAMESPACE_CALLOUT"; Value: "") "RemusStealer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "SERIAL_ACCESS_NUM"; Value: "") "RemusStealer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NEXT_CATALOG_ENTRY_ID"; Value: "") "RemusStealer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NUM_CATALOG_ENTRIES64"; Value: "") "RemusStealer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000001"; Key: "PACKEDCATALOGITEM"; Value: "") "RemusStealer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000002"; Key: "PACKEDCATALOGITEM"; Value: "") "RemusStealer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000003"; Key: "PACKEDCATALOGITEM"; Value: "") "RemusStealer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000004"; Key: "PACKEDCATALOGITEM"; Value: "") "RemusStealer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000005"; Key: "PACKEDCATALOGITEM"; Value: "") "RemusStealer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000006"; Key: "PACKEDCATALOGITEM"; Value: "") "RemusStealer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000007"; Key: "PACKEDCATALOGITEM"; Value: "") "RemusStealer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000008"; Key: "PACKEDCATALOGITEM"; Value: "") "RemusStealer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000009"; Key: "PACKEDCATALOGITEM"; Value: "")5b:T754,"RemusStealer.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS"; Value: "0100000000") "RemusStealer.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "INTRANETNAME"; Value: "0100000000") "RemusStealer.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "UNCASINTRANET"; Value: "0100000000") "RemusStealer.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "AUTODETECT"; Value: "0000000000") "RemusStealer.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\NOTIFICATIONS\DATA"; Key: "418A073AA3BC3475"; Value: "DB0C000000000000040004000102040000000000630000000D787900010000006B507E000200000087DE83004B000000A19F5E000400010000009100000056737D00070000006B507E00010000009829B70007000000E6C53100010004000000090000001A9CB2000100050000000100000016F0B20001006500000078030000E6C5310000") "OneDrive.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS"; Value: "0100000000") "OneDrive.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "INTRANETNAME"; Value: "0100000000") "OneDrive.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "UNCASINTRANET"; Value: "0100000000") "OneDrive.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "AUTODETECT"; Value: "0000000000") "powershell.exe" (Access type: "SETVAL"; Path: "HKCU\LOCAL SETTINGS\MUICACHE\2FD\52C64B7E"; Key: "LANGUAGELIST"; Value: "en-US")5c:T430,"RemusStealer.exe" reads file "C:\Users\%OSUSER%\Desktop\desktop.ini" "RemusStealer.exe" reads file "C:\Users\%OSUSER%\Documents\desktop.ini" "RemusStealer.exe" reads file "C:\Users\%OSUSER%\Music\desktop.ini" "RemusStealer.exe" reads file "C:\Users\%OSUSER%\Pictures\desktop.ini" "RemusStealer.exe" reads file "C:\Users\%OSUSER%\Videos\desktop.ini" "RemusStealer.exe" reads file "C:\Users\%OSUSER%\Downloads\desktop.ini" "RemusStealer.exe" reads file "C:\Users\%OSUSER%\OneDrive\desktop.ini" "RemusStealer.exe" reads file "C:\Users\desktop.ini" "OneDrive.exe" reads file "C:\Windows\win.ini" "OneDrive.exe" reads file "C:\Users\%OSUSER%\Desktop\desktop.ini" "OneDrive.exe" reads file "C:\Users\%OSUSER%\Documents\desktop.ini" "OneDrive.exe" reads file "C:\Users\%OSUSER%\Music\desktop.ini" "OneDrive.exe" reads file "C:\Users\%OSUSER%\Pictures\desktop.ini" "OneDrive.exe" reads file "C:\Users\%OSUSER%\Videos\desktop.ini" "OneDrive.exe" reads file "C:\Users\%OSUSER%\Downloads\desktop.ini" "OneDrive.exe" reads file "C:\Users\%OSUSER%\OneDrive\desktop.ini"5d:T77e,"RemusStealer.exe" has type "PE32+ executable for MS Windows 6.01 (GUI) x86-64 9 sections"- Location: [%LOCALAPPDATA%\RemusStealer\RemusStealer.exe]- [targetUID: 00000000-00000876] "tempdir.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 (stripped to external PDB) 3 sections"- Location: [%TEMP%\RarSFX0\tempdir.dll]- [targetUID: 00000000-00002448] "OneDrive.exe" has type "PE32+ executable for MS Windows 6.00 (GUI) x86-64 8 sections"- Location: [%TEMP%\OneDrive.exe]- [targetUID: 00000000-00000876] "OneDrive.exe" has type "PE32+ executable for MS Windows 6.00 (GUI) x86-64 6 sections"- Location: [%TEMP%\RarSFX0\OneDrive.exe]- [targetUID: 00000000-00000876] "signed_j0TYyO.exe" has type "PE32+ executable for MS Windows 6.00 (GUI) x86-64 6 sections"- Location: [%TEMP%\RarSFX0\signed_j0TYyO.exe]- [targetUID: 00000000-00007456] "vcruntime140.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 8 sections"- Location: [%ALLUSERSPROFILE%\TomatoIndigo\vcruntime140.dll]- [targetUID: 00000000-00002448] "sslconf.exe" has type "PE32+ executable for MS Windows 6.00 (console) x86-64 6 sections"- Location: [%ALLUSERSPROFILE%\TomatoIndigo\sslconf.exe]- [targetUID: 00000000-00002448] "tempdir.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 (stripped to external PDB) 3 sections"- Location: [%ALLUSERSPROFILE%\TomatoIndigo\tempdir.dll]- [targetUID: 00000000-00002448] "svchost.exe" has type "PE32+ executable for MS Windows 6.00 (GUI) x86-64 6 sections"- Location: [%LOCALAPPDATA%\Microsoft\svchost.exe]- [targetUID: 00000000-00002620] "vcruntime140.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 8 sections"- Location: [%TEMP%\RarSFX0\vcruntime140.dll]- [targetUID: 00000000-00002448] "sslconf.exe" has type "PE32+ executable for MS Windows 6.00 (console) x86-64 6 sections"- Location: [%TEMP%\RarSFX0\sslconf.exe]- [targetUID: 00000000-00002448]5e:Ta8e,"RemusStealer.exe" wrote 95 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\OneDrive.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000100100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e ... "RemusStealer.exe" wrote 45496 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\RemusStealer\RemusStealer.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "OneDrive.exe" wrote 61439 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\RarSFX0\OneDrive.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "OneDrive.exe" wrote 9920 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\RarSFX0\signed_j0TYyO.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "OneDrive.exe" wrote 30016 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\RarSFX0\sslconf.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000100100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "OneDrive.exe" wrote 61440 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\RarSFX0\tempdir.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff000000ffff12ff732330653cffffff0bffff0aff3d2529ff25ff0f1c5f2e04ff2a79ff7dffff19ffffffff19ffffff37ff1707ffffff4b61ff42ffff2d3b3f5a6e4c22 ... "sslconf.exe" wrote 30016 bytes starting with PE header signature to file "C:\ProgramData\TomatoIndigo\sslconf.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000100100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...5f:Tb61,"powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CRLS") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CTLS") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE")60:T5d0,"RemusStealer.exe" wrote 00000FB8 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\OneDrive.exe" (Handle: 1164) "RemusStealer.exe" wrote 00000008 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\OneDrive.exe" (Handle: 1164) "RemusStealer.exe" wrote 00000FB8 bytes to a remote process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" (Handle: 1324) "RemusStealer.exe" wrote 00000008 bytes to a remote process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" (Handle: 1324) "OneDrive.exe" wrote 00000FB8 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\RarSFX0\sslconf.exe" (Handle: 1288) "OneDrive.exe" wrote 00000008 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\RarSFX0\sslconf.exe" (Handle: 1288) "OneDrive.exe" wrote 00000FB8 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\RarSFX0\OneDrive.exe" (Handle: 1388) "OneDrive.exe" wrote 00000008 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\RarSFX0\OneDrive.exe" (Handle: 1388) "sslconf.exe" wrote 00000FB8 bytes to a remote process "C:\ProgramData\TomatoIndigo\sslconf.exe" (Handle: 976) "sslconf.exe" wrote 00000008 bytes to a remote process "C:\ProgramData\TomatoIndigo\sslconf.exe" (Handle: 976) "OneDrive.exe" wrote 00000FB8 bytes to a remote process "C:\Windows\System32\schtasks.exe" (Handle: 368) "OneDrive.exe" wrote 00000008 bytes to a remote process "C:\Windows\System32\schtasks.exe" (Handle: 368)61:T400,AAABAAEAICAQsAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADu7u7u7u7u7u7u7gAAAA7u7u7u7u7u7u7u7u7uAADu7u7u7u7u7u7u7u7u7uAO7u7u7u7u7u7u7u7u7u7mbu7u7u7u7u7u7u7u7u7uZmZm7u7u7u7u7u7u7u7uZmZmZmbu7u7u7u7u7u7uZmZmZmZmZm7u7u7u7u7u5mZmZmZmZmZmbu7u7u7u5mZmZmZmZmZmZmZu7u7u5mZmZmZmZmZmZmZmZmbu7mZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZgZmZmZmZmZmZmZmZmZmZmAAZmZmZmZmZmZmZmZmZmAAAAZmZmZmZmZmZmZmZmAAAAAAZmZmZmZmZmZmZmZgAAAAAABmZmZmZmZmZmZmAAAAAAAAAAZmZmZmZmZmZgAAAAAAAAAGZmZmZmZmZmAAAAAAAAAAAAZmZmZmZmYAAAAAAAAAAAAAZmZmZmYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD///////////////////////////AAAAPAAAABgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABgAAAB8AAAB/gAAAf+AAAP/8AAH//gAD//8AB///wB////////////////////////////w==1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"d44e6faaf3df358593a29faace64a071ab8de0a84c30a5232d8e9081dd668f1b","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1792299736934,"unified_at":"2026-10-18T05:02:16.934Z","metadata":{"hashes":{"sha256":"d44e6faaf3df358593a29faace64a071ab8de0a84c30a5232d8e9081dd668f1b","sha1":"32c8e90b75f37bdaabab9e32ede708969930d501","md5":"ce8cd7ff4a20d2e54511fd473890f9ed","sha512":"7c197153dd47e66c4161c1b0cdb7ef7ca04c22748aa35d1957a051afe0b57d98ad3ff25b4c479c7c1b510f930396f0a577b445f8eedd6f0f58cb7c0ff39b4ff4","ssdeep":"196608:5qky4MPis6BaQdPsCGxQllByuyHb/c2zZ7sNyo8d6h7mNT1VBjuP9GvainYQgSe8:9ydis5CGo3XC/cMZBo8d6hizYQgSRhv","ssdeep_chunks":["196608:5qky4MP","196608:qky4MPi","196608:ky4MPis","196608:y4MPis6","196608:4MPis6B","196608:MPis6Ba","196608:Pis6BaQ","196608:is6BaQd","196608:s6BaQdP","196608:6BaQdPs","196608:BaQdPsC","196608:aQdPsCG","196608:QdPsCGx","196608:dPsCGxQ","196608:PsCGxQl","196608:sCGxQll","196608:CGxQllB","196608:GxQllBy","196608:xQllByu","196608:QllByuy","196608:llByuyH","196608:lByuyHb","196608:ByuyHb/","196608:yuyHb/c","196608:uyHb/c2","196608:yHb/c2z","196608:Hb/c2zZ","196608:b/c2zZ7","196608:/c2zZ7s","196608:c2zZ7sN","196608:2zZ7sNy","196608:zZ7sNyo","196608:Z7sNyo8","196608:7sNyo8d","196608:sNyo8d6","196608:Nyo8d6h","196608:yo8d6h7","196608:o8d6h7m","196608:8d6h7mN","196608:d6h7mNT","196608:6h7mNT1","196608:h7mNT1V","196608:7mNT1VB","196608:mNT1VBj","196608:NT1VBju","196608:T1VBjuP","196608:1VBjuP9","196608:VBjuP9G","196608:BjuP9Gv","196608:juP9Gva","196608:uP9Gvai","196608:P9Gvain","196608:9GvainY","196608:GvainYQ","196608:vainYQg","196608:ainYQgS","196608:inYQgSe","196608:nYQgSe8","393216:5qky4MP","393216:qky4MPi","393216:ky4MPis","393216:y4MPis6","393216:4MPis6B","393216:MPis6Ba","393216:Pis6BaQ","393216:is6BaQd","393216:s6BaQdP","393216:6BaQdPs","393216:BaQdPsC","393216:aQdPsCG","393216:QdPsCGx","393216:dPsCGxQ","393216:PsCGxQl","393216:sCGxQll","393216:CGxQllB","393216:GxQllBy","393216:xQllByu","393216:QllByuy","393216:llByuyH","393216:lByuyHb","393216:ByuyHb/","393216:yuyHb/c","393216:uyHb/c2","393216:yHb/c2z","393216:Hb/c2zZ","393216:b/c2zZ7","393216:/c2zZ7s","393216:c2zZ7sN","393216:2zZ7sNy","393216:zZ7sNyo","393216:Z7sNyo8","393216:7sNyo8d","393216:sNyo8d6","393216:Nyo8d6h","393216:yo8d6h7","393216:o8d6h7m","393216:8d6h7mN","393216:d6h7mNT","393216:6h7mNT1","393216:h7mNT1V","393216:7mNT1VB","393216:mNT1VBj","393216:NT1VBju","393216:T1VBjuP","393216:1VBjuP9","393216:VBjuP9G","393216:BjuP9Gv","393216:juP9Gva","393216:uP9Gvai","393216:P9Gvain","393216:9GvainY","393216:GvainYQ","393216:vainYQg","393216:ainYQgS","393216:inYQgSe","393216:nYQgSe8","196608:9ydis5C","196608:ydis5CG","196608:dis5CGo","196608:is5CGo3","196608:s5CGo3X","196608:5CGo3XC","196608:CGo3XC/","196608:Go3XC/c","196608:o3XC/cM","196608:3XC/cMZ","196608:XC/cMZB","196608:C/cMZBo","196608:/cMZBo8","196608:cMZBo8d","196608:MZBo8d6","196608:ZBo8d6h","196608:Bo8d6hi","196608:o8d6hiz","196608:8d6hizY","196608:d6hizYQ","196608:6hizYQg","196608:hizYQgS","196608:izYQgSR","196608:zYQgSRh","196608:YQgSRhv"],"imphash":"d42595b695fc008ef2c56aabd8efd68e","pehash":"c273b090e10da2cde74ed80a4437753d920345fd"},"file_info":{"file_name":"file.exe","file_type":["peexe","64bits","executable"],"file_type_id":"64-bit exe","file_size":20099512,"entropy":7.6,"compile_timestamp":"1970-01-01T00:00:00","is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1792279836000,"last_seen":1792299656000,"last_multi_scan":1792299656000},"pe_metadata":{"is_dll":false,"is_packed":false,"section_count":9,"import_count":0,"export_count":0,"embedded_file_count":3,"sections":[{"name":".text","virtual_address":"0x1000","virtual_size":4034124,"raw_size":4034560},{"name":".rdata","virtual_address":"0x3da000","virtual_size":15278480,"raw_size":15278592},{"name":".data","virtual_address":"0x126d000","virtual_size":548040,"raw_size":221184},{"name":".pdata","virtual_address":"0x12f3000","virtual_size":59208,"raw_size":59392},{"name":".xdata","virtual_address":"0x1302000","virtual_size":180,"raw_size":512},{"name":".idata","virtual_address":"0x1303000","virtual_size":1342,"raw_size":1536},{"name":".reloc","virtual_address":"0x1304000","virtual_size":48716,"raw_size":49152},{"name":".symtab","virtual_address":"0x1310000","virtual_size":376701,"raw_size":376832},{"name":".rsrc","virtual_address":"0x136c000","virtual_size":67804,"raw_size":68096}],"section_names":[".text",".rdata",".data",".pdata",".xdata",".idata",".reloc",".symtab",".rsrc"],"imported_dlls":null,"imported_functions":null}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["evasive"]},"stats":{"av":{"malicious_count":4,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":2,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":102},"sandbox_signatures":{"informative_count":225,"suspicious_count":21,"malicious_count":11,"total":257},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/W64.Evo","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"crowdstrikefalconml":{"name":"CrowdStrike Falcon ML","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of WinGo/Kryptik.ABE trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W64/WinGo.J.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Win/malicious_confidence_60%","sources":[{"report_type":"quickscan","report_id":""}]},{"value":"Win/malicious_confidence_100%","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Reconnaissance","technique":"IP Addresses","attack_id":"T1590.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1590/005","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Input file contains API references not part of its Import Address Table (IAT)"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Able to execute applications using .NET process API"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Calls an API typically used to find a resource in a module"}],"sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Found named pipe like strings"},{"type":"informative","value":"Contains ability to create/connect to a named pipe (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"},{"type":"informative","value":"Able to retrieve command line parameters of the running process"}],"sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"suspicious","value":"Contains references to WMI/WMIC"},{"type":"informative","value":"Contains ability to execute a WMI query"}],"sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"tactic":"Execution","technique":"Scheduled Task","attack_id":"T1053.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1053/005","identifiers":[{"type":"malicious","value":"Schedules a task to be executed at a specific time and date"},{"type":"malicious","value":"Schedules a task to be executed from task XML file"}],"sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"tactic":"Execution","technique":"PowerShell","attack_id":"T1059.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/001","identifiers":[{"type":"informative","value":"Able to build PowerShell events through modules contained in the .NET code"},{"type":"informative","value":"Executes PowerShell with command line"}],"sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Fails to load modules at runtime"},{"type":"informative","value":"Loads rich edit control libraries"},{"type":"informative","value":"Loads the .NET runtime environment"},{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"}],"sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"tactic":"Execution","technique":"Command and Scripting Interpreter","attack_id":"T1059","attack_id_wiki":"https://attack.mitre.org/techniques/T1059","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"tactic":"Execution","technique":"Component Object Model","attack_id":"T1559.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1559/001","identifiers":[{"type":"malicious","value":"Loads the task scheduler COM API"}],"sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"tactic":"Execution","technique":"Malicious File","attack_id":"T1204.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1204/002","identifiers":[{"type":"malicious","value":"The analysis spawned a process that was identified as malicious"},{"type":"malicious","value":"The analysis extracted a file that was identified as malicious"}],"sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"tactic":"Execution","technique":"DLL","attack_id":"T1574.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/001","identifiers":[{"type":"informative","value":"Potential hijacking of DLL execution flow detected"}],"sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"tactic":"Persistence","technique":"Registry Run Keys / Startup Folder","attack_id":"T1547.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/001","identifiers":[{"type":"informative","value":"Contains reference to Windows Startup folder"}],"sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Able to create/load registry keys (API string)"},{"type":"informative","value":"Writes registry keys"},{"type":"informative","value":"Accesses System Certificates Settings"},{"type":"suspicious","value":"Modifies Software Policy Settings"}],"sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"tactic":"Persistence","technique":"Socket Filters","attack_id":"T1205.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1205/002","identifiers":[{"type":"informative","value":"Able to monitor socket connection"}],"sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Creates or modifies windows services"}],"sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"tactic":"Persistence","technique":"Transport Agent","attack_id":"T1505.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1505/002","identifiers":[{"type":"informative","value":"Able to establish persistence using Exchange transport agent (.NET)"}],"sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"tactic":"Persistence","technique":"Shortcut Modification","attack_id":"T1547.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/009","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Able to modify thread functionality – possible hijack (API string)"},{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"malicious","value":"Writes data to a remote process"},{"type":"malicious","value":"Creates a process in suspended mode (likely for process injection)"},{"type":"informative","value":"Able to inject code into another process (API string)"},{"type":"informative","value":"Found PE header in memory"}],"sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"tactic":"Privilege Escalation","technique":"Abuse Elevation Control Mechanism","attack_id":"T1548","attack_id_wiki":"https://attack.mitre.org/techniques/T1548","identifiers":[{"type":"informative","value":"Contains ability to use security policy setting (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"tactic":"Privilege Escalation","technique":"Create Process with Token","attack_id":"T1134.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/002","identifiers":[{"type":"informative","value":"Contains ability to create process with token (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to modify access token privileges (API string)"},{"type":"informative","value":"Calls an API typically used to enable or disable privileges in the specified access token"}],"sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"tactic":"Credential Access","technique":"Steal Web Session Cookie","attack_id":"T1539","attack_id_wiki":"https://attack.mitre.org/techniques/T1539","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"tactic":"Credential Access","technique":"Steal or Forge Kerberos Tickets","attack_id":"T1558","attack_id_wiki":"https://attack.mitre.org/techniques/T1558","identifiers":[{"type":"informative","value":"Able to access credential file using Kerberos"}],"sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"tactic":"Credential Access","technique":"Credential API Hooking","attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","identifiers":[{"type":"suspicious","value":"Hooks API calls"}],"sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Able to enumerate system processes using native API"},{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"malicious","value":"Spawns many processes"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Process launched with changed environment"}],"sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Found system command-related strings"},{"type":"informative","value":"Able to gather system information (.NET)"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"References to WMI query strings used for information discovery"},{"type":"informative","value":"Reads system-defined device setup information from registry"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Able to retrieve geographical location information"},{"type":"informative","value":"Contains ability to retrieve the NetBIOS name of the local computer (API string)"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Able to discover operating system information (API string)"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve computer name"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Reads the cryptographic machine GUID"}],"sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"tactic":"Discovery","technique":"Time Based Checks","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Tries to access LNK files (Windows shortcut)"},{"type":"informative","value":"Calls an API typically used for searching a directory for files"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Contains ability to retrieve list of files and subdirectories"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Reads files"},{"type":"suspicious","value":"Reads configuration files (.ini files)"}],"sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"suspicious","value":"Queries sensitive IE security settings"},{"type":"suspicious","value":"Reads VM-specific registry key"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Found registry location strings in memory"},{"type":"informative","value":"Able to query registry keys (API string)"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Reads Windows Trust Settings"}],"sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Contains ability to query network adapter information (API string)"},{"type":"informative","value":"Detected Suricata Alert - External IP Lookup"},{"type":"suspicious","value":"Attempts to identify external IP address"},{"type":"informative","value":"Able to determine NetBIOS or DNS name associated with the local computer"},{"type":"informative","value":"Contains ability to retrieve the local name for a socket (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve local language"},{"type":"informative","value":"Able to query system locale information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Reads the windows installation language"},{"type":"informative","value":"Calls an API typically used to retrieve default language settings"},{"type":"informative","value":"Able to retrieve system language (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Calls an API typically used to enumerate active windows"},{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"},{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"},{"type":"informative","value":"Scanning for window names"},{"type":"informative","value":"Calls an API typically used to get active windows title"}],"sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"tactic":"Discovery","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"tactic":"Discovery","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to check debugger is running (API string)"},{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve user name"},{"type":"informative","value":"Able to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Able to query security token membership for user discovery (API string)"},{"type":"informative","value":"Queries the user identity associated with the current process token"},{"type":"informative","value":"Calls an API typically used to retrieve account information for specified SID"}],"sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"tactic":"Discovery","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using API string"}],"sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine timezone (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"tactic":"Discovery","technique":"Remote System Discovery","attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","identifiers":[{"type":"informative","value":"Able to identify remote systems"}],"sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"tactic":"Discovery","technique":"Peripheral Device Discovery","attack_id":"T1120","attack_id_wiki":"https://attack.mitre.org/techniques/T1120","identifiers":[{"type":"malicious","value":"Queries firmware table information (may be used to fingerprint/evade)"}],"sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"tactic":"Discovery","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"},{"type":"informative","value":"Observed a high volume of repeated registry API calls (API Hammering)"}],"sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"tactic":"Discovery","technique":"Account Discovery","attack_id":"T1087","attack_id_wiki":"https://attack.mitre.org/techniques/T1087","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"tactic":"Discovery","technique":"Local Storage Discovery","attack_id":"T1680","attack_id_wiki":"https://attack.mitre.org/techniques/T1680","identifiers":[{"type":"informative","value":"Calls an API typically used to enumerate Windows drive types"}],"sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Calls an API typically used to create an instance of a named pipe"}],"sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Able to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Contains SQL queries"}],"sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"},{"type":"informative","value":"Calls an API typically used to create a directory"}],"sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"tactic":"Collection","technique":"Archive via Library","attack_id":"T1560.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1560/002","identifiers":[{"type":"informative","value":"Able to perform archive via gzip Library"},{"type":"informative","value":"Able to compress/decompress content at runtime"}],"sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"informative","value":"Found E-Mail address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"suspicious","value":"Queries the display settings of system associated file extensions"},{"type":"informative","value":"Writes files in a temp directory"},{"type":"informative","value":"Calls an API typically used to copy file from one location to another"}],"sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"tactic":"Collection","technique":"Automated Collection","attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","identifiers":[{"type":"informative","value":"Shows ability to send encrypted data to the internet"}],"sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Drops files with image extension"},{"type":"informative","value":"Drops XML files"},{"type":"suspicious","value":"Writes a PE file header to disc"},{"type":"suspicious","value":"Drops executable files"},{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Drops executable files inside temp directory"}],"sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Communicates with HTTP web server (GET/POST requests)"},{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"},{"type":"informative","value":"Found string related to HTTP headers"},{"type":"informative","value":"Calls an API typically used to send the specified request to the HTTP server"},{"type":"informative","value":"GETs files from a web server (PE files)"},{"type":"informative","value":"GETs files from a web server (HTTPS)"}],"sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Contacts server"},{"type":"informative","value":"Contacts domains"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Found potential URLs in memory dumps"}],"sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"Contains ability to perform Base64 encoding/decoding"},{"type":"informative","value":"HTTP requests contain Base64 strings"}],"sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Able to use Microsoft's Enhanced Cryptographic Provider"}],"sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"informative","value":"Contains ability to communicate with C2 using Sockets (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"informative","value":"Contains ability to open a port and listen for incoming connection (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","identifiers":[{"type":"informative","value":"Contains ability to perform encryption/decryption using RSA algorithm"}],"sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"tactic":"Command and Control","technique":"Internal Proxy","attack_id":"T1090.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1090/001","identifiers":[{"type":"suspicious","value":"Modifies proxy settings"}],"sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"tactic":"Command and Control","technique":"Domain Generation Algorithms","attack_id":"T1568.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1568/002","identifiers":[{"type":"informative","value":"High entropy domain detected"}],"sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"tactic":"Command and Control","technique":"Steganography","attack_id":"T1001.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1001/002","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over Unencrypted Non-C2 Protocol","attack_id":"T1048.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1048/003","identifiers":[{"type":"informative","value":"Data transmitted in plain text over an insecure network protocol/port"}],"sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to shutdown system"}],"sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains ability to perform encryption (API string)"},{"type":"informative","value":"Contains possible references to Golang crypto modules"},{"type":"informative","value":"Contains reference to crypto DLLs"},{"type":"informative","value":"Contains reference to cryptographic keys"},{"type":"informative","value":"Able to access crypto-related API (String)"}],"sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"tactic":"Stealth","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"suspicious","value":"Timestamp in PE header is very old or in the future"},{"type":"suspicious","value":"CRC value set in PE header does not match actual value"},{"type":"informative","value":"Possibly references Golang binary related string"},{"type":"informative","value":"Contains ability to perform AES/RC4 encryption (API string)"},{"type":"informative","value":"Contains key cryptographic functions (API string)"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"YARA signature match - AES encryption"}],"sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"tactic":"Stealth","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Able to decrypt/decode data"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"},{"type":"informative","value":"Contains ability to perform decryption (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"tactic":"Stealth","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to show a graphical window (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"tactic":"Stealth","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"tactic":"Stealth","technique":"Mutual Exclusion","attack_id":"T1480.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1480/002","identifiers":[{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"tactic":"Stealth","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"suspicious","value":"Marks file for deletion"},{"type":"suspicious","value":"Opens file with deletion access rights"}],"sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"tactic":"Stealth","technique":"Match Legitimate Resource Name or Location","attack_id":"T1036.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1036/005","identifiers":[{"type":"informative","value":"Creates file(s) in System32 or SysWOW64 directory"}],"sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"tactic":"Stealth","technique":"Reflective Code Loading","attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Loads the CLR Loader DLL"}],"sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"tactic":"Stealth","technique":"Masquerade Task or Service","attack_id":"T1036.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1036/004","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"tactic":"Stealth","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"malicious","value":"Drops executable files to the application program directory (%ProgramData%)"},{"type":"informative","value":"Drops files inside appdata directory"}],"sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"tactic":"Stealth","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"}],"sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"tactic":"Stealth","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"tactic":"Stealth","technique":"Junk Code Insertion","attack_id":"T1027.016","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/016","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"tactic":"Stealth","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"suspicious","value":"Section contains high entropy"},{"type":"informative","value":".rdata section contains high entropy"},{"type":"informative","value":"YARA signature match – Embedded PE executable"}],"sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"tactic":"Stealth","technique":"Stripped Payloads","attack_id":"T1027.008","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/008","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"tactic":"Stealth","technique":"Encrypted/Encoded File","attack_id":"T1027.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/013","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"tactic":"Stealth","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"tactic":"Defense Impairment","technique":"Disable or Modify Tools","attack_id":"T1685","attack_id_wiki":"https://attack.mitre.org/techniques/T1685","identifiers":[{"type":"informative","value":"Contains ability to modify process attributes (API string)"},{"type":"informative","value":"Contains strings related to AMSI (Anti Malware Scan Interface)"},{"type":"informative","value":"Modifies process error mode to suppress error dialogs"},{"type":"informative","value":"Calls GetProcAddress on AmsiScanBuffer function (may used to bypass AMSI)"},{"type":"informative","value":"Loads the AMSI (Antimalware Scan Interface) DLL"},{"type":"suspicious","value":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)"}],"sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"tactic":"Defense Impairment","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to build PowerShell events through modules contained in the .NET code","description":"$27","origin":"File/Memory","mitre_attack_id":"T1059.001","relevance":1,"id":"string-942","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to compress/decompress content at runtime","description":"Found string \"system.io.compression\" (Source: \"00000000-00007296.00000001.339555.341E0000.00000004.mdmp, 00000000-00007296.00000001.339555.34200000.00000004.mdmp\")\n Found string \"compressionmode\" (Source: \"00000000-00007296.00000001.339555.341E0000.00000004.mdmp\")\n Found string \"decompressionmethods\" (Source: \"00000000-00007296.00000001.339555.341E0000.00000004.mdmp\")\n Found string \"compressionlevel\" (Source: \"00000000-00007296.00000001.339555.341E0000.00000004.mdmp\")\n Found string \"compressionstrategy\" (Source: \"00000000-00007296.00000001.339555.341E0000.00000004.mdmp\")\n Found string \"compressionmethod\" (Source: \"00000000-00007296.00000001.339555.341E0000.00000004.mdmp\")\n Found string \"compressiontracingswitchlevel\" (Source: \"00000000-00007296.00000001.339555.34200000.00000004.mdmp\")\n Found string \"compressiontracingswitch\" (Source: \"00000000-00007296.00000001.339555.34200000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1560.002","relevance":1,"id":"string-935","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"Found reference to API \"VirtualFree\" (Indicator: \"VirtualFree\"; File: \"RemusStealer.exe\")\n Found reference to API \"VirtualAlloc\" (Indicator: \"VirtualAlloc\"; File: \"RemusStealer.exe\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"RemusStealer.exe\")\n Found reference to API \"CreateThread failed\" (Indicator: \"CreateThread\"; File: \"RemusStealer.exe\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify thread functionality – possible hijack (API string)","description":"Found reference to API \"SetThreadContext\" (Indicator: \"SetThreadContext\"; File: \"RemusStealer.exe\")\n Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; File: \"RemusStealer.exe\")\n Found reference to API \"GetThreadContext\" (Indicator: \"GetThreadContext\"; File: \"RemusStealer.exe\")\n Found reference to API \"SuspendThread\" (Indicator: \"SuspendThread\"; File: \"RemusStealer.exe\")","origin":"File/Memory","mitre_attack_id":"T1055.003","relevance":3,"id":"string-309","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to find a resource in a module","description":"\"OneDrive.exe\" called \"FindResourceW\" with parameter \"101\" - (UID: 00000000-00007456)\n \"OneDrive.exe\" called \"FindResourceW\" with parameter \"140700649713344\" - (UID: 00000000-00007456)\n \"powershell.exe\" called \"FindResourceW\" with parameter \"7\" - (UID: 00000000-00007296)\n \"powershell.exe\" called \"FindResourceW\" with parameter \"63\" - (UID: 00000000-00007296)\n \"powershell.exe\" called \"FindResourceW\" with parameter \"64\" - (UID: 00000000-00007296)\n \"powershell.exe\" called \"FindResourceW\" with parameter \"8\" - (UID: 00000000-00007296)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-140","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to load a resource in memory","description":"\"OneDrive.exe\" called \"LoadResource with parameter {'hModule': '140700649390080', 'hResInfo': '140700649886560'}\" (UID: 00000000-00007456)\n \"powershell.exe\" called \"LoadResource with parameter {'hModule': '2581025587201', 'hResInfo': '2581025588448'}\" (UID: 00000000-00007296)\n \"powershell.exe\" called \"LoadResource with parameter {'hModule': '2581025587201', 'hResInfo': '2581025588480'}\" (UID: 00000000-00007296)\n \"powershell.exe\" called \"LoadResource with parameter {'hModule': '2581025587201', 'hResInfo': '2581025588496'}\" (UID: 00000000-00007296)\n \"powershell.exe\" called \"LoadResource with parameter {'hModule': '2581025587201', 'hResInfo': '2581025588464'}\" (UID: 00000000-00007296)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"$28","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; File: \"RemusStealer.exe\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; File: \"RemusStealer.exe\")\n Found reference to API \"syscall.LoadLibrary\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00000876.00000000.339071.02134000.00000002.mdmp\")\n Found reference to API \"syscall._LoadLibrary\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00000876.00000000.339071.02134000.00000002.mdmp\")\n Found reference to API \"syscall.procLoadLibraryW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00000876.00000000.339071.02134000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to perform Base64 encoding/decoding","description":"$29","origin":"File/Memory","mitre_attack_id":"T1132","relevance":1,"id":"string-338","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"$2a","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains strings related to AMSI (Anti Malware Scan Interface)","description":"Observed string: \":\\WINDOWS\\SYSTEM32\\amsi.dll\" (Indicator: \"amsi.dll\") in Source: 00000000-00007296.00000000.339360.F1720000.00000004.mdmp\n 00000000-00007296.00000001.339555.F1720000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1685","relevance":1,"id":"string-231","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00000876.00000001.340150.40000000.00000040.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Modifies process error mode to suppress error dialogs","description":"\"RemusStealer.exe\" set its error mode to SEM_NOOPENFILEERRORBOX\n \"RemusStealer.exe\" set its error mode to SEM_FAILCRITICALERRORS\n \"OneDrive.exe\" set its error mode to SEM_NOOPENFILEERRORBOX\n \"OneDrive.exe\" set its error mode to SEM_FAILCRITICALERRORS","origin":"API Call","mitre_attack_id":"T1685","relevance":10,"id":"api-38","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"$2b","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"$2c","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount\"; File: \"RemusStealer.exe\")\n Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"RemusStealer.exe\")\n Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; File: \"RemusStealer.exe\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"RemusStealer.exe\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"RemusStealer.exe\")\n Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"RemusStealer.exe\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-148","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to access crypto-related API (String)","description":"Found reference to API \"CryptProtectMemory failed\" (Indicator: \"CryptProtectMemory\"; File: \"RemusStealer.exe\")\n Found reference to API \"CryptUnprotectMemory failed\" (Indicator: \"CryptUnprotectMemory\"; File: \"RemusStealer.exe\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-920","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to decrypt/decode data","description":"$2d","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-356","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to perform archive via gzip Library","description":"$2e","origin":"File/Memory","mitre_attack_id":"T1560.002","relevance":1,"id":"string-725","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to use Microsoft's Enhanced Cryptographic Provider","description":"$2f","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-602","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform AES/RC4 encryption (API string)","description":"Found reference to API \"CryptProtectMemory failed\" (Indicator: \"CryptProtectMemory\"; File: \"RemusStealer.exe\")\n Found reference to API \"CryptUnprotectMemory failed\" (Indicator: \"CryptUnprotectMemory\"; File: \"RemusStealer.exe\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-438","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform decryption (API string)","description":"Found reference to API \"CryptUnprotectMemory failed\" (Indicator: \"CryptUnprotectMemory\"; File: \"RemusStealer.exe\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-212","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform encryption (API string)","description":"Found reference to API \"CryptProtectMemory failed\" (Indicator: \"CryptProtectMemory\"; File: \"RemusStealer.exe\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-108","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform encryption/decryption using RSA algorithm","description":"Found string \"rsacryptoserviceprovider\" (Indicator: \"RSACryptoServiceProvider\"; Source: \"00000000-00007296.00000001.339555.341C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1573.002","relevance":1,"id":"string-352","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains key cryptographic functions (API string)","description":"Found reference to API \"CryptProtectMemory failed\" (Indicator: \"CryptProtectMemory\"; File: \"RemusStealer.exe\")\n Found reference to API \"CryptUnprotectMemory failed\" (Indicator: \"CryptUnprotectMemory\"; File: \"RemusStealer.exe\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-195","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains possible references to Golang crypto modules","description":"$30","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-234","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to crypto DLLs","description":"Found string \":\\WINDOWS\\SYSTEM32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00000876.00000000.339071.8F110000.00000004.mdmp, 00000000-00000876.00000001.340150.8F110000.00000004.mdmp\")\n Found string \":\\WINDOWS\\SYSTEM32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00007296.00000000.339360.EF460000.00000004.mdmp, 00000000-00007296.00000001.339555.EF460000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-493","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to cryptographic keys","description":"Found string \"ncrypted Private Key\" (Indicator: \"private key\"; Source: \"00000000-00007296.00000000.339360.F1720000.00000004.mdmp, 00000000-00007296.00000001.339555.F1720000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-280","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"Cryptographic Related","name":"HTTP requests contain Base64 strings","description":"Contains base64 string in header \"comCache\" in header \"GET /line/?fields=country HTTP/1.1Host: ip-api.comCache-Control: no-cache\"\n Contains base64 string in header \"orgCache\" in header \"GET / HTTP/1.1Host: api.ipify.orgCache-Control: no-cache\"","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-60","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: HTTP requests contain Base64 strings\n Matched sigs: YARA signature match - AES encryption","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"$31","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: YARA signature match - AES encryption","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$32","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate system processes using native API","description":"Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00007296-00000C2C-3539285448\")\n Found reference to API \"NtQuerySystemInformationW\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00007296-00000C2C-3539841888\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-907","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system information (.NET)","description":"Found string \"System.Identity.UserName\" (Source: \"00000000-00000876.00000000.339071.D7CF0000.00000002.mdmp\")\n Found string \"System.Identity.QualifiedUserName\" (Source: \"00000000-00000876.00000000.339071.D7CF0000.00000002.mdmp\")\n Found string \"System.UserName\" (Source: \"00000000-00000876.00000000.339071.D7CF0000.00000002.mdmp\")\n Found string \"GetUserNameA\" (Source: \"00000000-00000876.00000001.340150.40000000.00000040.mdmp\")\n Found string \"ystem.Identity.QualifiedUserName\" (Source: \"00000000-00000876.00000001.340150.D7CA0000.00000002.mdmp\")\n Found string \"ystem.Identity.UserName\" (Source: \"00000000-00000876.00000001.340150.D7CA0000.00000002.mdmp\")\n Found string \"ystem.UserName\" (Source: \"00000000-00000876.00000001.340150.D7CA0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-937","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00007296-00000C2C-3539285448\")\n Found string \"NtQuerySystemInformationW\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00007296-00000C2C-3539841888\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"RemusStealer.exe\")\n Found string \"syscall.GetCommandLine\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00000876.00000000.339071.02134000.00000002.mdmp\")\n Found string \"syscall.procGetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00000876.00000000.339071.02134000.00000002.mdmp\")\n Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00000876.00000001.340150.40000000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; Source: \"00000000-00007296-00000C2C-3537898698\")\n Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; Source: \"00000000-00007296-00000C2C-3537898870\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00007296-00000C2C-3541307023\")\n Found reference to API \"CheckTokenMembershipW\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00007296-00000C2C-3541307062\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"Found reference to API \"GetSystemDefaultLCID\" (Indicator: \"GetSystemDefaultLCID\"; File: \"RemusStealer.exe\")","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve geographical location information","description":"Found reference to API \"syscall.GetAddrInfoW\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00000876.00000000.339071.02134000.00000002.mdmp\")\n Found reference to API \"syscall.procGetAddrInfoW\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00000876.00000000.339071.02134000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-739","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"Found system information discovery API: \"GetEnvironmentStringsW\" in file \"RemusStealer.exe\"\n Found system information discovery API: \"GetSystemInfo\" in file \"RemusStealer.exe\"\n Found system information discovery API: \"uncovered 46-49 pronics GetEnvironmentStringsW\" in \"00000000-00000876.00000000.339071.00000000.00000004.mdmp, 00000000-00000876.00000001.340150.00000000.00000004.mdmp\"\n Found system information discovery API: \"syscall.GetEnvironmentStrings\" in \"00000000-00000876.00000000.339071.02134000.00000002.mdmp\"\n Found system information discovery API: \"syscall.procGetEnvironmentStringsW\" in \"00000000-00000876.00000000.339071.02134000.00000002.mdmp\"\n Found system information discovery API: \"internal/syscall/windows/registry.procExpandEnvironmentStringsW\" in \"00000000-00000876.00000000.339071.02134000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve system language (API string)","description":"Found reference to API \"GetKeyboardType\" (Indicator: \"GetKeyboardType\"; File: \"RemusStealer.exe\")\n Found reference to API \"GetKeyboardLayout\" (Indicator: \"GetKeyboardLayout\"; File: \"RemusStealer.exe\")\n Found reference to API \"GetUserDefaultLangID\" (Indicator: \"GetUserDefaultLangID\"; File: \"RemusStealer.exe\")\n Found reference to API \"GetSystemDefaultLangID\" (Indicator: \"GetSystemDefaultLangID\"; File: \"RemusStealer.exe\")\n Found reference to API \"GetKeyboardLayout\" (Indicator: \"GetKeyboardLayout\"; Source: \"00000000-00000876.00000001.340150.40000000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"Found reference to API \"SendMessageW\" (Indicator: \"sendmessage\"; Source: \"00000000-00007456-00000C2C-3534845925\")\n Found reference to API \"FindWindowExW\" (Indicator: \"findwindow\"; Source: \"00000000-00007456-00000C2C-3534849366\")\n Found reference to API \"EnumWindows\" (Indicator: \"enumwindows\"; Source: \"00000000-00007296-00000C2C-3539446387\")\n Found reference to API \"EnumWindowsW\" (Indicator: \"enumwindows\"; Source: \"00000000-00007296-00000C2C-3539446431\")","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"OneDrive.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00007456)\n \"powershell.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00007296)","origin":"API Call","mitre_attack_id":"T1497","relevance":3,"id":"api-296","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"RemusStealer.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00000876)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"RemusStealer.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00000876)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API possibly used to retrieve a handle to the foreground window","description":"\"RemusStealer.exe\" called \"GetForegroundWindow\" (UID: 00000000-00000876)\n \"OneDrive.exe\" called \"GetForegroundWindow\" (UID: 00000000-00007456)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-142","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"powershell.exe\" called \"IsWow64Process\" with parameter \"7296\" - (UID: 00000000-00007296)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to enumerate active windows","description":"\"sslconf.exe\" called \"EnumWindows\" with parameter \"0\" - (UID: 00000000-00002448)\n \"sslconf.exe\" called \"EnumWindows\" with parameter \"610616212096\" - (UID: 00000000-00002448)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-152","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get active windows title","description":"\"OneDrive.exe\" called \"GetWindowTextW\" with parameter \"%TEMP%\\RarSFX0\" - (UID: 00000000-00007456)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-151","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"RemusStealer.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00000876)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$33","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"\"OneDrive.exe\" called \"GetVersionExA\" with parameter 940000000a00000000000000ab3f00000200000000000000010000000000000000001e5f22020000180000000000000000000000000000000000000000000000000000000000000080f86307f341000000000000000000009cc0c487f97f000000000000000000000000d189f97f00000000000000000000e058d189f97f000008000000000000006b11d889f97f000000000000 (UID: 00000000-00007456)\n \"powershell.exe\" called \"GetVersionExA\" with parameter 940000000a00000000000000ab3f0000020000000000730079007300740065006d00330032005c00770069006e0064006f007700730070006f007700650072007300680065006c006c005c00760031002e0030005c0070006f007700650072007300680065006c006c002e0065007800650000005c006d0061006300680069006e0065002e0063000500000534ff0000f0c946ef (UID: 00000000-00007296)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve account information for specified SID","description":"\"powershell.exe\" called \"LookupAccountSidW\" with param Name NETWORK SERVICE (UID: 00000000-00007296)\n \"powershell.exe\" called \"LookupAccountSidW\" with param Name SYSTEM (UID: 00000000-00007296)","origin":"API Call","mitre_attack_id":"T1033","relevance":3,"id":"api-148","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve default language settings","description":"\"OneDrive.exe\" called \"GetSystemDefaultLangID\" (UID: 00000000-00007456)","origin":"API Call","mitre_attack_id":"T1614.001","relevance":3,"id":"api-149","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"powershell.exe\" called \"GetLocaleInfoW\" with parameter \"9\" - (UID: 00000000-00007296)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to execute a WMI query","description":"Found string \"SELECT * FROM AntiVirusProduct\" (Indicator: \"select * from \"; Source: \"00000000-00000876-00002713-3552696392\")\n Found string \"SELECT * FROM ANTIVIRUSPRODUCT\" (Indicator: \"select * from \"; Source: \"00000000-00000876.00000001.340150.8F110000.00000004.mdmp\")\n Found string \"SELECT * FROM AntiVirusProduct\" (Indicator: \"select * from \"; Source: \"00000000-00000876.00000001.340150.8F194000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":1,"id":"string-433","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"$34","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; File: \"RemusStealer.exe\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine timezone (API string)","description":"Found reference to API \"syscall.GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; Source: \"00000000-00000876.00000000.339071.02134000.00000002.mdmp\")\n Found reference to API \"syscall.procGetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; Source: \"00000000-00000876.00000000.339071.02134000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-248","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"Found reference to API \"GetActiveWindow\" (Indicator: \"GetActiveWindow\"; File: \"RemusStealer.exe\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"internal/syscall/windows.rtlGetVersion\" (Indicator: \"GetVersion\"; Source: \"00000000-00000876.00000000.339071.02134000.00000002.mdmp\")\n Found reference to API \"runtime._RtlGetVersion\" (Indicator: \"GetVersion\"; Source: \"00000000-00000876.00000000.339071.02134000.00000002.mdmp\")\n Found reference to API \"internal/syscall/windows.procRtlGetVersion\" (Indicator: \"GetVersion\"; Source: \"00000000-00000876.00000000.339071.02134000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Found reference to API \"GetStartupInfoW\" (Indicator: \"GetStartupInfo\"; File: \"RemusStealer.exe\")","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-167","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"Environment Awareness","name":"Queries the user identity associated with the current process token","description":"\"RemusStealer.exe\" queried token user identity (UID: 00000000-00000876)","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-328","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"$35","origin":"API Call","mitre_attack_id":"T1082","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"RemusStealer.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"OneDrive.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"sslconf.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"$36","origin":"Registry Access","mitre_attack_id":"T1518","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"External Systems","name":"Detected Suricata Alert - External IP Lookup","description":"Detected alert \"ET INFO External IP Lookup ip-api.com\" (SID: 2022082, Rev: 6, Severity: 2) categorized as \"Device Retrieving External IP Address Detected\"\n Detected alert \"ET INFO External IP Lookup api.ipify.org\" (SID: 2021997, Rev: 6, Severity: 2) categorized as \"Device Retrieving External IP Address Detected\"","origin":"Suricata Alerts","mitre_attack_id":"T1016","relevance":3,"id":"suricata-4","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"General","name":".rdata section contains high entropy","description":"\"RemusStealer.exe\" has section name .rdata with entropy \"7.7647666461757865\"","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-187","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"General","name":"Able to create/load registry keys (API string)","description":"Found registry modification API: \"internal/syscall/windows/registry.procRegLoadMUIStringW\" in \"00000000-00000876.00000000.339071.02134000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-307","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"General","name":"Able to execute applications using .NET process API","description":"Found string \"processstartinfo\" (Source: \"00000000-00007296.00000001.339555.341E0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-934","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"General","name":"Able to retrieve command line parameters of the running process","description":"Found string \"syscall.GetCommandLine\" (Source: \"00000000-00000876.00000000.339071.02134000.00000002.mdmp\")\n Found string \"syscall.procGetCommandLineW\" (Source: \"00000000-00000876.00000000.339071.02134000.00000002.mdmp\")\n Found string \"GetCommandLineW\" (Source: \"00000000-00000876.00000001.340150.40000000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-930","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"$37","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"General","name":"Calls GetProcAddress on AmsiScanBuffer function (may used to bypass AMSI)","description":"\"powershell.exe\" called \"GetProcAddress\" with a parameter \"AmsiScanBuffer\" (UID: 00000000-00007296)","origin":"API Call","mitre_attack_id":"T1685","relevance":1,"id":"api-179","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"General","name":"Calls an API typically used to copy file from one location to another","description":"\"OneDrive.exe\" called \"CopyFileW\" to copy %TEMP%\\RarSFX0\\OneDrive.exe to new location %LOCALAPPDATA%\\Microsoft\\svchost.exe (UID: 00000000-00002620)","origin":"API Call","mitre_attack_id":"T1005","relevance":3,"id":"api-123","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"\"RemusStealer.exe\" called \"CreateDirectoryW\" with parameter %LOCALAPPDATA%\\RemusStealer (UID: 00000000-00000876)\n \"OneDrive.exe\" called \"CreateDirectoryW\" with parameter C:\\Users (UID: 00000000-00007456)\n \"OneDrive.exe\" called \"CreateDirectoryW\" with parameter C:\\Users\\24cvHmM (UID: 00000000-00007456)\n \"OneDrive.exe\" called \"CreateDirectoryW\" with parameter %USERPROFILE%\\AppData (UID: 00000000-00007456)\n \"OneDrive.exe\" called \"CreateDirectoryW\" with parameter %USERPROFILE%\\AppData\\Local (UID: 00000000-00007456)\n \"OneDrive.exe\" called \"CreateDirectoryW\" with parameter %LOCALAPPDATA%\\Temp (UID: 00000000-00007456)\n \"OneDrive.exe\" called \"CreateDirectoryW\" with parameter %TEMP%\\RarSFX0 (UID: 00000000-00007456)\n \"sslconf.exe\" called \"CreateDirectoryW\" with parameter %ALLUSERSPROFILE%\\TomatoIndigo (UID: 00000000-00002448)\n \"OneDrive.exe\" called \"CreateDirectoryW\" with parameter %LOCALAPPDATA%\\Microsoft (UID: 00000000-00002620)","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"\"RemusStealer.exe\" called \"CreateProcessW\" with parameter \"\"%TEMP%\\OneDrive.exe\"\" - (UID: 00000000-00000876)\n \"RemusStealer.exe\" called \"CreateProcessW\" with parameter \"powershell -NoProfile -Command \"\"\" - (UID: 00000000-00000876)\n \"OneDrive.exe\" called \"CreateProcessW\" with parameter \"\"%TEMP%\\RarSFX0\\sslconf.exe\"\" - (UID: 00000000-00007456)\n \"OneDrive.exe\" called \"CreateProcessW\" with parameter \"\"%TEMP%\\RarSFX0\\OneDrive.exe\"\" - (UID: 00000000-00007456)\n \"sslconf.exe\" called \"CreateProcessW\" with parameter \"\"%ALLUSERSPROFILE%\\TomatoIndigo\\sslconf.exe\"\" - (UID: 00000000-00002448)\n \"OneDrive.exe\" called \"CreateProcessW\" with parameter \"\"%WINDIR%\\System32\\schtasks.exe\" /create /xml \"%TEMP%\\MsEdgeUpdate.xml\" /tn \"\\Users\\24cvHmM\\OneDriv\" - (UID: 00000000-00002620)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create an instance of a named pipe","description":"\"powershell.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\\PSHost.134367691913602601.7296.DefaultAppDomain.powershell\" - (UID: 00000000-00007296)","origin":"API Call","mitre_attack_id":"T1570","relevance":3,"id":"api-138","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$38","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$39","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"ip-api.com\"\n \"api.ipify.org\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"193.233.75.14:5555\"\n \"208.95.112.1:80\"\n \"104.26.12.205:80\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"General","name":"Contains SQL queries","description":"\"SELECT * FROM AntiVirusProduct\" (Source: 00000000-00000876-00002713-3552696392, Indicator: \"select * from antivirusproduct\")\n \"SELECT * FROM ANTIVIRUSPRODUCT\" (Source: 00000000-00000876.00000001.340150.8F110000.00000004.mdmp, Indicator: \"select * from antivirusproduct\")\n \"SELECT * FROM AntiVirusProduct\" (Source: 00000000-00000876.00000001.340150.8F194000.00000004.mdmp, Indicator: \"select * from antivirusproduct\")","origin":"File/Memory","mitre_attack_id":"T1213","relevance":2,"id":"string-16","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"Found reference to API \"syscall.CreateProcessAsUser\" (Indicator: \"CreateProcess\"; Source: \"00000000-00000876.00000000.339071.02134000.00000002.mdmp\")\n Found reference to API \"syscall.CreateProcess\" (Indicator: \"CreateProcess\"; Source: \"00000000-00000876.00000000.339071.02134000.00000002.mdmp\")\n Found reference to API \"syscall.procCreateProcessAsUserW\" (Indicator: \"CreateProcess\"; Source: \"00000000-00000876.00000000.339071.02134000.00000002.mdmp\")\n Found reference to API \"syscall.procCreateProcessW\" (Indicator: \"CreateProcess\"; Source: \"00000000-00000876.00000000.339071.02134000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \"syscall.CreateDirectory\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00000876.00000000.339071.02134000.00000002.mdmp\")\n Found reference to API \"syscall.procCreateDirectoryW\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00000876.00000000.339071.02134000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1074.001","relevance":1,"id":"string-423","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFileA\" (Indicator: \"CreateFile\"; File: \"RemusStealer.exe\")\n Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"00000000-00000876.00000000.339071.00000000.00000004.mdmp, 00000000-00000876.00000001.340150.00000000.00000004.mdmp\")\n Found reference to API \"syscall.CreateFile\" (Indicator: \"CreateFile\"; Source: \"00000000-00000876.00000000.339071.02134000.00000002.mdmp\")\n Found reference to API \"syscall.procCreateFileW\" (Indicator: \"CreateFile\"; Source: \"00000000-00000876.00000000.339071.02134000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"syscall.RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00000876.00000000.339071.02134000.00000002.mdmp\")\n Found reference to API \"syscall.procRegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00000876.00000000.339071.02134000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$3a","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Found reference to API \"yncShellExecute\" (Indicator: \"ShellExecute\"; Source: \"00000000-00000876.00000000.339071.8F110000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-240","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"RemusStealer.exe\")\n Found reference to API \"syscall.GetCommandLine\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00000876.00000000.339071.02134000.00000002.mdmp\")\n Found reference to API \"syscall.procGetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00000876.00000000.339071.02134000.00000002.mdmp\")\n Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00000876.00000001.340150.40000000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"SetThreadContext\" (Indicator: \"SetThreadContext\"; File: \"RemusStealer.exe\")\n Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; File: \"RemusStealer.exe\")\n Found reference to API \"GetThreadContext\" (Indicator: \"GetThreadContext\"; File: \"RemusStealer.exe\")\n Found reference to API \"SuspendThread\" (Indicator: \"SuspendThread\"; File: \"RemusStealer.exe\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"RemusStealer.exe\")\n Found reference to API \"CreateThread failed\" (Indicator: \"CreateThread\"; File: \"RemusStealer.exe\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"WaitForMultipleObjects error %d, GetLastError %d\" (Indicator: \"GetLastError\"; File: \"RemusStealer.exe\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; File: \"RemusStealer.exe\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; File: \"RemusStealer.exe\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"GetShellWindow\" (Indicator: \"GetShellWindow\"; File: \"RemusStealer.exe\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-208","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"General","name":"Contains export functions","description":"$3b","origin":"Static Parser","relevance":1,"id":"static-78","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"General","name":"Contains reference to Windows Startup folder","description":"$3c","origin":"File/Memory","mitre_attack_id":"T1547.001","relevance":1,"id":"string-265","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$3d","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"$3e","origin":"Created Mutant","mitre_attack_id":"T1480.002","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"Antivirus vendors marked dropped file \"RemusStealer.lnk\" as clean (type is \"MS Windows shortcut Item id list present Points to a file or directory Has Relative path Has Working directory Unicoded MachineID l0wofth5slhy6mc KnownFolderID 0762D272-C50A-4BB0-A382-697DCD729B80 Archive ctime=Sun Oct 18 03:53:09 2026 atime=Sun Oct 18 03:53:09 2026 mtime=Sun Oct 18 03:53:09 2026 length=20099512 window=normal IDListSize 0x0273 Root folder \"20D04FE0-3AEA-1069-A2D8-08002B30309D\" Volume \"C:\\\" LocalBasePath \"C:\\Users\\24cvHmM\\AppData\\Local\\RemusStealer\\RemusStealer.exe\"\")\n Antivirus vendors marked dropped file \"vcruntime140.dll\" as clean (type is \"PE32+ executable for MS Windows 6.00 (DLL) x86-64 8 sections\")","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"General","name":"Executes PowerShell with command line","description":"Process \"powershell.exe\" with commandline \"powershell -NoProfile -Command \"\"\" (UID: 00000000-00007296)","origin":"Monitored Target","mitre_attack_id":"T1059.001","relevance":1,"id":"target-486","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"$3f","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"RemusStealer.exe\" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA\n IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\n \"OneDrive.exe\" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA\n IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\n \"signed_j0TYyO.exe\" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA\n IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\n \"vcruntime140.dll\" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA\n IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_GUARD_CF\n \"sslconf.exe\" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA\n IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"General","name":"Found E-Mail address in binary/memory","description":"Pattern match: \"premium-server@thawte.com\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"General","name":"Found named pipe like strings","description":"Found string - \\\\.\\pipe\\\n Found string - \\\\.\\pipe\\PSHost.134367691913602601.7296.DefaultAppDomain.powershell","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-146","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"$40","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"General","name":"GETs files from a web server (PE files)","description":"$41","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$42","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"General","name":"Loads rich edit control libraries","description":"\"OneDrive.exe\" loaded module \"%WINDIR%\\System32\\riched20.dll\" at 89D10000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-2","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"powershell.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\fe2524177eb3088c77be666722039f52\\mscorlib.ni.dll\" at 7ED10000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-3","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"General","name":"Loads the AMSI (Antimalware Scan Interface) DLL","description":"\"powershell.exe\" loaded module \"%WINDIR%\\System32\\amsi.dll\" at 9D6A0000\n \"OneDrive.exe\" loaded module \"%WINDIR%\\System32\\amsi.dll\" at 9D7A0000","origin":"Loaded Module","mitre_attack_id":"T1685","id":"module-8","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"RemusStealer.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at ADE20000\n \"RemusStealer.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at AC880000\n \"OneDrive.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at ADE20000\n \"OneDrive.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at AC880000\n \"sslconf.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at ADE20000\n \"sslconf.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at AC880000\n \"powershell.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at ADE20000\n \"powershell.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at AC880000\n \"schtasks.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at ADE20000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"General","name":"Loads the CLR Loader DLL","description":"\"powershell.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll\" at 935F0000","origin":"Loaded Module","mitre_attack_id":"T1620","id":"module-7","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"RemusStealer.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at AE490000\n \"OneDrive.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at AE490000\n \"sslconf.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at AE490000\n \"powershell.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at AE490000\n \"sslconf.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 9A160000\n \"schtasks.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at AE490000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"19001a000000000040c71eadf97f0000@ntdll.dll\"\n \"220023000000000018c71eadf97f0000@ntdll.dll\"\n \"19001a006c00650040c71eadf97f0000@ntdll.dll\"\n \"\"#le@ntdll.dll\", \"19001a00f97f000040c71eadf97f0000@ntdll.dll\", \"22002300f97f000018c71eadf97f0000@ntdll.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"RemusStealer.exe\" was detected as \"Go\" and name: \"Compiler\"\n \"OneDrive.exe\" was detected as \"Go\" and name: \"Compiler\"\n \"signed_j0TYyO.exe\" was detected as \"Go\" and name: \"Compiler\"\n \"vcruntime140.dll\" was detected as \"Go\" and name: \"Compiler\"\n \"sslconf.exe\" was detected as \"Go\" and name: \"Compiler\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$43","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"General","name":"PE file contains Debug data directory","description":"\"OneDrive.exe\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"\n \"signed_j0TYyO.exe\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"\n \"vcruntime140.dll\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"\n \"sslconf.exe\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"","origin":"Static Parser","id":"static-146","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"RemusStealer.exe\" has an executable section named \".text\"\n \"OneDrive.exe\" has an executable section named \".text\"\n \"signed_j0TYyO.exe\" has an executable section named \".text\"\n \"vcruntime140.dll\" has an executable section named \".text\"\n \"vcruntime140.dll\" has an executable section named \"fothk\"\n \"sslconf.exe\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"RemusStealer.exe\" has an writable section named \".data\"\n \"RemusStealer.exe\" has an writable section named \".idata\"\n \"OneDrive.exe\" has an writable section named \".data\"\n \"signed_j0TYyO.exe\" has an writable section named \".data\"\n \"vcruntime140.dll\" has an writable section named \".data\"\n \"sslconf.exe\" has an writable section named \".data\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"$44","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"General","name":"PE file has a big raw size section","description":"Raw size of \".text\" is \"0x3d9000\" greater than 0x100000\n Raw size of \".rdata\" is \"0xe92200\" greater than 0x100000\n Raw size of \".cfg\" is \"0x36ee00\" greater than 0x100000\n Raw size of \".cfg\" is \"0x34e600\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-125","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"General","name":"PE file has a big virtual size section","description":"Virtual size of \".text\" is \"0x3d8e4c\" greater than 0x100000\n Virtual size of \".rdata\" is \"0xe92190\" greater than 0x100000\n Virtual size of \".cfg\" is \"0x36edaf\" greater than 0x100000\n Virtual size of \".cfg\" is \"0x34e497\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-124","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"General","name":"PE file has a high image base","description":"\"OneDrive.exe\" has high imagebase \"0x140000000\"\n \"signed_j0TYyO.exe\" has high imagebase \"0x140000000\"\n \"vcruntime140.dll\" has high imagebase \"0x180000000\"\n \"sslconf.exe\" has high imagebase \"0x140000000\"","origin":"Static Parser","relevance":1,"id":"static-93","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"General","name":"Possibly references Golang binary related string","description":"\"Go build ID: \"VARJHKjCxKSKoJdkg-To/OpJWaf1u9x93ZNiYBJi8/ffWBOrYNvYSypXRqtMot/B2hwqwtxk88_gk3mrccL\"\" (Indicator: \"Go build ID: \"VARJHKjCxKSKoJdkg-To/OpJWaf1u9x93ZNiYBJi8/ffWBOrYNvYSypXRqtMot/B2hwqwtxk88_gk3mrccL\")\" in Source: RemusStealer.exe","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-74","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"Observed system executable string:\"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" [Source: 00000000-00000876-00000C47-10387304937]\n Observed system executable string:\"\"%WINDIR%\\System32\\schtasks.exe\" /create /xml \"%TEMP%\\MsEdgeUpdate.xml\" /tn \"\\Users\\24cvHmM\\OneDriv\" [Source: 00000000-00002620-00000C47-1575499278], Observed system executable string:\"%WINDIR%\\System32\\schtasks.exe\" [Source: 00000000-00002620-00000BC0-3546292062]","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"OneDrive.exe\" (UID: 00000000-00007456) was launched with new environment variables: \"USERDNSDOMAIN=\"l0WOfth5SlHy6MC\"\"\n Process \"OneDrive.exe\" (UID: 00000000-00007456) was launched with modified environment variables: \"NUMBER_OF_PROCESSORS\"\n Process \"sslconf.exe\" (UID: 00000000-00002448) was launched with new environment variables: \"sfxnamenoext=\"OneDrive\", sfxcmd=\"\"%TEMP%\\OneDrive.exe\"\", sfxname=\"%TEMP%\\OneDrive.exe\", sfxstime=\"2026-10-17-20-53-09-945\"\"\n Process \"powershell.exe\" (UID: 00000000-00007296) was launched with missing environment variables: \"sfxnamenoext, sfxcmd, sfxname, sfxstime\"\n Process \"sslconf.exe\" (UID: 00000000-00007376) was launched with new environment variables: \"sfxnamenoext=\"OneDrive\", sfxcmd=\"\"%TEMP%\\OneDrive.exe\"\", sfxname=\"%TEMP%\\OneDrive.exe\", sfxstime=\"2026-10-17-20-53-09-945\"\"","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"api.ipify.org\"\n \"ip-api.com\"\n \"rg1k98tivqqmmjm238ntbg0tkwo5ejnwecwn1.com\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"General","name":"Reads Windows Trust Settings","description":"\"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-20","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"$45","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"General","name":"References Windows file paths for DLLs (possible dropped files)","description":"$46","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"\"OneDrive.exe\" searching for class \"Edit\"","origin":"API Call","mitre_attack_id":"T1010","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"OneDrive.exe\" (UID: 00000000-00007456)\n Spawned process \"sslconf.exe\" (UID: 00000000-00002448)\n Spawned process \"powershell.exe\" with commandline \"powershell -NoProfile -Command \"\"\" (UID: 00000000-00007296)\n Spawned process \"sslconf.exe\" (UID: 00000000-00007376)\n Spawned process \"OneDrive.exe\" (UID: 00000000-00002620)\n Spawned process \"schtasks.exe\" with commandline \"/create /xml \"%TEMP%\\\\MsEdgeUpdate.xml\" /tn \"\\\\Users\\\\24cvHmM\\\\O ...\" (UID: 00000000-00001648)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"OneDrive.exe\" (UID: 00000000-00007456)\n Spawned process \"sslconf.exe\" (UID: 00000000-00002448)\n Spawned process \"powershell.exe\" with commandline \"powershell -NoProfile -Command \"\"\" (UID: 00000000-00007296)\n Spawned process \"sslconf.exe\" (UID: 00000000-00007376)\n Spawned process \"OneDrive.exe\" (UID: 00000000-00002620)\n Spawned process \"schtasks.exe\" with commandline \"/create /xml \"%TEMP%\\\\MsEdgeUpdate.xml\" /tn \"\\\\Users\\\\24cvHmM\\\\O ...\" (UID: 00000000-00001648)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"The input sample is signed with a certificate issued by \"CN=Ember Systems Partners, O=Ember Systems Partners, C=US\" (SHA1: 99:F6:AA:F5:28:74:58:FC:20:BA:9D:2B:91:0D:39:4B:E3:F0:71:18; see report for more information)\n The input sample is signed with a certificate issued by \"CN=DigiCert Assured ID Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US\" (SHA1: A9:9D:5B:79:E9:F1:CD:A5:9C:DA:B6:37:31:69:D5:35:3F:58:74:C6; see report for more information)\n The input sample is signed with a certificate issued by \"CN=DigiCert Trusted Root G4, OU=www.digicert.com, O=DigiCert Inc, C=US\" (SHA1: 07:89:4D:00:FC:19:4A:17:DB:27:3A:EB:5C:F8:FA:CE:F1:44:23:A4; see report for more information)\n The input sample is signed with a certificate issued by \"CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1, O=\"DigiCert\n Inc.\", C=US\" (SHA1: 51:D9:AB:DA:03:49:73:D8:4F:42:66:AC:A4:82:48:E6:B3:69:C4:39; see report for more information)","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"General","name":"Writes files in a temp directory","description":"$47","origin":"API Call","mitre_attack_id":"T1005","relevance":1,"id":"api-267","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"Installation/Persistence","name":"Able to establish persistence using Exchange transport agent (.NET)","description":"Found string \"System.IsAttachment\" (Source: \"00000000-00000876.00000000.339071.D7CF0000.00000002.mdmp\")\n Found string \"System.Message.AttachmentContents\" (Source: \"00000000-00000876.00000000.339071.D7CF0000.00000002.mdmp\")\n Found string \"System.Message.AttachmentNames\" (Source: \"00000000-00000876.00000000.339071.D7CF0000.00000002.mdmp\")\n Found string \"System.Message.HasAttachments\" (Source: \"00000000-00000876.00000000.339071.D7CF0000.00000002.mdmp\")\n Found string \"ystem.IsAttachment\" (Source: \"00000000-00000876.00000001.340150.D7CA0000.00000002.mdmp\")\n Found string \"ystem.Message.AttachmentContents\" (Source: \"00000000-00000876.00000001.340150.D7CA0000.00000002.mdmp\")\n Found string \"ystem.Message.AttachmentNames\" (Source: \"00000000-00000876.00000001.340150.D7CA0000.00000002.mdmp\")\n Found string \"ystem.Message.HasAttachments\" (Source: \"00000000-00000876.00000001.340150.D7CA0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1505.002","relevance":1,"id":"string-938","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; File: \"RemusStealer.exe\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; File: \"RemusStealer.exe\")\n Found reference to API \"syscall.LoadLibrary\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00000876.00000000.339071.02134000.00000002.mdmp\")\n Found reference to API \"syscall._LoadLibrary\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00000876.00000000.339071.02134000.00000002.mdmp\")\n Found reference to API \"syscall.procLoadLibraryW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00000876.00000000.339071.02134000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"RemusStealer.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)\n \"OneDrive.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates file(s) in System32 or SysWOW64 directory","description":"\"powershell.exe\" create file \"C:\\Windows\\System32\\CatRoot\"\n \"powershell.exe\" create file \"C:\\Windows\\System32\\catroot2\"\n \"powershell.exe\" create file \"%WINDIR%\\System32\\CatRoot\"\n \"powershell.exe\" create file \"%WINDIR%\\System32\\catroot2\"","origin":"API Call","mitre_attack_id":"T1036.005","relevance":5,"id":"api-324","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$48","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"Installation/Persistence","name":"Drops XML files","description":"\"MsEdgeUpdate.xml\" has type \"XML 1.0 document Unicode text UTF-16 little-endian text with CRLF line terminators\" - Location: [%TEMP%\\MsEdgeUpdate.xml]","origin":"Binary File","mitre_attack_id":"T1105","relevance":1,"id":"binary-39","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$49","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"Installation/Persistence","name":"Potential hijacking of DLL execution flow detected","description":"\"tempdir.dll\" has type \"PE32+ executable for MS Windows 5.02 (DLL) x86-64 (stripped to external PDB) 3 sections\"- Location: [%TEMP%\\RarSFX0\\tempdir.dll]- [targetUID: 00000000-00002448]\n \"vcruntime140.dll\" has type \"PE32+ executable for MS Windows 6.00 (DLL) x86-64 8 sections\"- Location: [%ALLUSERSPROFILE%\\TomatoIndigo\\vcruntime140.dll]- [targetUID: 00000000-00002448]\n \"tempdir.dll\" has type \"PE32+ executable for MS Windows 5.02 (DLL) x86-64 (stripped to external PDB) 3 sections\"- Location: [%ALLUSERSPROFILE%\\TomatoIndigo\\tempdir.dll]- [targetUID: 00000000-00002448]\n \"vcruntime140.dll\" has type \"PE32+ executable for MS Windows 6.00 (DLL) x86-64 8 sections\"- Location: [%TEMP%\\RarSFX0\\vcruntime140.dll]- [targetUID: 00000000-00002448]","origin":"Binary File","mitre_attack_id":"T1574.001","relevance":5,"id":"binary-91","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"$4a","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$4b","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"RemusStealer.exe\" reads file \"c:\\remusstealer.exe\"\n \"RemusStealer.exe\" reads file \"c:\\windows\\fonts\\staticcache.dat\"\n \"OneDrive.exe\" reads file \"c:\\users\\%osuser%\\appdata\\local\\temp\\onedrive.exe\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"$4c","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"\"RemusStealer.exe\" trying to touch file \"C:\\Windows\\System32\\apphelp.dll\"\n \"RemusStealer.exe\" trying to touch file \"C:\\WINDOWS\\SYSTEM32\\apphelp.dll\"\n \"RemusStealer.exe\" trying to touch file \"C:\\RemusStealer.exe\"\n \"RemusStealer.exe\" trying to touch file \"C:\\Windows\\System32\\ntdll.dll\"\n \"RemusStealer.exe\" trying to touch file \"C:\\Windows\\System32\\kernel32.dll\"\n \"RemusStealer.exe\" trying to touch file \"C:\\Windows\\System32\\KernelBase.dll\"\n \"RemusStealer.exe\" trying to touch file \"C:\\Windows\\apppatch\\sysmain.sdb\"\n \"RemusStealer.exe\" trying to touch file \"C:\\windows\\temp\\VxSSL64.dll\"\n \"RemusStealer.exe\" trying to touch file \"C:\\FLTLIB.DLL\"\n \"RemusStealer.exe\" trying to touch file \"C:\\Windows\\System32\\fltLib.dll\"\n \"RemusStealer.exe\" trying to touch file \"C:\\WINDOWS\\SYSTEM32\\FLTLIB.DLL\"\n \"RemusStealer.exe\" trying to touch file \"C:\\MSVCP140.DLL\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"\"RemusStealer.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\Caches\"\n \"RemusStealer.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\RemusStealer.lnk\"\n \"RemusStealer.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\"\n \"RemusStealer.exe\" touched file \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\RemusStealer.lnk\"\n \"OneDrive.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\Caches\"\n \"OneDrive.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\"\n \"powershell.exe\" touched file \"C:\\Windows\\System32\\CatRoot\"\n \"powershell.exe\" touched file \"C:\\Windows\\System32\\catroot2\"\n \"powershell.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\StartupProfileData-NonInteractive\"\n \"powershell.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\PowerShell\\StartupProfileData-NonInteractive\"","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access LNK files (Windows shortcut)","description":"\"RemusStealer.exe\" trying to access LNK file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\REMUSSTEALER.LNK\"\n \"RemusStealer.exe\" trying to access LNK file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\RemusStealer.lnk\"\n \"RemusStealer.exe\" trying to access LNK file \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\REMUSSTEALER.LNK\"\n \"RemusStealer.exe\" trying to access LNK file \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\RemusStealer.lnk\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-203","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$4d","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$4e","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"$4f","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"Network Related","name":"Able to determine NetBIOS or DNS name associated with the local computer","description":"Found reference to API \"GetComputerNameExA\" (Indicator: \"getcomputernameexa\"; Source: \"00000000-00000876-00000C2C-3545385690\")\n Found reference to API \"internal/syscall/windows.procGetComputerNameExW\" (Indicator: \"getcomputernameexw\"; Source: \"00000000-00000876.00000000.339071.02134000.00000002.mdmp\")\n Found reference to API \"GetComputerNameExA\" (Indicator: \"getcomputernameexa\"; Source: \"00000000-00000876.00000001.340150.40000000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-736","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"Network Related","name":"Able to identify remote systems","description":"Found string \"ping\" (Indicator: \"ping\"; Source: \"00000000-00007296.00000001.339555.341E0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1018","relevance":7,"id":"string-417","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"Network Related","name":"Able to monitor socket connection","description":"Found reference to API \"syscall.Setsockopt\" (Indicator: \"setsockopt\"; Source: \"00000000-00000876.00000000.339071.02134000.00000002.mdmp\")\n Found reference to API \"internal/poll.(*FD).SetsockoptInt\" (Indicator: \"setsockopt\"; Source: \"00000000-00000876.00000000.339071.02134000.00000002.mdmp\")\n Found reference to API \"internal/poll.(*FD).SetsockoptInt.deferwrap1\" (Indicator: \"setsockopt\"; Source: \"00000000-00000876.00000000.339071.02134000.00000002.mdmp\")\n Found reference to API \"syscall.procsetsockopt\" (Indicator: \"setsockopt\"; Source: \"00000000-00000876.00000000.339071.02134000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1205.002","relevance":1,"id":"string-879","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to send the specified request to the HTTP server","description":"\"sslconf.exe\" called \"WinHttpSendRequest\" with parameters {\"hRequest\": \"25d9551fdf0\"\n \"dwHeadersLength\": \"0\"\n \"dwOptionalLength\": \"0\"\n \"dwTotalLength\": \"0\"\n \"dwContext\": \"0\"\n \"$error\": \"2ee7\"}","origin":"API Call","mitre_attack_id":"T1071.001","relevance":2,"id":"api-190","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"Network Related","name":"Communicates with HTTP web server (GET/POST requests)","description":"Found http requests in header \"GET /line/?fields=country\"\n Found http requests in header \"GET /\"","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-62","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with C2 using Sockets (API string)","description":"Found reference to API \"syscall.WSARecv\" (Indicator: \"WSARecv\"; Source: \"00000000-00000876.00000000.339071.02134000.00000002.mdmp\")\n Found reference to API \"syscall.WSASend\" (Indicator: \"WSASend\"; Source: \"00000000-00000876.00000000.339071.02134000.00000002.mdmp\")\n Found reference to API \"syscall.WSAStartup\" (Indicator: \"WSAStartup\"; Source: \"00000000-00000876.00000000.339071.02134000.00000002.mdmp\")\n Found reference to API \"syscall.procWSARecv\" (Indicator: \"WSARecv\"; Source: \"00000000-00000876.00000000.339071.02134000.00000002.mdmp\")\n Found reference to API \"syscall.procWSASend\" (Indicator: \"WSASend\"; Source: \"00000000-00000876.00000000.339071.02134000.00000002.mdmp\")\n Found reference to API \"syscall.procWSAStartup\" (Indicator: \"WSAStartup\"; Source: \"00000000-00000876.00000000.339071.02134000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1095","relevance":1,"id":"string-228","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; Source: \"00000000-00000876-00000C2C-3532467262\")\n Found reference to API \"syscall.WSARecv\" (Indicator: \"WSARecv\"; Source: \"00000000-00000876.00000000.339071.02134000.00000002.mdmp\")\n Found reference to API \"syscall.WSASend\" (Indicator: \"WSASend\"; Source: \"00000000-00000876.00000000.339071.02134000.00000002.mdmp\")\n Found reference to API \"syscall.WSAStartup\" (Indicator: \"WSAStartup\"; Source: \"00000000-00000876.00000000.339071.02134000.00000002.mdmp\")\n Found reference to API \"syscall.procWSARecv\" (Indicator: \"WSARecv\"; Source: \"00000000-00000876.00000000.339071.02134000.00000002.mdmp\")\n Found reference to API \"syscall.procWSASend\" (Indicator: \"WSASend\"; Source: \"00000000-00000876.00000000.339071.02134000.00000002.mdmp\")\n Found reference to API \"syscall.procWSAStartup\" (Indicator: \"WSAStartup\"; Source: \"00000000-00000876.00000000.339071.02134000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create/connect to a named pipe (API string)","description":"Found reference to API \"syscall.CreatePipe\" (Indicator: \"CreatePipe\"; Source: \"00000000-00000876.00000000.339071.02134000.00000002.mdmp\")\n Found reference to API \"syscall.procCreatePipe\" (Indicator: \"CreatePipe\"; Source: \"00000000-00000876.00000000.339071.02134000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-210","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"Network Related","name":"Contains ability to open a port and listen for incoming connection (API string)","description":"Found reference to API \"syscall.procsetsockopt\" (Indicator: \"setsockopt\"; Source: \"00000000-00000876.00000000.339071.02134000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1571","relevance":1,"id":"string-419","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"$50","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"Network Related","name":"Data transmitted in plain text over an insecure network protocol/port","description":"HTTP traffic to 208.95.112.1 on port 80\n HTTP traffic to 104.26.12.205 on port 80","origin":"Network Traffic","mitre_attack_id":"T1048.003","relevance":1,"id":"network-97","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"64.124.12.162\"\n \"2.5.29.37\"\n \"2.5.29.35\"\n \"192.168.0.2\"\n \"9.17.8.9\"\n Potential IP \"3.0.0.0\" found in string \"ystem.Management.Automation.resources,3.0.0.0,en-US,31bf3856ad364e35\"\n Potential IP \"3.0.0.0\" found in string \"icrosoft.PowerShell.ConsoleHost.resources,3.0.0.0,en-US,31bf3856ad364e35\"\n \"2.5.29.16\"\n \"4.0.0.0000000\"\n Potential IP \"1.0.0.0\" found in string \"icrosoft.Management.Infrastructure,1.0.0.0,,31bf3856ad364e35\"\n \"2.5.29.32\"\n Potential IP \"2.5.29.37\" found in string \"%2.5.29.37\"\n \"2.5.29.31\"\n Potential IP \"2.5.29.35\" found in string \"#2.5.29.35\"\n \"2.5.4.6\"\n \"2.5.4.8\"\n \"2.5.29.15\"\n \"2.5.29.14\"\n \"2.5.29.19\"\n \"2.5.4.7\"\n \"2.5.4.10\"\n \"2.5.4.5\"\n \"2.5.4.11\"\n \"2.5.29.17\"\n \"2.5.4.3\"\n \"2.5.29.1\"\n \"2.5.29.10\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$51","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$52","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"Network Related","name":"Found string related to HTTP headers","description":"Found string \"HTTP/1.0H9\" (Indicator: \"HTTP/1.0\"; File: \"RemusStealer.exe\")\n Found string \"HTTP/1.1H9\" (Indicator: \"HTTP/1.1\"; File: \"RemusStealer.exe\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-457","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"Network Related","name":"GETs files from a web server (HTTPS)","description":"GET /line/?fields=country HTTP/1.1\nHost: ip-api.com\nCache-Control: no-cache\n\n GET / HTTP/1.1\nHost: api.ipify.org\nCache-Control: no-cache\n","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":3,"id":"network-72","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"Network Related","name":"High entropy domain detected","description":"Contacted domain: \"rg1k98tivqqmmjm238ntbg0tkwo5ejnwecwn1.com\" has high entropy","origin":"Network Traffic","mitre_attack_id":"T1568.002","relevance":5,"id":"network-81","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"Network Related","name":"Shows ability to send encrypted data to the internet","description":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network","origin":"Indicator Combinations","mitre_attack_id":"T1119","relevance":2,"id":"summary-27","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - AES encryption","description":"YARA signature for AES encryption matched on file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-103","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match – Embedded PE executable","description":"YARA signature matched on embedded PE in file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1027.009","relevance":2,"id":"yara-140","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"Ransomware/Banking","name":"Contains ability to create/switch the desktop (API string)","description":"Found reference to API \"CreateDesktopW\" (Indicator: \"CreateDesktop\"; Source: \"00000000-00000876.00000001.340150.40000000.00000040.mdmp\")","origin":"File/Memory","relevance":1,"id":"string-541","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"$53","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access credential file using Kerberos","description":"Found string \"Kerberos\" (Indicator: \"kerberos\"; Source: \"00000000-00000876.00000000.339071.8F110000.00000004.mdmp, 00000000-00000876.00000001.340150.8F110000.00000004.mdmp\")\n Found string \"Kerberos\" (Indicator: \"kerberos\"; Source: \"00000000-00007296.00000000.339360.EF460000.00000004.mdmp\")\n Found string \"kerberosclient\" (Indicator: \"kerberos\"; Source: \"00000000-00007296.00000001.339555.341E0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1558","relevance":1,"id":"string-868","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture screen (API string)","description":"Found reference to API \"GetDesktopWindow\" (Indicator: \"GetDesktopWindow\"; File: \"RemusStealer.exe\")\n Found reference to API \"GetDC\" (Indicator: \"GetDC\"; Source: \"00000000-00000876.00000001.340150.40000000.00000040.mdmp\")\n Found reference to API \"GetWindowDC\" (Indicator: \"GetWindowDC\"; Source: \"00000000-00000876.00000001.340150.40000000.00000040.mdmp\")\n Found reference to API \"BitBlt\" (Indicator: \"BitBlt\"; Source: \"00000000-00000876.00000001.340150.40000000.00000040.mdmp\")\n Found reference to API \"CreateCompatibleBitmap\" (Indicator: \"CreateCompatibleBitmap\"; Source: \"00000000-00000876.00000001.340150.40000000.00000040.mdmp\")\n Found reference to API \"CreateCompatibleDC\" (Indicator: \"CreateCompatibleDC\"; Source: \"00000000-00000876.00000001.340150.40000000.00000040.mdmp\")\n Found reference to API \"GetDIBits\" (Indicator: \"GetDIBits\"; Source: \"00000000-00000876.00000001.340150.40000000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to discover operating system information (API string)","description":"Found reference to API \"runtime._RtlGetVersion\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00000876.00000000.339071.02134000.00000002.mdmp\")\n Found reference to API \"internal/syscall/windows.procRtlGetVersion\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00000876.00000000.339071.02134000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"Found registry query API: \"syscall.RegOpenKeyEx\" in \"00000000-00000876.00000000.339071.02134000.00000002.mdmp\"\n Found registry query API: \"syscall.RegQueryValueEx\" in \"00000000-00000876.00000000.339071.02134000.00000002.mdmp\"\n Found registry query API: \"syscall.procRegEnumKeyExW\" in \"00000000-00000876.00000000.339071.02134000.00000002.mdmp\"\n Found registry query API: \"syscall.procRegOpenKeyExW\" in \"00000000-00000876.00000000.339071.02134000.00000002.mdmp\"\n Found registry query API: \"syscall.procRegQueryValueExW\" in \"00000000-00000876.00000000.339071.02134000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve usernames and/or user information (API string)","description":"Found reference to API \"GetProcessWindowStation\" (Indicator: \"GetProcessWindowStation\"; File: \"RemusStealer.exe\")\n Found reference to API \"GetUserNameA\" (Indicator: \"GetUserName\"; Source: \"00000000-00000876.00000001.340150.40000000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$54","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"RemusStealer.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"OneDrive.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"sslconf.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"sslconf.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"2\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to enumerate Windows drive types","description":"\"powershell.exe\" called \"GetDriveTypeW\" with parameter C:\\ (UID: 00000000-00007296)","origin":"API Call","mitre_attack_id":"T1680","relevance":7,"id":"api-327","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve computer name","description":"\"RemusStealer.exe\" called \"GetComputerNameW\" (UID: 00000000-00000876)\n \"powershell.exe\" called \"GetComputerNameW\" (UID: 00000000-00007296)\n \"OneDrive.exe\" called \"GetComputerNameA\" (UID: 00000000-00002620)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-141","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"powershell.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"09000000001000000000010000000000fffffeffff7f0000ff0000000000000008000000d8210000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve user name","description":"\"powershell.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"2\"}\n \"powershell.exe\" called \"GetUserNameW\" (UID: 00000000-00007296)\n \"powershell.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"65538\"}","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-135","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$55","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"Found reference to API \"syscall.FindFirstFile\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00000876.00000000.339071.02134000.00000002.mdmp\")\n Found reference to API \"syscall.procFindFirstFileW\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00000876.00000000.339071.02134000.00000002.mdmp\")\n Found reference to API \"238,7948,3120,,FindNextFileW,kernel32.dll,\"01:28:22.484\",RX=0,PX=0\" (Indicator: \"FindNextFile\"; Source: \"00000000-00007296.00000000.339360.F1720000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$56","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to query network adapter information (API string)","description":"Found reference to API \"internal/syscall/windows.GetAdaptersAddresses\" (Indicator: \"GetAdaptersAddresses\"; Source: \"00000000-00000876.00000000.339071.02134000.00000002.mdmp\")\n Found reference to API \"internal/syscall/windows.procGetAdaptersAddresses\" (Indicator: \"GetAdaptersAddresses\"; Source: \"00000000-00000876.00000000.339071.02134000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-118","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00000876.00000000.339071.00000000.00000004.mdmp, 00000000-00000876.00000001.340150.00000000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; File: \"RemusStealer.exe\")\n Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; File: \"RemusStealer.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"RemusStealer.exe\")\n Found reference to API \"syscall.GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00000876.00000000.339071.02134000.00000002.mdmp\")\n Found reference to API \"syscall._GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00000876.00000000.339071.02134000.00000002.mdmp\")\n Found reference to API \"syscall.procGetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00000876.00000000.339071.02134000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"$57","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve list of files and subdirectories","description":"Found string \"dir\" (Indicator: \"dir\"; Source: \"00000000-00007296.00000000.339360.F1720000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-328","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the NetBIOS name of the local computer (API string)","description":"Found reference to API \"internal/syscall/windows.GetComputerNameEx\" (Indicator: \"GetComputerName\"; Source: \"00000000-00000876.00000000.339071.02134000.00000002.mdmp\")\n Found reference to API \"internal/syscall/windows.procGetComputerNameExW\" (Indicator: \"GetComputerName\"; Source: \"00000000-00000876.00000000.339071.02134000.00000002.mdmp\")\n Found reference to API \"GetComputerNameA\" (Indicator: \"GetComputerName\"; Source: \"00000000-00000876.00000001.340150.40000000.00000040.mdmp\")\n Found reference to API \"GetComputerNameExA\" (Indicator: \"GetComputerName\"; Source: \"00000000-00000876.00000001.340150.40000000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-122","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; File: \"RemusStealer.exe\")\n Found reference to API \"internal/syscall/windows.GetModuleFileName\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00000876.00000000.339071.02134000.00000002.mdmp\")\n Found reference to API \"internal/syscall/windows.procGetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00000876.00000000.339071.02134000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"Found reference to API \"syscall.GetEnvironmentVariable\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00000876.00000000.339071.02134000.00000002.mdmp\")\n Found reference to API \"syscall.procGetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00000876.00000000.339071.02134000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-107","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the local name for a socket (API string)","description":"Found reference to API \"syscall.getsockname\" (Indicator: \"getsockname\"; Source: \"00000000-00000876.00000000.339071.02134000.00000002.mdmp\")\n Found reference to API \"syscall.procgetsockname\" (Indicator: \"getsockname\"; Source: \"00000000-00000876.00000000.339071.02134000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-224","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; Source: \"00000000-00000876.00000001.340150.40000000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-131","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount\"; File: \"RemusStealer.exe\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"$58","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found system command-related strings","description":"Found string \"Hostname\" (Indicator: \"hostname\"; File: \"RemusStealer.exe\")\n Found string \"ping\" (Indicator: \"ping\"; Source: \"00000000-00007296.00000001.339555.341E0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":7,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Reads system-defined device setup information from registry","description":"\"OneDrive.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0002\"; Key: \"PRUNINGMODE\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-106","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"References to WMI query strings used for information discovery","description":"$59","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-507","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"System Security","name":"Calls an API typically used to enable or disable privileges in the specified access token","description":"\"powershell.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00007296)","origin":"API Call","mitre_attack_id":"T1134","relevance":3,"id":"api-111","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"Found string \":\\WINDOWS\\system32\\DRIVERS\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00000876.00000000.339071.8F110000.00000004.mdmp, 00000000-00000876.00000001.340150.8F110000.00000004.mdmp\")\n Found string \"\\Device\\HarddiskVolume2\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscoreei.dll\" (Indicator: \"\\Device\\\"; Source: \"00000000-00007296.00000000.339360.EF460000.00000004.mdmp, 00000000-00007296.00000001.339555.EF460000.00000004.mdmp\")\n Found string \":\\WINDOWS\\system32\\DRIVERS\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00007296.00000000.339360.EF460000.00000004.mdmp, 00000000-00007296.00000001.339555.EF460000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"System Security","name":"Contains ability to create process with token (API string)","description":"Found reference to API \"syscall.CreateProcessAsUser\" (Indicator: \"CreateProcessAsUser\"; Source: \"00000000-00000876.00000000.339071.02134000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.002","relevance":1,"id":"string-168","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"Found reference to API \"LookupPrivilegeValueW\" (Indicator: \"LookupPrivilegeValue\"; Source: \"00000000-00000876.00000001.340150.40000000.00000040.mdmp\")\n Found reference to API \"SeDebugPrivilege\" (Indicator: \"SeDebugPrivilege\"; Source: \"00000000-00007296.00000000.339360.EF460000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify process attributes (API string)","description":"Found reference to API \"syscall.procInitializeProcThreadAttributeList\" (Indicator: \"InitializeProcThreadAttributeList\"; Source: \"00000000-00000876.00000000.339071.02134000.00000002.mdmp\")\n Found reference to API \"syscall.procUpdateProcThreadAttribute\" (Indicator: \"UpdateProcThreadAttribute\"; Source: \"00000000-00000876.00000000.339071.02134000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1685","relevance":1,"id":"string-402","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"System Security","name":"Contains ability to shutdown system","description":"Observed string: \"Shutdown\" (Indicator: \"shutdown\") in Source: RemusStealer.exe\n Observed string: \"shutdown\" (Indicator: \"shutdown\") in Source: RemusStealer.exe","origin":"File/Memory","mitre_attack_id":"T1529","relevance":1,"id":"string-406","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; File: \"RemusStealer.exe\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; File: \"RemusStealer.exe\")\n Found reference to API \"syscall.TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00000876.00000000.339071.02134000.00000002.mdmp\")\n Found reference to API \"syscall.procTerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00000876.00000000.339071.02134000.00000002.mdmp\")\n Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00000876.00000001.340150.40000000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"System Security","name":"Contains ability to use security policy setting (API string)","description":"Found reference to API \"SeSecurityPrivilege\" (Indicator: \"SeSecurityPrivilege\"; File: \"RemusStealer.exe\")\n Found reference to API \"SeRestorePrivilege\" (Indicator: \"SeRestorePrivilege\"; File: \"RemusStealer.exe\")\n Found reference to API \"SeCreateSymbolicLinkPrivilege\" (Indicator: \"SeCreateSymbolicLinkPrivilege\"; File: \"RemusStealer.exe\")","origin":"File/Memory","mitre_attack_id":"T1548","relevance":3,"id":"string-97","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"RemusStealer.exe\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00000876.00000000.339071.00000000.00000004.mdmp, 00000000-00000876.00000001.340150.00000000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"sslconf.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"RemusStealer.exe\" opened \"\\Device\\KsecDD\"\n \"OneDrive.exe\" opened \"\\Device\\KsecDD\"\n \"powershell.exe\" opened \"\\Device\\KsecDD\"\n \"sslconf.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$5a","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"System Security","name":"Writes registry keys","description":"$5b","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops executable files inside temp directory","description":"\"tempdir.dll\" has type \"PE32+ executable for MS Windows 5.02 (DLL) x86-64 (stripped to external PDB) 3 sections\"- Location: [%TEMP%\\RarSFX0\\tempdir.dll]- [targetUID: 00000000-00002448]\n \"OneDrive.exe\" has type \"PE32+ executable for MS Windows 6.00 (GUI) x86-64 8 sections\"- Location: [%TEMP%\\OneDrive.exe]- [targetUID: 00000000-00000876]\n \"OneDrive.exe\" has type \"PE32+ executable for MS Windows 6.00 (GUI) x86-64 6 sections\"- Location: [%TEMP%\\RarSFX0\\OneDrive.exe]- [targetUID: 00000000-00000876]\n \"signed_j0TYyO.exe\" has type \"PE32+ executable for MS Windows 6.00 (GUI) x86-64 6 sections\"- Location: [%TEMP%\\RarSFX0\\signed_j0TYyO.exe]- [targetUID: 00000000-00007456]\n \"vcruntime140.dll\" has type \"PE32+ executable for MS Windows 6.00 (DLL) x86-64 8 sections\"- Location: [%TEMP%\\RarSFX0\\vcruntime140.dll]- [targetUID: 00000000-00002448]\n \"sslconf.exe\" has type \"PE32+ executable for MS Windows 6.00 (console) x86-64 6 sections\"- Location: [%TEMP%\\RarSFX0\\sslconf.exe]- [targetUID: 00000000-00002448]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-33","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"Dropped file: \"RemusStealer.exe\" - Location: [%LOCALAPPDATA%\\RemusStealer\\RemusStealer.exe]- [targetUID: 00000000-00000876]\n Dropped file: \"RemusStealer.lnk\" - Location: [%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\RemusStealer.lnk]- [targetUID: 00000000-00000876]\n Dropped file: \"StartupProfileData-NonInteractive\" - Location: [%LOCALAPPDATA%\\Microsoft\\Windows\\PowerShell\\StartupProfileData-NonInteractive]- [targetUID: 00000000-00007296]\n Dropped file: \"svchost.exe\" - Location: [%LOCALAPPDATA%\\Microsoft\\svchost.exe]- [targetUID: 00000000-00002620]\n Dropped file: \"M6PV7QVM.txt\" - Location: [%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache\\IE\\LSCBY323\\M6PV7QVM.txt]- [targetUID: 00000000-00002620]","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files with image extension","description":"\"PhotosStoreLogo.png\" has type \"PNG image data 256 x 256 8-bit/color RGBA non-interlaced\" and extension \"png\"\n \"OneDriveMedTile.scale-100.png\" has type \"PNG image data 150 x 150 8-bit/color RGBA non-interlaced\" and extension \"png\"\n \"OneDriveSmallTile.scale-100.png\" has type \"PNG image data 70 x 70 8-bit/color RGBA non-interlaced\" and extension \"png\"","origin":"Binary File","mitre_attack_id":"T1105","id":"binary-56","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"Found string \"trunc\" (Source: RemusStealer.exe, API is part of module: UCRTBASE.DLL)\n Found string \"ungetc\" (Source: RemusStealer.exe, API is part of module: MSVCRT.DLL)\n Found string \"accept\" (Source: RemusStealer.exe, API is part of module: WS2_32.DLL)\n Found string \"remove\" (Source: RemusStealer.exe, API is part of module: MSVCRT.DLL)\n Found string \"signal\" (Source: RemusStealer.exe, API is part of module: MSVCRT.DLL)\n Found string \"connect\" (Source: RemusStealer.exe, API is part of module: WS2_32.DLL)\n Found string \"tmpfile\" (Source: RemusStealer.exe, API is part of module: MSVCRT.DLL)\n Found string \"shutdown\" (Source: RemusStealer.exe, API is part of module: WS2_32.DLL)\n Found string \"WSAIoctl\" (Source: RemusStealer.exe, API is part of module: WS2_32.DLL)\n Found string \"Extract\" (Source: RemusStealer.exe, API is part of module: URLMON.DLL)","origin":"File/Memory","mitre_attack_id":"T1106","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"RemusStealer.exe\" was detected as \"tElock v1.0 (private) -> tE!\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"RemusStealer.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"OneDrive.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"\"sslconf.exe\" is allocating memory with PAGE_GUARD access rights (Handle: FFFFFFFFFFFFFFFF); (PID: 2448)\n \"powershell.exe\" is allocating memory with PAGE_GUARD access rights (Handle: FFFFFFFFFFFFFFFF); (PID: 7296)\n \"sslconf.exe\" is allocating memory with PAGE_GUARD access rights (Handle: FFFFFFFFFFFFFFFF); (PID: 7376)\n \"OneDrive.exe\" is protecting memory with PAGE_GUARD access rights (Handle: FFFFFFFFFFFFFFFF); (PID: 2620)","origin":"API Call","mitre_attack_id":"T1685","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Section contains high entropy","description":"\"RemusStealer.exe\" has section name .rdata with entropy \"7.7647666461757865\"","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads VM-specific registry key","description":"\"sslconf.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\ENUM\\SCSI\\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\\000000\")\n \"sslconf.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\ENUM\\SCSI\\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\\000000\"; Key: \"HARDWAREID\")\n \"sslconf.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\ENUM\\SCSI\\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\\000000\"; Key: \"FRIENDLYNAME\")\n \"sslconf.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\ENUM\\SCSI\\DISK&VEN_VMWARE&PROD_VIRTUAL_SATA_HAR\\5&3F6B946&0&000000\")\n \"sslconf.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\ENUM\\SCSI\\DISK&VEN_VMWARE&PROD_VIRTUAL_SATA_HAR\\5&3F6B946&0&000000\"; Key: \"HARDWAREID\")\n \"sslconf.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\ENUM\\SCSI\\DISK&VEN_VMWARE&PROD_VIRTUAL_SATA_HAR\\5&3F6B946&0&000000\"; Key: \"FRIENDLYNAME\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-33","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"suspicious","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"ET INFO External IP Lookup ip-api.com\" (SID: 2022082, Rev: 6, Severity: 2) categorized as \"Device Retrieving External IP Address Detected\"\n Detected alert \"ET INFO External IP Lookup api.ipify.org\" (SID: 2021997, Rev: 6, Severity: 2) categorized as \"Device Retrieving External IP Address Detected\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-1","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"3/27 Antivirus vendors marked sample as malicious (11% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"suspicious","category":"General","name":"Reads configuration files (.ini files)","description":"$5c","origin":"API Call","mitre_attack_id":"T1083","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"$5d","origin":"Binary File","mitre_attack_id":"T1105","relevance":5,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes a PE file header to disc","description":"$5e","origin":"API Call","mitre_attack_id":"T1105","relevance":5,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"suspicious","category":"Network Related","name":"Attempts to identify external IP address","description":"\"api.ipify.org\"\n \"ip-api.com\"","origin":"Network Traffic","mitre_attack_id":"T1016","relevance":6,"id":"network-24","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 208.95.112.1 on port 80 is sent without HTTP header\n TCP traffic to 104.26.12.205 on port 80 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains references to WMI/WMIC","description":"Found string \"ROOT\\CIMV2\" (Indicator: \"root\\cimv2\"; in Source: \"00000000-00000876.00000001.340150.8F194000.00000004.mdmp, 00000000-00000876.00000001.340150.8F1C4000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":3,"id":"string-30","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"OneDrive.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\RarSFX0\\__tmp_rar_sfx_access_check_6965924\" for deletion\n \"powershell.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_gelns33r.c3w.ps1\" for deletion\n \"powershell.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_13qko3ux.kv5.psm1\" for deletion\n \"OneDrive.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\MsEdgeUpdate.xml\" for deletion","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"OneDrive.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\RarSFX0\\__tmp_rar_sfx_access_check_6965924\" with delete access\n \"powershell.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_gelns33r.c3w.ps1\" with delete access\n \"powershell.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_13qko3ux.kv5.psm1\" with delete access\n \"OneDrive.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\MsEdgeUpdate.xml\" with delete access","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"suspicious","category":"System Security","name":"Hooks API calls","description":"\"ShowWindow@USER32.DLL\" in \"sslconf.exe\"","origin":"Hook Detection","mitre_attack_id":"T1056.004","relevance":10,"id":"hooks-0","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"suspicious","category":"System Security","name":"Modifies Software Policy Settings","description":"$5f","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-19","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"RemusStealer.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\"; Value: \"0100000000\")\n \"OneDrive.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\"; Value: \"0100000000\")","origin":"Registry Access","mitre_attack_id":"T1090.001","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"suspicious","category":"System Security","name":"Queries sensitive IE security settings","description":"\"RemusStealer.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")\n \"OneDrive.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":8,"id":"registry-36","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"suspicious","category":"System Security","name":"Queries the display settings of system associated file extensions","description":"\"RemusStealer.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\SYSTEMFILEASSOCIATIONS\\.EXE\"; Key: \"ALWAYSSHOWEXT\")\n \"RemusStealer.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\SYSTEMFILEASSOCIATIONS\\.EXE\"; Key: \"NEVERSHOWEXT\")\n \"OneDrive.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\SYSTEMFILEASSOCIATIONS\\.EXE\"; Key: \"ALWAYSSHOWEXT\")\n \"OneDrive.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\SYSTEMFILEASSOCIATIONS\\.EXE\"; Key: \"NEVERSHOWEXT\")","origin":"Registry Access","mitre_attack_id":"T1005","relevance":7,"id":"registry-47","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"OneDrive.exe\" claimed CRC 20127186 while the actual is CRC 4549816\n \"signed_j0TYyO.exe\" claimed CRC 4549816 while the actual is CRC 4042784\n \"vcruntime140.dll\" claimed CRC 4042784 while the actual is CRC 150327\n \"sslconf.exe\" claimed CRC 150327 while the actual is CRC 46415","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"VirtualAlloc\n GetSystemInfo\n GetThreadContext\n LoadLibraryW\n GetSystemDirectoryA\n CreateThread\n WriteFile\n LoadLibraryExW\n GetProcAddress\n GetModuleHandleW\n GetCommandLineW\n GetTickCount64\n GetModuleFileNameW\n CreateFileA\n GetModuleHandleA\n TerminateProcess\n IsDebuggerPresent\n UnhandledExceptionFilter\n GetStartupInfoW","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Timestamp in PE header is very old or in the future","description":"\"RemusStealer.exe\" claims program is from Thu Jan 1 00:00:00 1970","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-3","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Creates a process in suspended mode (likely for process injection)","description":"\"RemusStealer.exe\" called \"CreateProcessW\" with parameter \"\"%TEMP%\\OneDrive.exe\"\" - (UID: 00000000-00000876)\n \"OneDrive.exe\" called \"CreateProcessW\" with parameter \"\"%TEMP%\\RarSFX0\\sslconf.exe\"\" - (UID: 00000000-00007456)\n \"OneDrive.exe\" called \"CreateProcessW\" with parameter \"\"%TEMP%\\RarSFX0\\OneDrive.exe\"\" - (UID: 00000000-00007456)","origin":"API Call","mitre_attack_id":"T1055","relevance":10,"id":"api-129","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Queries firmware table information (may be used to fingerprint/evade)","description":"\"RemusStealer.exe\" at 00000000-00000876-00000C15-3552699145\n \"RemusStealer.exe\" at 00000000-00000876-00000C15-3552703109","origin":"API Call","mitre_attack_id":"T1120","relevance":10,"id":"api-65","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"malicious","category":"General","name":"The analysis extracted a file that was identified as malicious","description":"11/26 Antivirus vendors marked dropped file \"svchost.exe\" as malicious (classified as \"Trojan.Win64.Agent\" with 42% detection rate)","origin":"Binary File","mitre_attack_id":"T1204.002","relevance":10,"id":"binary-11","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"malicious","category":"General","name":"The analysis spawned a process that was identified as malicious","description":"11/26 Antivirus vendors marked spawned process \"OneDrive.exe\" (PID: 2620) as malicious (classified as \"Trojan.Win64.Agent\" with 42% detection rate)","origin":"Monitored Target","mitre_attack_id":"T1204.002","relevance":10,"id":"target-58","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"malicious","category":"Installation/Persistence","name":"Drops executable files to the application program directory (%ProgramData%)","description":"File type \"PE32+ executable for MS Windows 6.00 (DLL) x86-64 8 sections\" was dropped at \"%ALLUSERSPROFILE%\\TomatoIndigo\\vcruntime140.dll\"\n File type \"PE32+ executable for MS Windows 6.00 (console) x86-64 6 sections\" was dropped at \"%ALLUSERSPROFILE%\\TomatoIndigo\\sslconf.exe\"\n File type \"PE32+ executable for MS Windows 5.02 (DLL) x86-64 (stripped to external PDB) 3 sections\" was dropped at \"%ALLUSERSPROFILE%\\TomatoIndigo\\tempdir.dll\"","origin":"Binary File","mitre_attack_id":"T1036","relevance":7,"id":"binary-27","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"malicious","category":"Installation/Persistence","name":"Loads the task scheduler COM API","description":"\"schtasks.exe\" loaded module \"%WINDIR%\\System32\\taskschd.dll\" at A7A50000","origin":"Loaded Module","mitre_attack_id":"T1559.001","relevance":5,"id":"module-4","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"malicious","category":"Installation/Persistence","name":"Schedules a task to be executed at a specific time and date","description":"Process \"schtasks.exe\" with commandline \"/create /xml \"%TEMP%\\\\MsEdgeUpdate.xml\" /tn \"\\\\Users\\\\24cvHmM\\\\OneDriveUpdater\" /f\" (UID: 00000000-00001648)","origin":"Monitored Target","mitre_attack_id":"T1053.005","relevance":8,"id":"target-13","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"malicious","category":"Installation/Persistence","name":"Schedules a task to be executed from task XML file","description":"Process \"schtasks.exe\" with commandline \"/create /xml \"%TEMP%\\\\MsEdgeUpdate.xml\" /tn \"\\\\Users\\\\24cvHmM\\\\OneDriveUpdater\" /f\" (UID: 00000000-00001648)","origin":"Monitored Target","mitre_attack_id":"T1053.005","relevance":5,"id":"target-414","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"$60","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns many processes","description":"Spawned process \"RemusStealer.exe\" (UID: 00000000-00000876)\n Spawned process \"OneDrive.exe\" (UID: 00000000-00007456)\n Spawned process \"sslconf.exe\" (UID: 00000000-00002448)\n Spawned process \"powershell.exe\" with commandline \"powershell -NoProfile -Command \"\"\" (UID: 00000000-00007296)\n Spawned process \"sslconf.exe\" (UID: 00000000-00007376)\n Spawned process \"OneDrive.exe\" (UID: 00000000-00002620)\n Spawned process \"schtasks.exe\" with commandline \"/create /xml \"%TEMP%\\\\MsEdgeUpdate.xml\" /tn \"\\\\Users\\\\24cvHmM\\\\OneDriveUpdater\" /f\" (UID: 00000000-00001648)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]}],"incidents":[{"name":"Spyware","details_count":2,"details":[{"detail":"Hooks API calls"},{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"name":"Persistence","details_count":6,"details":[{"detail":"Writes data to a remote process"},{"detail":"Creates new processes"},{"detail":"Schedules a task to be executed at a specific time and date"},{"detail":"Spawns many processes"},{"detail":"Writes a file to the startup folder"},{"detail":"Drops executable files to the application program directory (%ProgramData%)"}],"sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"name":"Fingerprint","details_count":5,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Queries firmware table information (may be used to fingerprint/evade)"},{"detail":"Attempts to identify external IP address"},{"detail":"Queries sensitive IE security settings"},{"detail":"Queries the display settings of system associated file extensions"}],"sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"name":"Evasive","details_count":3,"details":[{"detail":"Marks file for deletion"},{"detail":"Reads VM-specific registry key"},{"detail":"Found a reference to a WMI query string known to be used for VM detection"}],"sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 3 domains and 3 hosts"}],"sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]}],"intel_graph":{"map":{"Domain:api.ipify.org":{"type":"Domain","value":"api.ipify.org"},"Domain:ip-api.com":{"type":"Domain","value":"ip-api.com"},"Domain:rg1k98tivqqmmjm238ntbg0tkwo5ejnwecwn1.com":{"type":"Domain","value":"rg1k98tivqqmmjm238ntbg0tkwo5ejnwecwn1.com"},"File:02b562d7532985d27e279644dd3b0faa00a21055a82228bce2ce7949466e1c4a":{"type":"File","value":"02b562d7532985d27e279644dd3b0faa00a21055a82228bce2ce7949466e1c4a"},"File:181ca31ecd72e8021d210b7565812f0492370e97d06373747592e0b5fa8b6406":{"type":"File","value":"181ca31ecd72e8021d210b7565812f0492370e97d06373747592e0b5fa8b6406"},"File:1c1975f56416589fd0aa9add4c44a87c5dfd71ca365630e40e9f64bde6f0e49c":{"type":"File","value":"1c1975f56416589fd0aa9add4c44a87c5dfd71ca365630e40e9f64bde6f0e49c"},"File:2219994adf05739c9c2e38200218b50d536cdbce02c26f249197b5fa9cc357bb":{"type":"File","value":"2219994adf05739c9c2e38200218b50d536cdbce02c26f249197b5fa9cc357bb"},"File:36a79bdb3217b6709fa93d3d5555f26e59737d3c594c4068bbf4cbcdf17c08c5":{"type":"File","value":"36a79bdb3217b6709fa93d3d5555f26e59737d3c594c4068bbf4cbcdf17c08c5"},"File:3eba66dfe009ead0320103108a4ffafc546537b4048839ddc1737d5fd08f6cb7":{"type":"File","value":"3eba66dfe009ead0320103108a4ffafc546537b4048839ddc1737d5fd08f6cb7"},"File:49b8de0cb3e07bae798801373367184d7c26d749dd73524fd4f0a836bbb133d2":{"type":"File","value":"49b8de0cb3e07bae798801373367184d7c26d749dd73524fd4f0a836bbb133d2"},"File:4d026a8788918e4e93368794ff5d07c40355c97e2f7b5daaa1a2d451a3911253":{"type":"File","value":"4d026a8788918e4e93368794ff5d07c40355c97e2f7b5daaa1a2d451a3911253"},"File:59f7217d5e0633ecfac55fbbe35b1a95b0c11e2a6a58de16396dd9159260af0b":{"type":"File","value":"59f7217d5e0633ecfac55fbbe35b1a95b0c11e2a6a58de16396dd9159260af0b"},"File:6b9942f7dd6804e3b81b5d105fc83bb336bf4ae386e4e1ccbebdac659e29a731":{"type":"File","value":"6b9942f7dd6804e3b81b5d105fc83bb336bf4ae386e4e1ccbebdac659e29a731"},"File:6c6b5f91ad925d9fd3611bd15ea380ed5a1eeb148face0797026341d5f14241b":{"type":"File","value":"6c6b5f91ad925d9fd3611bd15ea380ed5a1eeb148face0797026341d5f14241b"},"File:6d004e918e7763fdd0815047969938620083bcdfba8b0563298fcf1b9b375429":{"type":"File","value":"6d004e918e7763fdd0815047969938620083bcdfba8b0563298fcf1b9b375429"},"File:73f63a98f6721664516f8dd8043e8cb31a1345335f124ddfefaaa9fb83b2980a":{"type":"File","value":"73f63a98f6721664516f8dd8043e8cb31a1345335f124ddfefaaa9fb83b2980a"},"File:83e985ed6e94c4f6b83ef0f15433d97e5210a492a3f6f1cfdbba0c3350b5d949":{"type":"File","value":"83e985ed6e94c4f6b83ef0f15433d97e5210a492a3f6f1cfdbba0c3350b5d949"},"File:884129b7691d98f541650f9974a034323677ebe4e1c3bd71ebf5d43cdf118acc":{"type":"File","value":"884129b7691d98f541650f9974a034323677ebe4e1c3bd71ebf5d43cdf118acc"},"File:8f29d7892bbdfc65c418e01eba179b429ec3e8658bac0e36d00ba07045986457":{"type":"File","value":"8f29d7892bbdfc65c418e01eba179b429ec3e8658bac0e36d00ba07045986457"},"File:934d27d63c746dae9fdd74c58030f23f7287d8ab72a38142bb592d40a9ebdb1b":{"type":"File","value":"934d27d63c746dae9fdd74c58030f23f7287d8ab72a38142bb592d40a9ebdb1b"},"File:a5437c6e669b83b5ae336cdddb79fed6425408f3f72ee367441986495e3e56fd":{"type":"File","value":"a5437c6e669b83b5ae336cdddb79fed6425408f3f72ee367441986495e3e56fd"},"File:a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf":{"type":"File","value":"a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf"},"File:b4fe5623c76a4b21650754bd002ed4fbd468b21eeb5f9443b7a7225a8a263404":{"type":"File","value":"b4fe5623c76a4b21650754bd002ed4fbd468b21eeb5f9443b7a7225a8a263404"},"File:b691e704617ae2f6e0a1a9c3facb623321b76b5741e28d508562293e5a800d92":{"type":"File","value":"b691e704617ae2f6e0a1a9c3facb623321b76b5741e28d508562293e5a800d92"},"File:b98f5f43aed0150a0d853bab4f7f5c034aab1aade83078c846a43a7fd66e2eea":{"type":"File","value":"b98f5f43aed0150a0d853bab4f7f5c034aab1aade83078c846a43a7fd66e2eea"},"File:bbbdc901eea44376af3082a603a75c14b20e02b3bbd8274e6a52d06b6bb2883d":{"type":"File","value":"bbbdc901eea44376af3082a603a75c14b20e02b3bbd8274e6a52d06b6bb2883d"},"File:bf60bbc4c462ceddf8f2a757275522079d1ed815f04e04118a04effae90e282d":{"type":"File","value":"bf60bbc4c462ceddf8f2a757275522079d1ed815f04e04118a04effae90e282d"},"File:cd0991dd595a1392452a8c7ccf089e73626bc6eed1fd3f54ee4c6aa7ffbaedba":{"type":"File","value":"cd0991dd595a1392452a8c7ccf089e73626bc6eed1fd3f54ee4c6aa7ffbaedba"},"File:cdf0547ed7deef0d151aef7632e76ff66234f980b904502c255ef2bee4527b1e":{"type":"File","value":"cdf0547ed7deef0d151aef7632e76ff66234f980b904502c255ef2bee4527b1e"},"File:d44e6faaf3df358593a29faace64a071ab8de0a84c30a5232d8e9081dd668f1b":{"type":"File","value":"d44e6faaf3df358593a29faace64a071ab8de0a84c30a5232d8e9081dd668f1b"},"File:d723b18523d8175aed8566ec48d787b6c373caadffa1f0a350a25bed2e608781":{"type":"File","value":"d723b18523d8175aed8566ec48d787b6c373caadffa1f0a350a25bed2e608781"},"File:ee57225deb5b003c11d84f099a3cfe378ada230aaa89c6d7fc6334a21ce7dc06":{"type":"File","value":"ee57225deb5b003c11d84f099a3cfe378ada230aaa89c6d7fc6334a21ce7dc06"},"File:f685ceed98b502364cc073f8448b7faee49b274686109a48daf5acdbea33f3e6":{"type":"File","value":"f685ceed98b502364cc073f8448b7faee49b274686109a48daf5acdbea33f3e6"},"File:fb3385d1de11e20aa8c5609e26473d7090826f299ad48b4d92bae54d8a2d4fb4":{"type":"File","value":"fb3385d1de11e20aa8c5609e26473d7090826f299ad48b4d92bae54d8a2d4fb4"},"File:fd826215add30c1319eefa291b6eaf8ddfa7720cfe816c49aef6fe8a88de7939":{"type":"File","value":"fd826215add30c1319eefa291b6eaf8ddfa7720cfe816c49aef6fe8a88de7939"},"File:fec098a5aa84897cd74b95d64eb0b82ce23feb2131d12da597bd65c09feddc18":{"type":"File","value":"fec098a5aa84897cd74b95d64eb0b82ce23feb2131d12da597bd65c09feddc18"},"Ip:104.26.12.205":{"type":"Ip","value":"104.26.12.205"},"Ip:193.233.75.14":{"type":"Ip","value":"193.233.75.14"},"Ip:208.95.112.1":{"type":"Ip","value":"208.95.112.1"},"Url:/":{"type":"Url","value":"/"},"Url:/line/?fields=country":{"type":"Url","value":"/line/?fields=country"}},"chains":[{"id":"sandbox_network","root":"File:d44e6faaf3df358593a29faace64a071ab8de0a84c30a5232d8e9081dd668f1b","edges":[{"edge_kind":"contacted_ip","from_key":"File:d44e6faaf3df358593a29faace64a071ab8de0a84c30a5232d8e9081dd668f1b","to_key":"Ip:193.233.75.14"},{"edge_kind":"contacted_ip","from_key":"File:d44e6faaf3df358593a29faace64a071ab8de0a84c30a5232d8e9081dd668f1b","to_key":"Ip:208.95.112.1"},{"edge_kind":"contacted_ip","from_key":"File:d44e6faaf3df358593a29faace64a071ab8de0a84c30a5232d8e9081dd668f1b","to_key":"Ip:104.26.12.205"},{"edge_kind":"contacted_domain","from_key":"File:d44e6faaf3df358593a29faace64a071ab8de0a84c30a5232d8e9081dd668f1b","to_key":"Domain:api.ipify.org"},{"edge_kind":"resolves_to","from_key":"Domain:api.ipify.org","to_key":"Ip:104.26.12.205"},{"edge_kind":"contacted_domain","from_key":"File:d44e6faaf3df358593a29faace64a071ab8de0a84c30a5232d8e9081dd668f1b","to_key":"Domain:ip-api.com"},{"edge_kind":"resolves_to","from_key":"Domain:ip-api.com","to_key":"Ip:208.95.112.1"},{"edge_kind":"contacted_domain","from_key":"File:d44e6faaf3df358593a29faace64a071ab8de0a84c30a5232d8e9081dd668f1b","to_key":"Domain:rg1k98tivqqmmjm238ntbg0tkwo5ejnwecwn1.com"},{"edge_kind":"contacted_url","from_key":"File:d44e6faaf3df358593a29faace64a071ab8de0a84c30a5232d8e9081dd668f1b","to_key":"Url:/line/?fields=country"},{"edge_kind":"contacted_url","from_key":"File:d44e6faaf3df358593a29faace64a071ab8de0a84c30a5232d8e9081dd668f1b","to_key":"Url:/"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}},{"id":"sandbox_files","root":"File:d44e6faaf3df358593a29faace64a071ab8de0a84c30a5232d8e9081dd668f1b","edges":[{"edge_kind":"extracted","from_key":"File:d44e6faaf3df358593a29faace64a071ab8de0a84c30a5232d8e9081dd668f1b","to_key":"File:83e985ed6e94c4f6b83ef0f15433d97e5210a492a3f6f1cfdbba0c3350b5d949"},{"edge_kind":"extracted","from_key":"File:d44e6faaf3df358593a29faace64a071ab8de0a84c30a5232d8e9081dd668f1b","to_key":"File:6c6b5f91ad925d9fd3611bd15ea380ed5a1eeb148face0797026341d5f14241b"},{"edge_kind":"extracted","from_key":"File:d44e6faaf3df358593a29faace64a071ab8de0a84c30a5232d8e9081dd668f1b","to_key":"File:cdf0547ed7deef0d151aef7632e76ff66234f980b904502c255ef2bee4527b1e"},{"edge_kind":"extracted","from_key":"File:d44e6faaf3df358593a29faace64a071ab8de0a84c30a5232d8e9081dd668f1b","to_key":"File:6b9942f7dd6804e3b81b5d105fc83bb336bf4ae386e4e1ccbebdac659e29a731"},{"edge_kind":"extracted","from_key":"File:d44e6faaf3df358593a29faace64a071ab8de0a84c30a5232d8e9081dd668f1b","to_key":"File:ee57225deb5b003c11d84f099a3cfe378ada230aaa89c6d7fc6334a21ce7dc06"},{"edge_kind":"extracted","from_key":"File:d44e6faaf3df358593a29faace64a071ab8de0a84c30a5232d8e9081dd668f1b","to_key":"File:934d27d63c746dae9fdd74c58030f23f7287d8ab72a38142bb592d40a9ebdb1b"},{"edge_kind":"extracted","from_key":"File:d44e6faaf3df358593a29faace64a071ab8de0a84c30a5232d8e9081dd668f1b","to_key":"File:b98f5f43aed0150a0d853bab4f7f5c034aab1aade83078c846a43a7fd66e2eea"},{"edge_kind":"extracted","from_key":"File:d44e6faaf3df358593a29faace64a071ab8de0a84c30a5232d8e9081dd668f1b","to_key":"File:1c1975f56416589fd0aa9add4c44a87c5dfd71ca365630e40e9f64bde6f0e49c"},{"edge_kind":"extracted","from_key":"File:d44e6faaf3df358593a29faace64a071ab8de0a84c30a5232d8e9081dd668f1b","to_key":"File:4d026a8788918e4e93368794ff5d07c40355c97e2f7b5daaa1a2d451a3911253"},{"edge_kind":"extracted","from_key":"File:d44e6faaf3df358593a29faace64a071ab8de0a84c30a5232d8e9081dd668f1b","to_key":"File:73f63a98f6721664516f8dd8043e8cb31a1345335f124ddfefaaa9fb83b2980a"},{"edge_kind":"extracted","from_key":"File:d44e6faaf3df358593a29faace64a071ab8de0a84c30a5232d8e9081dd668f1b","to_key":"File:b691e704617ae2f6e0a1a9c3facb623321b76b5741e28d508562293e5a800d92"},{"edge_kind":"extracted","from_key":"File:d44e6faaf3df358593a29faace64a071ab8de0a84c30a5232d8e9081dd668f1b","to_key":"File:49b8de0cb3e07bae798801373367184d7c26d749dd73524fd4f0a836bbb133d2"},{"edge_kind":"extracted","from_key":"File:d44e6faaf3df358593a29faace64a071ab8de0a84c30a5232d8e9081dd668f1b","to_key":"File:36a79bdb3217b6709fa93d3d5555f26e59737d3c594c4068bbf4cbcdf17c08c5"},{"edge_kind":"extracted","from_key":"File:d44e6faaf3df358593a29faace64a071ab8de0a84c30a5232d8e9081dd668f1b","to_key":"File:181ca31ecd72e8021d210b7565812f0492370e97d06373747592e0b5fa8b6406"},{"edge_kind":"extracted","from_key":"File:d44e6faaf3df358593a29faace64a071ab8de0a84c30a5232d8e9081dd668f1b","to_key":"File:a5437c6e669b83b5ae336cdddb79fed6425408f3f72ee367441986495e3e56fd"},{"edge_kind":"extracted","from_key":"File:d44e6faaf3df358593a29faace64a071ab8de0a84c30a5232d8e9081dd668f1b","to_key":"File:59f7217d5e0633ecfac55fbbe35b1a95b0c11e2a6a58de16396dd9159260af0b"},{"edge_kind":"extracted","from_key":"File:d44e6faaf3df358593a29faace64a071ab8de0a84c30a5232d8e9081dd668f1b","to_key":"File:d723b18523d8175aed8566ec48d787b6c373caadffa1f0a350a25bed2e608781"},{"edge_kind":"extracted","from_key":"File:d44e6faaf3df358593a29faace64a071ab8de0a84c30a5232d8e9081dd668f1b","to_key":"File:bbbdc901eea44376af3082a603a75c14b20e02b3bbd8274e6a52d06b6bb2883d"},{"edge_kind":"extracted","from_key":"File:d44e6faaf3df358593a29faace64a071ab8de0a84c30a5232d8e9081dd668f1b","to_key":"File:fb3385d1de11e20aa8c5609e26473d7090826f299ad48b4d92bae54d8a2d4fb4"},{"edge_kind":"extracted","from_key":"File:d44e6faaf3df358593a29faace64a071ab8de0a84c30a5232d8e9081dd668f1b","to_key":"File:6d004e918e7763fdd0815047969938620083bcdfba8b0563298fcf1b9b375429"},{"edge_kind":"extracted","from_key":"File:d44e6faaf3df358593a29faace64a071ab8de0a84c30a5232d8e9081dd668f1b","to_key":"File:fd826215add30c1319eefa291b6eaf8ddfa7720cfe816c49aef6fe8a88de7939"},{"edge_kind":"extracted","from_key":"File:d44e6faaf3df358593a29faace64a071ab8de0a84c30a5232d8e9081dd668f1b","to_key":"File:3eba66dfe009ead0320103108a4ffafc546537b4048839ddc1737d5fd08f6cb7"},{"edge_kind":"extracted","from_key":"File:d44e6faaf3df358593a29faace64a071ab8de0a84c30a5232d8e9081dd668f1b","to_key":"File:fec098a5aa84897cd74b95d64eb0b82ce23feb2131d12da597bd65c09feddc18"},{"edge_kind":"extracted","from_key":"File:d44e6faaf3df358593a29faace64a071ab8de0a84c30a5232d8e9081dd668f1b","to_key":"File:2219994adf05739c9c2e38200218b50d536cdbce02c26f249197b5fa9cc357bb"},{"edge_kind":"extracted","from_key":"File:d44e6faaf3df358593a29faace64a071ab8de0a84c30a5232d8e9081dd668f1b","to_key":"File:cd0991dd595a1392452a8c7ccf089e73626bc6eed1fd3f54ee4c6aa7ffbaedba"},{"edge_kind":"extracted","from_key":"File:d44e6faaf3df358593a29faace64a071ab8de0a84c30a5232d8e9081dd668f1b","to_key":"File:8f29d7892bbdfc65c418e01eba179b429ec3e8658bac0e36d00ba07045986457"},{"edge_kind":"extracted","from_key":"File:d44e6faaf3df358593a29faace64a071ab8de0a84c30a5232d8e9081dd668f1b","to_key":"File:6b9942f7dd6804e3b81b5d105fc83bb336bf4ae386e4e1ccbebdac659e29a731"},{"edge_kind":"extracted","from_key":"File:d44e6faaf3df358593a29faace64a071ab8de0a84c30a5232d8e9081dd668f1b","to_key":"File:f685ceed98b502364cc073f8448b7faee49b274686109a48daf5acdbea33f3e6"},{"edge_kind":"extracted","from_key":"File:d44e6faaf3df358593a29faace64a071ab8de0a84c30a5232d8e9081dd668f1b","to_key":"File:b4fe5623c76a4b21650754bd002ed4fbd468b21eeb5f9443b7a7225a8a263404"},{"edge_kind":"extracted","from_key":"File:d44e6faaf3df358593a29faace64a071ab8de0a84c30a5232d8e9081dd668f1b","to_key":"File:02b562d7532985d27e279644dd3b0faa00a21055a82228bce2ce7949466e1c4a"},{"edge_kind":"extracted","from_key":"File:d44e6faaf3df358593a29faace64a071ab8de0a84c30a5232d8e9081dd668f1b","to_key":"File:bf60bbc4c462ceddf8f2a757275522079d1ed815f04e04118a04effae90e282d"},{"edge_kind":"extracted","from_key":"File:d44e6faaf3df358593a29faace64a071ab8de0a84c30a5232d8e9081dd668f1b","to_key":"File:a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf"},{"edge_kind":"extracted","from_key":"File:d44e6faaf3df358593a29faace64a071ab8de0a84c30a5232d8e9081dd668f1b","to_key":"File:884129b7691d98f541650f9974a034323677ebe4e1c3bd71ebf5d43cdf118acc"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}}]}},"activity":{"stats":{"process_count":7,"spawned_processes_count":7,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":33,"imported_dlls_count":126,"dropped_files_count":0,"extracted_files_count":33,"files_written_count":33,"files_deleted_count":0,"registry_keys_created_count":35,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":35,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":3,"dns_resolutions_count":3,"contacted_urls_count":2,"http_requests_count":2},"behavior_tags":["evasive"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"6ad4428d14ba30852e066fa4","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"WinGo.J.gen","contacted_countries":["DEU","USA"],"submit_name":"RemusStealer.exe","analysis_start_time":"2026-10-18T03:52:49+00:00","indicators_count":{"informative":225,"suspicious":75,"malicious":13},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"193.233.75.14","port":5555,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"address":"208.95.112.1","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"address":"104.26.12.205","port":80,"protocol":"TCP","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]}],"dns_resolutions":[{"domain":"api.ipify.org","address":"104.26.12.205","ttl":300,"country":"-","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"domain":"ip-api.com","address":"208.95.112.1","ttl":60,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"domain":"rg1k98tivqqmmjm238ntbg0tkwo5ejnwecwn1.com","ttl":900,"country":"-","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]}],"http_requests":[{"host":"ip-api.com","host_ip":"208.95.112.1:80","url":"/line/?fields=country","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /line/?fields=country HTTP/1.1\nHost: ip-api.com\nCache-Control: no-cache","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"host":"api.ipify.org","host_ip":"104.26.12.205:80","url":"/","method":"GET","response_code":"200","response_phrase":"OK","header":"GET / HTTP/1.1\nHost: api.ipify.org\nCache-Control: no-cache","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}],"processes":[{"pid":876,"ppid":0,"name":"RemusStealer.exe","command_line":"","sha256":"d44e6faaf3df358593a29faace64a071ab8de0a84c30a5232d8e9081dd668f1b","normalized_path":"C:\\RemusStealer.exe","uid":"00000000-00000876","icon":"$61"},{"pid":7456,"ppid":876,"name":"OneDrive.exe","command_line":"","sha256":"b19eb1e98d0ebf251376dd1c76e2cc6544356adecb415880c6103aae2292dacb","normalized_path":"%TEMP%\\OneDrive.exe","parent_uid":"00000000-00000876","uid":"00000000-00007456"},{"pid":2448,"ppid":7456,"name":"sslconf.exe","command_line":"","sha256":"fd826215add30c1319eefa291b6eaf8ddfa7720cfe816c49aef6fe8a88de7939","normalized_path":"%TEMP%\\RarSFX0\\sslconf.exe","parent_uid":"00000000-00007456","uid":"00000000-00002448"},{"pid":7376,"ppid":2448,"name":"sslconf.exe","command_line":"","sha256":"fd826215add30c1319eefa291b6eaf8ddfa7720cfe816c49aef6fe8a88de7939","normalized_path":"%ALLUSERSPROFILE%\\TomatoIndigo\\sslconf.exe","parent_uid":"00000000-00002448","uid":"00000000-00007376"},{"pid":2620,"ppid":7456,"name":"OneDrive.exe","command_line":"","sha256":"6b9942f7dd6804e3b81b5d105fc83bb336bf4ae386e4e1ccbebdac659e29a731","normalized_path":"%TEMP%\\RarSFX0\\OneDrive.exe","parent_uid":"00000000-00007456","uid":"00000000-00002620"},{"pid":1648,"ppid":2620,"name":"schtasks.exe","command_line":"/create /xml \"%TEMP%\\MsEdgeUpdate.xml\" /tn \"\\Users\\24cvHmM\\OneDriveUpdater\" /f","sha256":"3a0943826ebc7f6d76908e5bc6a14067265460b0742f89ae0f74b9380ef9a361","normalized_path":"%WINDIR%\\System32\\schtasks.exe","parent_uid":"00000000-00002620","uid":"00000000-00001648"},{"pid":7296,"ppid":876,"name":"powershell.exe","command_line":"powershell -NoProfile -Command \"\"","sha256":"34507738f84b9d4f231dc0c187fee4a03b4ddb84cf63ff56a4a1761a9bd56ea6","normalized_path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00000876","uid":"00000000-00007296"}],"all_imported_dlls":["atl.dll","bcrypt.dll","clbcatq.dll","sfc_os.dll","OnDemandConnRouteHelper.dll","wintrust.dll","tiptsf.dll","rasadhlp.dll","vcruntime140_clr0400.dll","System.Data.ni.dll","combase.dll","mswsock.dll","winnsi.dll","Microsoft.PowerShell.ConsoleHost.ni.dll","slc.dll","profapi.dll","usp10.dll","devobj.dll","System.Transactions.ni.dll","KernelBase.dll","imagehlp.dll","iertutil.dll","System.Data.dll","msvcrt.dll","msIso.dll","comctl32.dll","crypt32.dll","mscoreei.dll","rpcrt4.dll","shell32.dll","riched20.dll","gdi32full.dll","fltLib.dll","powrprof.dll","psapi.dll","System.Transactions.dll","mscoree.dll","Microsoft.Management.Infrastructure.ni.dll","ntdll.dll","WindowsCodecs.dll","tempdir.dll","MpOAV.dll","d1tdHSUH.dll","windows.storage.dll","Windows.StateRepositoryPS.dll","Microsoft.PowerShell.Security.ni.dll","apphelp.dll","msvcp140.dll","dwmapi.dll","pcacli.dll","webio.dll","aepic.dll","sspicli.dll","System.DirectoryServices.ni.dll","win32u.dll","taskschd.dll","System.Management.Automation.ni.dll","ole32.dll","vcruntime140_1.dll","propsys.dll","ucrtbase_clr0400.dll","urlmon.dll","wbemprox.dll","setupapi.dll","ws2_32.dll","shlwapi.dll","srvcli.dll","IPHLPAPI.DLL","System.Core.ni.dll","wldp.dll","uxtheme.dll","CoreUIComponents.dll","System.Xml.ni.dll","System.Configuration.ni.dll","user32.dll","vcruntime140.dll","CoreMessaging.dll","System.Management.ni.dll","sppc.dll","cfgmgr32.dll","linkinfo.dll","System.ni.dll","kernel.appcore.dll","GdiPlus.dll","mpr.dll","gpapi.dll","winmm.dll","TextInputFramework.dll","gdi32.dll","cryptsp.dll","rsaenh.dll","OneCoreUAPCommonProxyStub.dll","userenv.dll","clrjit.dll","kernel32.dll","edputil.dll","cryptbase.dll","WinTypes.dll","nsi.dll","cldapi.dll","dnsapi.dll","VxSSL64.dll","SHCore.dll","ntmarta.dll","msvcp_win.dll","ucrtbase.dll","bcryptprimitives.dll","winhttp.dll","version.dll","amsi.dll","secur32.dll","oleaut32.dll","winmmbase.dll","imm32.dll","sechost.dll","msctf.dll","wbemcomn.dll","msls31.dll","msasn1.dll","mscorlib.ni.dll","MpClient.dll","advapi32.dll","clr.dll","System.Numerics.ni.dll","ntshrui.dll","cscapi.dll"]},"file_activity":{"dropped_files":[],"extracted_files":[{"name":"83e985ed6e94c4f6b83ef0f15433d97e5210a492a3f6f1cfdbba0c3350b5d949","sha256":"83e985ed6e94c4f6b83ef0f15433d97e5210a492a3f6f1cfdbba0c3350b5d949","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"6c6b5f91ad925d9fd3611bd15ea380ed5a1eeb148face0797026341d5f14241b","sha256":"6c6b5f91ad925d9fd3611bd15ea380ed5a1eeb148face0797026341d5f14241b","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":".data","sha256":"cdf0547ed7deef0d151aef7632e76ff66234f980b904502c255ef2bee4527b1e","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"OneDrive.exe","sha256":"6b9942f7dd6804e3b81b5d105fc83bb336bf4ae386e4e1ccbebdac659e29a731","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"name":"OneDriveMedTile.scale-100.png","sha256":"ee57225deb5b003c11d84f099a3cfe378ada230aaa89c6d7fc6334a21ce7dc06","verdict":"likely_benign","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"name":"934d27d63c746dae9fdd74c58030f23f7287d8ab72a38142bb592d40a9ebdb1b","sha256":"934d27d63c746dae9fdd74c58030f23f7287d8ab72a38142bb592d40a9ebdb1b","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"CERTIFICATE","sha256":"b98f5f43aed0150a0d853bab4f7f5c034aab1aade83078c846a43a7fd66e2eea","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"OneDriveSmallTile.scale-100.png","sha256":"1c1975f56416589fd0aa9add4c44a87c5dfd71ca365630e40e9f64bde6f0e49c","verdict":"likely_benign","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"name":".text","sha256":"4d026a8788918e4e93368794ff5d07c40355c97e2f7b5daaa1a2d451a3911253","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"PhotosStoreLogo.png","sha256":"73f63a98f6721664516f8dd8043e8cb31a1345335f124ddfefaaa9fb83b2980a","verdict":"likely_benign","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"name":".xdata","sha256":"b691e704617ae2f6e0a1a9c3facb623321b76b5741e28d508562293e5a800d92","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"49b8de0cb3e07bae798801373367184d7c26d749dd73524fd4f0a836bbb133d2","sha256":"49b8de0cb3e07bae798801373367184d7c26d749dd73524fd4f0a836bbb133d2","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"signed_j0TYyO.exe","sha256":"36a79bdb3217b6709fa93d3d5555f26e59737d3c594c4068bbf4cbcdf17c08c5","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"name":"tempdir.dll","sha256":"181ca31ecd72e8021d210b7565812f0492370e97d06373747592e0b5fa8b6406","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"name":"vcruntime140.dll","sha256":"a5437c6e669b83b5ae336cdddb79fed6425408f3f72ee367441986495e3e56fd","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"name":".reloc","sha256":"59f7217d5e0633ecfac55fbbe35b1a95b0c11e2a6a58de16396dd9159260af0b","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":".symtab","sha256":"d723b18523d8175aed8566ec48d787b6c373caadffa1f0a350a25bed2e608781","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":".rsrc/ICON/1.ico","sha256":"bbbdc901eea44376af3082a603a75c14b20e02b3bbd8274e6a52d06b6bb2883d","verdict":"likely_benign","sources":[{"report_type":"qsp","report_id":""}]},{"name":".idata","sha256":"fb3385d1de11e20aa8c5609e26473d7090826f299ad48b4d92bae54d8a2d4fb4","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":".rdata","sha256":"6d004e918e7763fdd0815047969938620083bcdfba8b0563298fcf1b9b375429","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"sslconf.exe","sha256":"fd826215add30c1319eefa291b6eaf8ddfa7720cfe816c49aef6fe8a88de7939","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"name":"3eba66dfe009ead0320103108a4ffafc546537b4048839ddc1737d5fd08f6cb7","sha256":"3eba66dfe009ead0320103108a4ffafc546537b4048839ddc1737d5fd08f6cb7","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"fec098a5aa84897cd74b95d64eb0b82ce23feb2131d12da597bd65c09feddc18","sha256":"fec098a5aa84897cd74b95d64eb0b82ce23feb2131d12da597bd65c09feddc18","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"onedrive.ico","sha256":"2219994adf05739c9c2e38200218b50d536cdbce02c26f249197b5fa9cc357bb","verdict":"likely_benign","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"name":".rsrc/GROUP_ICON/1","sha256":"cd0991dd595a1392452a8c7ccf089e73626bc6eed1fd3f54ee4c6aa7ffbaedba","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":".pdata","sha256":"8f29d7892bbdfc65c418e01eba179b429ec3e8658bac0e36d00ba07045986457","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"svchost.exe","sha256":"6b9942f7dd6804e3b81b5d105fc83bb336bf4ae386e4e1ccbebdac659e29a731","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"name":"RemusStealer.exe","sha256":"f685ceed98b502364cc073f8448b7faee49b274686109a48daf5acdbea33f3e6","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"name":"RemusStealer.lnk","sha256":"b4fe5623c76a4b21650754bd002ed4fbd468b21eeb5f9443b7a7225a8a263404","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"name":"MsEdgeUpdate.xml","sha256":"02b562d7532985d27e279644dd3b0faa00a21055a82228bce2ce7949466e1c4a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"name":"M6PV7QVM.txt","sha256":"bf60bbc4c462ceddf8f2a757275522079d1ed815f04e04118a04effae90e282d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"name":"StartupProfileData-NonInteractive","sha256":"a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"name":"line_1_.txt","sha256":"884129b7691d98f541650f9974a034323677ebe4e1c3bd71ebf5d43cdf118acc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]}],"files_written":[{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"path":"%TEMP%\\OneDrive.exe","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"path":"%LOCALAPPDATA%\\RemusStealer\\RemusStealer.exe","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"path":"PIPE\\srvsvc","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\RemusStealer.lnk","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"path":"C:\\Users","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"path":"%USERPROFILE%\\AppData","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"path":"%LOCALAPPDATA%\\Temp","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"path":"%TEMP%\\RarSFX0\\__tmp_rar_sfx_access_check_6965924","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"path":"%TEMP%\\RarSFX0\\OneDrive.exe","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"path":"%TEMP%\\RarSFX0\\signed_j0TYyO.exe","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"path":"%TEMP%\\RarSFX0\\sslconf.exe","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"path":"%TEMP%\\RarSFX0\\tempdir.dll","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"path":"%TEMP%\\RarSFX0\\vcruntime140.dll","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"path":"%TEMP%\\RarSFX0\\onedrive.ico","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"path":"%TEMP%\\RarSFX0\\OneDriveMedTile.scale-100.png","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"path":"%TEMP%\\RarSFX0\\OneDriveSmallTile.scale-100.png","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"path":"%TEMP%\\RarSFX0\\PhotosStoreLogo.png","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"path":"%ALLUSERSPROFILE%\\TomatoIndigo\\tempdir.dll","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"path":"%ALLUSERSPROFILE%\\TomatoIndigo\\vcruntime140.dll","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"path":"%ALLUSERSPROFILE%\\TomatoIndigo\\sslconf.exe","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"path":"%LOCALAPPDATA%\\Microsoft","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\svchost.exe","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"path":"%TEMP%\\MsEdgeUpdate.xml","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"path":"%WINDIR%\\System32\\CatRoot","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"path":"%WINDIR%\\System32\\catroot2","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_gelns33r.c3w.ps1","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_13qko3ux.kv5.psm1","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\PowerShell\\StartupProfileData-NonInteractive","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\CONNECTIONS\\","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:876:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:876:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:876:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"name":"\\BaseNamedObjects\\SyncRootManager","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:876:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"name":"Local\\SM0:876:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"name":"Local\\SM0:876:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"name":"SM0:876:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"name":"SM0:876:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7456:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7456:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7456:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7456:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"name":"Local\\SM0:7456:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"name":"Local\\SM0:7456:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"name":"SM0:7456:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"name":"SM0:7456:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:2448:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2448:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"name":"Local\\SM0:2448:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"name":"SM0:2448:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7376:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7376:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"name":"Local\\SM0:7376:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"name":"SM0:7376:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"name":"\\BaseNamedObjects\\{{34BA6F76-9E4B-4AF1-58C9-65518A68EF68}}_Admin","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2620:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7296:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]},{"name":"Local\\SM0:7296:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad4428d14ba30852e066fa4"}]}]}},"report_ids":{"sandbox_job_ids":["6ad4428d14ba30852e066fa4"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Win/malicious_confidence_60% Sample d44e6faaf3df… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample d44e6faaf3df…. Malware family: Win/malicious_confidence_60%. Threat score 100/100. 4/28 AV engines flagged this file. 11 malicious and 21 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/d44e6faaf3df358593a29faace64a071ab8de0a84c30a5232d8e9081dd668f1b"}],["$","meta","4",{"property":"og:title","content":"Malicious Win/malicious_confidence_60% Sample d44e6faaf3df… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample d44e6faaf3df…. Malware family: Win/malicious_confidence_60%. Threat score 100/100. 4/28 AV engines flagged this file. 11 malicious and 21 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/d44e6faaf3df358593a29faace64a071ab8de0a84c30a5232d8e9081dd668f1b"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Win/malicious_confidence_60% Sample d44e6faaf3df… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample d44e6faaf3df…. Malware family: Win/malicious_confidence_60%. Threat score 100/100. 4/28 AV engines flagged this file. 11 malicious and 21 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L62","11",{}]]