26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 46:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T47a,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Malware_56.0 Sample d76edf3f3b00… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample d76edf3f3b00…. Malware family: Malware_56.0. Threat score 100/100. 3/27 AV engines flagged this file. 5 malicious and 24 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/d76edf3f3b00efb1a4d382f04ac9fa3275fdb3d77737f16e024635a269c0d9af","keywords":["Malicious","Malware_56.0","malware analysis","sandbox report","threat intelligence","d76edf3f3b00efb1a4d382f04ac9fa3275fdb3d77737f16e024635a269c0d9af"],"about":{"@type":"SoftwareApplication","name":"u4pak.exe","applicationCategory":["peexe","executable"],"identifier":"d76edf3f3b00efb1a4d382f04ac9fa3275fdb3d77737f16e024635a269c0d9af","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Malware_56.0","antivirusDetections":{"malicious":3,"total":27},"behavioralIndicators":{"malicious":5,"suspicious":24},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T7ac,"u4pak.exe" queries volume information of "C:\u4pak.exe" at 00000000-00003276-00000046-3296523 "u4pak.exe" queries volume information of "C:\u4pak.exe" at 00000000-00003276-00000046-3298797 "u4pak.exe" queries volume information of "C:\u4pak.exe" at 00000000-00003276-00000046-3311019 "u4pak.exe" queries volume information of "C:\u4pak.exe" at 00000000-00003276-00000046-3315592 "u4pak.exe" queries volume information of "C:\u4pak.exe" at 00000000-00003276-00000046-3318841 "u4pak.exe" queries volume information of "C:\u4pak.exe" at 00000000-00003276-00000046-3321723 "u4pak.exe" queries volume information of "C:\u4pak.exe" at 00000000-00003276-00000046-3324663 "u4pak.exe" queries volume information of "C:\u4pak.exe" at 00000000-00003276-00000046-3328067 "u4pak.exe" queries volume information of "C:\u4pak.exe" at 00000000-00003276-00000046-3330960 "u4pak.exe" queries volume information of "C:\u4pak.exe" at 00000000-00003276-00000046-3334549 "u4pak.exe" queries volume information of "C:\u4pak.exe" at 00000000-00003276-00000046-3337781 "u4pak.exe" queries volume information of "C:\u4pak.exe" at 00000000-00003276-00000046-3343548 "u4pak.exe" queries volume information of "C:\u4pak.exe" at 00000000-00003276-00000046-3348109 "u4pak.exe" queries volume information of "C:\u4pak.exe" at 00000000-00003276-00000046-3352535 "u4pak.exe" queries volume information of "C:\u4pak.exe" at 00000000-00003276-00000046-3355297 "u4pak.exe" queries volume information of "C:\u4pak.exe" at 00000000-00003276-00000046-3359320 "u4pak.exe" queries volume information of "C:\u4pak.exe" at 00000000-00003276-00000046-3364012 "u4pak.exe" queries volume information of "C:\u4pak.exe" at 00000000-00003276-00000046-3400193 "u4pak.exe" queries volume information of "C:\u4pak.exe" at 00000000-00003276-00000046-3403191 "u4pak.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI29~1\_hashlib.pyd" at 00000000-00003276-00000046-340638028:T41a,Antivirus vendors marked dropped file "msvcp90.dll" as clean (type is "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "python27.dll" as clean (type is "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "msvcr90.dll" as clean (type is "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "msvcm90.dll" as clean (type is "PE32 executable (DLL) (GUI) Intel 80386 Mono/.Net assembly for MS Windows"), Antivirus vendors marked dropped file "_hashlib.pyd" as clean (type is "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "unicodedata.pyd" as clean (type is "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "bz2.pyd" as clean (type is "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "select.pyd" as clean (type is "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows")29:T435,"C:\u4pak.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI29802\bz2.pyd" for deletion "C:\u4pak.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI29802\Microsoft.VC90.CRT.manifest" for deletion "C:\u4pak.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI29802\msvcm90.dll" for deletion "C:\u4pak.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI29802\msvcp90.dll" for deletion "C:\u4pak.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI29802\msvcr90.dll" for deletion "C:\u4pak.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI29802\python27.dll" for deletion "C:\u4pak.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI29802\select.pyd" for deletion "C:\u4pak.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI29802\u4pak.exe.manifest" for deletion "C:\u4pak.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI29802\unicodedata.pyd" for deletion "C:\u4pak.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI29802\_hashlib.pyd" for deletion "C:\u4pak.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI29802" for deletion2a:T456,"u4pak.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI29802\bz2.pyd" with delete access "u4pak.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI29802\Microsoft.VC90.CRT.manifest" with delete access "u4pak.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI29802\msvcm90.dll" with delete access "u4pak.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI29802\msvcp90.dll" with delete access "u4pak.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI29802\msvcr90.dll" with delete access "u4pak.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI29802\python27.dll" with delete access "u4pak.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI29802\select.pyd" with delete access "u4pak.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI29802\u4pak.exe.manifest" with delete access "u4pak.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI29802\unicodedata.pyd" with delete access "u4pak.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI29802\_hashlib.pyd" with delete access "u4pak.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI29802" with delete access2b:Tb9d,"" wrote 774144 bytes starting with PE header signature to file "%TEMP%\_MEI31842\_hashlib.pyd": 4d5a90000300000004000000ffff0000b800000000000000400000000000000000000000000000000000000000000000000000000000000000000000f00000000e1fba0e00b409cd21b8014ccd21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "" wrote 65536 bytes starting with PE header signature to file "%TEMP%\_MEI31842\bz2.pyd": 4d5a90000300000004000000ffff0000b800000000000000400000000000000000000000000000000000000000000000000000000000000000000000f00000000e1fba0e00b409cd21b8014ccd21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "" wrote 225280 bytes starting with PE header signature to file "%TEMP%\_MEI31842\msvcm90.dll": 4d5a90000300000004000000ffff0000b800000000000000400000000000000000000000000000000000000000000000000000000000000000000000080100000e1fba0e00b409cd21b8014ccd21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "" wrote 569344 bytes starting with PE header signature to file "%TEMP%\_MEI31842\msvcp90.dll": 4d5a90000300000004000000ffff0000b800000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fba0e00b409cd21b8014ccd21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "" wrote 651264 bytes starting with PE header signature to file "%TEMP%\_MEI31842\msvcr90.dll": 4d5a90000300000004000000ffff0000b800000000000000400000000000000000000000000000000000000000000000000000000000000000000000e00000000e1fba0e00b409cd21b8014ccd21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "" wrote 2457600 bytes starting with PE header signature to file "%TEMP%\_MEI31842\python27.dll": 4d5a90000300000004000000ffff0000b800000000000000400000000000000000000000000000000000000000000000000000000000000000000000f00000000e1fba0e00b409cd21b8014ccd21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "" wrote 8192 bytes starting with PE header signature to file "%TEMP%\_MEI31842\select.pyd": 4d5a90000300000004000000ffff0000b800000000000000400000000000000000000000000000000000000000000000000000000000000000000000e00000000e1fba0e00b409cd21b8014ccd21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "" wrote 684032 bytes starting with PE header signature to file "%TEMP%\_MEI31842\unicodedata.pyd": 4d5a90000300000004000000ffff0000b800000000000000400000000000000000000000000000000000000000000000000000000000000000000000e80000000e1fba0e00b409cd21b8014ccd21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...2c:Tc47,"u4pak.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001364) "u4pak.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001364) "u4pak.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002232) "u4pak.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002232) "u4pak.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000e02c5c741cb4a300226efe7500000703000000002d6efe759e60e6b22d000000ecb75274a0b4a300b1ce9800b0dfa60280c0a6020b00000080000000e0b3a3000000ea0264b4a30070c8ff757aa541c4feffffff2d000000d0cc61742700000034b4a300856a00761c23057674b4a300f85f007608000000bb69ff75b269ff75f660e6b22d000000ecb7527427000000d0cc617448b4a3002d000000d0cc61742700000078b4a300856a00761c230576c0b4a3007e8a6074ee8c6074738a607410b85cf62d000000ecb7527427000000d0cc61745c280703f027070310b85cf688b4a300fc529e7474b5a300e0846074e8fd6382feffffff738a6074 (UID: 00000000-00002232)2d:T401,"u4pak.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00001364) "u4pak.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00001364) "u4pak.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00001364) "u4pak.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00001364) "u4pak.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002232) "u4pak.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002232) "u4pak.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002232) "u4pak.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002232) "u4pak.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI13642\python27.dll (UID: 00000000-00002232) "u4pak.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI13~1\_hashlib.pyd (UID: 00000000-00002232)2e:T36f6,"u4pak.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00001364) "u4pak.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00001364) "u4pak.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00001364) "u4pak.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00001364) "u4pak.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00001364) "u4pak.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00001364) "u4pak.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00001364) "u4pak.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00001364) "u4pak.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00001364) "u4pak.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00001364) "u4pak.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00001364) "u4pak.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00001364) "u4pak.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00001364) "u4pak.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00001364) "u4pak.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00001364) "u4pak.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00001364) "u4pak.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00001364) "u4pak.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00001364) "u4pak.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00001364) "u4pak.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00001364) "u4pak.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00001364) "u4pak.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00001364) "u4pak.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00001364) "u4pak.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00001364) "u4pak.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00001364) "u4pak.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00001364) "u4pak.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00001364) "u4pak.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00001364) "u4pak.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00001364) "u4pak.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00001364) "u4pak.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00001364) "u4pak.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00001364) "u4pak.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00001364) "u4pak.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00001364) "u4pak.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00001364) "u4pak.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00001364) "u4pak.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00001364) "u4pak.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00001364) "u4pak.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00001364) "u4pak.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00001364) "u4pak.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00001364) "u4pak.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00001364) "u4pak.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00001364) "u4pak.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00001364) "u4pak.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00001364) "u4pak.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00002232) "u4pak.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00002232) "u4pak.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00002232) "u4pak.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00002232) "u4pak.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00002232) "u4pak.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00002232) "u4pak.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00002232) "u4pak.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00002232) "u4pak.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00002232) "u4pak.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00002232) "u4pak.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00002232) "u4pak.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00002232) "u4pak.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00002232) "u4pak.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00002232) "u4pak.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00002232) "u4pak.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00002232) "u4pak.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00002232) "u4pak.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00002232) "u4pak.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00002232) "u4pak.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00002232) "u4pak.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00002232) "u4pak.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00002232) "u4pak.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00002232) "u4pak.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00002232) "u4pak.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00002232) "u4pak.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00002232) "u4pak.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00002232) "u4pak.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00002232) "u4pak.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00002232) "u4pak.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00002232) "u4pak.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00002232) "u4pak.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00002232) "u4pak.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00002232) "u4pak.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00002232) "u4pak.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00002232) "u4pak.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00002232) "u4pak.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00002232) "u4pak.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00002232) "u4pak.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00002232) "u4pak.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00002232) "u4pak.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00002232) "u4pak.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00002232) "u4pak.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00002232) "u4pak.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00002232) "u4pak.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00002232) "u4pak.exe" called "GetProcAddress" with a parameter CreateActCtxW (UID: 00000000-00002232) "u4pak.exe" called "GetProcAddress" with a parameter ActivateActCtx (UID: 00000000-00002232) "u4pak.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00002232) "u4pak.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00002232) "u4pak.exe" called "GetProcAddress" with a parameter IsProcessorFeaturePresent (UID: 00000000-00002232) "u4pak.exe" called "GetProcAddress" with a parameter FindActCtxSectionStringW (UID: 00000000-00002232) "u4pak.exe" called "GetProcAddress" with a parameter GetCurrentActCtx (UID: 00000000-00002232) "u4pak.exe" called "GetProcAddress" with a parameter DeactivateActCtx (UID: 00000000-00002232) "u4pak.exe" called "GetProcAddress" with a parameter AddRefActCtx (UID: 00000000-00002232) "u4pak.exe" called "GetProcAddress" with a parameter ReleaseActCtx (UID: 00000000-00002232) "u4pak.exe" called "GetProcAddress" with a parameter Py_DontWriteBytecodeFlag (UID: 00000000-00002232) "u4pak.exe" called "GetProcAddress" with a parameter Py_FileSystemDefaultEncoding (UID: 00000000-00002232) "u4pak.exe" called "GetProcAddress" with a parameter Py_FrozenFlag (UID: 00000000-00002232) "u4pak.exe" called "GetProcAddress" with a parameter Py_IgnoreEnvironmentFlag (UID: 00000000-00002232) "u4pak.exe" called "GetProcAddress" with a parameter Py_NoSiteFlag (UID: 00000000-00002232) "u4pak.exe" called "GetProcAddress" with a parameter Py_NoUserSiteDirectory (UID: 00000000-00002232) "u4pak.exe" called "GetProcAddress" with a parameter Py_OptimizeFlag (UID: 00000000-00002232) "u4pak.exe" called "GetProcAddress" with a parameter Py_VerboseFlag (UID: 00000000-00002232) "u4pak.exe" called "GetProcAddress" with a parameter Py_BuildValue (UID: 00000000-00002232) "u4pak.exe" called "GetProcAddress" with a parameter Py_DecRef (UID: 00000000-00002232) "u4pak.exe" called "GetProcAddress" with a parameter Py_EndInterpreter (UID: 00000000-00002232) "u4pak.exe" called "GetProcAddress" with a parameter Py_Finalize (UID: 00000000-00002232) "u4pak.exe" called "GetProcAddress" with a parameter Py_IncRef (UID: 00000000-00002232) "u4pak.exe" called "GetProcAddress" with a parameter Py_Initialize (UID: 00000000-00002232) "u4pak.exe" called "GetProcAddress" with a parameter Py_NewInterpreter (UID: 00000000-00002232) "u4pak.exe" called "GetProcAddress" with a parameter Py_SetProgramName (UID: 00000000-00002232) "u4pak.exe" called "GetProcAddress" with a parameter Py_SetPythonHome (UID: 00000000-00002232) "u4pak.exe" called "GetProcAddress" with a parameter PyDict_GetItemString (UID: 00000000-00002232) "u4pak.exe" called "GetProcAddress" with a parameter PyErr_Clear (UID: 00000000-00002232) "u4pak.exe" called "GetProcAddress" with a parameter PyErr_Occurred (UID: 00000000-00002232) "u4pak.exe" called "GetProcAddress" with a parameter PyErr_Print (UID: 00000000-00002232) "u4pak.exe" called "GetProcAddress" with a parameter PyEval_AcquireThread (UID: 00000000-00002232) "u4pak.exe" called "GetProcAddress" with a parameter PyEval_InitThreads (UID: 00000000-00002232) "u4pak.exe" called "GetProcAddress" with a parameter PyEval_ReleaseThread (UID: 00000000-00002232) "u4pak.exe" called "GetProcAddress" with a parameter PyImport_AddModule (UID: 00000000-00002232) "u4pak.exe" called "GetProcAddress" with a parameter PyImport_ExecCodeModule (UID: 00000000-00002232) "u4pak.exe" called "GetProcAddress" with a parameter PyImport_ImportModule (UID: 00000000-00002232) "u4pak.exe" called "GetProcAddress" with a parameter PyList_Append (UID: 00000000-00002232) "u4pak.exe" called "GetProcAddress" with a parameter PyList_New (UID: 00000000-00002232) "u4pak.exe" called "GetProcAddress" with a parameter PyLong_AsLong (UID: 00000000-00002232) "u4pak.exe" called "GetProcAddress" with a parameter PyModule_GetDict (UID: 00000000-00002232) "u4pak.exe" called "GetProcAddress" with a parameter PyObject_CallFunction (UID: 00000000-00002232) "u4pak.exe" called "GetProcAddress" with a parameter PyObject_SetAttrString (UID: 00000000-00002232) "u4pak.exe" called "GetProcAddress" with a parameter PyRun_SimpleString (UID: 00000000-00002232) "u4pak.exe" called "GetProcAddress" with a parameter PyString_FromString (UID: 00000000-00002232) "u4pak.exe" called "GetProcAddress" with a parameter PyString_FromFormat (UID: 00000000-00002232) "u4pak.exe" called "GetProcAddress" with a parameter PySys_AddWarnOption (UID: 00000000-00002232) "u4pak.exe" called "GetProcAddress" with a parameter PySys_SetArgvEx (UID: 00000000-00002232) "u4pak.exe" called "GetProcAddress" with a parameter PySys_GetObject (UID: 00000000-00002232) "u4pak.exe" called "GetProcAddress" with a parameter PySys_SetObject (UID: 00000000-00002232) "u4pak.exe" called "GetProcAddress" with a parameter PySys_SetPath (UID: 00000000-00002232) "u4pak.exe" called "GetProcAddress" with a parameter PyThreadState_Swap (UID: 00000000-00002232) "u4pak.exe" called "GetProcAddress" with a parameter init_hashlib (UID: 00000000-00002232)2f:T1f5a,Found reference to API (Indicator: "CreateActCtxW"; File: "u4pak.exe") Found reference to API (Indicator: "ActivateActCtx"; File: "u4pak.exe") Found reference to API (Indicator: "CreateProcessW"; File: "u4pak.exe") Found reference to API (Indicator: "DeleteCriticalSection"; File: "u4pak.exe") Found reference to API (Indicator: "EnterCriticalSection"; File: "u4pak.exe") Found reference to API (Indicator: "ExpandEnvironmentStringsW"; File: "u4pak.exe") Found reference to API (Indicator: "FormatMessageA"; File: "u4pak.exe") Found reference to API (Indicator: "GetCommandLineW"; File: "u4pak.exe") Found reference to API (Indicator: "GetCurrentProcess"; File: "u4pak.exe") Found reference to API (Indicator: "GetCurrentProcessId"; File: "u4pak.exe") Found reference to API (Indicator: "GetCurrentThreadId"; File: "u4pak.exe") Found reference to API (Indicator: "GetEnvironmentVariableW"; File: "u4pak.exe") Found reference to API (Indicator: "GetExitCodeProcess"; File: "u4pak.exe") Found reference to API (Indicator: "GetLastError"; File: "u4pak.exe") Found reference to API (Indicator: "GetModuleFileNameW"; File: "u4pak.exe") Found reference to API (Indicator: "GetModuleHandleA"; File: "u4pak.exe") Found reference to API (Indicator: "GetProcAddress"; File: "u4pak.exe") Found reference to API (Indicator: "GetShortPathNameW"; File: "u4pak.exe") Found reference to API (Indicator: "GetStartupInfoW"; File: "u4pak.exe") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; File: "u4pak.exe") Found reference to API (Indicator: "GetTempPathW"; File: "u4pak.exe") Found reference to API (Indicator: "GetTickCount"; File: "u4pak.exe") Found reference to API (Indicator: "InitializeCriticalSection"; File: "u4pak.exe") Found reference to API (Indicator: "LeaveCriticalSection"; File: "u4pak.exe") Found reference to API (Indicator: "LoadLibraryA"; File: "u4pak.exe") Found reference to API (Indicator: "LoadLibraryExW"; File: "u4pak.exe") Found reference to API (Indicator: "MultiByteToWideChar"; File: "u4pak.exe") Found reference to API (Indicator: "QueryPerformanceCounter"; File: "u4pak.exe") Found reference to API (Indicator: "SetDllDirectoryW"; File: "u4pak.exe") Found reference to API (Indicator: "SetEnvironmentVariableW"; File: "u4pak.exe") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; File: "u4pak.exe") Found reference to API (Indicator: "Sleep"; File: "u4pak.exe") Found reference to API (Indicator: "TerminateProcess"; File: "u4pak.exe") Found reference to API (Indicator: "TlsGetValue"; File: "u4pak.exe") Found reference to API (Indicator: "UnhandledExceptionFilter"; File: "u4pak.exe") Found reference to API (Indicator: "VirtualProtect"; File: "u4pak.exe") Found reference to API (Indicator: "VirtualQuery"; File: "u4pak.exe") Found reference to API (Indicator: "WaitForSingleObject"; File: "u4pak.exe") Found reference to API (Indicator: "WideCharToMultiByte"; File: "u4pak.exe") Found reference to API (Indicator: "ntohl"; File: "u4pak.exe") Found reference to API (Indicator: "CreateActCtxW"; Source: "00000000-00001364.00000000.193495.0040C000.00000002.mdmp") Found reference to API (Indicator: "ActivateActCtx"; Source: "00000000-00001364.00000000.193495.0040C000.00000002.mdmp") Found reference to API (Indicator: "CreateProcessW"; Source: "00000000-00001364.00000000.193495.0041D000.00000004.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00001364.00000000.193495.0041D000.00000004.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00001364.00000000.193495.0041D000.00000004.mdmp") Found reference to API (Indicator: "ExpandEnvironmentStringsW"; Source: "00000000-00001364.00000000.193495.0041D000.00000004.mdmp") Found reference to API (Indicator: "FormatMessageA"; Source: "00000000-00001364.00000000.193495.0041D000.00000004.mdmp") Found reference to API (Indicator: "GetCommandLineW"; Source: "00000000-00001364.00000000.193495.0041D000.00000004.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00001364.00000000.193495.0041D000.00000004.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00001364.00000000.193495.0041D000.00000004.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00001364.00000000.193495.0041D000.00000004.mdmp") Found reference to API (Indicator: "GetEnvironmentVariableW"; Source: "00000000-00001364.00000000.193495.0041D000.00000004.mdmp") Found reference to API (Indicator: "GetExitCodeProcess"; Source: "00000000-00001364.00000000.193495.0041D000.00000004.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00001364.00000000.193495.0041D000.00000004.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00001364.00000000.193495.0041D000.00000004.mdmp") Found reference to API (Indicator: "GetModuleHandleA"; Source: "00000000-00001364.00000000.193495.0041D000.00000004.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00001364.00000000.193495.0041D000.00000004.mdmp") Found reference to API (Indicator: "GetShortPathNameW"; Source: "00000000-00001364.00000000.193495.0041D000.00000004.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00001364.00000000.193495.0041D000.00000004.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00001364.00000000.193495.0041D000.00000004.mdmp") Found reference to API (Indicator: "GetTempPathW"; Source: "00000000-00001364.00000000.193495.0041D000.00000004.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00001364.00000000.193495.0041D000.00000004.mdmp") Found reference to API (Indicator: "InitializeCriticalSection"; Source: "00000000-00001364.00000000.193495.0041D000.00000004.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00001364.00000000.193495.0041D000.00000004.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00001364.00000000.193495.0041D000.00000004.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00001364.00000000.193495.0041D000.00000004.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00001364.00000000.193495.0041D000.00000004.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00001364.00000000.193495.0041D000.00000004.mdmp") Found reference to API (Indicator: "SetDllDirectoryW"; Source: "00000000-00001364.00000000.193495.0041D000.00000004.mdmp") Found reference to API (Indicator: "SetEnvironmentVariableW"; Source: "00000000-00001364.00000000.193495.0041D000.00000004.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00001364.00000000.193495.0041D000.00000004.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00001364.00000000.193495.0041D000.00000004.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00001364.00000000.193495.0041D000.00000004.mdmp") Found reference to API (Indicator: "TlsGetValue"; Source: "00000000-00001364.00000000.193495.0041D000.00000004.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00001364.00000000.193495.0041D000.00000004.mdmp") Found reference to API (Indicator: "VirtualProtect"; Source: "00000000-00001364.00000000.193495.0041D000.00000004.mdmp") Found reference to API (Indicator: "VirtualQuery"; Source: "00000000-00001364.00000000.193495.0041D000.00000004.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00001364.00000000.193495.0041D000.00000004.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00001364.00000000.193495.0041D000.00000004.mdmp") Found reference to API (Indicator: "ntohl"; Source: "00000000-00001364.00000000.193495.0041D000.00000004.mdmp")30:T81a,"python27.dll" contains export function called "PyAST_Compile" at ordinal 1 "python27.dll" contains export function called "PyAST_FromNode" at ordinal 2 "python27.dll" contains export function called "PyArena_AddPyObject" at ordinal 3 "python27.dll" contains export function called "PyArena_Free" at ordinal 4 "python27.dll" contains export function called "PyArena_Malloc" at ordinal 5 "python27.dll" contains export function called "PyArena_New" at ordinal 6 "python27.dll" contains export function called "PyArg_Parse" at ordinal 7 "python27.dll" contains export function called "PyArg_ParseTuple" at ordinal 8 "python27.dll" contains export function called "PyArg_ParseTupleAndKeywords" at ordinal 9 "python27.dll" contains export function called "PyArg_UnpackTuple" at ordinal 10 "python27.dll" contains export function called "PyArg_VaParse" at ordinal 11 "python27.dll" contains export function called "PyArg_VaParseTupleAndKeywords" at ordinal 12 "python27.dll" contains export function called "PyBaseObject_Type" at ordinal 13 "python27.dll" contains export function called "PyBaseString_Type" at ordinal 14 "python27.dll" contains export function called "PyBool_FromLong" at ordinal 15 "python27.dll" contains export function called "PyBool_Type" at ordinal 16 "python27.dll" contains export function called "PyBuffer_FillContiguousStrides" at ordinal 17 "python27.dll" contains export function called "PyBuffer_FillInfo" at ordinal 18 "python27.dll" contains export function called "PyBuffer_FromContiguous" at ordinal 19 "python27.dll" contains export function called "PyBuffer_FromMemory" at ordinal 20 "python27.dll" contains export function called "PyBuffer_FromObject" at ordinal 21 "python27.dll" contains export function called "PyBuffer_FromReadWriteMemory" at ordinal 22 "python27.dll" contains export function called "PyBuffer_FromReadWriteObject" at ordinal 23 "python27.dll" contains export function called "PyBuffer_GetPointer" at ordinal 24 "python27.dll" contains export function called "PyBuffer_IsContiguous" at ordinal 2531:T474,"u4pak.exe" was detected as "MinGW" and name: "Compiler" "u4pak.exe" was detected as "GNU linker ld (GNU Binutils)" and name: "Linker" "python27.dll" was detected as "MinGW" and name: "Compiler" "python27.dll" was detected as "GNU linker ld (GNU Binutils)" and name: "Linker" "msvcr90.dll" was detected as "MinGW" and name: "Compiler" "msvcr90.dll" was detected as "GNU linker ld (GNU Binutils)" and name: "Linker" "msvcp90.dll" was detected as "MinGW" and name: "Compiler" "msvcp90.dll" was detected as "GNU linker ld (GNU Binutils)" and name: "Linker" "_hashlib.pyd" was detected as "MinGW" and name: "Compiler" "_hashlib.pyd" was detected as "GNU linker ld (GNU Binutils)" and name: "Linker" "unicodedata.pyd" was detected as "MinGW" and name: "Compiler" "unicodedata.pyd" was detected as "GNU linker ld (GNU Binutils)" and name: "Linker" "bz2.pyd" was detected as "MinGW" and name: "Compiler" "bz2.pyd" was detected as "GNU linker ld (GNU Binutils)" and name: "Linker" "select.pyd" was detected as "MinGW" and name: "Compiler" "select.pyd" was detected as "GNU linker ld (GNU Binutils)" and name: "Linker"32:T12c9,"u4pak.exe" file has an entrypoint instructions - "sub esp, 0xc,mov dword ptr [0x41d2d8], 0,call 0x409e80,add esp, 0xc,jmp 0x401180,nop ,nop ,nop ,nop ,nop ,nop ,push ebx,sub esp, 0x18,mov eax, dword ptr [0x41e2b4],mov ebx, dword ptr [esp + 0x20],mov eax, dword ptr [eax],mov dword ptr [esp + 4], eax,mov eax, dword ptr [0x41e2a0],mov eax, dword ptr [eax],mov dword ptr [esp], eax,call 0x405120,mov dword ptr [esp + 0x20], ebx,mov dword ptr [esp + 0x24], eax,add esp, 0x18,pop ebx,jmp 0x4026c0,nop ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,push edi,push esi," "python27.dll" file has an entrypoint instructions - "mov edi, edi,push ebp,mov ebp, esp,cmp dword ptr [ebp + 0xc], 1,jne 0x1e11f8ee,call 0x1e11fdc1,push dword ptr [ebp + 8],mov ecx, dword ptr [ebp + 0x10],mov edx, dword ptr [ebp + 0xc],call 0x1e11f7c8,pop ecx,pop ebp,ret 0xc,mov edi, edi,push ebp,mov ebp, esp,sub esp, 0x328,mov dword ptr [0x1e24e3b8], eax,mov dword ptr [0x1e24e3b4], ecx,mov dword ptr [0x1e24e3b0], edx,mov dword ptr [0x1e24e3ac], ebx,mov dword ptr [0x1e24e3a8], esi,mov dword ptr [0x1e24e3a4], edi,mov word ptr [0x1e24e3d0], ss,mov word ptr [0x1e24e3c4], cs," "msvcr90.dll" file has an entrypoint instructions - "mov edi, edi,push ebp,mov ebp, esp,cmp dword ptr [ebp + 0xc], 1,jne 0x78542d50,call 0x7858f070,push dword ptr [ebp + 0x10],push dword ptr [ebp + 0xc],push dword ptr [ebp + 8],call 0x78542b94,add esp, 0xc,pop ebp,ret 0xc,int3 ,int3 ,int3 ,int3 ,int3 ,mov edi, edi,push esi,push edi,xor esi, esi,mov edi, 0x785bba40,cmp dword ptr [esi*8 + 0x785b70c4], 1,jne 0x78542d9d,lea eax, [esi*8 + 0x785b70c0],mov dword ptr [eax], edi,push 0xfa0,push dword ptr [eax],add edi, 0x18,call 0x7858d903,pop ecx,pop ecx,test eax, eax,je 0x78542da9,inc esi,cmp esi, 0x24,jl 0x78542d75," "msvcp90.dll" file has an entrypoint instructions - "mov edi, edi,push ebp,mov ebp, esp,cmp dword ptr [ebp + 0xc], 1,jne 0x784b9dd7,call 0x784ba2aa,push dword ptr [ebp + 8],mov ecx, dword ptr [ebp + 0x10],mov edx, dword ptr [ebp + 0xc],call 0x784b9cac,pop ecx,pop ebp,ret 0xc,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,jmp dword ptr [0x78481148],int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,jmp dword ptr [0x7848114c],int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,jmp dword ptr [0x78481150],int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,cmp dword ptr [0x78507758], 0,je 0x784b9e56,push ebp," "_hashlib.pyd" file has an entrypoint instructions - "mov edi, edi,push ebp,mov ebp, esp,cmp dword ptr [ebp + 0xc], 1,jne 0x100862e7,call 0x10086b95,push dword ptr [ebp + 8],mov ecx, dword ptr [ebp + 0x10],mov edx, dword ptr [ebp + 0xc],call 0x100861c1,pop ecx,pop ebp,ret 0xc,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,push ecx,lea ecx, [esp + 4],sub ecx, eax,sbb eax, eax,not eax,and ecx, eax,mov eax, esp,and eax, 0xfffff000,cmp ecx, eax,jb 0x10086322,mov eax, ecx,pop ecx,xchg eax, esp,mov eax, dword ptr [eax],mov dword ptr [esp], eax,ret ,sub eax, 0x1000,test dword ptr [eax], eax,jmp 0x10086314,int3 ,jmp dword ptr [0x10087114],jmp dword ptr [0x10087118]," "unicodedata.pyd" file has an entrypoint instructions - "mov edi, edi,push ebp,mov ebp, esp,cmp dword ptr [ebp + 0xc], 1,jne 0x1d122d58,call 0x1d1231ba,push dword ptr [ebp + 8],mov ecx, dword ptr [ebp + 0x10],mov edx, dword ptr [ebp + 0xc],call 0x1d122c32,pop ecx,pop ebp,ret 0xc,mov edi, edi,push ebp,mov ebp, esp,sub esp, 0x328,mov dword ptr [0x1d1c8980], eax,mov dword ptr [0x1d1c897c], ecx,mov dword ptr [0x1d1c8978], edx,mov dword ptr [0x1d1c8974], ebx,mov dword ptr [0x1d1c8970], esi,mov dword ptr [0x1d1c896c], edi,mov word ptr [0x1d1c8998], ss,mov word ptr [0x1d1c898c], cs," "bz2.pyd" file has an entrypoint instructions - "mov edi, edi,push ebp,mov ebp, esp,cmp dword ptr [ebp + 0xc], 1,jne 0x1d17c63a,call 0x1d17ca8a,push dword ptr [ebp + 8],mov ecx, dword ptr [ebp + 0x10],mov edx, dword ptr [ebp + 0xc],call 0x1d17c514,pop ecx,pop ebp,ret 0xc,mov edi, edi,push ebp,mov ebp, esp,sub esp, 0x328,mov dword ptr [0x1d181510], eax,mov dword ptr [0x1d18150c], ecx,mov dword ptr [0x1d181508], edx,mov dword ptr [0x1d181504], ebx,mov dword ptr [0x1d181500], esi,mov dword ptr [0x1d1814fc], edi,mov word ptr [0x1d181528], ss,mov word ptr [0x1d18151c], cs," "select.pyd" file has an entrypoint instructions - "mov edi, edi,push ebp,mov ebp, esp,cmp dword ptr [ebp + 0xc], 1,jne 0x1d1119b1,call 0x1d111e0a,push dword ptr [ebp + 8],mov ecx, dword ptr [ebp + 0x10],mov edx, dword ptr [ebp + 0xc],call 0x1d11188b,pop ecx,pop ebp,ret 0xc,mov edi, edi,push ebp,mov ebp, esp,sub esp, 0x328,mov dword ptr [0x1d1145f0], eax,mov dword ptr [0x1d1145ec], ecx,mov dword ptr [0x1d1145e8], edx,mov dword ptr [0x1d1145e4], ebx,mov dword ptr [0x1d1145e0], esi,mov dword ptr [0x1d1145dc], edi,mov word ptr [0x1d114608], ss,mov word ptr [0x1d1145fc], cs,"33:T64d,"u4pak.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "u4pak.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "u4pak.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "u4pak.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\CONHOST.EXE"; Key: ""; Value: "") "u4pak.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: ""; Value: "") "u4pak.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\BAM"; Key: ""; Value: "") "u4pak.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TERMINAL SERVER"; Key: ""; Value: "") "u4pak.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "u4pak.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "u4pak.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "u4pak.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "u4pak.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "u4pak.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: ""; Value: "")34:Ta1d,"u4pak.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "u4pak.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: "U4PAK.EXE"; Value: "") "u4pak.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "u4pak.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CONHOST.EXE"; Value: "") "u4pak.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TERMINAL SERVER"; Key: "TSAPPCOMPAT"; Value: "") "u4pak.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TERMINAL SERVER"; Key: "TSUSERENABLED"; Value: "") "u4pak.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "u4pak.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "u4pak.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "LOGFLAGS"; Value: "") "u4pak.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "SHOWDEBUGINFO"; Value: "") "u4pak.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: "CACHE"; Value: "") "u4pak.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY"; Value: "") "u4pak.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK"; Value: "") "u4pak.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "TYPE"; Value: "") "u4pak.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "ALTERNATECODEPAGE"; Value: "") "u4pak.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "u4pak.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "u4pak.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "u4pak.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "ENABLED"; Value: "")35:T9d1,"u4pak.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI13642" "u4pak.exe" trying to access non-existent file "C:\U4PAK.EXE.LOCAL" "u4pak.exe" trying to access non-existent file "C:\u4pak.exe.Local\" "u4pak.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI13~1\PYIMOD00_CRYPTO_KEY" "u4pak.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI13~1\pyimod00_crypto_key" "u4pak.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI13~1\PYIMOD00_CRYPTO_KEY.PYD" "u4pak.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI13~1\PYIMOD00_CRYPTO_KEY.PY" "u4pak.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI13~1\PYIMOD00_CRYPTO_KEY.PYW" "u4pak.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI13~1\PYIMOD00_CRYPTO_KEY.PYC" "u4pak.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI13~1\CTYPES" "u4pak.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI13~1\ctypes" "u4pak.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI13~1\CTYPES.PYD" "u4pak.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI13~1\CTYPES.PY" "u4pak.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI13~1\CTYPES.PYW" "u4pak.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI13~1\CTYPES.PYC" "u4pak.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI13~1\EGGS" "u4pak.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI13~1\eggs" "u4pak.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI13~1\LLFUSE" "u4pak.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI13~1\llfuse" "u4pak.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI13~1\LLFUSE.PYD" "u4pak.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI13~1\LLFUSE.PY" "u4pak.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI13~1\LLFUSE.PYW" "u4pak.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI13~1\LLFUSE.PYC" "u4pak.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI13~1\ORG"36:T4fa,"u4pak.exe" called "FindFirstFileA" with parameter %TEMP%\_MEI13~1 (UID: 00000000-00002232) "u4pak.exe" called "FindFirstFileA" with parameter %TEMP%\_MEI13~1/*.* (UID: 00000000-00002232) "u4pak.exe" called "FindNextFileA" with parameter .. (UID: 00000000-00002232) "u4pak.exe" called "FindNextFileA" with parameter bz2.pyd (UID: 00000000-00002232) "u4pak.exe" called "FindNextFileA" with parameter Microsoft.VC90.CRT.manifest (UID: 00000000-00002232) "u4pak.exe" called "FindNextFileA" with parameter msvcm90.dll (UID: 00000000-00002232) "u4pak.exe" called "FindNextFileA" with parameter msvcp90.dll (UID: 00000000-00002232) "u4pak.exe" called "FindNextFileA" with parameter msvcr90.dll (UID: 00000000-00002232) "u4pak.exe" called "FindNextFileA" with parameter python27.dll (UID: 00000000-00002232) "u4pak.exe" called "FindNextFileA" with parameter select.pyd (UID: 00000000-00002232) "u4pak.exe" called "FindNextFileA" with parameter u4pak.exe.manifest (UID: 00000000-00002232) "u4pak.exe" called "FindNextFileA" with parameter unicodedata.pyd (UID: 00000000-00002232) "u4pak.exe" called "FindNextFileA" with parameter _hashlib.pyd (UID: 00000000-00002232) "u4pak.exe" called "FindFirstFileA" with parameter %TEMP%\_MEI13~1\encodings (UID: 00000000-00002232)37:T553,Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00001364.00000000.193495.02D00000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00001364.00000000.193495.02D00000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00001364.00000000.193495.02D00000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00001364.00000000.193495.02D00000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00001364.00000000.193495.02D00000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00001364.00000000.193495.02D00000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00001364.00000000.193495.02D00000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00001364.00000000.193495.02D00000.00000004.mdmp")38:Tb83,Found reference to API "Cannot GetProcAddress for Py_DontWriteBytecodeFlag" (Indicator: "GetProcAddress"; File: "u4pak.exe") Found reference to API "Cannot GetProcAddress for Py_FileSystemDefaultEncoding" (Indicator: "GetProcAddress"; File: "u4pak.exe") Found reference to API "Cannot GetProcAddress for Py_FrozenFlag" (Indicator: "GetProcAddress"; File: "u4pak.exe") Found reference to API "Cannot GetProcAddress for Py_IgnoreEnvironmentFlag" (Indicator: "GetProcAddress"; File: "u4pak.exe") Found reference to API "Cannot GetProcAddress for Py_NoSiteFlag" (Indicator: "GetProcAddress"; File: "u4pak.exe") Found reference to API "Cannot GetProcAddress for Py_NoUserSiteDirectory" (Indicator: "GetProcAddress"; File: "u4pak.exe") Found reference to API "Cannot GetProcAddress for Py_OptimizeFlag" (Indicator: "GetProcAddress"; File: "u4pak.exe") Found reference to API "Cannot GetProcAddress for Py_VerboseFlag" (Indicator: "GetProcAddress"; File: "u4pak.exe") Found reference to API "Cannot GetProcAddress for Py_BuildValue" (Indicator: "GetProcAddress"; File: "u4pak.exe") Found reference to API "Cannot GetProcAddress for Py_DecRef" (Indicator: "GetProcAddress"; File: "u4pak.exe") Found reference to API "Cannot GetProcAddress for Py_EndInterpreter" (Indicator: "GetProcAddress"; File: "u4pak.exe") Found reference to API "Cannot GetProcAddress for Py_Finalize" (Indicator: "GetProcAddress"; File: "u4pak.exe") Found reference to API "Cannot GetProcAddress for Py_IncRef" (Indicator: "GetProcAddress"; File: "u4pak.exe") Found reference to API "Cannot GetProcAddress for Py_Initialize" (Indicator: "GetProcAddress"; File: "u4pak.exe") Found reference to API "Cannot GetProcAddress for Py_NewInterpreter" (Indicator: "GetProcAddress"; File: "u4pak.exe") Found reference to API "Cannot GetProcAddress for Py_SetPath" (Indicator: "GetProcAddress"; File: "u4pak.exe") Found reference to API "Cannot GetProcAddress for Py_SetProgramName" (Indicator: "GetProcAddress"; File: "u4pak.exe") Found reference to API "Cannot GetProcAddress for Py_SetPythonHome" (Indicator: "GetProcAddress"; File: "u4pak.exe") Found reference to API "Cannot GetProcAddress for PyDict_GetItemString" (Indicator: "GetProcAddress"; File: "u4pak.exe") Found reference to API "Cannot GetProcAddress for PyErr_Clear" (Indicator: "GetProcAddress"; File: "u4pak.exe") Found reference to API "Cannot GetProcAddress for PyErr_Occurred" (Indicator: "GetProcAddress"; File: "u4pak.exe") Found reference to API "Cannot GetProcAddress for PyErr_Print" (Indicator: "GetProcAddress"; File: "u4pak.exe") Found reference to API "Cannot GetProcAddress for PyEval_AcquireThread" (Indicator: "GetProcAddress"; File: "u4pak.exe") Found reference to API "Cannot GetProcAddress for PyEval_InitThreads" (Indicator: "GetProcAddress"; File: "u4pak.exe") Found reference to API "Cannot GetProcAddress for PyEval_ReleaseThread" (Indicator: "GetProcAddress"; File: "u4pak.exe")39:T4eb,"python27.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\_MEI13642\python27.dll]- [targetUID: 00000000-00001364] "msvcr90.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\_MEI13642\msvcr90.dll]- [targetUID: 00000000-00001364] "msvcp90.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\_MEI13642\msvcp90.dll]- [targetUID: 00000000-00001364] "msvcm90.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 Mono/.Net assembly for MS Windows"- Location: [%TEMP%\_MEI13642\msvcm90.dll]- [targetUID: 00000000-00001364] "_hashlib.pyd" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\_MEI13642\_hashlib.pyd]- [targetUID: 00000000-00001364] "unicodedata.pyd" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\_MEI13642\unicodedata.pyd]- [targetUID: 00000000-00001364] "bz2.pyd" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\_MEI13642\bz2.pyd]- [targetUID: 00000000-00001364] "select.pyd" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\_MEI13642\select.pyd]- [targetUID: 00000000-00001364]3a:T1033,file/memory contains long string(File: "bz2.pyd") Found string "Error allocating decompression buffer" (Source: "00000000-00005060.00000000.265525.0040C000.00000002.mdmp") Found string "unknown compression method" (Source: "00000000-00005060.00000000.265525.0040C000.00000002.mdmp") Found string "Create new instance of RecordBase(filename, offset, compressed_size, uncompressed_size, compression_method, timestamp, sha1, compression_blocks, encrypted, compression_block_size)" (Source: "00000000-00007844.00000000.265656.029B0000.00000004.mdmp") Found string "RecordBase(filename=%r, offset=%r, compressed_size=%r, uncompressed_size=%r, compression_method=%r, timestamp=%r, sha1=%r, compression_blocks=%r, encrypted=%r, compression_block_size=%r)" (Source: "00000000-00007844.00000000.265656.029FC000.00000004.mdmp") Found string "RecordBase(filename, offset, compressed_size, uncompressed_size, compression_method, timestamp, sha1, compression_blocks, encrypted, compression_block_size)" (Source: "00000000-00007844.00000000.265656.029FC000.00000004.mdmp, 00000000-00007844.00000000.265656.02E70000.00000004.mdmp") Found string "compression_blocks:" (Source: "00000000-00007844.00000000.265656.029FC000.00000004.mdmp") Found string "The functions in this module allow compression and decompression using the" (Source: "00000000-00007844.00000000.265656.02A50000.00000004.mdmp, 00000000-00007844.00000000.265656.1E20F000.00000004.mdmp") Found string "compress(string[, level]) -- Compress string, with compression level in 0-9." (Source: "00000000-00007844.00000000.265656.02A50000.00000004.mdmp, 00000000-00007844.00000000.265656.1E20F000.00000004.mdmp") Found string "if r1.compression_method not in COMPR_METHODS:" (Source: "00000000-00007844.00000000.265656.02B70000.00000004.mdmp") Found string "callback(r1, 'unknown compression method: 0x%02x' % r1.compression_method)" (Source: "00000000-00007844.00000000.265656.02B70000.00000004.mdmp") Found string "if r1.compression_method != COMPR_NONE and r1.compressed_size != r1.uncompressed_size:" (Source: "00000000-00007844.00000000.265656.02B70000.00000004.mdmp") Found string "cmeth = record.compression_method" (Source: "00000000-00007844.00000000.265656.02B70000.00000004.mdmp") Found string "r1.compression_method == r2.compression_method and \" (Source: "00000000-00007844.00000000.265656.02B70000.00000004.mdmp") Found string "r1.compression_blocks == r2.compression_blocks and \" (Source: "00000000-00007844.00000000.265656.02B70000.00000004.mdmp") Found string "r1.compression_block_size == r2.compression_block_size" (Source: "00000000-00007844.00000000.265656.02B70000.00000004.mdmp") Found string "for attr in ['compressed_size', 'uncompressed_size', 'timestamp', 'encrypted', 'compression_block_size']:" (Source: "00000000-00007844.00000000.265656.02B70000.00000004.mdmp") Found string "if r1.compression_blocks != r2.compression_blocks:" (Source: "00000000-00007844.00000000.265656.02B70000.00000004.mdmp") Found string "diff.append('\tcompression_blocks:\n\t\t%r\n\t\t\t!=\n\t\t%r' % (r1.compression_blocks, r2.compression_blocks))" (Source: "00000000-00007844.00000000.265656.02B70000.00000004.mdmp") Found string "'filename', 'offset', 'compressed_size', 'uncompressed_size', 'compression_method'," (Source: "00000000-00007844.00000000.265656.02B70000.00000004.mdmp") Found string "'timestamp', 'sha1', 'compression_blocks', 'encrypted', 'compression_block_size'])):" (Source: "00000000-00007844.00000000.265656.02B70000.00000004.mdmp") Found string "if self.compression_method == COMPR_NONE:" (Source: "00000000-00007844.00000000.265656.02B70000.00000004.mdmp") Found string "raise NotImplementedError('decompression is not implemented yet')" (Source: "00000000-00007844.00000000.265656.02B70000.00000004.mdmp") Found string "def __new__(cls, filename, offset, compressed_size, uncompressed_size, compression_method, timestamp, sha1):" (Source: "00000000-00007844.00000000.265656.02B70000.00000004.mdmp") Found string "compression_method, timestamp, sha1, None, False, None)" (Source: "00000000-00007844.00000000.265656.02B70000.00000004.mdmp")3b:Tde9,Found reference to "SHA384" (Indicator: "SHA384"; Source: "00000000-00007844.00000000.265656.02C70000.00000004.mdmp, 00000000-00007844.00000000.265656.02E70000.00000004.mdmp, 00000000-00007844.00000000.265656.10087000.00000002.mdmp, 00000000-00007844.00000000.265656.1E120000.00000002.mdmp") Found reference to "SHA512" (Indicator: "SHA512"; Source: "00000000-00007844.00000000.265656.02C70000.00000004.mdmp, 00000000-00007844.00000000.265656.02E70000.00000004.mdmp, 00000000-00007844.00000000.265656.10087000.00000002.mdmp, 00000000-00007844.00000000.265656.1E120000.00000002.mdmp") Found reference to "DlSHA512 block transform for x86, CRYPTOGAMS by " (Indicator: "SHA512"; Source: "00000000-00007844.00000000.265656.10001000.00000020.mdmp") Found reference to "HMAC routines" (Indicator: "HMAC"; Source: "00000000-00007844.00000000.265656.10087000.00000002.mdmp") Found reference to "AES-256-CBC-HMAC-SHA1" (Indicator: "HMAC"; Source: "00000000-00007844.00000000.265656.10087000.00000002.mdmp") Found reference to "AES-192-CBC-HMAC-SHA1" (Indicator: "HMAC"; Source: "00000000-00007844.00000000.265656.10087000.00000002.mdmp") Found reference to "AES-128-CBC-HMAC-SHA1" (Indicator: "HMAC"; Source: "00000000-00007844.00000000.265656.10087000.00000002.mdmp") Found reference to "RC4-HMAC-MD5" (Indicator: "HMAC"; Source: "00000000-00007844.00000000.265656.10087000.00000002.mdmp") Found reference to "HMAC" (Indicator: "HMAC"; Source: "00000000-00007844.00000000.265656.10087000.00000002.mdmp") Found reference to "HMAC GOST 34.11-94" (Indicator: "HMAC"; Source: "00000000-00007844.00000000.265656.10087000.00000002.mdmp") Found reference to "id-HMACGostR3411-94" (Indicator: "HMAC"; Source: "00000000-00007844.00000000.265656.10087000.00000002.mdmp") Found reference to "hmacWithSHA512" (Indicator: "SHA512"; Source: "00000000-00007844.00000000.265656.10087000.00000002.mdmp") Found reference to "hmacWithSHA384" (Indicator: "SHA384"; Source: "00000000-00007844.00000000.265656.10087000.00000002.mdmp") Found reference to "ecdsa-with-SHA512" (Indicator: "SHA512"; Source: "00000000-00007844.00000000.265656.10087000.00000002.mdmp") Found reference to "ecdsa-with-SHA384" (Indicator: "SHA384"; Source: "00000000-00007844.00000000.265656.10087000.00000002.mdmp") Found reference to "HMAC-SHA1" (Indicator: "HMAC"; Source: "00000000-00007844.00000000.265656.10087000.00000002.mdmp") Found reference to "HMAC-MD5" (Indicator: "HMAC"; Source: "00000000-00007844.00000000.265656.10087000.00000002.mdmp") Found reference to "RSA-SHA512" (Indicator: "SHA512"; Source: "00000000-00007844.00000000.265656.10087000.00000002.mdmp") Found reference to "RSA-SHA384" (Indicator: "SHA384"; Source: "00000000-00007844.00000000.265656.10087000.00000002.mdmp") Found reference to "id-smime-alg-CMSRC2wrap" (Indicator: "RC2"; Source: "00000000-00007844.00000000.265656.10087000.00000002.mdmp") Found reference to "id-smime-alg-RC2wrap" (Indicator: "RC2"; Source: "00000000-00007844.00000000.265656.10087000.00000002.mdmp") Found reference to "id-smime-alg-ESDHwithRC2" (Indicator: "RC2"; Source: "00000000-00007844.00000000.265656.10087000.00000002.mdmp") Found reference to "pbeWithMD5AndRC2-CBC" (Indicator: "RC2"; Source: "00000000-00007844.00000000.265656.10087000.00000002.mdmp") Found reference to "PBE-MD5-RC2-64" (Indicator: "RC2"; Source: "00000000-00007844.00000000.265656.10087000.00000002.mdmp") Found reference to "pbeWithMD2AndRC2-CBC" (Indicator: "RC2"; Source: "00000000-00007844.00000000.265656.10087000.00000002.mdmp")3c:Td49,Found string "X509v3 Private Key Usage Period" (Indicator: "private key"; Source: "00000000-00007844.00000000.265656.10087000.00000002.mdmp") Found string "private key does not match certificate" (Indicator: "private key"; Source: "00000000-00007844.00000000.265656.10087000.00000002.mdmp") Found string "no public key" (Indicator: "public key"; Source: "00000000-00007844.00000000.265656.10087000.00000002.mdmp") Found string "no private key" (Indicator: "private key"; Source: "00000000-00007844.00000000.265656.10087000.00000002.mdmp") Found string "error getting public key" (Indicator: "public key"; Source: "00000000-00007844.00000000.265656.10087000.00000002.mdmp") Found string "unimplemented public key method" (Indicator: "public key"; Source: "00000000-00007844.00000000.265656.10087000.00000002.mdmp") Found string "failed loading public key" (Indicator: "public key"; Source: "00000000-00007844.00000000.265656.10087000.00000002.mdmp") Found string "failed loading private key" (Indicator: "private key"; Source: "00000000-00007844.00000000.265656.10087000.00000002.mdmp") Found string "missing private key" (Indicator: "private key"; Source: "00000000-00007844.00000000.265656.10087000.00000002.mdmp") Found string "invalid private key" (Indicator: "private key"; Source: "00000000-00007844.00000000.265656.10087000.00000002.mdmp") Found string "wrong public key type" (Indicator: "public key"; Source: "00000000-00007844.00000000.265656.10087000.00000002.mdmp") Found string "unsupported public key type" (Indicator: "public key"; Source: "00000000-00007844.00000000.265656.10087000.00000002.mdmp") Found string "unknown public key type" (Indicator: "public key"; Source: "00000000-00007844.00000000.265656.10087000.00000002.mdmp") Found string "unable to decode rsa private key" (Indicator: "private key"; Source: "00000000-00007844.00000000.265656.10087000.00000002.mdmp") Found string "private key header missing" (Indicator: "private key"; Source: "00000000-00007844.00000000.265656.10087000.00000002.mdmp") Found string "unable to get certs public key" (Indicator: "public key"; Source: "00000000-00007844.00000000.265656.10087000.00000002.mdmp") Found string "public key encode error" (Indicator: "public key"; Source: "00000000-00007844.00000000.265656.10087000.00000002.mdmp") Found string "public key decode error" (Indicator: "public key"; Source: "00000000-00007844.00000000.265656.10087000.00000002.mdmp") Found string "public key no rsa" (Indicator: "public key"; Source: "00000000-00007844.00000000.265656.10087000.00000002.mdmp") Found string "expecting public key blob" (Indicator: "public key"; Source: "00000000-00007844.00000000.265656.10087000.00000002.mdmp") Found string "expecting private key blob" (Indicator: "private key"; Source: "00000000-00007844.00000000.265656.10087000.00000002.mdmp") Found string "error converting private key" (Indicator: "private key"; Source: "00000000-00007844.00000000.265656.10087000.00000002.mdmp") Found string "unsupported private key algorithm" (Indicator: "private key"; Source: "00000000-00007844.00000000.265656.10087000.00000002.mdmp") Found string "public key not rsa" (Indicator: "public key"; Source: "00000000-00007844.00000000.265656.10087000.00000002.mdmp") Found string "private key encode error" (Indicator: "private key"; Source: "00000000-00007844.00000000.265656.10087000.00000002.mdmp")3d:T5f8c,Found XOR loop in file "python27.dll" at offset 357394; code bytes = 30d0 Found XOR loop in file "python27.dll" at offset 1253043; code bytes = 30d0 Found XOR loop in file "python27.dll" at offset 1376545; code bytes = 30d0 Found XOR loop in file "python27.dll" at offset 1381311; code bytes = 30d0 Found XOR loop in file "python27.dll" at offset 1499985; code bytes = 30d0 Found XOR loop in file "python27.dll" at offset 1554586; code bytes = 30d0 Found XOR loop in file "python27.dll" at offset 1704459; code bytes = 30d0 Found XOR loop in file "python27.dll" at offset 1737036; code bytes = 30d0 Found XOR loop in file "python27.dll" at offset 1785927; code bytes = 30d0 Found XOR loop in file "python27.dll" at offset 1826117; code bytes = 30d0 Found XOR loop in file "python27.dll" at offset 2315084; code bytes = 30d0 Found XOR loop in file "python27.dll" at offset 2383745; code bytes = 30d0 Found XOR loop in file "python27.dll" at offset 2394149; code bytes = 30d0 Found XOR loop in file "python27.dll" at offset 2398619; code bytes = 30d0 Found XOR loop in file "python27.dll" at offset 2409489; code bytes = 30d0 Found XOR loop in file "python27.dll" at offset 2413339; code bytes = 30d0 Found XOR loop in file "python27.dll" at offset 2428211; code bytes = 30d0 Found XOR loop in file "python27.dll" at offset 2434075; code bytes = 30d0 Found XOR loop in file "python27.dll" at offset 2435231; code bytes = 30d0 Found XOR loop in file "python27.dll" at offset 2436777; code bytes = 30d0 Found XOR loop in file "python27.dll" at offset 2437547; code bytes = 30d0 Found XOR loop in file "python27.dll" at offset 2447305; code bytes = 30d0 Found XOR loop in file "python27.dll" at offset 2448335; code bytes = 30d0 Found XOR loop in file "python27.dll" at offset 2449153; code bytes = 30d0 Found XOR loop in file "python27.dll" at offset 2450697; code bytes = 30d0 Found XOR loop in file "python27.dll" at offset 2452701; code bytes = 30d0 Found XOR loop in file "python27.dll" at offset 2456669; code bytes = 30d0 Found XOR loop in file "python27.dll" at offset 242033; code bytes = 33c1 Found XOR loop in file "python27.dll" at offset 242119; code bytes = 33c1 Found XOR loop in file "python27.dll" at offset 242141; code bytes = 33c1 Found XOR loop in file "python27.dll" at offset 242205; code bytes = 33c1 Found XOR loop in file "python27.dll" at offset 242227; code bytes = 33c1 Found XOR loop in file "python27.dll" at offset 242505; code bytes = 33c1 Found XOR loop in file "python27.dll" at offset 275625; code bytes = 33c1 Found XOR loop in file "python27.dll" at offset 309578; code bytes = 33c1 Found XOR loop in file "python27.dll" at offset 379946; code bytes = 33c1 Found XOR loop in file "python27.dll" at offset 380649; code bytes = 33c1 Found XOR loop in file "python27.dll" at offset 381025; code bytes = 33c1 Found XOR loop in file "python27.dll" at offset 381469; code bytes = 33c1 Found XOR loop in file "python27.dll" at offset 381840; code bytes = 33c1 Found XOR loop in file "python27.dll" at offset 517462; code bytes = 33c1 Found XOR loop in file "python27.dll" at offset 568115; code bytes = 33c1 Found XOR loop in file "python27.dll" at offset 653845; code bytes = 33c1 Found XOR loop in file "python27.dll" at offset 673822; code bytes = 33c1 Found XOR loop in file "python27.dll" at offset 1544494; code bytes = 33c1 Found XOR loop in file "python27.dll" at offset 1703781; code bytes = 33c1 Found XOR loop in file "python27.dll" at offset 1730346; code bytes = 33c1 Found XOR loop in file "python27.dll" at offset 2390057; code bytes = 33c1 Found XOR loop in file "python27.dll" at offset 2401393; code bytes = 33c1 Found XOR loop in file "python27.dll" at offset 2405137; code bytes = 33c1 Found XOR loop in file "python27.dll" at offset 2409133; code bytes = 33c1 Found XOR loop in file "python27.dll" at offset 2421759; code bytes = 33c1 Found XOR loop in file "python27.dll" at offset 2429117; code bytes = 33c1 Found XOR loop in file "python27.dll" at offset 580508; code bytes = 8030 Found XOR loop in file "python27.dll" at offset 675314; code bytes = 8030 Found XOR loop in file "python27.dll" at offset 811189; code bytes = 8030 Found XOR loop in file "python27.dll" at offset 926066; code bytes = 8030 Found XOR loop in file "python27.dll" at offset 1243178; code bytes = 8030 Found XOR loop in file "python27.dll" at offset 1252910; code bytes = 8030 Found XOR loop in file "python27.dll" at offset 1260107; code bytes = 8030 Found XOR loop in file "python27.dll" at offset 1286799; code bytes = 8030 Found XOR loop in file "python27.dll" at offset 1376344; code bytes = 8030 Found XOR loop in file "python27.dll" at offset 1499852; code bytes = 8030 Found XOR loop in file "python27.dll" at offset 1522985; code bytes = 8030 Found XOR loop in file "python27.dll" at offset 1610531; code bytes = 8030 Found XOR loop in file "python27.dll" at offset 1704326; code bytes = 8030 Found XOR loop in file "python27.dll" at offset 1825984; code bytes = 8030 Found XOR loop in file "python27.dll" at offset 2041852; code bytes = 8030 Found XOR loop in file "python27.dll" at offset 2041868; code bytes = 8030 Found XOR loop in file "python27.dll" at offset 2396544; code bytes = 8030 Found XOR loop in file "python27.dll" at offset 2403170; code bytes = 8030 Found XOR loop in file "python27.dll" at offset 2403804; code bytes = 8030 Found XOR loop in file "python27.dll" at offset 2424182; code bytes = 8030 Found XOR loop in file "python27.dll" at offset 2425438; code bytes = 8030 Found XOR loop in file "python27.dll" at offset 2426780; code bytes = 8030 Found XOR loop in file "python27.dll" at offset 2428848; code bytes = 8030 Found XOR loop in file "python27.dll" at offset 2430988; code bytes = 8030 Found XOR loop in file "python27.dll" at offset 2434056; code bytes = 8030 Found XOR loop in file "python27.dll" at offset 2435212; code bytes = 8030 Found XOR loop in file "python27.dll" at offset 2437528; code bytes = 8030 Found XOR loop in file "python27.dll" at offset 2438700; code bytes = 8030 Found XOR loop in file "python27.dll" at offset 2447984; code bytes = 8030 Found XOR loop in file "python27.dll" at offset 2450658; code bytes = 8030 Found XOR loop in file "python27.dll" at offset 2451814; code bytes = 8030 Found XOR loop in file "python27.dll" at offset 2452680; code bytes = 8030 Found XOR loop in file "python27.dll" at offset 2456662; code bytes = 8030 Found XOR loop in file "msvcr90.dll" at offset 48298; code bytes = 30d0 Found XOR loop in file "msvcr90.dll" at offset 99466; code bytes = 30d0 Found XOR loop in file "msvcr90.dll" at offset 636777; code bytes = 30d0 Found XOR loop in file "msvcr90.dll" at offset 642347; code bytes = 30d0 Found XOR loop in file "msvcr90.dll" at offset 644237; code bytes = 30d0 Found XOR loop in file "msvcr90.dll" at offset 645787; code bytes = 30d0 Found XOR loop in file "msvcr90.dll" at offset 19754; code bytes = 33c1 Found XOR loop in file "msvcr90.dll" at offset 29066; code bytes = 33c1 Found XOR loop in file "msvcr90.dll" at offset 41189; code bytes = 33c1 Found XOR loop in file "msvcr90.dll" at offset 41637; code bytes = 33c1 Found XOR loop in file "msvcr90.dll" at offset 42213; code bytes = 33c1 Found XOR loop in file "msvcr90.dll" at offset 42661; code bytes = 33c1 Found XOR loop in file "msvcr90.dll" at offset 69381; code bytes = 33c1 Found XOR loop in file "msvcr90.dll" at offset 69829; code bytes = 33c1 Found XOR loop in file "msvcr90.dll" at offset 70405; code bytes = 33c1 Found XOR loop in file "msvcr90.dll" at offset 70853; code bytes = 33c1 Found XOR loop in file "msvcr90.dll" at offset 85482; code bytes = 33c1 Found XOR loop in file "msvcr90.dll" at offset 91738; code bytes = 33c1 Found XOR loop in file "msvcr90.dll" at offset 94037; code bytes = 33c1 Found XOR loop in file "msvcr90.dll" at offset 94485; code bytes = 33c1 Found XOR loop in file "msvcr90.dll" at offset 95061; code bytes = 33c1 Found XOR loop in file "msvcr90.dll" at offset 95509; code bytes = 33c1 Found XOR loop in file "msvcr90.dll" at offset 116837; code bytes = 33c1 Found XOR loop in file "msvcr90.dll" at offset 117285; code bytes = 33c1 Found XOR loop in file "msvcr90.dll" at offset 117861; code bytes = 33c1 Found XOR loop in file "msvcr90.dll" at offset 118309; code bytes = 33c1 Found XOR loop in file "msvcr90.dll" at offset 292736; code bytes = 33c1 Found XOR loop in file "msvcr90.dll" at offset 297007; code bytes = 33c1 Found XOR loop in file "msvcr90.dll" at offset 343036; code bytes = 33c1 Found XOR loop in file "msvcr90.dll" at offset 347509; code bytes = 33c1 Found XOR loop in file "msvcr90.dll" at offset 352907; code bytes = 33c1 Found XOR loop in file "msvcr90.dll" at offset 380988; code bytes = 33c1 Found XOR loop in file "msvcr90.dll" at offset 381639; code bytes = 33c1 Found XOR loop in file "msvcr90.dll" at offset 528809; code bytes = 33c1 Found XOR loop in file "msvcr90.dll" at offset 528816; code bytes = 33c1 Found XOR loop in file "msvcr90.dll" at offset 557895; code bytes = 33c1 Found XOR loop in file "msvcr90.dll" at offset 557923; code bytes = 33c1 Found XOR loop in file "msvcr90.dll" at offset 558154; code bytes = 33c1 Found XOR loop in file "msvcr90.dll" at offset 7959; code bytes = 8030 Found XOR loop in file "msvcr90.dll" at offset 53996; code bytes = 8030 Found XOR loop in file "msvcr90.dll" at offset 66346; code bytes = 8030 Found XOR loop in file "msvcr90.dll" at offset 102892; code bytes = 8030 Found XOR loop in file "msvcr90.dll" at offset 115242; code bytes = 8030 Found XOR loop in file "msvcr90.dll" at offset 230548; code bytes = 8030 Found XOR loop in file "msvcr90.dll" at offset 634996; code bytes = 8030 Found XOR loop in file "msvcr90.dll" at offset 638640; code bytes = 8030 Found XOR loop in file "msvcr90.dll" at offset 649145; code bytes = 8030 Found XOR loop in file "msvcp90.dll" at offset 549075; code bytes = 30d0 Found XOR loop in file "msvcp90.dll" at offset 552409; code bytes = 30d0 Found XOR loop in file "msvcp90.dll" at offset 556063; code bytes = 30d0 Found XOR loop in file "msvcp90.dll" at offset 559017; code bytes = 30d0 Found XOR loop in file "msvcp90.dll" at offset 559121; code bytes = 30d0 Found XOR loop in file "msvcp90.dll" at offset 3628; code bytes = 8030 Found XOR loop in file "msvcp90.dll" at offset 22600; code bytes = 8030 Found XOR loop in file "msvcp90.dll" at offset 547548; code bytes = 8030 Found XOR loop in file "msvcp90.dll" at offset 549060; code bytes = 8030 Found XOR loop in file "msvcp90.dll" at offset 558100; code bytes = 8030 Found XOR loop in file "msvcp90.dll" at offset 565689; code bytes = 8030 Found XOR loop in file "msvcm90.dll" at offset 24758; code bytes = 30d0 Found XOR loop in file "msvcm90.dll" at offset 216245; code bytes = 30d0 Found XOR loop in file "msvcm90.dll" at offset 217417; code bytes = 30d0 Found XOR loop in file "msvcm90.dll" at offset 161365; code bytes = 8030 Found XOR loop in file "msvcm90.dll" at offset 161446; code bytes = 8030 Found XOR loop in file "msvcm90.dll" at offset 197574; code bytes = 8030 Found XOR loop in file "msvcm90.dll" at offset 216230; code bytes = 8030 Found XOR loop in file "msvcm90.dll" at offset 216936; code bytes = 8030 Found XOR loop in file "_hashlib.pyd" at offset 733620; code bytes = 30d0 Found XOR loop in file "_hashlib.pyd" at offset 744465; code bytes = 30d0 Found XOR loop in file "_hashlib.pyd" at offset 745729; code bytes = 30d0 Found XOR loop in file "_hashlib.pyd" at offset 760063; code bytes = 30d0 Found XOR loop in file "_hashlib.pyd" at offset 761055; code bytes = 30d0 Found XOR loop in file "_hashlib.pyd" at offset 763105; code bytes = 30d0 Found XOR loop in file "_hashlib.pyd" at offset 764099; code bytes = 30d0 Found XOR loop in file "_hashlib.pyd" at offset 768885; code bytes = 30d0 Found XOR loop in file "_hashlib.pyd" at offset 773225; code bytes = 30d0 Found XOR loop in file "_hashlib.pyd" at offset 9094; code bytes = 33c1 Found XOR loop in file "_hashlib.pyd" at offset 9158; code bytes = 33c1 Found XOR loop in file "_hashlib.pyd" at offset 18004; code bytes = 33c1 Found XOR loop in file "_hashlib.pyd" at offset 18024; code bytes = 33c1 Found XOR loop in file "_hashlib.pyd" at offset 18906; code bytes = 33c1 Found XOR loop in file "_hashlib.pyd" at offset 18927; code bytes = 33c1 Found XOR loop in file "_hashlib.pyd" at offset 158451; code bytes = 33c1 Found XOR loop in file "_hashlib.pyd" at offset 158483; code bytes = 33c1 Found XOR loop in file "_hashlib.pyd" at offset 404003; code bytes = 33c1 Found XOR loop in file "_hashlib.pyd" at offset 681955; code bytes = 33c1 Found XOR loop in file "_hashlib.pyd" at offset 750323; code bytes = 33c1 Found XOR loop in file "_hashlib.pyd" at offset 372529; code bytes = 8030 Found XOR loop in file "_hashlib.pyd" at offset 755352; code bytes = 8030 Found XOR loop in file "_hashlib.pyd" at offset 759074; code bytes = 8030 Found XOR loop in file "_hashlib.pyd" at offset 760044; code bytes = 8030 Found XOR loop in file "_hashlib.pyd" at offset 762060; code bytes = 8030 Found XOR loop in file "_hashlib.pyd" at offset 763086; code bytes = 8030 Found XOR loop in file "_hashlib.pyd" at offset 767678; code bytes = 8030 Found XOR loop in file "unicodedata.pyd" at offset 491420; code bytes = 30d0 Found XOR loop in file "unicodedata.pyd" at offset 558404; code bytes = 30d0 Found XOR loop in file "unicodedata.pyd" at offset 158661; code bytes = 33c1 Found XOR loop in file "unicodedata.pyd" at offset 683099; code bytes = 33c1 Found XOR loop in file "unicodedata.pyd" at offset 157092; code bytes = 8030 Found XOR loop in file "unicodedata.pyd" at offset 562132; code bytes = 8030 Found XOR loop in file "unicodedata.pyd" at offset 635088; code bytes = 8030 Found XOR loop in file "bz2.pyd" at offset 47914; code bytes = 30d0 Found XOR loop in file "bz2.pyd" at offset 48996; code bytes = 30d0 Found XOR loop in file "bz2.pyd" at offset 35449; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 12456; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 177571; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 245291; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 250841; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 295723; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 345490; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 395454; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 402768; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 428111; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 613786; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 629454; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 632259; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 740257; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 899046; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 934483; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 934883; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 964658; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1165529; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1183793; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1200871; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1238993; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1245624; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1250888; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1254895; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1296903; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1419104; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1439565; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1520087; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1569155; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1642773; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1681094; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1868704; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2083143; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2095640; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2220761; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2328868; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2647251; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2654553; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2666338; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2667881; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2850257; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2890466; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2942813; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3027515; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3033351; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3135522; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 243953; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 263267; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 318797; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 334077; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 355958; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 626655; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 671645; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 745375; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 746439; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 749278; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 750075; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 783190; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 817979; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 849715; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1013942; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1081181; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1096907; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1099907; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1112054; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1139612; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1441209; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1445607; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1484914; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1565911; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1593336; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1734695; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1786849; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1850636; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1881106; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1956004; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2056870; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2071094; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2204981; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2212630; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2232249; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2283196; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2296159; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2296329; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2390671; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2435944; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2452438; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2476813; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2490758; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2500370; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2562339; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2563349; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2630911; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2653243; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2654346; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2695882; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2737237; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2768570; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2853569; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2952937; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2965209; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3047310; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3076141; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3105244; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3112671; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3115189; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 56954; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 102501; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 132103; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 589106; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 605688; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 818681; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 948450; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1096811; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1110975; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1162296; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1289982; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1342350; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1446400; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1461168; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1605749; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1693616; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1717763; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1780258; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1898699; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2024247; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2061639; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2142074; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2154719; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2226682; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2457874; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2578993; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2673225; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2702787; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2721784; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2745010; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2764281; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2845611; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2865254; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2868445; code bytes = 80303e:T87e,file/memory contains long string with (Indicator: " socket "; File: "select.pyd") Found reference to API "__WSAFDIsSet" (Indicator: "__wsafdisset"; File: "u4pak.exe") Found reference to API "WSAGetLastError" (Indicator: "wsagetlasterror"; File: "u4pak.exe") Found reference to API "used with a socket or two-way pipe." (Indicator: " socket "; Source: "00000000-00007844.00000000.265656.02C70000.00000004.mdmp, 00000000-00007844.00000000.265656.1E213000.00000004.mdmp") Found reference to API "WSAstartup" (Indicator: "wsastartup"; Source: "00000000-00007844.00000000.265656.10087000.00000002.mdmp") Found reference to API "gethostbyname" (Indicator: "gethostbyname"; Source: "00000000-00007844.00000000.265656.10087000.00000002.mdmp") Found reference to API "could not bind to the requested symbol name" (Indicator: " bind "; Source: "00000000-00007844.00000000.265656.10087000.00000002.mdmp") Found reference to API "WSAStartup" (Indicator: "wsastartup"; Source: "00000000-00007844.00000000.265656.10087000.00000002.mdmp") Found reference to API "unable to listen socket" (Indicator: " listen "; Source: "00000000-00007844.00000000.265656.10087000.00000002.mdmp") Found reference to API "unable to bind socket" (Indicator: " bind "; Source: "00000000-00007844.00000000.265656.10087000.00000002.mdmp") Found reference to API "no accept port specified" (Indicator: " accept "; Source: "00000000-00007844.00000000.265656.10087000.00000002.mdmp") Found reference to API "nbio connect error" (Indicator: " connect "; Source: "00000000-00007844.00000000.265656.10087000.00000002.mdmp") Found reference to API "gethostbyname addr is not af inet" (Indicator: "gethostbyname"; Source: "00000000-00007844.00000000.265656.10087000.00000002.mdmp") Found reference to API "error setting nbio on accept socket" (Indicator: " accept "; Source: "00000000-00007844.00000000.265656.10087000.00000002.mdmp") Found reference to API "WSASTARTUP" (Indicator: "wsastartup"; Source: "00000000-00007844.00000000.265656.10087000.00000002.mdmp") Found reference to API "BIO_gethostbyname" (Indicator: "gethostbyname"; Source: "00000000-00007844.00000000.265656.10087000.00000002.mdmp")3f:T829,Observed string: "lhash part of OpenSSL 1.0.1j 15 Oct 2014" (Indicator: "OpenSSL 1.") Observed string: "Stack part of OpenSSL 1.0.1j 15 Oct 2014" (Indicator: "OpenSSL 1.") Observed string: "Big Number part of OpenSSL 1.0.1j 15 Oct 2014" (Indicator: "OpenSSL 1.") Observed string: "ASN.1 part of OpenSSL 1.0.1j 15 Oct 2014" (Indicator: "OpenSSL 1.") Observed string: "SHA1 part of OpenSSL 1.0.1j 15 Oct 2014" (Indicator: "OpenSSL 1.") Observed string: "SHA-256 part of OpenSSL 1.0.1j 15 Oct 2014" (Indicator: "OpenSSL 1.") Observed string: "SHA-512 part of OpenSSL 1.0.1j 15 Oct 2014" (Indicator: "OpenSSL 1.") Observed string: "RIPE-MD160 part of OpenSSL 1.0.1j 15 Oct 2014" (Indicator: "OpenSSL 1.") Observed string: "SHA part of OpenSSL 1.0.1j 15 Oct 2014" (Indicator: "OpenSSL 1.") Observed string: "MD5 part of OpenSSL 1.0.1j 15 Oct 2014" (Indicator: "OpenSSL 1.") Observed string: "MD4 part of OpenSSL 1.0.1j 15 Oct 2014" (Indicator: "OpenSSL 1.") Observed string: "EC part of OpenSSL 1.0.1j 15 Oct 2014" (Indicator: "OpenSSL 1.") Observed string: "ECDSA part of OpenSSL 1.0.1j 15 Oct 2014" (Indicator: "OpenSSL 1.") Observed string: "DSA part of OpenSSL 1.0.1j 15 Oct 2014" (Indicator: "OpenSSL 1.") Observed string: "Diffie-Hellman part of OpenSSL 1.0.1j 15 Oct 2014" (Indicator: "OpenSSL 1.") Observed string: "RSA part of OpenSSL 1.0.1j 15 Oct 2014" (Indicator: "OpenSSL 1.") Observed string: "EVP part of OpenSSL 1.0.1j 15 Oct 2014" (Indicator: "OpenSSL 1.") Observed string: "ECDH part of OpenSSL 1.0.1j 15 Oct 2014" (Indicator: "OpenSSL 1.") Observed string: "AES part of OpenSSL 1.0.1j 15 Oct 2014" (Indicator: "OpenSSL 1.") Observed string: "RAND part of OpenSSL 1.0.1j 15 Oct 2014" (Indicator: "OpenSSL 1.") Observed string: "CONF part of OpenSSL 1.0.1j 15 Oct 2014" (Indicator: "OpenSSL 1.") Observed string: "X.509 part of OpenSSL 1.0.1j 15 Oct 2014" (Indicator: "OpenSSL 1.") Observed string: "CONF_def part of OpenSSL 1.0.1j 15 Oct 2014" (Indicator: "OpenSSL 1.") Observed string: "PEM part of OpenSSL 1.0.1j 15 Oct 2014" (Indicator: "OpenSSL 1.")40:T479,Found reference to API "CreateCompatibleBitmap" (Indicator: "CreateCompatibleBitmap"; File: "u4pak.exe") Found reference to API "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; File: "u4pak.exe") Found reference to API "BitBlt" (Indicator: "BitBlt"; File: "u4pak.exe") Found reference to API "CreateDCA" (Indicator: "CreateDC"; File: "u4pak.exe") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; File: "u4pak.exe") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; Source: "00000000-00007844.00000000.265656.10087000.00000002.mdmp") Found reference to API "BitBlt" (Indicator: "BitBlt"; Source: "00000000-00007844.00000000.265656.10087000.00000002.mdmp") Found reference to API "CreateCompatibleBitmap" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00007844.00000000.265656.10087000.00000002.mdmp") Found reference to API "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; Source: "00000000-00007844.00000000.265656.10087000.00000002.mdmp") Found reference to API "CreateDCA" (Indicator: "CreateDC"; Source: "00000000-00007844.00000000.265656.10087000.00000002.mdmp")41:T4fa,"u4pak.exe" called "FindFirstFileA" with parameter %TEMP%\_MEI50~1 (UID: 00000000-00007844) "u4pak.exe" called "FindFirstFileA" with parameter %TEMP%\_MEI50~1/*.* (UID: 00000000-00007844) "u4pak.exe" called "FindNextFileA" with parameter .. (UID: 00000000-00007844) "u4pak.exe" called "FindNextFileA" with parameter bz2.pyd (UID: 00000000-00007844) "u4pak.exe" called "FindNextFileA" with parameter Microsoft.VC90.CRT.manifest (UID: 00000000-00007844) "u4pak.exe" called "FindNextFileA" with parameter msvcm90.dll (UID: 00000000-00007844) "u4pak.exe" called "FindNextFileA" with parameter msvcp90.dll (UID: 00000000-00007844) "u4pak.exe" called "FindNextFileA" with parameter msvcr90.dll (UID: 00000000-00007844) "u4pak.exe" called "FindNextFileA" with parameter python27.dll (UID: 00000000-00007844) "u4pak.exe" called "FindNextFileA" with parameter select.pyd (UID: 00000000-00007844) "u4pak.exe" called "FindNextFileA" with parameter u4pak.exe.manifest (UID: 00000000-00007844) "u4pak.exe" called "FindNextFileA" with parameter unicodedata.pyd (UID: 00000000-00007844) "u4pak.exe" called "FindNextFileA" with parameter _hashlib.pyd (UID: 00000000-00007844) "u4pak.exe" called "FindFirstFileA" with parameter %TEMP%\_MEI50~1\encodings (UID: 00000000-00007844)42:Tf3e,Found string "Tries to import the AES module from PyCrypto." (Indicator: "aes"; Source: "00000000-00007844.00000000.265656.01020000.00000004.mdmp, 00000000-00007844.00000000.265656.029B0000.00000004.mdmp") Found string "PyCrypto 2.4 and 2.6 uses different name of the AES ext" (Indicator: "aes"; Source: "00000000-00007844.00000000.265656.01020000.00000004.mdmp") Found string "PyCrypto 2.4 and 2.6 uses different name of the AES extension." (Indicator: "aes"; Source: "00000000-00007844.00000000.265656.029B0000.00000004.mdmp") Found string "a zipfile, or to a specific path inside a zipfile. For example, it can be" (Indicator: "zipfile"; Source: "00000000-00007844.00000000.265656.029B0000.00000004.mdmp, 00000000-00007844.00000000.265656.1E20F000.00000004.mdmp") Found string "zipfile targeted." (Indicator: "zipfile"; Source: "00000000-00007844.00000000.265656.029B0000.00000004.mdmp, 00000000-00007844.00000000.265656.1E20F000.00000004.mdmp") Found string "_aes" (Indicator: "aes"; Source: "00000000-00007844.00000000.265656.029FC000.00000004.mdmp") Found string "_import_aesmod" (Indicator: "aes"; Source: "00000000-00007844.00000000.265656.029FC000.00000004.mdmp") Found string "Crypto.Cipher._AES" (Indicator: "aes"; Source: "00000000-00007844.00000000.265656.029FC000.00000004.mdmp") Found string "Crypto.Cipher.AES" (Indicator: "aes"; Source: "00000000-00007844.00000000.265656.029FC000.00000004.mdmp") Found string "encodings.base64_codec" (Indicator: "base64"; Source: "00000000-00007844.00000000.265656.029FC000.00000004.mdmp") Found string "base64" (Indicator: "base64"; Source: "00000000-00007844.00000000.265656.029FC000.00000004.mdmp") Found string "WSAESTALE" (Indicator: "aes"; Source: "00000000-00007844.00000000.265656.029FC000.00000004.mdmp, 00000000-00007844.00000000.265656.1E120000.00000002.mdmp") Found string "WSAESHUTDOWN" (Indicator: "aes"; Source: "00000000-00007844.00000000.265656.029FC000.00000004.mdmp, 00000000-00007844.00000000.265656.1E120000.00000002.mdmp") Found string "WSAESOCKTNOSUPPORT" (Indicator: "aes"; Source: "00000000-00007844.00000000.265656.029FC000.00000004.mdmp, 00000000-00007844.00000000.265656.1E120000.00000002.mdmp") Found string "e of the AES" (Indicator: "aes"; Source: "00000000-00007844.00000000.265656.02A50000.00000004.mdmp") Found string "r1.encrypted == r2.encrypted and \" (Indicator: ".encrypt"; Source: "00000000-00007844.00000000.265656.02B70000.00000004.mdmp") Found string "record_bytes = write_record(stream,fh,record.compression_method,record.encrypted,record.compression_block_size)" (Indicator: ".encrypt"; Source: "00000000-00007844.00000000.265656.02B70000.00000004.mdmp") Found string "elif name == 'user.u4pak.encrypted':" (Indicator: ".encrypt"; Source: "00000000-00007844.00000000.265656.02B70000.00000004.mdmp") Found string "return str(entry.record.encrypted).encode('ascii')" (Indicator: ".encrypt"; Source: "00000000-00007844.00000000.265656.02B70000.00000004.mdmp") Found string "'user.u4pak.encrypted']" (Indicator: ".encrypt"; Source: "00000000-00007844.00000000.265656.02B70000.00000004.mdmp") Found string "user.u4pak.encrypted" (Indicator: ".encrypt"; Source: "00000000-00007844.00000000.265656.02C70000.00000004.mdmp") Found string "base64_codec" (Indicator: "base64"; Source: "00000000-00007844.00000000.265656.02C70000.00000004.mdmp") Found string "ecdsa-with-SHA1" (Indicator: "ecdsa"; Source: "00000000-00007844.00000000.265656.02C70000.00000004.mdmp, 00000000-00007844.00000000.265656.10087000.00000002.mdmp") Found string "b2a_base64" (Indicator: "base64"; Source: "00000000-00007844.00000000.265656.02E70000.00000004.mdmp, 00000000-00007844.00000000.265656.1E120000.00000002.mdmp") Found string "a2b_base64" (Indicator: "base64"; Source: "00000000-00007844.00000000.265656.02E70000.00000004.mdmp, 00000000-00007844.00000000.265656.1E120000.00000002.mdmp")43:T624,Found string "password based MAC" (Indicator: "password"; Source: "00000000-00007844.00000000.265656.10087000.00000002.mdmp") Found string "secretary" (Indicator: "secret"; Source: "00000000-00007844.00000000.265656.10087000.00000002.mdmp") Found string "secretBag" (Indicator: "secret"; Source: "00000000-00007844.00000000.265656.10087000.00000002.mdmp") Found string "no password" (Indicator: "password"; Source: "00000000-00007844.00000000.265656.10087000.00000002.mdmp") Found string "CMS_RecipientInfo_set0_password" (Indicator: "password"; Source: "00000000-00007844.00000000.265656.10087000.00000002.mdmp") Found string "CMS_decrypt_set1_password" (Indicator: "password"; Source: "00000000-00007844.00000000.265656.10087000.00000002.mdmp") Found string "CMS_add0_recipient_password" (Indicator: "password"; Source: "00000000-00007844.00000000.265656.10087000.00000002.mdmp") Found string "bad password read" (Indicator: "password"; Source: "00000000-00007844.00000000.265656.10087000.00000002.mdmp") Found string "problems getting password" (Indicator: "password"; Source: "00000000-00007844.00000000.265656.10087000.00000002.mdmp") Found string "password" (Indicator: "password"; Source: "00000000-00007844.00000000.265656.10087000.00000002.mdmp") Found string "password is too long." (Indicator: "password"; Source: "00000000-00007844.00000000.265656.10087000.00000002.mdmp") Found string "pbkdf2_hmac(hash_name, password, salt, iterations, dklen=None) -> key" (Indicator: "password"; Source: "00000000-00007844.00000000.265656.100B6000.00000004.mdmp")44:Ta3a,Found string "\Device\HarddiskVolume3\Windows\System32\conhost.exe" (Indicator: "\Device\"; Source: "00000000-00005060-00000BC0-3112898400") Found string "\Device\HarddiskVolume3\u4pak.exe" (Indicator: "\Device\"; Source: "00000000-00005060-00000BC0-3114750750") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00005060.00000000.265525.00850000.00000004.mdmp, 00000000-00005060.00000000.265525.00870000.00000004.mdmp, 00000000-00005060.00000001.265663.00850000.00000004.mdmp, 00000000-00005060.00000001.265663.00870000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00005060.00000000.265525.00850000.00000004.mdmp, 00000000-00005060.00000000.265525.00870000.00000004.mdmp, 00000000-00005060.00000001.265663.00850000.00000004.mdmp, 00000000-00005060.00000001.265663.00870000.00000004.mdmp") Found string "\Device\HarddiskVolume3\u4pak.exe" (Indicator: "\Device\"; Source: "00000000-00005060.00000000.265525.00870000.00000004.mdmp, 00000000-00005060.00000001.265663.00870000.00000004.mdmp") Found string "em32\Drivers\DriT" (Indicator: "\drivers\"; Source: "00000000-00005060.00000000.265525.00870000.00000004.mdmp, 00000000-00005060.00000001.265663.00870000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00007844.00000000.265656.00990000.00000004.mdmp, 00000000-00007844.00000000.265656.01020000.00000004.mdmp, 00000000-00007844.00000000.265656.02B10000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00007844.00000000.265656.00990000.00000004.mdmp, 00000000-00007844.00000000.265656.01020000.00000004.mdmp, 00000000-00007844.00000000.265656.02B10000.00000004.mdmp") Found string "\Device\HarddiskVolume3\u4pak.exe" (Indicator: "\Device\"; Source: "00000000-00007844.00000000.265656.00990000.00000004.mdmp") Found string "indows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00007844.00000000.265656.00990000.00000004.mdmp") Found string "indows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00007844.00000000.265656.00990000.00000004.mdmp") Found string "C:\Windows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00007844.00000000.265656.029B0000.00000004.mdmp") Found string "C:\Windows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00007844.00000000.265656.029B0000.00000004.mdmp")45:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAZmZniId3dwAAAAAAAAAARmZmaIiIiIiIiIh2ZERAAEZmZmiIiIiIiIiId3d3ZABGZmZoiIiIiIiIiHd3d3YARmZmeIiIiIiIiIh3d3d0AGZmZniIiIiIiIiId3d3dABmZmZ4iIiIiIiIiHd3d3QAZmZmeIiIiIiIiIh3d3dkAGZmZniIiIiIiIiId3d3YABmZmZ3d3d4iIiIiHd3d2AAZmZmd3d3d3d3d3d3d3dgBGYBMzMwRmZnd3d3d3d3YARnO7u7swAAAAAARmZnd2AEe7u7u7uwAAAAB3AAAGdgBHu7u7u7swAAAAD3AABnYAY7u7u7u7MAAAAAf3AAZkAGO7u7u7uzAAAAAAfwAGZABju7u7u7swAAAAAIgABmQAY7u7u7u7MAAAAH9wAAZgAGO7u7u7u7u7sAB3AAAGYABju7u7u7uzO7AAAAAABmAAY7u7u7u7sAOwAAAAAAZgBGO7u7u7u7M7sAAAAABGYARzu7u7u7u7uzAAAAAARmAEc7u7u7u7uzMAAAAAAGZgBnO7u7u7EAAAAAAAAABmQAZzu7u7uwAAAAAAAAAAZkAEY7u7u7sAAAAAAAAAAGZAAAO7u7u7AAAAAAAAAABmAAADu7u7szAEREAAAAAAZgAAADM7szMAAAAAAAAEREQADgAAAH4AAAB8AAAAHAAAAAwAAAAMAAAADAAAAAwAAAAMAAAADAAAABwAAAAcAAAAGAAAABgAAAAYAAAAGAAAABgAAAAYAAAAGAAAABgAAAA4AAAAOAAAADgAAAAwAAAAMAAAADAAAAAwAAAAMAAAADAAAAA8AAAAfADAAH4B//Bw==1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"d76edf3f3b00efb1a4d382f04ac9fa3275fdb3d77737f16e024635a269c0d9af","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790991504092,"unified_at":"2026-10-03T01:38:24.092Z","metadata":{"hashes":{"sha256":"d76edf3f3b00efb1a4d382f04ac9fa3275fdb3d77737f16e024635a269c0d9af","sha1":"6f36c432d2909c33dff648ef7b137fd96d5efc08","md5":"0b6bd2c1870ccaac9eb028bd417d6939","sha512":"451c48aae2bde5e4a3cbce01f98cfc895f9677ae423f8e747a4541c67f1c970f77241470aae06ff4fd0711a1e1ff39aab0c00855c1ef7679cc87e232a3ae2bda","ssdeep":"98304:Ytfs39A+lPLeqNZ8hY/AGDnqiv18VQJ4TJlQ/pWDJ:cmPlPKQ8hY/A2rv18qJcIpm","ssdeep_chunks":["98304:Ytfs39A","98304:tfs39A+","98304:fs39A+l","98304:s39A+lP","98304:39A+lPL","98304:9A+lPLe","98304:A+lPLeq","98304:+lPLeqN","98304:lPLeqNZ","98304:PLeqNZ8","98304:LeqNZ8h","98304:eqNZ8hY","98304:qNZ8hY/","98304:NZ8hY/A","98304:Z8hY/AG","98304:8hY/AGD","98304:hY/AGDn","98304:Y/AGDnq","98304:/AGDnqi","98304:AGDnqiv","98304:GDnqiv1","98304:Dnqiv18","98304:nqiv18V","98304:qiv18VQ","98304:iv18VQJ","98304:v18VQJ4","98304:18VQJ4T","98304:8VQJ4TJ","98304:VQJ4TJl","98304:QJ4TJlQ","98304:J4TJlQ/","98304:4TJlQ/p","98304:TJlQ/pW","98304:JlQ/pWD","98304:lQ/pWDJ","196608:Ytfs39A","196608:tfs39A+","196608:fs39A+l","196608:s39A+lP","196608:39A+lPL","196608:9A+lPLe","196608:A+lPLeq","196608:+lPLeqN","196608:lPLeqNZ","196608:PLeqNZ8","196608:LeqNZ8h","196608:eqNZ8hY","196608:qNZ8hY/","196608:NZ8hY/A","196608:Z8hY/AG","196608:8hY/AGD","196608:hY/AGDn","196608:Y/AGDnq","196608:/AGDnqi","196608:AGDnqiv","196608:GDnqiv1","196608:Dnqiv18","196608:nqiv18V","196608:qiv18VQ","196608:iv18VQJ","196608:v18VQJ4","196608:18VQJ4T","196608:8VQJ4TJ","196608:VQJ4TJl","196608:QJ4TJlQ","196608:J4TJlQ/","196608:4TJlQ/p","196608:TJlQ/pW","196608:JlQ/pWD","196608:lQ/pWDJ","98304:cmPlPKQ","98304:mPlPKQ8","98304:PlPKQ8h","98304:lPKQ8hY","98304:PKQ8hY/","98304:KQ8hY/A","98304:Q8hY/A2","98304:8hY/A2r","98304:hY/A2rv","98304:Y/A2rv1","98304:/A2rv18","98304:A2rv18q","98304:2rv18qJ","98304:rv18qJc","98304:v18qJcI","98304:18qJcIp","98304:8qJcIpm"],"imphash":"7d03a66a3630475a0f63630fa4e99a1c"},"file_info":{"file_name":"u4pak.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":3175772,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1499293194000,"last_seen":1773629633000,"last_multi_scan":1773629633000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["exploit","banker","delf","mofksys","neshta"]},"stats":{"av":{"malicious_count":3,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":68},"sandbox_signatures":{"informative_count":172,"suspicious_count":24,"malicious_count":5,"total":201},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"malicious","threat_name":"Malware_-10","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"undetected","status":"clean","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/S-1c56a407!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware_56.0","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Malware_56.0","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Able to inject code into another process (API string)"},{"type":"suspicious","value":"Spawned processes likely due to injection"},{"type":"malicious","value":"Writes data to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"615657c0909b966fb2172bc2"},{"report_type":"sandbox","report_id":"6635a2903df24f56a507882e"},{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"suspicious","value":"Opens file with deletion access rights"},{"type":"informative","value":"Contains ability to delete files/directories (API string)"},{"type":"suspicious","value":"Process deletes itself"},{"type":"suspicious","value":"Marks file for deletion"}],"sources":[{"report_type":"sandbox","report_id":"615657c0909b966fb2172bc2"},{"report_type":"sandbox","report_id":"6635a2903df24f56a507882e"},{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"},{"type":"suspicious","value":"PE file has unusual entropy sections"},{"type":"suspicious","value":"PE file has unusual entropy resources"}],"sources":[{"report_type":"sandbox","report_id":"615657c0909b966fb2172bc2"},{"report_type":"sandbox","report_id":"6635a2903df24f56a507882e"},{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"tactic":"Credential Access","technique":"Credential API Hooking","attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","identifiers":[{"type":"suspicious","value":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"615657c0909b966fb2172bc2"}]},{"tactic":"Discovery","technique":"Peripheral Device Discovery","attack_id":"T1120","attack_id_wiki":"https://attack.mitre.org/techniques/T1120","identifiers":[{"type":"informative","value":"Queries volume information"}],"sources":[{"report_type":"sandbox","report_id":"615657c0909b966fb2172bc2"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"suspicious","value":"Reads information about supported languages"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Able to query registry keys (API string)"},{"type":"informative","value":"Found registry location strings in memory"}],"sources":[{"report_type":"sandbox","report_id":"615657c0909b966fb2172bc2"},{"report_type":"sandbox","report_id":"6635a2903df24f56a507882e"},{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"tactic":"Lateral Movement","technique":"Remote Desktop Protocol","attack_id":"T1021.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1021/001","identifiers":[{"type":"suspicious","value":"Reads terminal service related keys (often RDP related)"}],"sources":[{"report_type":"sandbox","report_id":"615657c0909b966fb2172bc2"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Found Native API in Dotnet file"},{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Imports GetCommandLine API"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to dynamically load libraries"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Input file contains API references not part of its Import Address Table (IAT)"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Contains ability to create a new process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6635a2903df24f56a507882e"},{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"}],"sources":[{"report_type":"sandbox","report_id":"6635a2903df24f56a507882e"},{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"tactic":"Execution","technique":"Python","attack_id":"T1059.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/006","identifiers":[{"type":"informative","value":"PyInstaller file activity detected"}],"sources":[{"report_type":"sandbox","report_id":"6635a2903df24f56a507882e"},{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"},{"type":"informative","value":"Able to retrieve command line parameters of the running process"},{"type":"informative","value":"Able to import GetCommandLine API, which retrieves the command line string for the current process"}],"sources":[{"report_type":"sandbox","report_id":"6635a2903df24f56a507882e"},{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"tactic":"Persistence","technique":"DLL Search Order Hijacking","attack_id":"T1574.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/001","identifiers":[{"type":"informative","value":"Potential hijacking of DLL execution flow detected"}],"sources":[{"report_type":"sandbox","report_id":"6635a2903df24f56a507882e"},{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Creates or modifies windows services"},{"type":"informative","value":"Contains ability to access device drivers"}],"sources":[{"report_type":"sandbox","report_id":"6635a2903df24f56a507882e"},{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"suspicious","value":"Contains ability to retrieve the contents of the STARTUPINFO structure"},{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6635a2903df24f56a507882e"},{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6635a2903df24f56a507882e"},{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"6635a2903df24f56a507882e"},{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"tactic":"Privilege Escalation","technique":"Thread Local Storage","attack_id":"T1055.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/005","sources":[{"report_type":"sandbox","report_id":"6635a2903df24f56a507882e"},{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to set file time (API string)"},{"type":"informative","value":"Contains ability to query local/system time as file time"},{"type":"informative","value":"Contains ability to retrieve file time (API string)"},{"type":"suspicious","value":"Calls an API typically used to query local/system time as file time"}],"sources":[{"report_type":"sandbox","report_id":"6635a2903df24f56a507882e"},{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"},{"type":"informative","value":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)"},{"type":"informative","value":"Contains ability to check debugger is running (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6635a2903df24f56a507882e"},{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"PE file contains zero-size sections"},{"type":"suspicious","value":"Uses Windows cryptography API for obfuscation"},{"type":"informative","value":"YARA signature match - Djb2 Hash Algorithm"},{"type":"informative","value":"Sample file has high entropy (likely encrypted/compressed content)"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Contains key cryptographic functions (API string)"},{"type":"informative","value":"Contains ability to perform AES/RC4 encryption (API string)"},{"type":"informative","value":"YARA signature match - AES encryption"},{"type":"informative","value":"PE file contains zero-sized sections"},{"type":"informative","value":"YARA signature match - RSA algorithm (keys)"},{"type":"suspicious","value":"CRC value set in PE header does not match actual value"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"YARA signature match - AES Encryption"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"informative","value":"Contains CRYPTO related strings"}],"sources":[{"report_type":"sandbox","report_id":"6635a2903df24f56a507882e"},{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"informative","value":"Contains ability to delay the execution of current thread"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6635a2903df24f56a507882e"},{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Contains ability to modify registry key/value (API string)"},{"type":"informative","value":"Able to delete registry key/value (API string)"},{"type":"suspicious","value":"Writes registry keys"},{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Able to create/load registry keys (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6635a2903df24f56a507882e"},{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"tactic":"Defense Evasion","technique":"Dynamic API Resolution","attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","identifiers":[{"type":"informative","value":"Contains ability to dynamically determine API calls"}],"sources":[{"report_type":"sandbox","report_id":"6635a2903df24f56a507882e"},{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"},{"type":"informative","value":"XOR operations in executable file detected"}],"sources":[{"report_type":"sandbox","report_id":"6635a2903df24f56a507882e"},{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6635a2903df24f56a507882e"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","sources":[{"report_type":"sandbox","report_id":"6635a2903df24f56a507882e"},{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Able to load content into memory (.NET)"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"6635a2903df24f56a507882e"},{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"},{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"6635a2903df24f56a507882e"},{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Calls an API typically used for searching a directory for files"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Contains references to file movement (imports API)"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Able to rename or move file/directory (API string)"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Calls an API's typically used for searching a directory for a files"},{"type":"informative","value":"Touches files"}],"sources":[{"report_type":"sandbox","report_id":"6635a2903df24f56a507882e"},{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Able to query volume/memory size (API string)"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Found system command-related strings"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Contains ability to retrieve data about the local computer (API string)"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Contains ability to find logical drives of the machine (API string)"},{"type":"informative","value":"Contains ability to determine disk drive type (API string)"},{"type":"informative","value":"Contains ability to retrieve information about the current system (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6635a2903df24f56a507882e"},{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"suspicious","value":"Queries process information"},{"type":"informative","value":"Contains ability to retrieve/open a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6635a2903df24f56a507882e"},{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve local language"},{"type":"informative","value":"Able to query system locale information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6635a2903df24f56a507882e"},{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Able to retrieve date formats supported by the local system (API string)"},{"type":"informative","value":"Contains ability to retrieve machine timezone (API string)"},{"type":"informative","value":"Contains ability to query machine time"},{"type":"informative","value":"Contains ability to retrieve machine time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6635a2903df24f56a507882e"},{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6635a2903df24f56a507882e"},{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"6635a2903df24f56a507882e"},{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"informative","value":"Found E-Mail address in binary/memory"},{"type":"suspicious","value":"Found a potential E-Mail address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"6635a2903df24f56a507882e"},{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Contains ability to capture screen (API string)"},{"type":"informative","value":"Able to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6635a2903df24f56a507882e"},{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"Writes files in a temp directory"}],"sources":[{"report_type":"sandbox","report_id":"6635a2903df24f56a507882e"},{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Found potential URLs in memory dumps"}],"sources":[{"report_type":"sandbox","report_id":"6635a2903df24f56a507882e"},{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Drops executable files inside temp directory"},{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Drops XML files"},{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"suspicious","value":"Writes a PE file header to disc"},{"type":"suspicious","value":"Drops executable files"}],"sources":[{"report_type":"sandbox","report_id":"6635a2903df24f56a507882e"},{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Making HTTPS connections using secure TLS/SSL version"},{"type":"informative","value":"Able to use Microsoft's Enhanced Cryptographic Provider"}],"sources":[{"report_type":"sandbox","report_id":"6635a2903df24f56a507882e"},{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"},{"type":"informative","value":"Contains ability to use AES encryption instructions"}],"sources":[{"report_type":"sandbox","report_id":"6635a2903df24f56a507882e"},{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6635a2903df24f56a507882e"},{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"suspicious","value":"Contains ability to terminate a process"},{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Calls an API used to open a process handle"},{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6635a2903df24f56a507882e"},{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"tactic":"Reconnaissance","technique":"Gather Victim Network Information","attack_id":"T1590","attack_id_wiki":"https://attack.mitre.org/techniques/T1590","identifiers":[{"type":"informative","value":"Able to access user sensitive domain"}],"sources":[{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Contains ability to create/connect to a named pipe (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Able to modify thread functionality – possible hijack (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"tactic":"Defense Evasion","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"tactic":"Defense Evasion","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"suspicious","value":"Section contains high entropy"}],"sources":[{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Contains ability to detect virtual environment (API)"},{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"}],"sources":[{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"tactic":"Defense Evasion","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Found virtual disk drive like strings"}],"sources":[{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Contains ability to retrieve usernames and/or user information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Contains ability to free the memory used by network management functions (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Contains ability to move file or directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"tactic":"Collection","technique":"Archive via Library","attack_id":"T1560.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1560/002","identifiers":[{"type":"informative","value":"Able to compress/decompress content at runtime"}],"sources":[{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Contains SQL queries"}],"sources":[{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"tactic":"Collection","technique":"Automated Collection","attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","identifiers":[{"type":"informative","value":"Shows ability to send encrypted data to the internet"}],"sources":[{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"informative","value":"Contains ability to communicate with C2 using Sockets (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"tactic":"Command and Control","technique":"Standard Encoding","attack_id":"T1132.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1132/001","identifiers":[{"type":"informative","value":"Contains ability to attach base64 encoded attachment to an email"}],"sources":[{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"tactic":"Command and Control","technique":"Mail Protocols","attack_id":"T1071.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/003","identifiers":[{"type":"informative","value":"Found mail related domain names"}],"sources":[{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","identifiers":[{"type":"informative","value":"References OpenSSL library string"}],"sources":[{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"Contains ability to perform Base64 encoding/decoding"}],"sources":[{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains reference to cryptographic keys"}],"sources":[{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Reverse Engineering","name":"PE file contains zero-size sections","description":"Raw size of \".bss\" is zero","origin":"Static Parser","relevance":10,"id":"static-5","sources":[{"report_type":"sandbox","report_id":"615657c0909b966fb2172bc2"},{"report_type":"sandbox","report_id":"6635a2903df24f56a507882e"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"$27","origin":"API Call","mitre_attack_id":"T1120","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"615657c0909b966fb2172bc2"},{"report_type":"sandbox","report_id":"57881a97aac2ede1431ab690"},{"report_type":"sandbox","report_id":"6635a2903df24f56a507882e"},{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"level":"informative","category":"General","name":"Creates a writable file in a temporary directory","description":"\"u4pak.exe\" created file \"%TEMP%\\_MEI29802\\Microsoft.VC90.CRT.manifest\"\n \"u4pak.exe\" created file \"%TEMP%\\_MEI29802\\_hashlib.pyd\"\n \"u4pak.exe\" created file \"%TEMP%\\_MEI29802\\bz2.pyd\"\n \"u4pak.exe\" created file \"%TEMP%\\_MEI29802\\msvcm90.dll\"\n \"u4pak.exe\" created file \"%TEMP%\\_MEI29802\\msvcp90.dll\"\n \"u4pak.exe\" created file \"%TEMP%\\_MEI29802\\msvcr90.dll\"\n \"u4pak.exe\" created file \"%TEMP%\\_MEI29802\\python27.dll\"\n \"u4pak.exe\" created file \"%TEMP%\\_MEI29802\\select.pyd\"\n \"u4pak.exe\" created file \"%TEMP%\\_MEI29802\\u4pak.exe.manifest\"\n \"u4pak.exe\" created file \"%TEMP%\\_MEI29802\\unicodedata.pyd\"","origin":"API Call","relevance":1,"id":"api-4","sources":[{"report_type":"sandbox","report_id":"615657c0909b966fb2172bc2"},{"report_type":"sandbox","report_id":"57881a97aac2ede1431ab690"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"$28","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"615657c0909b966fb2172bc2"},{"report_type":"sandbox","report_id":"57881a97aac2ede1431ab690"},{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"u4pak.exe\" (UID: 00000000-00003276) was launched with new environment variables: \"PROCESSOR_ARCHITEW6432=\"AMD64\", _MEIPASS2=\"%TEMP%\\_MEI29802\"\"\n Process \"u4pak.exe\" (UID: 00000000-00003276) was launched with modified environment variables: \"CommonProgramFiles, PROCESSOR_ARCHITECTURE, ProgramFiles\"","origin":"Monitored Target","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"615657c0909b966fb2172bc2"},{"report_type":"sandbox","report_id":"6635a2903df24f56a507882e"},{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"u4pak.exe\" (UID: 00000000-00003276)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"615657c0909b966fb2172bc2"},{"report_type":"sandbox","report_id":"57881a97aac2ede1431ab690"},{"report_type":"sandbox","report_id":"6635a2903df24f56a507882e"},{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"u4pak.exe\" (UID: 00000000-00003276)","origin":"Monitored Target","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"615657c0909b966fb2172bc2"},{"report_type":"sandbox","report_id":"6635a2903df24f56a507882e"},{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"\"msvcp90.dll\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"\n \"python27.dll\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"\n \"msvcr90.dll\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"\n \"msvcm90.dll\" has type \"PE32 executable (DLL) (GUI) Intel 80386 Mono/.Net assembly for MS Windows\"\n \"Microsoft.VC90.CRT.manifest\" has type \"XML 1.0 document ASCII text with CRLF line terminators\"\n \"_hashlib.pyd\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"\n \"unicodedata.pyd\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"\n \"u4pak.exe.manifest\" has type \"XML 1.0 document ASCII text with CRLF line terminators\"\n \"bz2.pyd\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"\n \"select.pyd\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"615657c0909b966fb2172bc2"},{"report_type":"sandbox","report_id":"57881a97aac2ede1431ab690"},{"report_type":"sandbox","report_id":"6635a2903df24f56a507882e"},{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"\"u4pak.exe\" touched file \"%WINDIR%\\SysWOW64\\tzres.dll\"","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"615657c0909b966fb2172bc2"},{"report_type":"sandbox","report_id":"57881a97aac2ede1431ab690"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"msvcp90.dll\" was detected as \"Visual C++ 2005 DLL -> Microsoft\"\n \"python27.dll\" was detected as \"Visual C++ 2005 DLL -> Microsoft\"\n \"msvcr90.dll\" was detected as \"Visual C++ 2005 DLL -> Microsoft\"\n \"_hashlib.pyd\" was detected as \"Visual C++ 2005 DLL -> Microsoft\"\n \"unicodedata.pyd\" was detected as \"Visual C++ 2005 DLL -> Microsoft\"\n \"bz2.pyd\" was detected as \"Visual C++ 2005 DLL -> Microsoft\"\n \"select.pyd\" was detected as \"Visual C++ 2005 DLL -> Microsoft\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"615657c0909b966fb2172bc2"},{"report_type":"sandbox","report_id":"6635a2903df24f56a507882e"},{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Process deletes itself","description":"\"C:\\u4pak.exe\" deletes itself","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-27","sources":[{"report_type":"sandbox","report_id":"615657c0909b966fb2172bc2"},{"report_type":"sandbox","report_id":"6635a2903df24f56a507882e"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":".rdata\n .rsrc with unusual entropies 7.01949078592\n 7.29705940517","origin":"Static Parser","relevance":10,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"615657c0909b966fb2172bc2"},{"report_type":"sandbox","report_id":"57881a97aac2ede1431ab690"},{"report_type":"sandbox","report_id":"6635a2903df24f56a507882e"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"\"msvcp90.dll\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"\n \"python27.dll\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"\n \"msvcr90.dll\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"\n \"msvcm90.dll\" has type \"PE32 executable (DLL) (GUI) Intel 80386 Mono/.Net assembly for MS Windows\"\n \"_hashlib.pyd\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"\n \"unicodedata.pyd\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"\n \"bz2.pyd\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"\n \"select.pyd\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"","origin":"Binary File","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"615657c0909b966fb2172bc2"},{"report_type":"sandbox","report_id":"57881a97aac2ede1431ab690"},{"report_type":"sandbox","report_id":"6635a2903df24f56a507882e"},{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"Potential IP \"1.0.0.0\" found in string \"\"","origin":"File/Memory","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"615657c0909b966fb2172bc2"},{"report_type":"sandbox","report_id":"57881a97aac2ede1431ab690"}]},{"level":"suspicious","category":"Remote Access Related","name":"Reads terminal service related keys (often RDP related)","description":"\"u4pak.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TERMINAL SERVER\"; Key: \"TSUSERENABLED\")\n \"u4pak.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TERMINAL SERVER\"; Key: \"TSAPPCOMPAT\")","origin":"Registry Access","mitre_attack_id":"T1021.001","relevance":10,"id":"registry-61","sources":[{"report_type":"sandbox","report_id":"615657c0909b966fb2172bc2"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"$29","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"615657c0909b966fb2172bc2"},{"report_type":"sandbox","report_id":"57881a97aac2ede1431ab690"},{"report_type":"sandbox","report_id":"6635a2903df24f56a507882e"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"$2a","origin":"API Call","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"615657c0909b966fb2172bc2"},{"report_type":"sandbox","report_id":"57881a97aac2ede1431ab690"},{"report_type":"sandbox","report_id":"6635a2903df24f56a507882e"},{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"d76edf3f3b00efb1a4d382f04ac9fa3275fdb3d77737f16e024635a269c0d9af.bin\" claimed CRC 153498 while the actual is CRC 3219872\n \"python27.dll\" claimed CRC 2473013 while the actual is CRC 622740\n \"msvcr90.dll\" claimed CRC 675255 while the actual is CRC 2461933\n \"msvcm90.dll\" claimed CRC 253278 while the actual is CRC 675255","origin":"Static Parser","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"615657c0909b966fb2172bc2"},{"report_type":"sandbox","report_id":"57881a97aac2ede1431ab690"},{"report_type":"sandbox","report_id":"6635a2903df24f56a507882e"},{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"GetModuleFileNameW\n GetTickCount\n VirtualProtect\n LoadLibraryA\n GetCommandLineW\n UnhandledExceptionFilter\n LoadLibraryExW\n GetStartupInfoW\n GetProcAddress\n GetModuleHandleA\n GetTempPathW\n TerminateProcess\n CreateProcessW\n Sleep\n IsDebuggerPresent\n RegDeleteKeyA\n RegCloseKey\n RegDeleteValueA\n RegCreateKeyExA\n RegOpenKeyExA\n RegCreateKeyA\n RegEnumKeyExA\n GetFileAttributesA\n FindFirstFileW\n GetFileAttributesW\n OutputDebugStringW\n OutputDebugStringA\n GetModuleFileNameA\n LoadLibraryExA\n GetVersionExA\n GetFileSize\n OpenProcess\n CreateDirectoryA\n DeleteFileA\n CreateDirectoryW\n DeleteFileW\n FindNextFileW\n CreateFileMappingA\n FindNextFileA\n CreateFileW\n CreateFileA\n MapViewOfFile\n FindFirstFileA\n GetModuleHandleW\n GetFileAttributesExW\n CreateProcessA\n GetFileAttributesExA\n ShellExecuteW\n ShellExecuteA\n GetDriveTypeW\n GetDriveTypeA\n WriteFile\n CreateThread\n ExitThread\n LoadLibraryW\n GetStartupInfoA\n GetCommandLineA\n VirtualAlloc","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"615657c0909b966fb2172bc2"},{"report_type":"sandbox","report_id":"57881a97aac2ede1431ab690"},{"report_type":"sandbox","report_id":"6635a2903df24f56a507882e"},{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"\"u4pak.exe\" wrote bytes \"711186017a3b8501ab8b02007f950200fc8c0200729602006cc805001ecd82017d268201\" to virtual address \"0x762F07E4\" (part of module \"USER32.DLL\")\n \"u4pak.exe\" wrote bytes \"c0dfaf771cf9ae77ccf8ae770d64b07700000000c011267700000000fc3e267700000000e0132677000000009457507625e0af77c6e0af7700000000bc6a4f7600000000cf3126770000000093195076000000002c32267700000000\" to virtual address \"0x770F1000\" (part of module \"NSI.DLL\")","origin":"Hook Detection","mitre_attack_id":"T1056.004","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"615657c0909b966fb2172bc2"},{"report_type":"sandbox","report_id":"57881a97aac2ede1431ab690"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"u4pak.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")\n \"u4pak.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"u4pak.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"u4pak.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"615657c0909b966fb2172bc2"},{"report_type":"sandbox","report_id":"57881a97aac2ede1431ab690"},{"report_type":"sandbox","report_id":"6635a2903df24f56a507882e"},{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Timestamp in PE header is very old or in the future","description":"\"d76edf3f3b00efb1a4d382f04ac9fa3275fdb3d77737f16e024635a269c0d9af.bin\" claims program is from Thu Mar 3 07:29:51 2022","origin":"Static Parser","relevance":10,"id":"static-3","sources":[{"report_type":"sandbox","report_id":"615657c0909b966fb2172bc2"},{"report_type":"sandbox","report_id":"57881a97aac2ede1431ab690"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted Antivirus engine","description":"No specific details available","origin":"External System","relevance":5,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"615657c0909b966fb2172bc2"},{"report_type":"sandbox","report_id":"57881a97aac2ede1431ab690"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"6/69 Antivirus vendors marked sample as malicious (8% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"615657c0909b966fb2172bc2"},{"report_type":"sandbox","report_id":"57881a97aac2ede1431ab690"},{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"level":"malicious","category":"General","name":"The analysis spawned a process that was identified as malicious","description":"6/69 Antivirus vendors marked spawned process \"u4pak.exe\" (PID: 3276) as malicious (classified as \"Exploit.Python\" with 8% detection rate)","origin":"Monitored Target","relevance":10,"id":"target-58","sources":[{"report_type":"sandbox","report_id":"615657c0909b966fb2172bc2"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"\"u4pak.exe\" wrote 32 bytes to a remote process \"C:\\u4pak.exe\" (Handle: 136)\n \"u4pak.exe\" wrote 52 bytes to a remote process \"C:\\u4pak.exe\" (Handle: 136)\n \"u4pak.exe\" wrote 4 bytes to a remote process \"C:\\u4pak.exe\" (Handle: 136)\n \"u4pak.exe\" wrote 8 bytes to a remote process \"C:\\u4pak.exe\" (Handle: 136)","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"615657c0909b966fb2172bc2"},{"report_type":"sandbox","report_id":"6635a2903df24f56a507882e"},{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetSystemTimeAsFileTime@KERNEL32.DLL at 00023820-00003184-57073-2-00409E80\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00023820-00003184-64085-2-00409E80\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00024165-00002960-5684-2-00409E80\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00024165-00002960-11772-2-00409E80","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"57881a97aac2ede1431ab690"},{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Sets the process error mode to suppress error box","description":"\"\" set its error mode to SEM_NOOPENFILEERRORBOX","origin":"API Call","relevance":8,"id":"api-38","sources":[{"report_type":"sandbox","report_id":"57881a97aac2ede1431ab690"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.dll at 47507-5-004014F0\n SetUnhandledExceptionFilter@KERNEL32.dll at 47507-369-00409F30\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00023820-00003184-57073-1-004014F0\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00023820-00003184-57073-123-00409F30\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00023820-00003184-64085-124-00409F30\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00023820-00003184-64085-1-004014F0\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00024165-00002960-5684-123-00409F30\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00024165-00002960-5684-1-004014F0\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00024165-00002960-11772-123-00409F30\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00024165-00002960-11772-1-004014F0","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"57881a97aac2ede1431ab690"},{"report_type":"sandbox","report_id":"6635a2903df24f56a507882e"},{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"level":"malicious","category":"Installation/Persistance","name":"Writes a PE file header to disc","description":"$2b","origin":"API Call","relevance":1,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"57881a97aac2ede1431ab690"},{"report_type":"sandbox","report_id":"6635a2903df24f56a507882e"},{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"Found reference to API \"WaitForSingleObject\" (Indicator: \"WaitForSingleObject\"; File: \"u4pak.exe\")\n Found reference to API \"WaitForSingleObject\" (Indicator: \"WaitForSingleObject\"; Source: \"00000000-00001364.00000000.193495.0041D000.00000004.mdmp\")","origin":"File/Memory","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"6635a2903df24f56a507882e"},{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"u4pak.exe\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; File: \"u4pak.exe\")\n Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00001364.00000000.193495.0041D000.00000004.mdmp\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00001364.00000000.193495.0041D000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"6635a2903df24f56a507882e"},{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to pass information to a window procedure (API string)","description":"Found reference to API \"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00001364.00000000.193495.02D00000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"6635a2903df24f56a507882e"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"u4pak.exe\")\n Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"u4pak.exe\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"6635a2903df24f56a507882e"},{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"u4pak.exe\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"u4pak.exe\")\n Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"u4pak.exe\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-148","sources":[{"report_type":"sandbox","report_id":"6635a2903df24f56a507882e"},{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"Assembly shows XOR instruction xor ebx\n 01h in Stream UID: 1691-5-004014F0","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"6635a2903df24f56a507882e"},{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"level":"informative","category":"Cryptographic Related","name":"Sample file has high entropy (likely encrypted/compressed content)","description":"Sample file \"sample.bin\" has high entropy 7.992184622669953","origin":"Binary File","mitre_attack_id":"T1027","relevance":1,"id":"binary-71","sources":[{"report_type":"sandbox","report_id":"6635a2903df24f56a507882e"},{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: YARA signature match - AES Encryption","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6635a2903df24f56a507882e"},{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: YARA signature match - AES Encryption\n Matched sigs: Sample file has high entropy (likely encrypted/compressed content)","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6635a2903df24f56a507882e"},{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: YARA signature match - AES Encryption\n Matched sigs: Found potential URL in binary/memory","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"6635a2903df24f56a507882e"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"u4pak.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00002232)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6635a2903df24f56a507882e"},{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$2c","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6635a2903df24f56a507882e"},{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"\"u4pak.exe\" called \"GetVersionExA\" with parameter 9c0000000600000002000000f023000002000000003410535091d4040000000030c0d40430c0d404e8aad404fcc60a1e5091d404e8aad40430c0d404b04d221ee831da0400000000203410535091d404e8aad40400000000d055d6042bfc081e5091d404e8aad404203410535091d4040000000030c0d404e8aad404e8aad404fcc60a1e5091d404e8aad40430c0d404b04d221e (UID: 00000000-00002232)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"6635a2903df24f56a507882e"},{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"u4pak.exe\" called \"GetLocaleInfoA\" with parameter \"1033\" - (UID: 00000000-00002232)\n \"u4pak.exe\" called \"GetLocaleInfoW\" with parameter \"0\" - (UID: 00000000-00002232)\n \"u4pak.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00002232)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"6635a2903df24f56a507882e"},{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform scheduled transfer (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"u4pak.exe\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00001364.00000000.193495.0041D000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"6635a2903df24f56a507882e"},{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"u4pak.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"u4pak.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6635a2903df24f56a507882e"},{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; File: \"u4pak.exe\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00001364.00000000.193495.0041D000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"6635a2903df24f56a507882e"},{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve information about the current system (API string)","description":"Found reference to API \"ExpandEnvironmentStringsW\" (Indicator: \"ExpandEnvironmentStrings\"; File: \"u4pak.exe\")\n Found reference to API \"ExpandEnvironmentStringsW\" (Indicator: \"ExpandEnvironmentStrings\"; Source: \"00000000-00001364.00000000.193495.0041D000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"6635a2903df24f56a507882e"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"u4pak.exe\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00001364.00000000.193495.0041D000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"6635a2903df24f56a507882e"},{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"tlGetVersion\" (Indicator: \"GetVersion\"; Source: \"00000000-00001364.00000000.193495.02D00000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"6635a2903df24f56a507882e"},{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Found reference to API \"GetStartupInfoW\" (Indicator: \"GetStartupInfo\"; File: \"u4pak.exe\")","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-167","sources":[{"report_type":"sandbox","report_id":"6635a2903df24f56a507882e"},{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"\"u4pak.exe\" called \"CreateProcessW\" with parameter \"\"C:\\u4pak.exe\"\" - (UID: 00000000-00001364)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"6635a2903df24f56a507882e"},{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$2d","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"6635a2903df24f56a507882e"},{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$2e","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6635a2903df24f56a507882e"},{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; File: \"u4pak.exe\")\n Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; Source: \"00000000-00001364.00000000.193495.0041D000.00000004.mdmp\")\n Found reference to API \"2165985230,1340,3137,,CreateProcessW,kernel32.dll,\"00:50:19.406\",RX=0,PX=0\" (Indicator: \"CreateProcess\"; Source: \"00000000-00001364.00000000.193495.02D00000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"6635a2903df24f56a507882e"},{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically determine API calls","description":"Found GetProcAddress() and LoadLibraryA() in an import section (Source: u4pak.exe)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: msvcr90.dll)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: _hashlib.pyd)","origin":"Static Parser","mitre_attack_id":"T1027.007","relevance":1,"id":"static-79","sources":[{"report_type":"sandbox","report_id":"6635a2903df24f56a507882e"},{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$2f","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"6635a2903df24f56a507882e"},{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"u4pak.exe\")\n Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00001364.00000000.193495.0041D000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"6635a2903df24f56a507882e"},{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; File: \"u4pak.exe\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00001364.00000000.193495.0041D000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"6635a2903df24f56a507882e"},{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"level":"informative","category":"General","name":"Contains export functions","description":"$30","origin":"Static Parser","relevance":1,"id":"static-78","sources":[{"report_type":"sandbox","report_id":"6635a2903df24f56a507882e"},{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"Local\\SM0:2232:168:WilStaging_02\"\n \"SM0:2232:168:WilStaging_02\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6635a2903df24f56a507882e"},{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"msvcr90.dll\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n \"msvcp90.dll\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"6635a2903df24f56a507882e"},{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"\"u4pak.exe\" loaded module \"KERNEL32\" at base 742b0000\n \"u4pak.exe\" loaded module \"API-MS-WIN-CORE-STRING-L1-1-0\" at base 771e0000\n \"u4pak.exe\" loaded module \"API-MS-WIN-CORE-DATETIME-L1-1-1\" at base 771e0000\n \"u4pak.exe\" loaded module \"API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0\" at base 771e0000\n \"u4pak.exe\" loaded module \"%WINDIR%\\SYSTEM32\\IMM32.DLL\" at base 73e50000\n \"u4pak.exe\" loaded module \"API-MS-WIN-CORE-SYNCH-L1-2-0\" at base 771e0000\n \"u4pak.exe\" loaded module \"API-MS-WIN-CORE-FIBERS-L1-1-1\" at base 771e0000\n \"u4pak.exe\" loaded module \"API-MS-WIN-CORE-LOCALIZATION-L1-2-1\" at base 771e0000\n \"u4pak.exe\" loaded module \"%WINDIR%\\TEMP\\VXOLE32.DLL\" at base 72fc0000\n \"u4pak.exe\" loaded module \"NTDLL.DLL\" at base 773c0000\n \"u4pak.exe\" loaded module \"%TEMP%\\_MEI13642\\PYTHON27.DLL\" at base 1e000000\n \"u4pak.exe\" loaded module \"%TEMP%\\_MEI13~1\\_HASHLIB.PYD\" at base 10000000","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6635a2903df24f56a507882e"},{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"u4pak.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 75CE0000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6635a2903df24f56a507882e"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"u4pak.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 76340000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6635a2903df24f56a507882e"},{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"$31","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6635a2903df24f56a507882e"},{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"level":"informative","category":"General","name":"PE file contains Debug data directory","description":"\"python27.dll\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"\n \"msvcr90.dll\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"\n \"msvcp90.dll\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"\n \"_hashlib.pyd\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"\n \"unicodedata.pyd\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"\n \"bz2.pyd\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"\n \"select.pyd\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"","origin":"Static Parser","id":"static-146","sources":[{"report_type":"sandbox","report_id":"6635a2903df24f56a507882e"},{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"u4pak.exe\" has an executable section named \".text\"\n \"python27.dll\" has an executable section named \".text\"\n \"msvcr90.dll\" has an executable section named \".text\"\n \"msvcp90.dll\" has an executable section named \".text\"\n \"_hashlib.pyd\" has an executable section named \".text\"\n \"unicodedata.pyd\" has an executable section named \".text\"\n \"bz2.pyd\" has an executable section named \".text\"\n \"select.pyd\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"6635a2903df24f56a507882e"},{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"u4pak.exe\" has an writable section named \".data\"\n \"u4pak.exe\" has an writable section named \".bss\"\n \"u4pak.exe\" has an writable section named \".idata\"\n \"u4pak.exe\" has an writable section named \".CRT\"\n \"u4pak.exe\" has an writable section named \".tls\"\n \"u4pak.exe\" has an writable section named \".rsrc\"\n \"python27.dll\" has an writable section named \".data\"\n \"msvcr90.dll\" has an writable section named \".data\"\n \"msvcp90.dll\" has an writable section named \".data\"\n \"_hashlib.pyd\" has an writable section named \".data\"\n \"unicodedata.pyd\" has an writable section named \".data\"\n \"bz2.pyd\" has an writable section named \".data\"\n \"select.pyd\" has an writable section named \".data\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"6635a2903df24f56a507882e"},{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"$32","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"6635a2903df24f56a507882e"},{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"level":"informative","category":"General","name":"PE file has a big raw size section","description":"Raw size of \".text\" is \"0x11f000\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-125","sources":[{"report_type":"sandbox","report_id":"6635a2903df24f56a507882e"},{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"level":"informative","category":"General","name":"PE file has a big virtual size section","description":"Virtual size of \".text\" is \"0x11ef0c\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-124","sources":[{"report_type":"sandbox","report_id":"6635a2903df24f56a507882e"},{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"level":"informative","category":"General","name":"PE file has a high image base","description":"\"msvcr90.dll\" has high imagebase \"0x78520000\"\n \"msvcp90.dll\" has high imagebase \"0x78480000\"","origin":"Static Parser","relevance":1,"id":"static-93","sources":[{"report_type":"sandbox","report_id":"6635a2903df24f56a507882e"},{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"u4pak.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"python27.dll\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"msvcr90.dll\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"msvcp90.dll\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"_hashlib.pyd\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"unicodedata.pyd\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"bz2.pyd\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"select.pyd\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"6635a2903df24f56a507882e"},{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"level":"informative","category":"General","name":"Writes files in a temp directory","description":"\"u4pak.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\_MEI13642\\Microsoft.VC90.CRT.manifest\"\n \"u4pak.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\_MEI13642\\_hashlib.pyd\"\n \"u4pak.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\_MEI13642\\bz2.pyd\"\n \"u4pak.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\_MEI13642\\msvcm90.dll\"\n \"u4pak.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\_MEI13642\\msvcp90.dll\"\n \"u4pak.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\_MEI13642\\msvcr90.dll\"\n \"u4pak.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\_MEI13642\\python27.dll\"\n \"u4pak.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\_MEI13642\\select.pyd\"\n \"u4pak.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\_MEI13642\\u4pak.exe.manifest\"\n \"u4pak.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\_MEI13642\\unicodedata.pyd\"","origin":"API Call","mitre_attack_id":"T1005","relevance":1,"id":"api-267","sources":[{"report_type":"sandbox","report_id":"6635a2903df24f56a507882e"},{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"u4pak.exe\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; File: \"u4pak.exe\")\n Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00001364.00000000.193495.0041D000.00000004.mdmp\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00001364.00000000.193495.0041D000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"6635a2903df24f56a507882e"},{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"level":"informative","category":"Installation/Persistence","name":"Drops XML files","description":"\"u4pak.exe.manifest\" has type \"XML 1.0 document ASCII text with CRLF line terminators\" - Location: [%TEMP%\\_MEI13642\\u4pak.exe.manifest]\n \"Microsoft.VC90.CRT.manifest\" has type \"XML 1.0 document ASCII text with CRLF line terminators\" - Location: [%TEMP%\\_MEI13642\\Microsoft.VC90.CRT.manifest]","origin":"Binary File","mitre_attack_id":"T1105","relevance":1,"id":"binary-39","sources":[{"report_type":"sandbox","report_id":"6635a2903df24f56a507882e"},{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$33","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6635a2903df24f56a507882e"},{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"level":"informative","category":"Installation/Persistence","name":"PyInstaller file activity detected","description":"\"u4pak.exe\" writes file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\_MEI13642\\_hashlib.pyd\"\n \"u4pak.exe\" writes file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\_MEI13642\\bz2.pyd\"\n \"u4pak.exe\" writes file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\_MEI13642\\select.pyd\"\n \"u4pak.exe\" writes file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\_MEI13642\\unicodedata.pyd\"","origin":"API Call","mitre_attack_id":"T1059.006","relevance":1,"id":"api-211","sources":[{"report_type":"sandbox","report_id":"6635a2903df24f56a507882e"},{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"u4pak.exe\" queries basic process information of the \"C:\\u4pak.exe\" (UID: 1364)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"6635a2903df24f56a507882e"},{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$34","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6635a2903df24f56a507882e"},{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"u4pak.exe\" reads file \"c:\\u4pak.exe\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"6635a2903df24f56a507882e"},{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6635a2903df24f56a507882e"},{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"\"u4pak.exe\" trying to touch file \"C:\\Windows\\System32\\WOW64LOG.DLL\"\n \"u4pak.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\apphelp.dll\"\n \"u4pak.exe\" trying to touch file \"C:\\u4pak.exe\"\n \"u4pak.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\ntdll.dll\"\n \"u4pak.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\kernel32.dll\"\n \"u4pak.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\KernelBase.dll\"\n \"u4pak.exe\" trying to touch file \"C:\\Windows\\apppatch\\sysmain.sdb\"\n \"u4pak.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\msvcrt.dll\"\n \"u4pak.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\bcryptprimitives.dll\"\n \"u4pak.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\cryptbase.dll\"\n \"u4pak.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\sechost.dll\"\n \"u4pak.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\sspicli.dll\"\n \"u4pak.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\rpcrt4.dll\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6635a2903df24f56a507882e"},{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"\"u4pak.exe\" trying to access non-existent file \"C:\\Windows\\System32\\WOW64LOG.DLL\"\n \"u4pak.exe\" trying to access non-existent file \"C:\\FLTLIB.DLL\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6635a2903df24f56a507882e"},{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$35","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6635a2903df24f56a507882e"},{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"u4pak.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\_mei13642\\microsoft.vc90.crt.manifest\"\n \"u4pak.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\_mei13642\\_hashlib.pyd\"\n \"u4pak.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\_mei13642\\bz2.pyd\"\n \"u4pak.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\_mei13642\\msvcm90.dll\"\n \"u4pak.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\_mei13642\\msvcp90.dll\"\n \"u4pak.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\_mei13642\\msvcr90.dll\"\n \"u4pak.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\_mei13642\\python27.dll\"\n \"u4pak.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\_mei13642\\select.pyd\"\n \"u4pak.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\_mei13642\\u4pak.exe.manifest\"\n \"u4pak.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\_mei13642\\unicodedata.pyd\"\n \"u4pak.exe\" writes file \"%temp%\\_mei13642\\microsoft.vc90.crt.manifest\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"6635a2903df24f56a507882e"},{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \">Q.cM\"\n Heuristic match: \"5:.Ua\"\n Heuristic match: \".m].aQ\"\n Heuristic match: \"#a.dM\"\n Pattern match: \"www.memtest86.com\"\n Pattern match: \"http://www.w3.org/2001/XMLSchema-instance\"","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"6635a2903df24f56a507882e"},{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e\n Observed JA3 fingerprint: bd0bf25947d4a37404f0424edf4db9ad","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"6635a2903df24f56a507882e"}]},{"level":"informative","category":"Network Related","name":"Making HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"6635a2903df24f56a507882e"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - AES Encryption","description":"YARA signature for AES encryption matched on file \"_hashlib.pyd\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-103","sources":[{"report_type":"sandbox","report_id":"6635a2903df24f56a507882e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"u4pak.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6635a2903df24f56a507882e"},{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API's typically used for searching a directory for a files","description":"$36","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"6635a2903df24f56a507882e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to capture screen (API string)","description":"$37","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"6635a2903df24f56a507882e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"Found reference to API \"GetCurrentProcess\" (Indicator: \"GetCurrentProcess\"; File: \"u4pak.exe\")\n Found reference to API \"GetCurrentProcessId\" (Indicator: \"GetCurrentProcess\"; File: \"u4pak.exe\")\n Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; File: \"u4pak.exe\")\n Found reference to API \"GetCurrentProcess\" (Indicator: \"GetCurrentProcess\"; Source: \"00000000-00001364.00000000.193495.0041D000.00000004.mdmp\")\n Found reference to API \"GetCurrentProcessId\" (Indicator: \"GetCurrentProcess\"; Source: \"00000000-00001364.00000000.193495.0041D000.00000004.mdmp\")\n Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00001364.00000000.193495.0041D000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"6635a2903df24f56a507882e"},{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; File: \"u4pak.exe\")\n Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00001364.00000000.193495.0041D000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"6635a2903df24f56a507882e"},{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"$38","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"6635a2903df24f56a507882e"},{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"Found reference to API \"GetTempPathW\" (Indicator: \"GetTempPath\"; File: \"u4pak.exe\")\n Found reference to API \"GetTempPathW\" (Indicator: \"GetTempPath\"; Source: \"00000000-00001364.00000000.193495.0041D000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"6635a2903df24f56a507882e"},{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"Failed to get executable path. GetModuleFileNameW: %s\" (Indicator: \"GetModuleFileName\"; File: \"u4pak.exe\")\n Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; File: \"u4pak.exe\")\n Found reference to API \"GetModuleFileNameW: %s\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00001364.00000000.193495.0040C000.00000002.mdmp\")\n Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00001364.00000000.193495.0041D000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"6635a2903df24f56a507882e"},{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"Found reference to API \"GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; File: \"u4pak.exe\")\n Found reference to API \"GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00001364.00000000.193495.0041D000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-107","sources":[{"report_type":"sandbox","report_id":"6635a2903df24f56a507882e"},{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"u4pak.exe\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00001364.00000000.193495.0041D000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"6635a2903df24f56a507882e"},{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Imports GetCommandLine API","description":"Observed import api \"GetCommandLineA\" which can \"Retrieves the command-line string for the current process\" [Source: msvcr90.dll]","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-88","sources":[{"report_type":"sandbox","report_id":"6635a2903df24f56a507882e"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; File: \"u4pak.exe\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00001364.00000000.193495.0041D000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"6635a2903df24f56a507882e"},{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"u4pak.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\USERSETTINGS\\S-1-5-21-735145574-3570218355-1207367261-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME2\\U4PAK.EXE\"; Value: \"BF2FB29F089EDA0100000000000000000000000002000000\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"6635a2903df24f56a507882e"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"\"u4pak.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\USERSETTINGS\\S-1-5-21-735145574-3570218355-1207367261-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME2\\WINDOWS\\SYSTEM32\\CONHOST.EXE\"; Value: \"\")\n \"u4pak.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\USERSETTINGS\\S-1-5-21-735145574-3570218355-1207367261-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME2\\U4PAK.EXE\"; Value: \"\")","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"6635a2903df24f56a507882e"},{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops executable files inside temp directory","description":"$39","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-33","sources":[{"report_type":"sandbox","report_id":"6635a2903df24f56a507882e"},{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"u4pak.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"u4pak.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"6635a2903df24f56a507882e"},{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries process information","description":"\"u4pak.exe\" queried SystemProcessInformation at 00000000-00001364-00000C13-2014988691 [PID: 1364]\n \"u4pak.exe\" queried SystemProcessInformation at 00000000-00001364-00000C13-2015003072 [PID: 1364]\n \"u4pak.exe\" queried SystemProcessInformation at 00000000-00001364-00000C13-2015221999 [PID: 1364]\n \"u4pak.exe\" queried SystemProcessInformation at 00000000-00001364-00000C13-2015230548 [PID: 1364]\n \"u4pak.exe\" queried SystemProcessInformation at 00000000-00002232-00000C13-2015894070 [PID: 2232]\n \"u4pak.exe\" queried SystemProcessInformation at 00000000-00002232-00000C13-2015903133 [PID: 2232]\n \"u4pak.exe\" queried SystemProcessInformation at 00000000-00002232-00000C13-2016146714 [PID: 2232]\n \"u4pak.exe\" queried SystemProcessInformation at 00000000-00002232-00000C13-2016156621 [PID: 2232]\n \"u4pak.exe\" queried SystemProcessInformation at 00000000-00002232-00000C13-2016326609 [PID: 2232]\n \"u4pak.exe\" queried SystemProcessInformation at 00000000-00002232-00000C13-2016335564 [PID: 2232]","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"6635a2903df24f56a507882e"},{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"level":"suspicious","category":"Environment Awareness","name":"Calls an API typically used to query local/system time as file time","description":"\"u4pak.exe\" called \"FileTimeToLocalFileTime\" with parameter fcaade96089eda01 & fcd27feacd9dda01 (UID: 00000000-00002232)\n \"u4pak.exe\" called \"FileTimeToSystemTime\" (UID: 00000000-00002232)\n \"u4pak.exe\" called \"FileTimeToLocalFileTime\" with parameter 23cf8ce4cd9dda01 & 23f72d38939dda01 (UID: 00000000-00002232)\n \"u4pak.exe\" called \"FileTimeToLocalFileTime\" with parameter c7f5979f089eda01 & c71d39f3cd9dda01 (UID: 00000000-00002232)\n \"u4pak.exe\" called \"FileTimeToLocalFileTime\" with parameter 461e809f089eda01 & FF! (UID: 00000000-00002232)","origin":"API Call","mitre_attack_id":"T1070.006","relevance":3,"id":"api-223","sources":[{"report_type":"sandbox","report_id":"6635a2903df24f56a507882e"},{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure","description":"GetStartupInfoW@KERNEL32.dll at 1691-5-004014F0","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1543","relevance":5,"id":"stream-133","sources":[{"report_type":"sandbox","report_id":"6635a2903df24f56a507882e"},{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"level":"suspicious","category":"General","name":"Found a potential E-Mail address in binary/memory","description":"Pattern match: \"etg@v.u\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"6635a2903df24f56a507882e"}]},{"level":"suspicious","category":"General","name":"PE file has unusual entropy resources","description":"\"u4pak.exe\" has resource with unusual entropy \"RT_ICON:7.9507866382\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":5,"id":"static-92","sources":[{"report_type":"sandbox","report_id":"6635a2903df24f56a507882e"},{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"level":"suspicious","category":"Network Related","name":"Spawned processes likely due to injection","description":"Process \"C:\\u4pak.exe\" spawned likely due to injection","origin":"Monitored Target","mitre_attack_id":"T1055","relevance":3,"id":"target-413","sources":[{"report_type":"sandbox","report_id":"6635a2903df24f56a507882e"}]},{"level":"suspicious","category":"System Security","name":"Writes registry keys","description":"\"u4pak.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\USERSETTINGS\\S-1-5-21-735145574-3570218355-1207367261-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME2\\U4PAK.EXE\"; Value: \"BF2FB29F089EDA0100000000000000000000000002000000\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"6635a2903df24f56a507882e"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to compress/decompress content at runtime","description":"$3a","origin":"File/Memory","mitre_attack_id":"T1560.002","relevance":1,"id":"string-935","sources":[{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"Found reference to API \"VirtualAlloc\" (Indicator: \"VirtualAlloc\"; File: \"u4pak.exe\")\n Found reference to API \"VirtualFree\" (Indicator: \"VirtualFree\"; File: \"u4pak.exe\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"u4pak.exe\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to load content into memory (.NET)","description":"Observed namespace \"System.Runtime.InteropServices.Marshal\" and TypeReference \"ThrowExceptionForHR\" in \"msvcm90.dll\"\n Observed namespace \"System.Runtime.InteropServices.Marshal\" and TypeReference \"GetObjectForIUnknown\" in \"msvcm90.dll\"\n Observed namespace \"System.Runtime.InteropServices.Marshal\" and TypeReference \"GetExceptionPointers\" in \"msvcm90.dll\"\n Observed namespace \"System.Runtime.InteropServices.Marshal\" and TypeReference \"GetExceptionCode\" in \"msvcm90.dll\"\n Observed namespace \"System.Runtime.InteropServices.Marshal\" and TypeReference \"AllocHGlobal\" in \"msvcm90.dll\"\n Observed namespace \"System.Runtime.InteropServices.Marshal\" and TypeReference \"FreeHGlobal\" in \"msvcm90.dll\"\n Observed namespace \"System.Runtime.InteropServices.Marshal\" and TypeReference \"ReAllocHGlobal\" in \"msvcm90.dll\"","origin":"Static Parser","mitre_attack_id":"T1140","relevance":5,"id":"static-107","sources":[{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify thread functionality – possible hijack (API string)","description":"Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; File: \"u4pak.exe\")","origin":"File/Memory","mitre_attack_id":"T1055.003","relevance":3,"id":"string-309","sources":[{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to attach base64 encoded attachment to an email","description":"Found string \"Content-Transfer-Encoding: base64%s%s\" (Indicator: \"Content-Transfer-Encoding: base64\"; Source: \"00000000-00007844.00000000.265656.10087000.00000002.mdmp\")\n Found string \"Content-Transfer-Encoding: base64%s\" (Indicator: \"Content-Transfer-Encoding: base64\"; Source: \"00000000-00007844.00000000.265656.10087000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1132.001","relevance":3,"id":"string-588","sources":[{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify registry key/value (API string)","description":"Found reference to API \"RegSetValueExA\" (Indicator: \"RegSetValue\"; File: \"u4pak.exe\")\n Found reference to API \"RegSetValueA\" (Indicator: \"RegSetValue\"; File: \"u4pak.exe\")\n Found reference to API \"RegFlushKey\" (Indicator: \"RegFlushKey\"; File: \"u4pak.exe\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-304","sources":[{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to perform Base64 encoding/decoding","description":"Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+\"; Source: \"00000000-00007844.00000000.265656.10087000.00000002.mdmp, 00000000-00007844.00000000.265656.1E120000.00000002.mdmp\")\n Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\"; Source: \"00000000-00007844.00000000.265656.10087000.00000002.mdmp, 00000000-00007844.00000000.265656.1E120000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1132","relevance":1,"id":"string-338","sources":[{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to set file time (API string)","description":"Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; File: \"u4pak.exe\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-409","sources":[{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"$3b","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found virtual disk drive like strings","description":"Found string - ^-\\d+$|^-\\d*\\.\\d+$; Source: \"00000000-00007844.00000000.265656.02CE7000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-145","sources":[{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"PE file contains zero-sized sections","description":"Raw size of \".bss\" is zero","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-5","sources":[{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to use Microsoft's Enhanced Cryptographic Provider","description":"Found api reference \"CryptReleaseContext\" (Indicator: \"CryptReleaseContext\"; File: \"u4pak.exe\")\n Found api reference \"CryptReleaseContext\" (Indicator: \"CryptReleaseContext\"; Source: \"00000000-00007844.00000000.265656.10087000.00000002.mdmp, 00000000-00007844.00000000.265656.1E120000.00000002.mdmp\")\n Found api reference \"CryptGenRandom\" (Indicator: \"CryptGenRandom\"; Source: \"00000000-00007844.00000000.265656.10087000.00000002.mdmp, 00000000-00007844.00000000.265656.1E120000.00000002.mdmp\")\n Found api reference \"CryptAcquireContextW\" (Indicator: \"CryptAcquireContextW\"; Source: \"00000000-00007844.00000000.265656.10087000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-602","sources":[{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform AES/RC4 encryption (API string)","description":"Found reference to API \"CryptReleaseContext\" (Indicator: \"CryptReleaseContext\"; File: \"u4pak.exe\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-438","sources":[{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to use AES encryption instructions","description":"Found string \"AESNI_XTS_CIPHER\" (Indicator: \"AESNI\"; Source: \"00000000-00007844.00000000.265656.10087000.00000002.mdmp\")\n Found string \"AESNI_INIT_KEY\" (Indicator: \"AESNI\"; Source: \"00000000-00007844.00000000.265656.10087000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1573.001","relevance":3,"id":"string-584","sources":[{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains key cryptographic functions (API string)","description":"Found reference to API \"CryptReleaseContext\" (Indicator: \"CryptReleaseContext\"; File: \"u4pak.exe\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-195","sources":[{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to cryptographic keys","description":"$3c","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-280","sources":[{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$3d","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"level":"informative","category":"Environment Awareness","name":"Able to access user sensitive domain","description":"Found string \"# from https://gist.github.com/sampsyo/471779\" (Indicator: \"github.com\"; Source: \"00000000-00007844.00000000.265656.02B70000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1590","relevance":1,"id":"string-761","sources":[{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"u4pak.exe\")\n Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"u4pak.exe\")\n Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00005060.00000000.265525.0041D000.00000004.mdmp, 00000000-00005060.00000001.265663.0041D000.00000004.mdmp\")\n Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00007844.00000000.265656.0041C000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"Found reference to API \"GetLocaleInfoA\" (Indicator: \"GetLocaleInfo\"; File: \"u4pak.exe\")\n Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; File: \"u4pak.exe\")\n Found reference to API \"GetUserDefaultLCID\" (Indicator: \"GetUserDefaultLCID\"; File: \"u4pak.exe\")\n Found reference to API \"EnumSystemLocalesA\" (Indicator: \"EnumSystemLocales\"; File: \"u4pak.exe\")","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query volume/memory size (API string)","description":"Found reference to API \"GetDiskFreeSpaceA\" (Indicator: \"GetDiskFreeSpace\"; File: \"u4pak.exe\")\n Found reference to API \"GlobalMemoryStatus\" (Indicator: \"GlobalMemoryStatus\"; File: \"u4pak.exe\")\n Found reference to API \"GlobalMemoryStatus\" (Indicator: \"GlobalMemoryStatus\"; Source: \"00000000-00007844.00000000.265656.10087000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-193","sources":[{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve date formats supported by the local system (API string)","description":"Found reference to API \"GetTimeFormatA\" (Indicator: \"GetTimeFormat\"; File: \"u4pak.exe\")\n Found reference to API \"GetDateFormatA\" (Indicator: \"GetDateFormat\"; File: \"u4pak.exe\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-901","sources":[{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"Found system information discovery API: \"ExpandEnvironmentStringsW\" in file \"u4pak.exe\"\n Found system information discovery API: \"GetSystemInfo\" in file \"u4pak.exe\"\n Found system information discovery API: \"GetEnvironmentStringsW\" in file \"u4pak.exe\"\n Found system information discovery API: \"GetEnvironmentStrings\" in file \"u4pak.exe\"\n Found system information discovery API: \"GetUserObjectInformationW\" in file \"u4pak.exe\"\n Found system information discovery API: \"ExpandEnvironmentStringsW\" in \"00000000-00005060.00000000.265525.0041D000.00000004.mdmp, 00000000-00005060.00000001.265663.0041D000.00000004.mdmp\"\n Found system information discovery API: \"ExpandEnvironmentStringsW\" in \"00000000-00007844.00000000.265656.0041C000.00000004.mdmp, 00000000-00007844.00000000.265656.1E120000.00000002.mdmp\"\n Found system information discovery API: \"GetUserObjectInformationW\" in \"00000000-00007844.00000000.265656.10087000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"u4pak.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00005060)\n \"u4pak.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00007844)","origin":"API Call","mitre_attack_id":"T1497","relevance":3,"id":"api-296","sources":[{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"u4pak.exe\" called \"QueryPerformanceCounter\" (UID: 00000000-00005060)\n \"u4pak.exe\" called \"QueryPerformanceCounter\" (UID: 00000000-00007844)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"u4pak.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00005060)\n \"u4pak.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00007844)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to detect virtual environment (API)","description":"GetTickCount@KERNEL32.DLL at 00000000-00007844-17489-107-00409E80","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497","relevance":3,"id":"stream-87","sources":[{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query local/system time as file time","description":"GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00007844-17489-107-00409E80","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1070.006","relevance":1,"id":"stream-71","sources":[{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine timezone (API string)","description":"Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; File: \"u4pak.exe\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-248","sources":[{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"Found reference to API \"GetForegroundWindow\" (Indicator: \"GetForegroundWindow\"; Source: \"00000000-00007844.00000000.265656.10087000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"level":"informative","category":"General","name":"Able to create/load registry keys (API string)","description":"Found registry modification API: \"RegLoadKeyA\" in file \"u4pak.exe\"\n Found registry modification API: \"RegConnectRegistryA\" in file \"u4pak.exe\"\n Found registry modification API: \"RegCreateKeyA\" in file \"u4pak.exe\"\n Found registry modification API: \"RegCreateKeyExA\" in file \"u4pak.exe\"","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-307","sources":[{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"level":"informative","category":"General","name":"Able to rename or move file/directory (API string)","description":"Found string \"MoveFileA\" (Indicator: \"MoveFileA\"; File: \"u4pak.exe\")\n Found string \"MoveFileW\" (Indicator: \"MoveFileW\"; File: \"u4pak.exe\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-884","sources":[{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"level":"informative","category":"General","name":"Able to retrieve command line parameters of the running process","description":"Found string \"GetCommandLineW\" (Source: \"00000000-00005060.00000000.265525.0041D000.00000004.mdmp, 00000000-00005060.00000001.265663.0041D000.00000004.mdmp\")\n Found string \"GetCommandLineW\" (Source: \"00000000-00007844.00000000.265656.0041C000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-930","sources":[{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"level":"informative","category":"General","name":"Contains SQL queries","description":"\"Insert a simple entry into the list of warnings filters (at the front).\" (Source: 00000000-00007844.00000000.265656.029B0000.00000004.mdmp, Indicator: \"insert a simple entry into the list of warnings filters (at the front).\"), \"Insert an entry into the list of warnings filters (at the front).\" (Source: 00000000-00007844.00000000.265656.029B0000.00000004.mdmp, Indicator: \"insert an entry into the list of warnings filters (at the front).\"), \"inserts *copies* into it of the objects found in the original.\" (Source: 00000000-00007844.00000000.265656.02E55000.00000004.mdmp, Indicator: \"inserts *copies* into it of the objects found in the original.\")","origin":"File/Memory","mitre_attack_id":"T1213","relevance":2,"id":"string-16","sources":[{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; File: \"u4pak.exe\")\n Found reference to API \"CreateDirectoryA\" (Indicator: \"CreateDirectory\"; File: \"u4pak.exe\")","origin":"File/Memory","mitre_attack_id":"T1074.001","relevance":1,"id":"string-423","sources":[{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; File: \"u4pak.exe\")\n Found reference to API \"CreateFileMappingA\" (Indicator: \"CreateFile\"; File: \"u4pak.exe\")\n Found reference to API \"CreateFileA\" (Indicator: \"CreateFile\"; File: \"u4pak.exe\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"level":"informative","category":"General","name":"Contains ability to delay the execution of current thread","description":"Sleep@KERNEL32.DLL at 00000000-00007844-17489-40-004044F0\n WaitForSingleObject@KERNEL32.DLL at 00000000-00007844-17489-60-00404C40","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497.003","relevance":3,"id":"stream-103","sources":[{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; File: \"u4pak.exe\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically load libraries","description":"LoadLibraryExW@KERNEL32.DLL at 00000000-00007844-17489-95-00404BD0\n LoadLibraryA@KERNEL32.DLL at 00000000-00007844-17489-98-004052A0","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":3,"id":"stream-108","sources":[{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Found reference to API \"ShellExecuteW\" (Indicator: \"ShellExecute\"; File: \"u4pak.exe\")\n Found reference to API \"ShellExecuteA\" (Indicator: \"ShellExecute\"; File: \"u4pak.exe\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-240","sources":[{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"level":"informative","category":"General","name":"Contains ability to move file or directory (API string)","description":"Found reference to API \"MoveFileA\" (Indicator: \"MoveFile\"; File: \"u4pak.exe\")\n Found reference to API \"MoveFileW\" (Indicator: \"MoveFile\"; File: \"u4pak.exe\")","origin":"File/Memory","mitre_attack_id":"T1570","relevance":1,"id":"string-322","sources":[{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; File: \"u4pak.exe\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"u4pak.exe\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/open a process (API string)","description":"Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; File: \"u4pak.exe\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; File: \"u4pak.exe\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"level":"informative","category":"General","name":"Contains references to file movement (imports API)","description":"Found MoveFileA in import section (Source: python27.dll)\n Found MoveFileA in import section (Source: msvcr90.dll)","origin":"Static Parser","mitre_attack_id":"T1083","relevance":1,"id":"static-205","sources":[{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"level":"informative","category":"General","name":"Found E-Mail address in binary/memory","description":"Pattern match: \"mal@lemburg.com\"\n Pattern match: \"guido@python.org\"\n Pattern match: \"mike.verdone@gmail.com\"\n Pattern match: \"mark.russell@zen.co.uk\"\n Pattern match: \"ks_in@devanagari.utf\"\n Pattern match: \"sd_in@devanagari.utf\"\n Pattern match: \"appro@openssl.org\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"level":"informative","category":"General","name":"Found Native API in Dotnet file","description":"Observed unmanaged function \"EnterCriticalSection\" in \"msvcm90.dll\"\n Observed unmanaged function \"LeaveCriticalSection\" in \"msvcm90.dll\"\n Observed unmanaged function \"\" in \"msvcm90.dll\"","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-101","sources":[{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"\"Software\\Python\\PythonCore\\\" in Source: 00000000-00007844.00000000.265656.1E120000.00000002.mdmp\n \"Software\\Python\\PythonCore\\%s\\Modules\\%s%s\" in Source: 00000000-00007844.00000000.265656.1E120000.00000002.mdmp","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"level":"informative","category":"General","name":"Found well known domains (string)","description":"\"# from https://gist.github.com/sampsyo/471779\" (Indicator: \"github.com\")","origin":"File/Memory","relevance":1,"id":"string-135","sources":[{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"level":"informative","category":"General","name":"PE file contains COM data directory","description":"\"msvcm90.dll\" has COM data directory \"IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR\"","origin":"Static Parser","id":"static-144","sources":[{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"Observed system executable string:\"\\Device\\HarddiskVolume3\\Windows\\System32\\conhost.exe\" [Source: 00000000-00005060-00000BC0-3112898400]","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"level":"informative","category":"Installation/Persistence","name":"Potential hijacking of DLL execution flow detected","description":"\"python27.dll\" has type \"PE32 executable for MS Windows 5.00 (DLL) Intel i386 5 sections\"- Location: [%TEMP%\\_MEI50602\\python27.dll]- [targetUID: 00000000-00005060]\n \"msvcr90.dll\" has type \"PE32 executable for MS Windows 5.00 (DLL) Intel i386 4 sections\"- Location: [%TEMP%\\_MEI50602\\msvcr90.dll]- [targetUID: 00000000-00005060]\n \"msvcp90.dll\" has type \"PE32 executable for MS Windows 5.00 (DLL) Intel i386 4 sections\"- Location: [%TEMP%\\_MEI50602\\msvcp90.dll]- [targetUID: 00000000-00005060]\n \"msvcm90.dll\" has type \"PE32 executable for MS Windows 5.00 (DLL) Intel i386 Mono/.Net assembly 4 sections\"- Location: [%TEMP%\\_MEI50602\\msvcm90.dll]- [targetUID: 00000000-00005060]","origin":"Binary File","mitre_attack_id":"T1574.001","relevance":5,"id":"binary-91","sources":[{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with C2 using Sockets (API string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; Source: \"00000000-00007844.00000000.265656.10087000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1095","relevance":1,"id":"string-228","sources":[{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; Source: \"00000000-00007844.00000000.265656.10087000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create/connect to a named pipe (API string)","description":"Found reference to API \"CreatePipe\" (Indicator: \"CreatePipe\"; File: \"u4pak.exe\")\n Found reference to API \"PeekNamedPipe\" (Indicator: \"PeekNamedPipe\"; File: \"u4pak.exe\")","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-210","sources":[{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"$3e","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"level":"informative","category":"Network Related","name":"Found mail related domain names","description":"Observed email domain:\"fast version of a heappush followed by a heappop.i\" [Source: 00000000-00007844.00000000.265656.02CE7000.00000004.mdmp]\n Observed email domain:\"maxheap version of a heappush followed by a heappop.i\" [Source: 00000000-00007844.00000000.265656.02CE7000.00000004.mdmp]\n Observed email domain:\"maxheap version of a heappush followed by a heappop.\" [Source: 00000000-00007844.00000000.265656.02E70000.00000004.mdmp]\n Observed email domain:\"es_mx.iso8859-1\" [Source: 00000000-00007844.00000000.265656.02E70000.00000004.mdmp]\n Observed email domain:\"es_mx.iso88591\" [Source: 00000000-00007844.00000000.265656.02E70000.00000004.mdmp]\n Observed email domain:\"nhn_mx.utf-8\" [Source: 00000000-00007844.00000000.265656.02E70000.00000004.mdmp]","origin":"File/Memory","mitre_attack_id":"T1071.003","relevance":1,"id":"string-169","sources":[{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"Found URL \"http://code.activestate.com/recipes/66012/def\" - Source: \"00000000-00007844.00000000.265656.02B70000.00000004.mdmp\")\n Found URL \"https://gist.github.com/sampsyo/471779\" - Source: \"00000000-00007844.00000000.265656.02B70000.00000004.mdmp\")\n Found URL \"http://www.python.org/dev/peps/pep-0205/\" - Source: \"00000000-00007844.00000000.265656.02CE7000.00000004.mdmp\")\n Found URL \"http://www.openssl.org/support/faq.html.....................\\crypto\\asn1\\asn_pack.c.\\crypto\\engine\\tb_cipher.c.\\crypto\\pkcs12\\p12_utl.c.\\crypto\\asn1\\tasn_utl.c.\\crypto\\asn1\\a_bitstr.cx509_namex509_name_internalnamex509_name_entriesrdnsx509_name_entry.\\crypto\\asn1\\x_name.cdefaultutf8onlypkixnombstrmask:.\\crypto\\asn1\\a_strnid.cregistered\" - Source: \"00000000-00007844.00000000.265656.10087000.00000002.mdmp\")\n Found URL \"http://python.org/dev/peps/pep-0263/\" - Source: \"00000000-00007844.00000000.265656.1E120000.00000002.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"level":"informative","category":"Network Related","name":"References OpenSSL library string","description":"$3f","origin":"File/Memory","mitre_attack_id":"T1573.002","relevance":1,"id":"string-5003","sources":[{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"level":"informative","category":"Network Related","name":"Shows ability to send encrypted data to the internet","description":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network","origin":"Indicator Combinations","mitre_attack_id":"T1119","relevance":2,"id":"summary-27","sources":[{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - AES encryption","description":"YARA signature for AES encryption matched on process \"00000000-00007844\"\n YARA signature for AES encryption matched on file \"_hashlib.pyd\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-103","sources":[{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - Djb2 Hash Algorithm","description":"YARA signature for Djb2 Hash Algorithm matched on file \"msvcr90.dll\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-542","sources":[{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - RSA algorithm (keys)","description":"YARA signature for RSA public and private key matched on file \"msvcm90.dll\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":3,"id":"yara-62","sources":[{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture screen (API string)","description":"$40","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to import GetCommandLine API, which retrieves the command line string for the current process","description":"Observed import api \"GetCommandLineA\" which can \"retrieve the command-line string for the current process\" [Source: msvcr90.dll]","origin":"Static Parser","mitre_attack_id":"T1059.003","relevance":1,"id":"static-88","sources":[{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"Found registry query API: \"RegEnumKeyExA\" in file \"u4pak.exe\"\n Found registry query API: \"RegQueryValueExA\" in file \"u4pak.exe\"\n Found registry query API: \"RegEnumValueA\" in file \"u4pak.exe\"\n Found registry query API: \"RegQueryValueA\" in file \"u4pak.exe\"\n Found registry query API: \"RegQueryInfoKeyA\" in file \"u4pak.exe\"\n Found registry query API: \"RegOpenKeyExA\" in file \"u4pak.exe\"\n Found registry query API: \"RegSaveKeyA\" in file \"u4pak.exe\"","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$41","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$42","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to determine disk drive type (API string)","description":"Found reference to API \"GetDriveTypeA\" (Indicator: \"GetDriveType\"; File: \"u4pak.exe\")\n Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveType\"; File: \"u4pak.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-80","sources":[{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"Found reference to API \"FindFirstFileA\" (Indicator: \"FindFirstFile\"; File: \"u4pak.exe\")\n Found reference to API \"FindNextFileA\" (Indicator: \"FindNextFile\"; File: \"u4pak.exe\")\n Found reference to API \"FindNextFileW\" (Indicator: \"FindNextFile\"; File: \"u4pak.exe\")\n Found reference to API \"FindFirstFileW\" (Indicator: \"FindFirstFile\"; File: \"u4pak.exe\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to find logical drives of the machine (API string)","description":"Found reference to API \"GetLogicalDrives\" (Indicator: \"GetLogicalDrives\"; File: \"u4pak.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-84","sources":[{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; File: \"u4pak.exe\")","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve data about the local computer (API string)","description":"Found reference to API \"InterlockedExchange\" (Indicator: \"InterlockedExchange\"; File: \"u4pak.exe\")\n Found reference to API \"InterlockedExchange\" (Indicator: \"InterlockedExchange\"; Source: \"00000000-00007844.00000000.265656.10087000.00000002.mdmp, 00000000-00007844.00000000.265656.1E120000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":3,"id":"string-115","sources":[{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve usernames and/or user information (API string)","description":"Found reference to API \"GetUserObjectInformationW\" (Indicator: \"GetUserObjectInformation\"; File: \"u4pak.exe\")\n Found reference to API \"GetProcessWindowStation\" (Indicator: \"GetProcessWindowStation\"; File: \"u4pak.exe\")\n Found reference to API \"GetUserObjectInformationW\" (Indicator: \"GetUserObjectInformation\"; Source: \"00000000-00007844.00000000.265656.10087000.00000002.mdmp\")\n Found reference to API \"GetProcessWindowStation\" (Indicator: \"GetProcessWindowStation\"; Source: \"00000000-00007844.00000000.265656.10087000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"$43","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found system command-related strings","description":"Found string \"no hostname specified\" (Indicator: \"hostname\"; Source: \"00000000-00007844.00000000.265656.10087000.00000002.mdmp\")\n Found string \"bad hostname lookup\" (Indicator: \"hostname\"; Source: \"00000000-00007844.00000000.265656.10087000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":7,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"level":"informative","category":"System Security","name":"Able to delete registry key/value (API string)","description":"Found registry deletion API: \"RegDeleteKeyA\" in file \"u4pak.exe\"\n Found registry deletion API: \"RegDeleteValueA\" in file \"u4pak.exe\"","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-230","sources":[{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"level":"informative","category":"System Security","name":"Able to retrieve/open a process (API string)","description":"Found string \"OpenProcess\" (Indicator: \"OpenProcess\"; File: \"u4pak.exe\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-729","sources":[{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"level":"informative","category":"System Security","name":"Calls an API used to open a process handle","description":"Observed import api \"OpenProcess\" which can be \"used to open a process handle\" [Source: python27.dll]","origin":"Static Parser","mitre_attack_id":"T1489","relevance":5,"id":"static-191","sources":[{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"$44","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"RemoveDirectoryA\" (Indicator: \"RemoveDirectory\"; File: \"u4pak.exe\")\n Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; File: \"u4pak.exe\")\n Found reference to API \"DeleteFileA\" (Indicator: \"DeleteFile\"; File: \"u4pak.exe\")\n Found reference to API \"RemoveDirectoryW\" (Indicator: \"RemoveDirectory\"; File: \"u4pak.exe\")","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify file attributes (API string)","description":"Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; File: \"u4pak.exe\")\n Found reference to API \"SetFileAttributesA\" (Indicator: \"SetFileAttributes\"; File: \"u4pak.exe\")","origin":"File/Memory","mitre_attack_id":"T1222","relevance":1,"id":"string-426","sources":[{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"u4pak.exe\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to free the memory used by network management functions (API string)","description":"Found reference to API \"NetApiBufferFree\" (Indicator: \"NetApiBufferFree\"; Source: \"00000000-00007844.00000000.265656.10087000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-223","sources":[{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"level":"informative","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"Found string \"CreateActCtxW\" (Source: u4pak.exe, API is part of module: KERNELBASE.DLL)\n Found string \"ActivateActCtx\" (Source: u4pak.exe, API is part of module: KERNELBASE.DLL)","origin":"File/Memory","mitre_attack_id":"T1106","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Section contains high entropy","description":"\"u4pak.exe\" has section name .rdata with entropy \"7.01949078591609\"\n \"u4pak.exe\" has section name .rsrc with entropy \"7.297059405170559\"","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"level":"suspicious","category":"Cryptographic Related","name":"Uses Windows cryptography API for obfuscation","description":"Observed Cryptography api used in \"advapi32.dll\" [Source: python27.dll]","origin":"Static Parser","mitre_attack_id":"T1027","relevance":3,"id":"static-207","sources":[{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"level":"suspicious","category":"System Security","name":"Contains ability to terminate a process","description":"TerminateProcess@KERNEL32.dll at 15941-369-00409F30\n TerminateProcess@KERNEL32.DLL at 00000000-00007844-17489-108-00409F30","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1489","relevance":1,"id":"stream-88","sources":[{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]}],"incidents":[{"name":"Remote Access","details_count":1,"details":[{"detail":"Reads terminal service related keys (often RDP related)"}],"sources":[{"report_type":"sandbox","report_id":"615657c0909b966fb2172bc2"}]},{"name":"Persistence","details_count":1,"details":[{"detail":"Writes data to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"615657c0909b966fb2172bc2"},{"report_type":"sandbox","report_id":"6635a2903df24f56a507882e"},{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"name":"Fingerprint","details_count":1,"details":[{"detail":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"615657c0909b966fb2172bc2"},{"report_type":"sandbox","report_id":"6635a2903df24f56a507882e"}]},{"name":"Evasive","details_count":1,"details":[{"detail":"Marks file for deletion"}],"sources":[{"report_type":"sandbox","report_id":"615657c0909b966fb2172bc2"},{"report_type":"sandbox","report_id":"6635a2903df24f56a507882e"},{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"name":"Spyware","details_count":1,"details":[{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"6635a2903df24f56a507882e"},{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]}]},"activity":{"stats":{"process_count":2,"spawned_processes_count":2,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":6,"imported_dlls_count":46,"dropped_files_count":0,"extracted_files_count":10,"files_written_count":60,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["exploit","banker","delf","mofksys","neshta"],"sample_flags":["Multi-Process","Extracted Files","Sample Crashed"],"sandbox_reports":[{"id":"69b770bf592f7093ec0c2f12","environment_id":140,"environment_description":"Windows 11 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":80,"malware_family":"Malware_56.0","submit_name":"u4pak.exe","analysis_start_time":"2026-03-16T02:53:53+00:00","indicators_count":{"informative":161,"suspicious":23,"malicious":1},"tags":["Multi-Process","Extracted Files"],"is_in_unified_schema":true},{"id":"6635a2903df24f56a507882e","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"submit_name":"u4pak.exe","analysis_start_time":"2024-05-04T02:50:56+00:00","indicators_count":{"informative":86,"suspicious":23,"malicious":1},"tags":["Multi-Process","Extracted Files"],"is_in_unified_schema":true},{"id":"615657c0909b966fb2172bc2","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":96,"malware_family":"Exploit.Python","submit_name":"u4pak.exe","analysis_start_time":"2021-10-01T00:35:19+00:00","indicators_count":{"informative":10,"suspicious":16,"malicious":4},"tags":["Multi-Process","Extracted Files"],"is_in_unified_schema":true},{"id":"57881a97aac2ede1431ab690","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":61,"malware_family":"Trojan","submit_name":"u4pak.exe","analysis_start_time":"2016-07-15T01:05:56+00:00","indicators_count":{"informative":5,"suspicious":16,"malicious":3},"tags":["Extracted Files","Sample Crashed"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"615657c0909b966fb2172bc2"}],"processes":[{"pid":2980,"ppid":0,"name":"u4pak.exe","command_line":"","sha256":"d76edf3f3b00efb1a4d382f04ac9fa3275fdb3d77737f16e024635a269c0d9af","normalized_path":"C:\\u4pak.exe","uid":"00000000-00002980","icon":"$45"},{"pid":3276,"ppid":2980,"name":"u4pak.exe","command_line":"","sha256":"d76edf3f3b00efb1a4d382f04ac9fa3275fdb3d77737f16e024635a269c0d9af","normalized_path":"C:\\u4pak.exe","parent_uid":"00000000-00002980","uid":"00000000-00003276"}],"all_imported_dlls":["rpcrt4.dll","sechost.dll","tzres.dll","msctf.dll","KernelBase.dll","ws2_32.dll","sspicli.dll","msvcrt.dll","cryptbase.dll","imm32.dll","python27.dll","shlwapi.dll","shell32.dll","wow64.dll","wow64win.dll","api-ms-win-core-synch-l1-2-0.dll","advapi32.dll","ole32.dll","msvcr90.dll","ntdll.dll","gdi32.dll","lpk.dll","oleaut32.dll","wow64cpu.dll","nsi.dll","kernel32.dll","user32.dll","apphelp.dll","usp10.dll","VxSSL32.dll","fltLib.dll","SHCore.dll","combase.dll","powrprof.dll","ucrtbase.dll","gdi32full.dll","profapi.dll","kernel.appcore.dll","windows.storage.dll","bcryptprimitives.dll","win32u.dll","msvcp_win.dll","cfgmgr32.dll","cryptsp.dll","wow64base.dll","wow64con.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"bz2.pyd","sha256":"7b253061211b2f95cd3f16c07ece83bc12cd9445769296025c97905d2df169f4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"615657c0909b966fb2172bc2"},{"report_type":"sandbox","report_id":"57881a97aac2ede1431ab690"},{"report_type":"sandbox","report_id":"6635a2903df24f56a507882e"},{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"name":"msvcm90.dll","sha256":"7a74da389fbd10a710c294c2e914dc6f18e05f028f07958a2fa53ac44f0e4b90","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"615657c0909b966fb2172bc2"},{"report_type":"sandbox","report_id":"57881a97aac2ede1431ab690"},{"report_type":"sandbox","report_id":"6635a2903df24f56a507882e"},{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"name":"msvcp90.dll","sha256":"06918cf99ad26cd6cf106881c0d5bdb212dc0bac4549805c9f5906e3d03d152c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"615657c0909b966fb2172bc2"},{"report_type":"sandbox","report_id":"57881a97aac2ede1431ab690"},{"report_type":"sandbox","report_id":"6635a2903df24f56a507882e"},{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"name":"msvcr90.dll","sha256":"8e7fe1a1f3550c479ffd86a77bc9d10686d47f8727025bb891d8f4f0259354c8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"615657c0909b966fb2172bc2"},{"report_type":"sandbox","report_id":"57881a97aac2ede1431ab690"},{"report_type":"sandbox","report_id":"6635a2903df24f56a507882e"},{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"name":"python27.dll","sha256":"462b83af5760c7d5eda780c1ad185776def680a650cd3425c7e810d405d830f7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"615657c0909b966fb2172bc2"},{"report_type":"sandbox","report_id":"57881a97aac2ede1431ab690"},{"report_type":"sandbox","report_id":"6635a2903df24f56a507882e"},{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"name":"select.pyd","sha256":"e8cb36cf6b46881d5dca66f9b1074e68148cd464f065bed7d89e6e5fcdcaf00d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"615657c0909b966fb2172bc2"},{"report_type":"sandbox","report_id":"57881a97aac2ede1431ab690"},{"report_type":"sandbox","report_id":"6635a2903df24f56a507882e"},{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"name":"unicodedata.pyd","sha256":"929397bbfb0e34dda5d18b6c4e5d271b4ee6a63a32e5f0c328a53b1c55a9590e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"615657c0909b966fb2172bc2"},{"report_type":"sandbox","report_id":"57881a97aac2ede1431ab690"},{"report_type":"sandbox","report_id":"6635a2903df24f56a507882e"},{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"name":"_hashlib.pyd","sha256":"fc9f52148793457a28c99e7a5aa114806c23efcd10516ddf311907546a4d1c57","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"615657c0909b966fb2172bc2"},{"report_type":"sandbox","report_id":"57881a97aac2ede1431ab690"},{"report_type":"sandbox","report_id":"6635a2903df24f56a507882e"},{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"name":"Microsoft.VC90.CRT.manifest","sha256":"0d060ed7c25159b7b75f16d449963bfd639c15b3c5280bc7897403268c2b9f35","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"615657c0909b966fb2172bc2"},{"report_type":"sandbox","report_id":"57881a97aac2ede1431ab690"},{"report_type":"sandbox","report_id":"6635a2903df24f56a507882e"},{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"name":"u4pak.exe.manifest","sha256":"96ea32c8adc238edc3ba89cbfebd3bdf2e92ae9e2b380dee0df97c90853744d3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"615657c0909b966fb2172bc2"},{"report_type":"sandbox","report_id":"57881a97aac2ede1431ab690"},{"report_type":"sandbox","report_id":"6635a2903df24f56a507882e"},{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]}],"files_written":[{"path":"C:\\u4pak.exe","sources":[{"report_type":"sandbox","report_id":"615657c0909b966fb2172bc2"}]},{"path":"%WINDIR%\\SysWOW64\\tzres.dll","sources":[{"report_type":"sandbox","report_id":"615657c0909b966fb2172bc2"}]},{"path":"%TEMP%\\_MEI29~1","sources":[{"report_type":"sandbox","report_id":"615657c0909b966fb2172bc2"}]},{"path":"%TEMP%\\_MEI29~1\\pyimod00_crypto_key.pyd","sources":[{"report_type":"sandbox","report_id":"615657c0909b966fb2172bc2"}]},{"path":"%TEMP%\\_MEI29~1\\pyimod00_crypto_key.py","sources":[{"report_type":"sandbox","report_id":"615657c0909b966fb2172bc2"}]},{"path":"%TEMP%\\_MEI29~1\\pyimod00_crypto_key.pyw","sources":[{"report_type":"sandbox","report_id":"615657c0909b966fb2172bc2"}]},{"path":"%TEMP%\\_MEI29~1\\pyimod00_crypto_key.pyc","sources":[{"report_type":"sandbox","report_id":"615657c0909b966fb2172bc2"}]},{"path":"%TEMP%\\_MEI29~1\\ctypes.pyd","sources":[{"report_type":"sandbox","report_id":"615657c0909b966fb2172bc2"}]},{"path":"%TEMP%\\_MEI29~1\\ctypes.py","sources":[{"report_type":"sandbox","report_id":"615657c0909b966fb2172bc2"}]},{"path":"%TEMP%\\_MEI29~1\\ctypes.pyw","sources":[{"report_type":"sandbox","report_id":"615657c0909b966fb2172bc2"}]},{"path":"%TEMP%\\_MEI29~1\\ctypes.pyc","sources":[{"report_type":"sandbox","report_id":"615657c0909b966fb2172bc2"}]},{"path":"%TEMP%\\_MEI29~1\\llfuse.pyd","sources":[{"report_type":"sandbox","report_id":"615657c0909b966fb2172bc2"}]},{"path":"%TEMP%\\_MEI29~1\\llfuse.py","sources":[{"report_type":"sandbox","report_id":"615657c0909b966fb2172bc2"}]},{"path":"%TEMP%\\_MEI29~1\\llfuse.pyw","sources":[{"report_type":"sandbox","report_id":"615657c0909b966fb2172bc2"}]},{"path":"%TEMP%\\_MEI29~1\\llfuse.pyc","sources":[{"report_type":"sandbox","report_id":"615657c0909b966fb2172bc2"}]},{"path":"%TEMP%\\_MEI29~1\\org.pyd","sources":[{"report_type":"sandbox","report_id":"615657c0909b966fb2172bc2"}]},{"path":"%TEMP%\\_MEI29~1\\org.py","sources":[{"report_type":"sandbox","report_id":"615657c0909b966fb2172bc2"}]},{"path":"%TEMP%\\_MEI29~1\\org.pyw","sources":[{"report_type":"sandbox","report_id":"615657c0909b966fb2172bc2"}]},{"path":"%TEMP%\\_MEI29~1\\org.pyc","sources":[{"report_type":"sandbox","report_id":"615657c0909b966fb2172bc2"}]},{"path":"%WINDIR%\\system32\\tzres.dll","sources":[{"report_type":"sandbox","report_id":"57881a97aac2ede1431ab690"}]},{"path":"%TEMP%\\_MEI31~1","sources":[{"report_type":"sandbox","report_id":"57881a97aac2ede1431ab690"}]},{"path":"%TEMP%\\_MEI31~1\\pyimod00_crypto_key.pyd","sources":[{"report_type":"sandbox","report_id":"57881a97aac2ede1431ab690"}]},{"path":"%TEMP%\\_MEI31~1\\pyimod00_crypto_key.py","sources":[{"report_type":"sandbox","report_id":"57881a97aac2ede1431ab690"}]},{"path":"%TEMP%\\_MEI31~1\\pyimod00_crypto_key.pyw","sources":[{"report_type":"sandbox","report_id":"57881a97aac2ede1431ab690"}]},{"path":"%TEMP%\\_MEI31~1\\pyimod00_crypto_key.pyc","sources":[{"report_type":"sandbox","report_id":"57881a97aac2ede1431ab690"}]},{"path":"%TEMP%\\_MEI31~1\\ctypes.pyd","sources":[{"report_type":"sandbox","report_id":"57881a97aac2ede1431ab690"}]},{"path":"%TEMP%\\_MEI31~1\\ctypes.py","sources":[{"report_type":"sandbox","report_id":"57881a97aac2ede1431ab690"}]},{"path":"%TEMP%\\_MEI31~1\\ctypes.pyw","sources":[{"report_type":"sandbox","report_id":"57881a97aac2ede1431ab690"}]},{"path":"%TEMP%\\_MEI31~1\\ctypes.pyc","sources":[{"report_type":"sandbox","report_id":"57881a97aac2ede1431ab690"}]},{"path":"C:\\d76edf3f3b00efb1a4d382f04ac9fa3275fdb3d77737f16e024635a269c0d9af.exe","sources":[{"report_type":"sandbox","report_id":"57881a97aac2ede1431ab690"}]},{"path":"%TEMP%\\_MEI31~1\\llfuse.pyd","sources":[{"report_type":"sandbox","report_id":"57881a97aac2ede1431ab690"}]},{"path":"%TEMP%\\_MEI31~1\\llfuse.py","sources":[{"report_type":"sandbox","report_id":"57881a97aac2ede1431ab690"}]},{"path":"%TEMP%\\_MEI31~1\\llfuse.pyw","sources":[{"report_type":"sandbox","report_id":"57881a97aac2ede1431ab690"}]},{"path":"%TEMP%\\_MEI31~1\\llfuse.pyc","sources":[{"report_type":"sandbox","report_id":"57881a97aac2ede1431ab690"}]},{"path":"%TEMP%\\_MEI31~1\\org.pyd","sources":[{"report_type":"sandbox","report_id":"57881a97aac2ede1431ab690"}]},{"path":"%TEMP%\\_MEI31~1\\org.py","sources":[{"report_type":"sandbox","report_id":"57881a97aac2ede1431ab690"}]},{"path":"%TEMP%\\_MEI31~1\\org.pyw","sources":[{"report_type":"sandbox","report_id":"57881a97aac2ede1431ab690"}]},{"path":"%TEMP%\\_MEI31~1\\org.pyc","sources":[{"report_type":"sandbox","report_id":"57881a97aac2ede1431ab690"}]},{"path":"C:\\D76EDF~1.EXE","sources":[{"report_type":"sandbox","report_id":"57881a97aac2ede1431ab690"}]},{"path":"%TEMP%\\_MEI13642\\Microsoft.VC90.CRT.manifest","sources":[{"report_type":"sandbox","report_id":"6635a2903df24f56a507882e"}]},{"path":"%TEMP%\\_MEI13642\\_hashlib.pyd","sources":[{"report_type":"sandbox","report_id":"6635a2903df24f56a507882e"}]},{"path":"%TEMP%\\_MEI13642\\bz2.pyd","sources":[{"report_type":"sandbox","report_id":"6635a2903df24f56a507882e"}]},{"path":"%TEMP%\\_MEI13642\\msvcm90.dll","sources":[{"report_type":"sandbox","report_id":"6635a2903df24f56a507882e"}]},{"path":"%TEMP%\\_MEI13642\\msvcp90.dll","sources":[{"report_type":"sandbox","report_id":"6635a2903df24f56a507882e"}]},{"path":"%TEMP%\\_MEI13642\\msvcr90.dll","sources":[{"report_type":"sandbox","report_id":"6635a2903df24f56a507882e"}]},{"path":"%TEMP%\\_MEI13642\\python27.dll","sources":[{"report_type":"sandbox","report_id":"6635a2903df24f56a507882e"}]},{"path":"%TEMP%\\_MEI13642\\select.pyd","sources":[{"report_type":"sandbox","report_id":"6635a2903df24f56a507882e"}]},{"path":"%TEMP%\\_MEI13642\\u4pak.exe.manifest","sources":[{"report_type":"sandbox","report_id":"6635a2903df24f56a507882e"}]},{"path":"%TEMP%\\_MEI13642\\unicodedata.pyd","sources":[{"report_type":"sandbox","report_id":"6635a2903df24f56a507882e"}]},{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"path":"%TEMP%\\_MEI50602\\Microsoft.VC90.CRT.manifest","sources":[{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"path":"%TEMP%\\_MEI50602\\_hashlib.pyd","sources":[{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"path":"%TEMP%\\_MEI50602\\bz2.pyd","sources":[{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"path":"%TEMP%\\_MEI50602\\msvcm90.dll","sources":[{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"path":"%TEMP%\\_MEI50602\\msvcp90.dll","sources":[{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"path":"%TEMP%\\_MEI50602\\msvcr90.dll","sources":[{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"path":"%TEMP%\\_MEI50602\\python27.dll","sources":[{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"path":"%TEMP%\\_MEI50602\\select.pyd","sources":[{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"path":"%TEMP%\\_MEI50602\\u4pak.exe.manifest","sources":[{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"path":"%TEMP%\\_MEI50602\\unicodedata.pyd","sources":[{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]}],"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"Local\\SM0:2232:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6635a2903df24f56a507882e"}]},{"name":"SM0:2232:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6635a2903df24f56a507882e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5060:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"name":"Local\\SM0:5060:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7844:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]},{"name":"Local\\SM0:7844:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69b770bf592f7093ec0c2f12"}]}]}},"report_ids":{"sandbox_job_ids":["6635a2903df24f56a507882e","615657c0909b966fb2172bc2","69b770bf592f7093ec0c2f12","57881a97aac2ede1431ab690"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Malware_56.0 Sample d76edf3f3b00… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample d76edf3f3b00…. Malware family: Malware_56.0. Threat score 100/100. 3/27 AV engines flagged this file. 5 malicious and 24 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/d76edf3f3b00efb1a4d382f04ac9fa3275fdb3d77737f16e024635a269c0d9af"}],["$","meta","4",{"property":"og:title","content":"Malicious Malware_56.0 Sample d76edf3f3b00… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample d76edf3f3b00…. Malware family: Malware_56.0. Threat score 100/100. 3/27 AV engines flagged this file. 5 malicious and 24 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/d76edf3f3b00efb1a4d382f04ac9fa3275fdb3d77737f16e024635a269c0d9af"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Malware_56.0 Sample d76edf3f3b00… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample d76edf3f3b00…. Malware family: Malware_56.0. Threat score 100/100. 3/27 AV engines flagged this file. 5 malicious and 24 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L46","11",{}]]