23:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 32:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 24:T77b,"WSBSDOpenBSD7.7.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000b0000009e29107758d9d7020000000028000000240000000000d60288eeaf000000000000000000000000000000000000000000d007b30230000000000000000b0000000000b30200000000a7000000000000000000000020d7d702e8b9d6020b00000000000000200000000000b302d001b302d40bb30200000000d00bb3020000000080eeaf0050f50f7758d9d702e8eeaf0034efaf00 (UID: 00000000-00005700) "WSBSDOpenBSD7.7.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005700) "WSBSDOpenBSD7.7.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005700)25:Tae4,"WSBSDOpenBSD7.7.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00005700) "WSBSDOpenBSD7.7.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005700) "WSBSDOpenBSD7.7.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005700) "WSBSDOpenBSD7.7.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005700) "WSBSDOpenBSD7.7.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00005700) "WSBSDOpenBSD7.7.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00005700) "WSBSDOpenBSD7.7.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00005700) "WSBSDOpenBSD7.7.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00005700) "WSBSDOpenBSD7.7.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00005700) "WSBSDOpenBSD7.7.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00005700) "WSBSDOpenBSD7.7.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00005700) "WSBSDOpenBSD7.7.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00005700) "WSBSDOpenBSD7.7.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00005700) "WSBSDOpenBSD7.7.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00005700) "WSBSDOpenBSD7.7.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00005700) "WSBSDOpenBSD7.7.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00005700) "WSBSDOpenBSD7.7.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00005700) "WSBSDOpenBSD7.7.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00005700) "WSBSDOpenBSD7.7.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00005700) "WSBSDOpenBSD7.7.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00005700) "WSBSDOpenBSD7.7.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00005700) "WSBSDOpenBSD7.7.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00005700) "WSBSDOpenBSD7.7.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00005700)26:T2b91,"WSBSDOpenBSD7.7.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00005700) "WSBSDOpenBSD7.7.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00005700) "WSBSDOpenBSD7.7.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00005700) "WSBSDOpenBSD7.7.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00005700) "WSBSDOpenBSD7.7.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00005700) "WSBSDOpenBSD7.7.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00005700) "WSBSDOpenBSD7.7.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00005700) "WSBSDOpenBSD7.7.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00005700) "WSBSDOpenBSD7.7.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00005700) "WSBSDOpenBSD7.7.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00005700) "WSBSDOpenBSD7.7.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00005700) "WSBSDOpenBSD7.7.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00005700) "WSBSDOpenBSD7.7.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00005700) "WSBSDOpenBSD7.7.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00005700) "WSBSDOpenBSD7.7.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00005700) "WSBSDOpenBSD7.7.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00005700) "WSBSDOpenBSD7.7.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00005700) "WSBSDOpenBSD7.7.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005700) "WSBSDOpenBSD7.7.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00005700) "WSBSDOpenBSD7.7.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00005700) "WSBSDOpenBSD7.7.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00005700) "WSBSDOpenBSD7.7.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00005700) "WSBSDOpenBSD7.7.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00005700) "WSBSDOpenBSD7.7.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00005700) "WSBSDOpenBSD7.7.exe" called "GetProcAddress" with a parameter RegisterShimImplCallback (UID: 00000000-00005700) "WSBSDOpenBSD7.7.exe" called "GetProcAddress" with a parameter RegisterShimImplCleanupCallback (UID: 00000000-00005700) "WSBSDOpenBSD7.7.exe" called "GetProcAddress" with a parameter SetShellShimInstance (UID: 00000000-00005700) "WSBSDOpenBSD7.7.exe" called "GetProcAddress" with a parameter OnShimDllMainCalled (UID: 00000000-00005700) "WSBSDOpenBSD7.7.exe" called "GetProcAddress" with a parameter _CorExeMain_RetAddr (UID: 00000000-00005700) "WSBSDOpenBSD7.7.exe" called "GetProcAddress" with a parameter _CorExeMain (UID: 00000000-00005700) "WSBSDOpenBSD7.7.exe" called "GetProcAddress" with a parameter UrlIsW (UID: 00000000-00005700) "WSBSDOpenBSD7.7.exe" called "GetProcAddress" with a parameter AppPolicyGetClrCompat (UID: 00000000-00005700) "WSBSDOpenBSD7.7.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00005700) "WSBSDOpenBSD7.7.exe" called "GetProcAddress" with a parameter GetCurrentPackageInfo (UID: 00000000-00005700) "WSBSDOpenBSD7.7.exe" called "GetProcAddress" with a parameter GetCurrentPackagePath (UID: 00000000-00005700) "WSBSDOpenBSD7.7.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00005700) "WSBSDOpenBSD7.7.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00005700) "WSBSDOpenBSD7.7.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00005700) "WSBSDOpenBSD7.7.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00005700) "WSBSDOpenBSD7.7.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00005700) "WSBSDOpenBSD7.7.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00005700) "WSBSDOpenBSD7.7.exe" called "GetProcAddress" with a parameter SetRuntimeInfo (UID: 00000000-00005700) "WSBSDOpenBSD7.7.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00005700) "WSBSDOpenBSD7.7.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00005700) "WSBSDOpenBSD7.7.exe" called "GetProcAddress" with a parameter QuirkIsEnabled3 (UID: 00000000-00005700) "WSBSDOpenBSD7.7.exe" called "GetProcAddress" with a parameter QuirkGetData2 (UID: 00000000-00005700) "WSBSDOpenBSD7.7.exe" called "GetProcAddress" with a parameter CreateConfigStream (UID: 00000000-00005700) "WSBSDOpenBSD7.7.exe" called "GetProcAddress" with a parameter CreateConfigStream_RetAddr (UID: 00000000-00005700) "WSBSDOpenBSD7.7.exe" called "GetProcAddress" with a parameter GetNumaHighestNodeNumber (UID: 00000000-00005700) "WSBSDOpenBSD7.7.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00005700) "WSBSDOpenBSD7.7.exe" called "GetProcAddress" with a parameter GetSystemWindowsDirectoryW (UID: 00000000-00005700) "WSBSDOpenBSD7.7.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00005700) "WSBSDOpenBSD7.7.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00005700) "WSBSDOpenBSD7.7.exe" called "GetProcAddress" with a parameter AddAccessAllowedAce (UID: 00000000-00005700) "WSBSDOpenBSD7.7.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00005700) "WSBSDOpenBSD7.7.exe" called "GetProcAddress" with a parameter RoInitialize (UID: 00000000-00005700) "WSBSDOpenBSD7.7.exe" called "GetProcAddress" with a parameter AddSIDToBoundaryDescriptor (UID: 00000000-00005700) "WSBSDOpenBSD7.7.exe" called "GetProcAddress" with a parameter CreateBoundaryDescriptorW (UID: 00000000-00005700) "WSBSDOpenBSD7.7.exe" called "GetProcAddress" with a parameter CreatePrivateNamespaceW (UID: 00000000-00005700) "WSBSDOpenBSD7.7.exe" called "GetProcAddress" with a parameter OpenPrivateNamespaceW (UID: 00000000-00005700) "WSBSDOpenBSD7.7.exe" called "GetProcAddress" with a parameter DeleteBoundaryDescriptor (UID: 00000000-00005700) "WSBSDOpenBSD7.7.exe" called "GetProcAddress" with a parameter WerRegisterRuntimeExceptionModule (UID: 00000000-00005700) "WSBSDOpenBSD7.7.exe" called "GetProcAddress" with a parameter RaiseException (UID: 00000000-00005700) "WSBSDOpenBSD7.7.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00005700) "WSBSDOpenBSD7.7.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00005700) "WSBSDOpenBSD7.7.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00005700) "WSBSDOpenBSD7.7.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00005700) "WSBSDOpenBSD7.7.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00005700) "WSBSDOpenBSD7.7.exe" called "GetProcAddress" with a parameter GetProcessMemoryInfo (UID: 00000000-00005700) "WSBSDOpenBSD7.7.exe" called "GetProcAddress" with a parameter GetNativeSystemInfo (UID: 00000000-00005700) "WSBSDOpenBSD7.7.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00005700) "WSBSDOpenBSD7.7.exe" called "GetProcAddress" with a parameter RoUninitialize (UID: 00000000-00005700) "WSBSDOpenBSD7.7.exe" called "GetProcAddress" with a parameter CoGetContextToken (UID: 00000000-00005700) "WSBSDOpenBSD7.7.exe" called "GetProcAddress" with a parameter GetEnabledXStateFeatures (UID: 00000000-00005700) "WSBSDOpenBSD7.7.exe" called "GetProcAddress" with a parameter sxsJitStartup (UID: 00000000-00005700) "WSBSDOpenBSD7.7.exe" called "GetProcAddress" with a parameter jitStartup (UID: 00000000-00005700) "WSBSDOpenBSD7.7.exe" called "GetProcAddress" with a parameter getJit (UID: 00000000-00005700) "WSBSDOpenBSD7.7.exe" called "GetProcAddress" with a parameter GetStdHandle (UID: 00000000-00005700) "WSBSDOpenBSD7.7.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00005700) "WSBSDOpenBSD7.7.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00005700) "WSBSDOpenBSD7.7.exe" called "GetProcAddress" with a parameter GetConsoleMode (UID: 00000000-00005700) "WSBSDOpenBSD7.7.exe" called "GetProcAddress" with a parameter WriteFile (UID: 00000000-00005700) "WSBSDOpenBSD7.7.exe" called "GetProcAddress" with a parameter GetConsoleOutputCP (UID: 00000000-00005700) "WSBSDOpenBSD7.7.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00005700) "WSBSDOpenBSD7.7.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00005700) "WSBSDOpenBSD7.7.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00005700) "WSBSDOpenBSD7.7.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00005700) "WSBSDOpenBSD7.7.exe" called "GetProcAddress" with a parameter GetUserPreferredUILanguages (UID: 00000000-00005700) "WSBSDOpenBSD7.7.exe" called "GetProcAddress" with a parameter UnmapViewOfFile (UID: 00000000-00005700) "WSBSDOpenBSD7.7.exe" called "GetProcAddress" with a parameter SetConsoleOutputCP (UID: 00000000-00005700) "WSBSDOpenBSD7.7.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00005700) "WSBSDOpenBSD7.7.exe" called "GetProcAddress" with a parameter GetComputerName (UID: 00000000-00005700) "WSBSDOpenBSD7.7.exe" called "GetProcAddress" with a parameter GetComputerNameW (UID: 00000000-00005700) "WSBSDOpenBSD7.7.exe" called "GetProcAddress" with a parameter GetConsoleCP (UID: 00000000-00005700) "WSBSDOpenBSD7.7.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00005700) "WSBSDOpenBSD7.7.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00005700) "WSBSDOpenBSD7.7.exe" called "GetProcAddress" with a parameter CreateActCtxW (UID: 00000000-00005700) "WSBSDOpenBSD7.7.exe" called "GetProcAddress" with a parameter AddRefActCtx (UID: 00000000-00005700) "WSBSDOpenBSD7.7.exe" called "GetProcAddress" with a parameter ReleaseActCtx (UID: 00000000-00005700) "WSBSDOpenBSD7.7.exe" called "GetProcAddress" with a parameter ActivateActCtx (UID: 00000000-00005700) "WSBSDOpenBSD7.7.exe" called "GetProcAddress" with a parameter DeactivateActCtx (UID: 00000000-00005700) "WSBSDOpenBSD7.7.exe" called "GetProcAddress" with a parameter GetCurrentActCtx (UID: 00000000-00005700) "WSBSDOpenBSD7.7.exe" called "GetProcAddress" with a parameter QueryActCtxW (UID: 00000000-00005700) "WSBSDOpenBSD7.7.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00005700)27:T764,"WSBSDOpenBSD7.7.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 73850000 "WSBSDOpenBSD7.7.exe" loaded module "ADVAPI32.DLL" at base 75b10000 "WSBSDOpenBSD7.7.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 73c20000 "WSBSDOpenBSD7.7.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 73c20000 "WSBSDOpenBSD7.7.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 73c20000 "WSBSDOpenBSD7.7.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL" at base 737a0000 "WSBSDOpenBSD7.7.exe" loaded module "SHLWAPI.DLL" at base 74fe0000 "WSBSDOpenBSD7.7.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 73bd0000 "WSBSDOpenBSD7.7.exe" loaded module "VERSION.DLL" at base 73790000 "WSBSDOpenBSD7.7.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLR.DLL" at base 72fe0000 "WSBSDOpenBSD7.7.exe" loaded module "USER32.DLL" at base 73fe0000 "WSBSDOpenBSD7.7.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 73c20000 "WSBSDOpenBSD7.7.exe" loaded module "MSCOREE.DLL" at base 73a70000 "WSBSDOpenBSD7.7.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 75490000 "WSBSDOpenBSD7.7.exe" loaded module "PSAPI.DLL" at base 73be0000 "WSBSDOpenBSD7.7.exe" loaded module "RPCRT4.DLL" at base 759f0000 "WSBSDOpenBSD7.7.exe" loaded module "KERNEL32.DLL" at base 750a0000 "WSBSDOpenBSD7.7.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 71b00000 "WSBSDOpenBSD7.7.exe" loaded module "OLE32.DLL" at base 73e00000 "WSBSDOpenBSD7.7.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 75490000 "WSBSDOpenBSD7.7.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 73c20000 "WSBSDOpenBSD7.7.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 71a7000028:T490,"WSBSDOpenBSD7.7.exe" file has an entrypoint instructions - "jmp dword ptr [0x402000],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,"29:T489,Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" [Source: 00000000-00005700-00000C2E-975770490] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll" [Source: 00000000-00005700-00000C2B-2417658176] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" [Source: 00000000-00005700-00000C2B-2417734131] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00005700-00000C2B-2417779033] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll" [Source: 00000000-00005700-00000C2B-2418011391] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" [Source: 00000000-00005700-00000C2B-2418033536] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" [Source: 00000000-00005700-00000C2B-2418089872] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll" [Source: 00000000-00005700-00000C2B-2418150902]2a:T63d,"WSBSDOpenBSD7.7.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "WSBSDOpenBSD7.7.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "WSBSDOpenBSD7.7.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "WSBSDOpenBSD7.7.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\CONHOST.EXE"; Key: ""; Value: "") "WSBSDOpenBSD7.7.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: ""; Value: "") "WSBSDOpenBSD7.7.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\BAM"; Key: ""; Value: "") "WSBSDOpenBSD7.7.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "WSBSDOpenBSD7.7.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "WSBSDOpenBSD7.7.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "WSBSDOpenBSD7.7.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "WSBSDOpenBSD7.7.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "WSBSDOpenBSD7.7.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "")2b:Tae5,"WSBSDOpenBSD7.7.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SAFEDLLSEARCHMODE"; Value: "") "WSBSDOpenBSD7.7.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "WSBSDOpenBSD7.7.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: "WSBSDOPENBSD7.7.EXE"; Value: "") "WSBSDOpenBSD7.7.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "WSBSDOpenBSD7.7.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CONHOST.EXE"; Value: "") "WSBSDOpenBSD7.7.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "WSBSDOpenBSD7.7.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "WSBSDOpenBSD7.7.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "WSBSDOpenBSD7.7.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "LOGFLAGS"; Value: "") "WSBSDOpenBSD7.7.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "SHOWDEBUGINFO"; Value: "") "WSBSDOpenBSD7.7.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: "CACHE"; Value: "") "WSBSDOpenBSD7.7.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY"; Value: "") "WSBSDOpenBSD7.7.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK"; Value: "") "WSBSDOpenBSD7.7.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "TYPE"; Value: "") "WSBSDOpenBSD7.7.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "ALTERNATECODEPAGE"; Value: "") "WSBSDOpenBSD7.7.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "WSBSDOpenBSD7.7.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "WSBSDOpenBSD7.7.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "ENABLED"; Value: "") "WSBSDOpenBSD7.7.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: "FIPSALGORITHMPOLICY"; Value: "")2c:T4ae,"WSBSDOpenBSD7.7.exe" trying to touch file "C:\Windows\System32\WOW64LOG.DLL" "WSBSDOpenBSD7.7.exe" trying to touch file "C:\WINDOWS\system32\wow64log.dll" "WSBSDOpenBSD7.7.exe" trying to touch file "C:\Windows\SysWOW64\mscoree.dll" "WSBSDOpenBSD7.7.exe" trying to touch file "C:\WINDOWS\SysWOW64\MSCOREE.DLL" "WSBSDOpenBSD7.7.exe" trying to touch file "\Device\ConDrv\Server" "WSBSDOpenBSD7.7.exe" trying to touch file "\Device\ConDrv\\Reference" "WSBSDOpenBSD7.7.exe" trying to touch file "\Device\ConDrv\\Connect" "WSBSDOpenBSD7.7.exe" trying to touch file "\Device\ConDrv\\Input" "WSBSDOpenBSD7.7.exe" trying to touch file "\Device\ConDrv\\Output" "WSBSDOpenBSD7.7.exe" trying to touch file "C:\Windows\SysWOW64\apphelp.dll" "WSBSDOpenBSD7.7.exe" trying to touch file "C:\WINDOWS\SysWOW64\apphelp.dll" "WSBSDOpenBSD7.7.exe" trying to touch file "C:\WSBSDOpenBSD7.7.exe" "WSBSDOpenBSD7.7.exe" trying to touch file "C:\Windows\SysWOW64\ntdll.dll" "WSBSDOpenBSD7.7.exe" trying to touch file "C:\Windows\SysWOW64\kernel32.dll" "WSBSDOpenBSD7.7.exe" trying to touch file "C:\Windows\SysWOW64\KernelBase.dll" "WSBSDOpenBSD7.7.exe" trying to touch file "C:\Windows\apppatch\sysmain.sdb"2d:T89d,"WSBSDOpenBSD7.7.exe" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL" "WSBSDOpenBSD7.7.exe" trying to access non-existent file "C:\WINDOWS\system32\wow64log.dll" "WSBSDOpenBSD7.7.exe" trying to access non-existent file "C:\FLTLIB.DLL" "WSBSDOpenBSD7.7.exe" trying to access non-existent file "C:\MSVCP140.DLL" "WSBSDOpenBSD7.7.exe" trying to access non-existent file "C:\MSVCP140.dll" "WSBSDOpenBSD7.7.exe" trying to access non-existent file "C:\VCRUNTIME140.DLL" "WSBSDOpenBSD7.7.exe" trying to access non-existent file "C:\VCRUNTIME140.dll" "WSBSDOpenBSD7.7.exe" trying to access non-existent file "C:\CRYPTSP.DLL" "WSBSDOpenBSD7.7.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\CLR.DLL" "WSBSDOpenBSD7.7.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\MSCORWKS.DLL" "WSBSDOpenBSD7.7.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\CLR.DLL" "WSBSDOpenBSD7.7.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\MSCORWKS.DLL" "WSBSDOpenBSD7.7.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\CLR.DLL" "WSBSDOpenBSD7.7.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\VCRUNTIME140_CLR0400.DLL" "WSBSDOpenBSD7.7.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\VCRUNTIME140_CLR0400.dll" "WSBSDOpenBSD7.7.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\UCRTBASE_CLR0400.DLL" "WSBSDOpenBSD7.7.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ucrtbase_clr0400.dll" "WSBSDOpenBSD7.7.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSCOREE.DLL" "WSBSDOpenBSD7.7.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" "WSBSDOpenBSD7.7.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\OLE32.DLL" "WSBSDOpenBSD7.7.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ole32.dll"2e:T421,"WSBSDOpenBSD7.7.exe" trying to access non-existent file "C:\Windows\SysWOW64\MSCOREE.DLL.LOCAL" "WSBSDOpenBSD7.7.exe" trying to access non-existent file "C:\WINDOWS\SysWOW64\MSCOREE.DLL.local" "WSBSDOpenBSD7.7.exe" trying to access non-existent file "C:\WSBSDOPENBSD7.7.EXE.CONFIG" "WSBSDOpenBSD7.7.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\FUSION.LOCALGAC" "WSBSDOpenBSD7.7.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\fusion.localgac" "WSBSDOpenBSD7.7.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\WSBSDOPENBSD7.7.EXE.LOG" "WSBSDOpenBSD7.7.exe" trying to access non-existent file "C:\WSBSDOpenBSD7.7.exe.config" "WSBSDOpenBSD7.7.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_32\WSBSD OPENBSD 7.7" "WSBSDOpenBSD7.7.exe" trying to access non-existent file "C:\WSBSDOPENBSD7.7.INI" "WSBSDOpenBSD7.7.exe" trying to access non-existent file "C:\WSBSDOpenBSD7.7.INI"2f:Tac3,Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00005700.00000000.263099.02D60000.00000004.mdmp, 00000000-00005700.00000001.265021.02D60000.00000004.mdmp, 00000000-00005700.00000002.266942.02D60000.00000004.mdmp, 00000000-00005700.00000003.268358.02D60000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00005700.00000000.263099.02D60000.00000004.mdmp, 00000000-00005700.00000001.265021.02D60000.00000004.mdmp, 00000000-00005700.00000002.266942.02D60000.00000004.mdmp, 00000000-00005700.00000003.268358.02D60000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00005700.00000000.263099.02D60000.00000004.mdmp, 00000000-00005700.00000001.265021.02D60000.00000004.mdmp, 00000000-00005700.00000002.266942.02D60000.00000004.mdmp, 00000000-00005700.00000003.268358.02D60000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00005700.00000000.263099.02D60000.00000004.mdmp, 00000000-00005700.00000001.265021.02D60000.00000004.mdmp, 00000000-00005700.00000002.266942.02D60000.00000004.mdmp, 00000000-00005700.00000003.268358.02D60000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00005700.00000000.263099.02D60000.00000004.mdmp, 00000000-00005700.00000001.265021.02D60000.00000004.mdmp, 00000000-00005700.00000002.266942.02D60000.00000004.mdmp, 00000000-00005700.00000003.268358.02D60000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00005700.00000000.263099.02D60000.00000004.mdmp, 00000000-00005700.00000001.265021.02D60000.00000004.mdmp, 00000000-00005700.00000002.266942.02D60000.00000004.mdmp, 00000000-00005700.00000003.268358.02D60000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00005700.00000000.263099.02D60000.00000004.mdmp, 00000000-00005700.00000001.265021.02D60000.00000004.mdmp, 00000000-00005700.00000002.266942.02D60000.00000004.mdmp, 00000000-00005700.00000003.268358.02D60000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00005700.00000000.263099.02D60000.00000004.mdmp, 00000000-00005700.00000001.265021.02D60000.00000004.mdmp, 00000000-00005700.00000002.266942.02D60000.00000004.mdmp, 00000000-00005700.00000003.268358.02D60000.00000004.mdmp")30:Ta14,"WSBSDOpenBSD7.7.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00005700) "WSBSDOpenBSD7.7.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\\* (UID: 00000000-00005700) "WSBSDOpenBSD7.7.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00005700) "WSBSDOpenBSD7.7.exe" called "FindNextFileW" with parameter NETFXSBS10.exe (UID: 00000000-00005700) "WSBSDOpenBSD7.7.exe" called "FindNextFileW" with parameter netfxsbs12.hkf (UID: 00000000-00005700) "WSBSDOpenBSD7.7.exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00005700) "WSBSDOpenBSD7.7.exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00005700) "WSBSDOpenBSD7.7.exe" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00005700) "WSBSDOpenBSD7.7.exe" called "FindNextFileW" with parameter sbs_diasymreader.dll (UID: 00000000-00005700) "WSBSDOpenBSD7.7.exe" called "FindNextFileW" with parameter sbs_iehost.dll (UID: 00000000-00005700) "WSBSDOpenBSD7.7.exe" called "FindNextFileW" with parameter sbs_microsoft.jscript.dll (UID: 00000000-00005700) "WSBSDOpenBSD7.7.exe" called "FindNextFileW" with parameter sbs_microsoft.vsa.vb.codedomprocessor.dll (UID: 00000000-00005700) "WSBSDOpenBSD7.7.exe" called "FindNextFileW" with parameter sbs_mscordbi.dll (UID: 00000000-00005700) "WSBSDOpenBSD7.7.exe" called "FindNextFileW" with parameter sbs_mscorrc.dll (UID: 00000000-00005700) "WSBSDOpenBSD7.7.exe" called "FindNextFileW" with parameter sbs_mscorsec.dll (UID: 00000000-00005700) "WSBSDOpenBSD7.7.exe" called "FindNextFileW" with parameter sbs_system.configuration.install.dll (UID: 00000000-00005700) "WSBSDOpenBSD7.7.exe" called "FindNextFileW" with parameter sbs_system.data.dll (UID: 00000000-00005700) "WSBSDOpenBSD7.7.exe" called "FindNextFileW" with parameter sbs_system.enterpriseservices.dll (UID: 00000000-00005700) "WSBSDOpenBSD7.7.exe" called "FindNextFileW" with parameter sbs_VsaVb7rt.dll (UID: 00000000-00005700) "WSBSDOpenBSD7.7.exe" called "FindNextFileW" with parameter sbs_wminet_utils.dll (UID: 00000000-00005700) "WSBSDOpenBSD7.7.exe" called "FindNextFileW" with parameter SharedReg12.dll (UID: 00000000-00005700) "WSBSDOpenBSD7.7.exe" called "FindNextFileW" with parameter v1.0.3705 (UID: 00000000-00005700) "WSBSDOpenBSD7.7.exe" called "FindNextFileW" with parameter v1.1.4322 (UID: 00000000-00005700) "WSBSDOpenBSD7.7.exe" called "FindNextFileW" with parameter v2.0.50727 (UID: 00000000-00005700)31:T400,AAABAAEAICAQjQAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AcREREY//+BEY//h3d4///xEREREf/3EREY/3EREY//8RERERF/gRERF/8REREY//GP//+BH3EYiBGPEY+HEY/xj///9xhxj/9xjxf//4F/8Y////gXiP//gX8X///3GPGP////F/////F/F///+Bfxj////3H////3Hxf///9x8Y////9x////9x8X////gYGP////cf////d/F/////GBj////3H////xfxf////3cY////93////cY8X////9xGP////F///+BH/F/////gRj///+Bj//4EX/xf////4EX////Ef//gRf/8X////+BEXd3cRf/+BEY//F/////gREREREY//ERj//xf////4GIiIiIj/9xGP//8X////+B///////4EY////F/////gfhndo+P9xj////xf////4H3ZmZvf/Ef////8X////9392Zmb3+Bf/////F/////F/dmZm9/gY/////xf///+Bj3ZmZveIGP////8X////gY+HiHj3+Bj/////F////3f/dmZm9/gY/////xf///gY/3ZmZvf/F/////8X///3H/92Zmb4/3GP/3f/F///cX//dmZm+P+BGIEX/3GIhxH//4ZmZ///8RERGP+BEREY//////////gREY//9xEXj///////////h3j///+Ij///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"{\"@context\":\"https://schema.org\",\"@type\":\"TechArticle\",\"headline\":\"Sample d6540c071cd0… — Score 0/100 — Hybrid Analysis\",\"description\":\"Threat analysis for sample d6540c071cd0…. Threat score 0/100. 0/27 AV engines flagged this file. 0 malicious and 6 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.\",\"url\":\"/sample/d6540c071cd02efea811475c20109fd45cc6a40a99d6b3e09a2449d02683641e\",\"keywords\":[\"malware analysis\",\"sandbox report\",\"threat intelligence\",\"d6540c071cd02efea811475c20109fd45cc6a40a99d6b3e09a2449d02683641e\"],\"about\":{\"@type\":\"SoftwareApplication\",\"name\":\"WSBSDOpenBSD7.7.exe\",\"applicationCategory\":[\"peexe\",\"assembly\",\"executable\"],\"identifier\":\"d6540c071cd02efea811475c20109fd45cc6a40a99d6b3e09a2449d02683641e\"},\"threatScore\":0,\"antivirusDetections\":{\"malicious\":0,\"total\":27},\"behavioralIndicators\":{\"malicious\":0,\"suspicious\":6},\"publisher\":{\"@type\":\"Organization\",\"name\":\"Hybrid Analysis\",\"url\":\"https://www.hybrid-analysis.com\"}}"}}],["$","$L23",null,{"initialData":{"schema_version":"1.0.15","sha256":"d6540c071cd02efea811475c20109fd45cc6a40a99d6b3e09a2449d02683641e","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"no specific threat","threat_score":0,"unified_at_epoch_ms":1792555455252,"unified_at":"2026-10-21T04:04:15.252Z","metadata":{"hashes":{"sha256":"d6540c071cd02efea811475c20109fd45cc6a40a99d6b3e09a2449d02683641e","sha1":"9960fd6031651de1d66ff9da93892bed52cc67c9","md5":"0f2440f2a66ad98b63b4a20aa22e2cd9","sha512":"353fc6f31868682920d8a74c75567a8aea1a66b780e9d9c4bbd02b3c68c971ce99bbcb3b3661d5dd50ad5ed245bb0fdb7b5155f655090fbbe5be30afd065431d","ssdeep":"768:MwejjjzIXxDRZDntz4ceCjhtcRooX8Y9:MBjjQXxDRNxyqndoX8Y9","ssdeep_chunks":["768:Mwejjjz","768:wejjjzI","768:ejjjzIX","768:jjjzIXx","768:jjzIXxD","768:jzIXxDR","768:zIXxDRZ","768:IXxDRZD","768:XxDRZDn","768:xDRZDnt","768:DRZDntz","768:RZDntz4","768:ZDntz4c","768:Dntz4ce","768:ntz4ceC","768:tz4ceCj","768:z4ceCjh","768:4ceCjht","768:ceCjhtc","768:eCjhtcR","768:CjhtcRo","768:jhtcRoo","768:htcRooX","768:tcRooX8","768:cRooX8Y","768:RooX8Y9","1536:Mwejjjz","1536:wejjjzI","1536:ejjjzIX","1536:jjjzIXx","1536:jjzIXxD","1536:jzIXxDR","1536:zIXxDRZ","1536:IXxDRZD","1536:XxDRZDn","1536:xDRZDnt","1536:DRZDntz","1536:RZDntz4","1536:ZDntz4c","1536:Dntz4ce","1536:ntz4ceC","1536:tz4ceCj","1536:z4ceCjh","1536:4ceCjht","1536:ceCjhtc","1536:eCjhtcR","1536:CjhtcRo","1536:jhtcRoo","1536:htcRooX","1536:tcRooX8","1536:cRooX8Y","1536:RooX8Y9","768:MBjjQXx","768:BjjQXxD","768:jjQXxDR","768:jQXxDRN","768:QXxDRNx","768:XxDRNxy","768:xDRNxyq","768:DRNxyqn","768:RNxyqnd","768:Nxyqndo","768:xyqndoX","768:yqndoX8","768:qndoX8Y","768:ndoX8Y9"],"imphash":"f34d5f2d4577ed6d9ceec516c1f5a744"},"file_info":{"file_name":"WSBSDOpenBSD7.7.exe","file_type":["peexe","assembly","executable"],"file_type_id":".NET exe","file_size":38400,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1792555292000,"last_seen":1792555292000,"last_multi_scan":1792555292000}},"detections":{"summary":{"verdict":"no specific threat","score":0,"tags":["evasive"]},"stats":{"av":{"malicious_count":0,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":0,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":36},"sandbox_signatures":{"informative_count":91,"suspicious_count":6,"malicious_count":0,"total":97},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"undetected","status":"clean","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{},"mitre_attacks":[{"tactic":"Reconnaissance","technique":"Gather Victim Network Information","attack_id":"T1590","attack_id_wiki":"https://attack.mitre.org/techniques/T1590","identifiers":[{"type":"informative","value":"Able to access user sensitive domain"}],"sources":[{"report_type":"sandbox","report_id":"6ad8391ba310c7a4cb0550db"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Able to execute application (.NET)"},{"type":"informative","value":"Contains ability to start a process (Dotnet)"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Input file contains API references not part of its Import Address Table (IAT)"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Able to execute applications using .NET process API"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Found Native API in Dotnet file"}],"sources":[{"report_type":"sandbox","report_id":"6ad8391ba310c7a4cb0550db"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"informative","value":"Contains ability to execute a WMI query"},{"type":"informative","value":"Contains ability to execute WMI queries (Dotnet)"},{"type":"suspicious","value":"Found a reference to a WMI query string known to be used for VM detection"}],"sources":[{"report_type":"sandbox","report_id":"6ad8391ba310c7a4cb0550db"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Fails to load modules at runtime"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Loads the .NET runtime environment"}],"sources":[{"report_type":"sandbox","report_id":"6ad8391ba310c7a4cb0550db"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad8391ba310c7a4cb0550db"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"6ad8391ba310c7a4cb0550db"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"6ad8391ba310c7a4cb0550db"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"6ad8391ba310c7a4cb0550db"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6ad8391ba310c7a4cb0550db"}]},{"tactic":"Credential Access","technique":"Credential API Hooking","attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","identifiers":[{"type":"suspicious","value":"Hooks API calls"}],"sources":[{"report_type":"sandbox","report_id":"6ad8391ba310c7a4cb0550db"}]},{"tactic":"Discovery","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to check debugger is running (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad8391ba310c7a4cb0550db"}]},{"tactic":"Discovery","technique":"Time Based Checks","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"},{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad8391ba310c7a4cb0550db"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Reads files"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Contains ability to retrieve files based on search patterns"},{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"},{"type":"informative","value":"Calls an API typically used for searching a directory for files"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"}],"sources":[{"report_type":"sandbox","report_id":"6ad8391ba310c7a4cb0550db"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Queries the user identity associated with the current process token"},{"type":"informative","value":"Contains ability to retrieve the current user information"},{"type":"informative","value":"Able to query security token membership for user discovery (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad8391ba310c7a4cb0550db"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Able to gather system file/directory information (.NET)"},{"type":"informative","value":"Found system command-related strings"},{"type":"informative","value":"Calls an API typically used to retrieve computer name"},{"type":"informative","value":"Able to gather system information (.NET)"},{"type":"informative","value":"Contains ability to retrieve the NetBIOS name of the local computer (API string)"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Contains ability to gather system information (Dotnet)"},{"type":"informative","value":"References to WMI query strings used for information discovery"}],"sources":[{"report_type":"sandbox","report_id":"6ad8391ba310c7a4cb0550db"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"References to WMI query strings used for process discovery"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"}],"sources":[{"report_type":"sandbox","report_id":"6ad8391ba310c7a4cb0550db"}]},{"tactic":"Discovery","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"suspicious","value":"Queries process mitigation policy via NtQueryInformationProcess"}],"sources":[{"report_type":"sandbox","report_id":"6ad8391ba310c7a4cb0550db"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"suspicious","value":"Attempts to retrieve the system language code"},{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"6ad8391ba310c7a4cb0550db"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6ad8391ba310c7a4cb0550db"}]},{"tactic":"Discovery","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"},{"type":"informative","value":"Contains ability to detect virtual environment (API)"}],"sources":[{"report_type":"sandbox","report_id":"6ad8391ba310c7a4cb0550db"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6ad8391ba310c7a4cb0550db"}]},{"tactic":"Collection","technique":"Code Repositories","attack_id":"T1213.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1213/003","identifiers":[{"type":"informative","value":"Able to access code repositories"}],"sources":[{"report_type":"sandbox","report_id":"6ad8391ba310c7a4cb0550db"}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Contains SQL queries"}],"sources":[{"report_type":"sandbox","report_id":"6ad8391ba310c7a4cb0550db"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Able to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad8391ba310c7a4cb0550db"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Writes log files"}],"sources":[{"report_type":"sandbox","report_id":"6ad8391ba310c7a4cb0550db"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Found potential URLs in memory dumps"}],"sources":[{"report_type":"sandbox","report_id":"6ad8391ba310c7a4cb0550db"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"}],"sources":[{"report_type":"sandbox","report_id":"6ad8391ba310c7a4cb0550db"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Able to interact with Microsoft Store installation processes"},{"type":"informative","value":"Dropped files"}],"sources":[{"report_type":"sandbox","report_id":"6ad8391ba310c7a4cb0550db"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains reference to crypto DLLs"}],"sources":[{"report_type":"sandbox","report_id":"6ad8391ba310c7a4cb0550db"}]},{"tactic":"Stealth","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Able to execute applications in hidden mode (.NET)"},{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad8391ba310c7a4cb0550db"}]},{"tactic":"Stealth","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"suspicious","value":"Timestamp in PE header is very old or in the future"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Shows ability to obfuscate file or information"}],"sources":[{"report_type":"sandbox","report_id":"6ad8391ba310c7a4cb0550db"}]},{"tactic":"Stealth","technique":"Reflective Code Loading","attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Loads the CLR Loader DLL"}],"sources":[{"report_type":"sandbox","report_id":"6ad8391ba310c7a4cb0550db"}]},{"tactic":"Stealth","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Drops files inside appdata directory"}],"sources":[{"report_type":"sandbox","report_id":"6ad8391ba310c7a4cb0550db"}]},{"tactic":"Stealth","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"6ad8391ba310c7a4cb0550db"}]},{"tactic":"Stealth","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6ad8391ba310c7a4cb0550db"}]},{"tactic":"Defense Impairment","technique":"Disable or Modify Tools","attack_id":"T1685","attack_id_wiki":"https://attack.mitre.org/techniques/T1685","identifiers":[{"type":"suspicious","value":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)"},{"type":"informative","value":"Modifies process error mode to suppress error dialogs"}],"sources":[{"report_type":"sandbox","report_id":"6ad8391ba310c7a4cb0550db"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to execute applications in hidden mode (.NET)","description":"Observed Namespace \"System.Diagnostics.ProcessStartInfo\" and MemberReference \"set_CreateNoWindow\" in \"WSBSDOpenBSD7.7.exe\"","origin":"Static Parser","mitre_attack_id":"T1564.003","relevance":7,"id":"static-161","sources":[{"report_type":"sandbox","report_id":"6ad8391ba310c7a4cb0550db"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount64\"; File: \"WSBSDOpenBSD7.7.exe\")\n Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount64\"; Source: \"00000000-00005700.00000000.263099.00752000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"6ad8391ba310c7a4cb0550db"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to pass information to a window procedure (API string)","description":"Found reference to API \"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00005700.00000000.263099.02D60000.00000004.mdmp, 00000000-00005700.00000001.265021.02D60000.00000004.mdmp, 00000000-00005700.00000002.266942.02D60000.00000004.mdmp, 00000000-00005700.00000003.268358.02D60000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"6ad8391ba310c7a4cb0550db"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Modifies process error mode to suppress error dialogs","description":"\"WSBSDOpenBSD7.7.exe\" set its error mode to SEM_NOOPENFILEERRORBOX\n \"WSBSDOpenBSD7.7.exe\" set its error mode to SEM_FAILCRITICALERRORS","origin":"API Call","mitre_attack_id":"T1685","relevance":10,"id":"api-38","sources":[{"report_type":"sandbox","report_id":"6ad8391ba310c7a4cb0550db"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"\"WSBSDOpenBSD7.7.exe\" queried SystemProcessInformation at 00000000-00005700-00000C15-2416792185 [PID: 5700]\n \"WSBSDOpenBSD7.7.exe\" queried SystemProcessInformation at 00000000-00005700-00000C15-2416800649 [PID: 5700]\n \"WSBSDOpenBSD7.7.exe\" queried SystemProcessInformation at 00000000-00005700-00000C15-2416974425 [PID: 5700]\n \"WSBSDOpenBSD7.7.exe\" queried SystemProcessInformation at 00000000-00005700-00000C15-2416982911 [PID: 5700]\n \"WSBSDOpenBSD7.7.exe\" queried SystemProcessInformation at 00000000-00005700-00000C15-2417090099 [PID: 5700]\n \"WSBSDOpenBSD7.7.exe\" queried SystemProcessInformation at 00000000-00005700-00000C15-2417098422 [PID: 5700]","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"6ad8391ba310c7a4cb0550db"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount\"; File: \"WSBSDOpenBSD7.7.exe\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"6ad8391ba310c7a4cb0550db"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to crypto DLLs","description":"Found string \":\\WINDOWS\\SYSTEM32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00005700.00000000.263099.02D60000.00000004.mdmp, 00000000-00005700.00000001.265021.02D60000.00000004.mdmp, 00000000-00005700.00000002.266942.02D60000.00000004.mdmp, 00000000-00005700.00000003.268358.02D60000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-493","sources":[{"report_type":"sandbox","report_id":"6ad8391ba310c7a4cb0550db"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains reference to crypto DLLs","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6ad8391ba310c7a4cb0550db"}]},{"level":"informative","category":"Environment Awareness","name":"Able to access user sensitive domain","description":"Found string \"Please Report Bugs In This Link In Your Windows Browser: https://github.com/TTSConsulting/WSBSD/issues\\n\" (Indicator: \"github.com\"; File: \"WSBSDOpenBSD7.7.exe\")\n Found string \"lease Report Bugs In This Link In Your Windows Browser: https://github.com/TTSConsulting/WSBSD/issues\" (Indicator: \"github.com\"; Source: \"00000000-00005700.00000000.263099.00752000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1590","relevance":1,"id":"string-761","sources":[{"report_type":"sandbox","report_id":"6ad8391ba310c7a4cb0550db"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system file/directory information (.NET)","description":"Observed dotnet function \"GetCurrentDirectory\" in \"WSBSDOpenBSD7.7.exe\"\n Observed dotnet function \"GetFiles\" in \"WSBSDOpenBSD7.7.exe\"","origin":"Static Parser","mitre_attack_id":"T1082","relevance":3,"id":"static-200","sources":[{"report_type":"sandbox","report_id":"6ad8391ba310c7a4cb0550db"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system information (.NET)","description":"Found string \"get_MachineName\" (Source: \"00000000-00005700.00000000.263099.00752000.00000002.mdmp\")\n Found string \"get_UserName\" (Source: \"00000000-00005700.00000000.263099.00752000.00000002.mdmp\")\n Found string \"get_OSVersion\" (Source: \"00000000-00005700.00000000.263099.00752000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-937","sources":[{"report_type":"sandbox","report_id":"6ad8391ba310c7a4cb0550db"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; Source: \"00000000-00005700-00000C2C-2417777449\")\n Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; Source: \"00000000-00005700-00000C2C-2417778124\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"6ad8391ba310c7a4cb0550db"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"Found reference to API \"\" (Indicator: \"enumchildwindows\"; Source: \"00000000-00005700.00000000.263099.02D60000.00000004.mdmp, 00000000-00005700.00000001.265021.02D60000.00000004.mdmp, 00000000-00005700.00000002.266942.02D60000.00000004.mdmp, 00000000-00005700.00000003.268358.02D60000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"6ad8391ba310c7a4cb0550db"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"WSBSDOpenBSD7.7.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00005700)","origin":"API Call","mitre_attack_id":"T1497","relevance":3,"id":"api-296","sources":[{"report_type":"sandbox","report_id":"6ad8391ba310c7a4cb0550db"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"WSBSDOpenBSD7.7.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00005700)\n \"WSBSDOpenBSD7.7.exe\" called \"QueryPerformanceCounter\" (UID: 00000000-00005700)\n \"WSBSDOpenBSD7.7.exe\" called \"GlobalMemoryStatusEx\" with parameters (UID: 00000000-00005700)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"6ad8391ba310c7a4cb0550db"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"WSBSDOpenBSD7.7.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00005700)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"6ad8391ba310c7a4cb0550db"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"WSBSDOpenBSD7.7.exe\" called \"IsWow64Process\" with parameter \"5700\" - (UID: 00000000-00005700)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"6ad8391ba310c7a4cb0550db"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"WSBSDOpenBSD7.7.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00005700)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6ad8391ba310c7a4cb0550db"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$24","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6ad8391ba310c7a4cb0550db"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"\"WSBSDOpenBSD7.7.exe\" called \"GetVersionExA\" with parameter 940000000600000002000000f02300000200000000000000010000000c0000000000000000000000000000000100000001000000000000000000000077006f0072006b0000000000000000000000000000000000010000002f00000000000000000000007200650065002e0064006c006c0000004e0054000000000000db00000000000000000000000000000000000000000000 (UID: 00000000-00005700)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"6ad8391ba310c7a4cb0550db"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to detect virtual environment (API)","description":"Program::GetTickCount64() at 0f2440f2a66ad98b63b4a20aa22e2cd9-6000002-Program~GetUptime","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497","relevance":3,"id":"stream-87","sources":[{"report_type":"sandbox","report_id":"6ad8391ba310c7a4cb0550db"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to execute WMI queries (Dotnet)","description":"Observed namespace \"System.Management.ManagementObjectSearcher\" in \"WSBSDOpenBSD7.7.exe\"","origin":"Static Parser","mitre_attack_id":"T1047","relevance":1,"id":"static-114","sources":[{"report_type":"sandbox","report_id":"6ad8391ba310c7a4cb0550db"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to execute a WMI query","description":"Found string \"SELECT * FROM Win32_Processor\" (Indicator: \"select * from \"; File: \"WSBSDOpenBSD7.7.exe\")\n Found string \"SELECT * FROM Win32_ComputerSystem\" (Indicator: \"select * from \"; File: \"WSBSDOpenBSD7.7.exe\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":1,"id":"string-433","sources":[{"report_type":"sandbox","report_id":"6ad8391ba310c7a4cb0550db"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to gather system information (Dotnet)","description":"Observed function \"get_MachineName\" in \"WSBSDOpenBSD7.7.exe\"\n Observed function \"get_UserName\" in \"WSBSDOpenBSD7.7.exe\"\n Observed function \"get_OSVersion\" in \"WSBSDOpenBSD7.7.exe\"","origin":"Static Parser","mitre_attack_id":"T1082","relevance":1,"id":"static-120","sources":[{"report_type":"sandbox","report_id":"6ad8391ba310c7a4cb0550db"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"WSBSDOpenBSD7.7.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6ad8391ba310c7a4cb0550db"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the current user information","description":"Observed string: \"whoami\" (Indicator: \"whoami\") in Source: WSBSDOpenBSD7.7.exe","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-432","sources":[{"report_type":"sandbox","report_id":"6ad8391ba310c7a4cb0550db"}]},{"level":"informative","category":"Environment Awareness","name":"Queries the user identity associated with the current process token","description":"\"WSBSDOpenBSD7.7.exe\" queried token user identity (UID: 00000000-00005700)","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-328","sources":[{"report_type":"sandbox","report_id":"6ad8391ba310c7a4cb0550db"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"\"WSBSDOpenBSD7.7.exe\" queries volume information of \"C:\\WSBSDOpenBSD7.7.exe\" at 00000000-00005700-00000C17-2418032248","origin":"API Call","mitre_attack_id":"T1082","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"6ad8391ba310c7a4cb0550db"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"WSBSDOpenBSD7.7.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6ad8391ba310c7a4cb0550db"}]},{"level":"informative","category":"Environment Awareness","name":"References to WMI query strings used for process discovery","description":"Found string \"SELECT * FROM Win32_Processor\" (Indicator: \" Win32_Process\"; File: \"WSBSDOpenBSD7.7.exe\")\n Found string \"ELECT * FROM Win32_Processor\" (Indicator: \" Win32_Process\"; Source: \"00000000-00005700.00000000.263099.00752000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-513","sources":[{"report_type":"sandbox","report_id":"6ad8391ba310c7a4cb0550db"}]},{"level":"informative","category":"External Systems","name":"Sample was identified as clean by Antivirus engines","description":"0/26 Antivirus vendors marked sample as clean (0% detection rate)","origin":"External System","relevance":10,"id":"avtest-1","sources":[{"report_type":"sandbox","report_id":"6ad8391ba310c7a4cb0550db"}]},{"level":"informative","category":"General","name":"Able to execute application (.NET)","description":"Observed function \"System.Diagnostics.ProcessStartInfo.UseShellExecute\" in \"WSBSDOpenBSD7.7.exe\"","origin":"Static Parser","mitre_attack_id":"T1106","relevance":3,"id":"static-108","sources":[{"report_type":"sandbox","report_id":"6ad8391ba310c7a4cb0550db"}]},{"level":"informative","category":"General","name":"Able to execute applications using .NET process API","description":"Found string \"set_UseShellExecute\" (Source: \"00000000-00005700.00000000.263099.00752000.00000002.mdmp\")\n Found string \"ProcessStartInfo\" (Source: \"00000000-00005700.00000000.263099.00752000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-934","sources":[{"report_type":"sandbox","report_id":"6ad8391ba310c7a4cb0550db"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$25","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"6ad8391ba310c7a4cb0550db"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$26","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6ad8391ba310c7a4cb0550db"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"C:\\Users\\tadeo\\OneDrive\\Documents\\GitHub\\WSBSD\\WSBSD\\BSDDISTROS\\OpenBSD\\7.7\\root\\WSBSD OpenBSD 7.7\\WSBSD OpenBSD 7.7\\obj\\Debug\\WSBSD OpenBSD 7.7.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"6ad8391ba310c7a4cb0550db"}]},{"level":"informative","category":"General","name":"Contains SQL queries","description":"\"SELECT * FROM Win32_Processor\" (Source: WSBSDOpenBSD7.7.exe, Indicator: \"select * from win32_processor\")\n \"SELECT * FROM Win32_ComputerSystem\" (Source: WSBSDOpenBSD7.7.exe, Indicator: \"select * from win32_computersystem\")","origin":"File/Memory","mitre_attack_id":"T1213","relevance":2,"id":"string-16","sources":[{"report_type":"sandbox","report_id":"6ad8391ba310c7a4cb0550db"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"Found reference to API (Indicator: \"GetTickCount64\"; File: \"WSBSDOpenBSD7.7.exe\")\n Found reference to API (Indicator: \"Sleep\"; File: \"WSBSDOpenBSD7.7.exe\")\n Found reference to API (Indicator: \"GetCurrentDirectory\"; File: \"WSBSDOpenBSD7.7.exe\")\n Found reference to API (Indicator: \"SetCurrentDirectory\"; File: \"WSBSDOpenBSD7.7.exe\")\n Found reference to API (Indicator: \"GetTickCount64\"; Source: \"00000000-00005700.00000000.263099.00752000.00000002.mdmp\")\n Found reference to API (Indicator: \"Sleep\"; Source: \"00000000-00005700.00000000.263099.00752000.00000002.mdmp\")\n Found reference to API (Indicator: \"GetCurrentDirectory\"; Source: \"00000000-00005700.00000000.263099.00752000.00000002.mdmp\")\n Found reference to API (Indicator: \"SetCurrentDirectory\"; Source: \"00000000-00005700.00000000.263099.00752000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"6ad8391ba310c7a4cb0550db"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Found reference to API \"set_UseShellExecute\" (Indicator: \"ShellExecute\"; File: \"WSBSDOpenBSD7.7.exe\")\n Found reference to API \"set_UseShellExecute\" (Indicator: \"ShellExecute\"; Source: \"00000000-00005700.00000000.263099.00752000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-240","sources":[{"report_type":"sandbox","report_id":"6ad8391ba310c7a4cb0550db"}]},{"level":"informative","category":"General","name":"Contains ability to start a process (Dotnet)","description":"Observed function \"Process.set_StartInfo\" in \"WSBSDOpenBSD7.7.exe\"\n Observed function \"Process.Start\" in \"WSBSDOpenBSD7.7.exe\"\n Observed function \"Process.get_StartInfo\" in \"WSBSDOpenBSD7.7.exe\"","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-111","sources":[{"report_type":"sandbox","report_id":"6ad8391ba310c7a4cb0550db"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"\"WSBSDOpenBSD7.7.exe\" failed to load missing module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\mscoree.dll\" - [base:0; Status:c0000135]\n \"WSBSDOpenBSD7.7.exe\" failed to load missing module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\ole32.dll\" - [base:0; Status:c0000135]\n \"WSBSDOpenBSD7.7.exe\" failed to load missing module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\api-ms-win-core-winrt-l1-1-0.dll\" - [base:0; Status:c0000135]","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"6ad8391ba310c7a4cb0550db"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"WSBSDOpenBSD7.7.exe\" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA\n IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_NO_SEH\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"6ad8391ba310c7a4cb0550db"}]},{"level":"informative","category":"General","name":"Found Native API in Dotnet file","description":"Observed unmanaged function \"GetTickCount64\" in \"WSBSDOpenBSD7.7.exe\"","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-101","sources":[{"report_type":"sandbox","report_id":"6ad8391ba310c7a4cb0550db"}]},{"level":"informative","category":"General","name":"Found well known domains (string)","description":"\"Please Report Bugs In This Link In Your Windows Browser: https://github.com/TTSConsulting/WSBSD/issues\\n\" (Indicator: \"github.com\")\n \"lease Report Bugs In This Link In Your Windows Browser: https://github.com/TTSConsulting/WSBSD/issues\" (Indicator: \"github.com\")","origin":"File/Memory","relevance":1,"id":"string-135","sources":[{"report_type":"sandbox","report_id":"6ad8391ba310c7a4cb0550db"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$27","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6ad8391ba310c7a4cb0550db"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"WSBSDOpenBSD7.7.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\36eaccfde177c2e7b93b8dbdde4e012a\\mscorlib.ni.dll\" at 71B00000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-3","sources":[{"report_type":"sandbox","report_id":"6ad8391ba310c7a4cb0550db"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"WSBSDOpenBSD7.7.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 75930000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6ad8391ba310c7a4cb0550db"}]},{"level":"informative","category":"General","name":"Loads the CLR Loader DLL","description":"\"WSBSDOpenBSD7.7.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 72FE0000","origin":"Loaded Module","mitre_attack_id":"T1620","id":"module-7","sources":[{"report_type":"sandbox","report_id":"6ad8391ba310c7a4cb0550db"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"WSBSDOpenBSD7.7.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 759F0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6ad8391ba310c7a4cb0550db"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"WSBSDOpenBSD7.7.exe\" was detected as \".NET\" and name: \"Library\"\n \"WSBSDOpenBSD7.7.exe\" was detected as \"Microsoft Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6ad8391ba310c7a4cb0550db"}]},{"level":"informative","category":"General","name":"PE file contains COM data directory","description":"\"WSBSDOpenBSD7.7.exe\" has COM data directory \"IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR\"","origin":"Static Parser","id":"static-144","sources":[{"report_type":"sandbox","report_id":"6ad8391ba310c7a4cb0550db"}]},{"level":"informative","category":"General","name":"PE file contains Debug data directory","description":"\"WSBSDOpenBSD7.7.exe\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"","origin":"Static Parser","id":"static-146","sources":[{"report_type":"sandbox","report_id":"6ad8391ba310c7a4cb0550db"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"WSBSDOpenBSD7.7.exe\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"6ad8391ba310c7a4cb0550db"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"$28","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"6ad8391ba310c7a4cb0550db"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"WSBSDOpenBSD7.7.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")\n \"WSBSDOpenBSD7.7.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"WSBSDOpenBSD7.7.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"WSBSDOpenBSD7.7.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6ad8391ba310c7a4cb0550db"}]},{"level":"informative","category":"General","name":"References Windows file paths for DLLs (possible dropped files)","description":"$29","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"6ad8391ba310c7a4cb0550db"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"WSBSDOpenBSD7.7.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"6ad8391ba310c7a4cb0550db"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"\"WSBSDOpenBSD7.7.exe.log\" has type \"CSV ASCII text\"- Location: [%LOCALAPPDATA%\\Microsoft\\CLR_v4.0_32\\UsageLogs\\WSBSDOpenBSD7.7.exe.log]- [targetUID: 00000000-00005700]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"6ad8391ba310c7a4cb0550db"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$2a","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6ad8391ba310c7a4cb0550db"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"WSBSDOpenBSD7.7.exe\" queries basic process information of the \"C:\\WSBSDOpenBSD7.7.exe\" (UID: 5700)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"6ad8391ba310c7a4cb0550db"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$2b","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6ad8391ba310c7a4cb0550db"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"WSBSDOpenBSD7.7.exe\" reads file \"c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config\"\n \"WSBSDOpenBSD7.7.exe\" reads file \"c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\mscorlib\\36eaccfde177c2e7b93b8dbdde4e012a\\mscorlib.ni.dll.aux\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"6ad8391ba310c7a4cb0550db"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Queries process mitigation policy via NtQueryInformationProcess\n Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques\n Matched sigs: Contains ability to detect virtual environment (API)","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6ad8391ba310c7a4cb0550db"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$2c","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6ad8391ba310c7a4cb0550db"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$2d","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6ad8391ba310c7a4cb0550db"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$2e","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6ad8391ba310c7a4cb0550db"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"WSBSDOpenBSD7.7.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\microsoft\\clr_v4.0_32\\usagelogs\\wsbsdopenbsd7.7.exe.log\"\n \"WSBSDOpenBSD7.7.exe\" writes file \"%localappdata%\\microsoft\\clr_v4.0_32\\usagelogs\\wsbsdopenbsd7.7.exe.log\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"6ad8391ba310c7a4cb0550db"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes log files","description":"\"WSBSDOpenBSD7.7.exe\" writes a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\CLR_v4.0_32\\UsageLogs\\WSBSDOpenBSD7.7.exe.log\"\n \"WSBSDOpenBSD7.7.exe\" writes a file \"%LOCALAPPDATA%\\Microsoft\\CLR_v4.0_32\\UsageLogs\\WSBSDOpenBSD7.7.exe.log\"","origin":"API Call","mitre_attack_id":"T1074.001","relevance":1,"id":"api-159","sources":[{"report_type":"sandbox","report_id":"6ad8391ba310c7a4cb0550db"}]},{"level":"informative","category":"Network Related","name":"Able to interact with Microsoft Store installation processes","description":"Found string \"winget install --id Microsoft.Edit\" (Source: \"00000000-00005700.00000000.263099.00752000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-892","sources":[{"report_type":"sandbox","report_id":"6ad8391ba310c7a4cb0550db"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"1.0.0.0\"\n Potential IP \"1.0.0.4\" found in string \"\\u001B[44mWSBSD BSD LOADER 1.0.0.4-1\\u001B[0m\"\n Potential IP \"1.0.0.4\" found in string \"\\u001B[44mStarting WSBSD 1.0.0.4-1...\\u001B[0m\"\n Potential IP \"1.0.0.4\" found in string \"[44mWSBSD BSD LOADER 1.0.0.4-1\"\n Potential IP \"1.0.0.4\" found in string \"[44mStarting WSBSD 1.0.0.4-1...\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"6ad8391ba310c7a4cb0550db"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"https://github.com/ttsconsulting/wsbsd/issues\\n\"\n Pattern match: \"https://github.com/ttsconsulting/wsbsd/issues\"\n Pattern match: \"microsoft.net/framework/v4.0.30319/\"\n Pattern match: \"http://www.w3.org/2001/xmlschema-instance\"","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"6ad8391ba310c7a4cb0550db"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"Found URL \"https://github.com/ttsconsulting/wsbsd/issueseofetchlearxiting\" - Source: \"00000000-00005700.00000000.263099.00752000.00000002.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"6ad8391ba310c7a4cb0550db"}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"Found HTTPS url \"https://github.com\"","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-98","sources":[{"report_type":"sandbox","report_id":"6ad8391ba310c7a4cb0550db"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access code repositories","description":"Found string \"C:\\Users\\tadeo\\OneDrive\\Documents\\GitHub\\WSBSD\\WSBSD\\BSDDISTROS\\OpenBSD\\7.7\\root\\WSBSD OpenBSD 7.7\\WSBSD OpenBSD 7.7\\obj\\Debug\\WSBSD OpenBSD 7.7.pdb\" (Indicator: \"github\\\"; File: \"WSBSDOpenBSD7.7.exe\")\n Found string \"C:\\Users\\tadeo\\OneDrive\\Documents\\GitHub\\WSBSD\\WSBSD\\BSDDISTROS\\OpenBSD\\7.7\\root\\WSBSD OpenBSD 7.7\\WSBSD OpenBSD 7.7\\obj\\Debug\\WSBSD OpenBSD 7.7.pdb\" (Indicator: \"github\\\"; Source: \"00000000-00005700.00000000.263099.00752000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1213.003","relevance":1,"id":"string-774","sources":[{"report_type":"sandbox","report_id":"6ad8391ba310c7a4cb0550db"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture screen (API string)","description":"$2f","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"6ad8391ba310c7a4cb0550db"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$30","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"6ad8391ba310c7a4cb0550db"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"WSBSDOpenBSD7.7.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6ad8391ba310c7a4cb0550db"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve computer name","description":"\"WSBSDOpenBSD7.7.exe\" called \"GetComputerNameW\" (UID: 00000000-00005700)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-141","sources":[{"report_type":"sandbox","report_id":"6ad8391ba310c7a4cb0550db"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"WSBSDOpenBSD7.7.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"090000000010000000000100fffffeffff00000008000000d8210000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"6ad8391ba310c7a4cb0550db"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"Found reference to API \"GetCurrentDirectory\" (Indicator: \"GetCurrentDirectory\"; File: \"WSBSDOpenBSD7.7.exe\")\n Found reference to API \"GetCurrentDirectory\" (Indicator: \"GetCurrentDirectory\"; Source: \"00000000-00005700.00000000.263099.00752000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"6ad8391ba310c7a4cb0550db"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve files based on search patterns","description":"Found string \"/c where edit\" (Indicator: \"/c where \"; File: \"WSBSDOpenBSD7.7.exe\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-484","sources":[{"report_type":"sandbox","report_id":"6ad8391ba310c7a4cb0550db"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the NetBIOS name of the local computer (API string)","description":"Found reference to API \"690094,5748,3147,,GetComputerNameW,kernel32.dll,\"01:08:30.875\",RX=0,PX=0\" (Indicator: \"GetComputerName\"; Source: \"00000000-00005700.00000000.263099.02D60000.00000004.mdmp\")\n Found reference to API \"1791288,5748,3147,,GetComputerNameW,kernel32.dll,\"01:09:23.093\",RX=0,PX=0\" (Indicator: \"GetComputerName\"; Source: \"00000000-00005700.00000002.266942.02D60000.00000004.mdmp\")\n Found reference to API \"9321194,5748,3147,,GetComputerNameW,kernel32.dll,\"01:09:53.093\",RX=0,PX=0\" (Indicator: \"GetComputerName\"; Source: \"00000000-00005700.00000003.268358.02D60000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-122","sources":[{"report_type":"sandbox","report_id":"6ad8391ba310c7a4cb0550db"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount\"; File: \"WSBSDOpenBSD7.7.exe\")\n Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount\"; Source: \"00000000-00005700.00000000.263099.00752000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"6ad8391ba310c7a4cb0550db"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"Found string \"Incorrect password. Exiting WSBSD terminal.\" (Indicator: \"password\"; File: \"WSBSDOpenBSD7.7.exe\")\n Found string \"ncorrect password. Exiting WSBSD terminal.\" (Indicator: \"password\"; Source: \"00000000-00005700.00000000.263099.00752000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"6ad8391ba310c7a4cb0550db"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found system command-related strings","description":"Found string \"whoami\" (Indicator: \"whoami\"; File: \"WSBSDOpenBSD7.7.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":7,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"6ad8391ba310c7a4cb0550db"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"References to WMI query strings used for information discovery","description":"Found string \"SELECT * FROM Win32_Processor\" (Indicator: \" Win32_Process\"; File: \"WSBSDOpenBSD7.7.exe\")\n Found string \"SELECT * FROM Win32_Processor\" (Indicator: \" Win32_Processor\"; File: \"WSBSDOpenBSD7.7.exe\")\n Found string \"SELECT * FROM Win32_ComputerSystem\" (Indicator: \" Win32_ComputerSystem\"; File: \"WSBSDOpenBSD7.7.exe\")\n Found string \"ELECT * FROM Win32_Processor\" (Indicator: \" Win32_Process\"; Source: \"00000000-00005700.00000000.263099.00752000.00000002.mdmp\")\n Found string \"ELECT * FROM Win32_Processor\" (Indicator: \" Win32_Processor\"; Source: \"00000000-00005700.00000000.263099.00752000.00000002.mdmp\")\n Found string \"ELECT * FROM Win32_ComputerSystem\" (Indicator: \" Win32_ComputerSystem\"; Source: \"00000000-00005700.00000000.263099.00752000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-507","sources":[{"report_type":"sandbox","report_id":"6ad8391ba310c7a4cb0550db"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"\"WSBSDOpenBSD7.7.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\USERSETTINGS\\S-1-5-21-735145574-3570218355-1207367261-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME2\\WINDOWS\\SYSTEM32\\CONHOST.EXE\"; Value: \"\")","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"6ad8391ba310c7a4cb0550db"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"Dropped file: \"WSBSDOpenBSD7.7.exe.log\" - Location: [%LOCALAPPDATA%\\Microsoft\\CLR_v4.0_32\\UsageLogs\\WSBSDOpenBSD7.7.exe.log]- [targetUID: 00000000-00005700]","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"6ad8391ba310c7a4cb0550db"}]},{"level":"informative","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"Found string \"GetTickCount64\" (Source: WSBSDOpenBSD7.7.exe, API is part of module: KERNELBASE.DLL)\n Found string \"Sleep\" (Source: WSBSDOpenBSD7.7.exe, API is part of module: KERNELBASE.DLL)","origin":"File/Memory","mitre_attack_id":"T1106","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"6ad8391ba310c7a4cb0550db"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"WSBSDOpenBSD7.7.exe\" was detected as \"Microsoft Visual C# v7.0 / Basic .NET\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"6ad8391ba310c7a4cb0550db"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"WSBSDOpenBSD7.7.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"WSBSDOpenBSD7.7.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"6ad8391ba310c7a4cb0550db"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"\"WSBSDOpenBSD7.7.exe\" is allocating memory with PAGE_GUARD access rights (Handle: FFFFFFFFFFFFFFFF); (PID: 5700)","origin":"API Call","mitre_attack_id":"T1685","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"6ad8391ba310c7a4cb0550db"}]},{"level":"suspicious","category":"Environment Awareness","name":"Attempts to retrieve the system language code","description":"\"WSBSDOpenBSD7.7.exe\" called \"NtQueryInstallUILanguage\" with parameters {\"LanguageId\": \"1033\"}","origin":"API Call","mitre_attack_id":"T1614.001","relevance":10,"id":"api-307","sources":[{"report_type":"sandbox","report_id":"6ad8391ba310c7a4cb0550db"}]},{"level":"suspicious","category":"Environment Awareness","name":"Found a reference to a WMI query string known to be used for VM detection","description":"\"SELECT * FROM Win32_Processor\" (Indicator: \" win32_process\"; File: \"WSBSDOpenBSD7.7.exe\")\n \"SELECT * FROM Win32_ComputerSystem\" (Indicator: \" win32_computersystem\"; File: \"WSBSDOpenBSD7.7.exe\")\n \"ELECT * FROM Win32_Processor\" (Indicator: \" win32_process\"; Source: \"00000000-00005700.00000000.263099.00752000.00000002.mdmp\")\n \"ELECT * FROM Win32_ComputerSystem\" (Indicator: \" win32_computersystem\"; Source: \"00000000-00005700.00000000.263099.00752000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":10,"id":"string-55","sources":[{"report_type":"sandbox","report_id":"6ad8391ba310c7a4cb0550db"}]},{"level":"suspicious","category":"Environment Awareness","name":"Queries process mitigation policy via NtQueryInformationProcess","description":"\"C:\\WSBSDOpenBSD7.7.exe\" queried ProcessMitigationPolicy","origin":"API Call","mitre_attack_id":"T1497.001","relevance":1,"id":"api-323","sources":[{"report_type":"sandbox","report_id":"6ad8391ba310c7a4cb0550db"}]},{"level":"suspicious","category":"System Security","name":"Hooks API calls","description":"\"Wow64Transition@NTDLL.DLL\" in \"WSBSDOpenBSD7.7.exe\"","origin":"Hook Detection","mitre_attack_id":"T1056.004","relevance":10,"id":"hooks-0","sources":[{"report_type":"sandbox","report_id":"6ad8391ba310c7a4cb0550db"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Timestamp in PE header is very old or in the future","description":"\"WSBSDOpenBSD7.7.exe\" claims program is from Mon Apr 11 00:27:19 2061","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-3","sources":[{"report_type":"sandbox","report_id":"6ad8391ba310c7a4cb0550db"}]}],"intel_graph":{"map":{"File:d6540c071cd02efea811475c20109fd45cc6a40a99d6b3e09a2449d02683641e":{"type":"File","value":"d6540c071cd02efea811475c20109fd45cc6a40a99d6b3e09a2449d02683641e"},"File:d8988d672d6915b46946b28c06ad8066c50041f6152a91d37ffa5cf129cc146b":{"type":"File","value":"d8988d672d6915b46946b28c06ad8066c50041f6152a91d37ffa5cf129cc146b"}},"chains":[{"id":"sandbox_files","root":"File:d6540c071cd02efea811475c20109fd45cc6a40a99d6b3e09a2449d02683641e","edges":[{"edge_kind":"extracted","from_key":"File:d6540c071cd02efea811475c20109fd45cc6a40a99d6b3e09a2449d02683641e","to_key":"File:d8988d672d6915b46946b28c06ad8066c50041f6152a91d37ffa5cf129cc146b"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}}]}},"activity":{"stats":{"process_count":1,"spawned_processes_count":1,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":41,"dropped_files_count":0,"extracted_files_count":1,"files_written_count":2,"files_deleted_count":0,"registry_keys_created_count":1,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":1,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["evasive"],"sample_flags":["Extracted Files"],"sandbox_reports":[{"id":"6ad8391ba310c7a4cb0550db","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"no specific threat","submit_name":"WSBSDOpenBSD7.7.exe","analysis_start_time":"2026-10-21T04:01:32+00:00","indicators_count":{"informative":91,"suspicious":9,"malicious":0},"tags":["Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6ad8391ba310c7a4cb0550db"}],"processes":[{"pid":5700,"ppid":0,"name":"WSBSDOpenBSD7.7.exe","command_line":"","sha256":"d6540c071cd02efea811475c20109fd45cc6a40a99d6b3e09a2449d02683641e","normalized_path":"C:\\WSBSDOpenBSD7.7.exe","uid":"00000000-00005700","icon":"$31"}],"all_imported_dlls":["win32u.dll","gdi32full.dll","shlwapi.dll","kernel.appcore.dll","wow64cpu.dll","version.dll","clrjit.dll","ws2_32.dll","ntdll.dll","wow64.dll","KernelBase.dll","bcryptprimitives.dll","vcruntime140.dll","msvcp140.dll","combase.dll","msvcrt.dll","mscoree.dll","apphelp.dll","msvcp_win.dll","kernel32.dll","ucrtbase.dll","sechost.dll","gdi32.dll","cryptsp.dll","mscoreei.dll","vcruntime140_clr0400.dll","wow64win.dll","VxSSL32.dll","fltLib.dll","clr.dll","ucrtbase_clr0400.dll","psapi.dll","cryptbase.dll","advapi32.dll","ole32.dll","oleaut32.dll","mscorlib.ni.dll","imm32.dll","user32.dll","rpcrt4.dll","sspicli.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"WSBSDOpenBSD7.7.exe.log","sha256":"d8988d672d6915b46946b28c06ad8066c50041f6152a91d37ffa5cf129cc146b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ad8391ba310c7a4cb0550db"}]}],"files_written":[{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"6ad8391ba310c7a4cb0550db"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\CLR_v4.0_32\\UsageLogs\\WSBSDOpenBSD7.7.exe.log","sources":[{"report_type":"sandbox","report_id":"6ad8391ba310c7a4cb0550db"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"6ad8391ba310c7a4cb0550db"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":null}},"report_ids":{"sandbox_job_ids":["6ad8391ba310c7a4cb0550db"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Sample d6540c071cd0… — Score 0/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Threat analysis for sample d6540c071cd0…. Threat score 0/100. 0/27 AV engines flagged this file. 0 malicious and 6 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/d6540c071cd02efea811475c20109fd45cc6a40a99d6b3e09a2449d02683641e"}],["$","meta","4",{"property":"og:title","content":"Sample d6540c071cd0… — Score 0/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Threat analysis for sample d6540c071cd0…. Threat score 0/100. 0/27 AV engines flagged this file. 0 malicious and 6 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/d6540c071cd02efea811475c20109fd45cc6a40a99d6b3e09a2449d02683641e"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Sample d6540c071cd0… — Score 0/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Threat analysis for sample d6540c071cd0…. Threat score 0/100. 0/27 AV engines flagged this file. 0 malicious and 6 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L32","11",{}]]