34:"SampleDetailWrapper" 35:I[7638,["$1","$2","$3","$4","$5","$8","$9","$a","$b"],"$34"] 54:I[27201,["$1","$2","$3","$4","$5"],"IconMark"] 33:T482,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Ransom.LockBit Sample de96af271bf5… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample de96af271bf5…. Malware family: Ransom.LockBit. Threat score 100/100. 19/24 AV engines flagged this file. 5 malicious and 12 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62","keywords":["Malicious","Ransom.LockBit","malware analysis","sandbox report","threat intelligence","de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62"],"about":{"@type":"SoftwareApplication","name":"xxx.exe","applicationCategory":["peexe","executable"],"identifier":"de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Ransom.LockBit","antivirusDetections":{"malicious":19,"total":24},"behavioralIndicators":{"malicious":5,"suspicious":12},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}36:T181c,"de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" renamed original file"C:\Users\%OSUSER%\Searches\Microsoft Office Outlook.searchconnector-ms" to "%USERPROFILE%\Searches\Microsoft Office Outlook.searchconnector-ms.HPvdi8peh" "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" renamed original file"C:\Users\%OSUSER%\Searches\Microsoft OneNote.searchconnector-ms" to "%USERPROFILE%\Searches\Microsoft OneNote.searchconnector-ms.HPvdi8peh" "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" renamed original file"C:\Users\%OSUSER%\Searches\winrt--{S-1-5-21-735145574-3570218355-1207367261-1001}-.searchconnector-ms" to "%USERPROFILE%\Searches\winrt--{S-1-5-21-735145574-3570218355-1207367261-1001}-.searchconnector-ms.HPvdi8peh" "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" renamed original file"C:\Users\%OSUSER%\MicrosoftEdgeBackups\backups\MicrosoftEdgeBackup20231002\MicrosoftEdgeFavoritesBackup.html" to "%USERPROFILE%\MicrosoftEdgeBackups\backups\MicrosoftEdgeBackup20231002\MicrosoftEdgeFavoritesBackup.html.HPvdi8peh" "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" renamed original file"C:\Users\%OSUSER%\Favorites\Bing.url" to "%USERPROFILE%\Favorites\Bing.url.HPvdi8peh" "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" renamed original file"C:\Users\%OSUSER%\Downloads\MicrosoftEdgeSetup.exe.xlzor0p.partial" to "%USERPROFILE%\Downloads\MicrosoftEdgeSetup.exe.xlzor0p.partial.HPvdi8peh" "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" renamed original file"C:\Users\%OSUSER%\Downloads\npp.8.4.7.portable.x64.zip" to "%USERPROFILE%\Downloads\npp.8.4.7.portable.x64.zip.HPvdi8peh" "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" renamed original file"C:\Users\%OSUSER%\Documents\Database1.accdb" to "%USERPROFILE%\Documents\Database1.accdb.HPvdi8peh" "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" renamed original file"C:\Users\%OSUSER%\Documents\Outlook Files\Outlook.pst" to "%USERPROFILE%\Documents\Outlook Files\Outlook.pst.HPvdi8peh" "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" renamed original file"C:\Users\%OSUSER%\Documents\Outlook Files\Outlook1.pst" to "%USERPROFILE%\Documents\Outlook Files\Outlook1.pst.HPvdi8peh" "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" renamed original file"C:\Users\%OSUSER%\Documents\OneNote Notebooks\Unfiled Notes.one" to "%USERPROFILE%\Documents\OneNote Notebooks\Unfiled Notes.one.HPvdi8peh" "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" renamed original file"C:\Users\%OSUSER%\Documents\OneNote Notebooks\OneNote 2010 Guide\OneNote Guide.one" to "%USERPROFILE%\Documents\OneNote Notebooks\OneNote 2010 Guide\OneNote Guide.one.HPvdi8peh" "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" renamed original file"C:\Users\%OSUSER%\Documents\OneNote Notebooks\OneNote 2010 Guide\Open Notebook.onetoc2" to "%USERPROFILE%\Documents\OneNote Notebooks\OneNote 2010 Guide\Open Notebook.onetoc2.HPvdi8peh" "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" renamed original file"C:\Users\%OSUSER%\Documents\OneNote Notebooks\My Notebook\Open Notebook.onetoc2" to "%USERPROFILE%\Documents\OneNote Notebooks\My Notebook\Open Notebook.onetoc2.HPvdi8peh" "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" renamed original file"C:\Users\%OSUSER%\Documents\OneNote Notebooks\My Notebook\Quick Notes.one" to "%USERPROFILE%\Documents\OneNote Notebooks\My Notebook\Quick Notes.one.HPvdi8peh" "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" renamed original file"C:\Users\%OSUSER%\AppData\Roaming\Wireshark\recent" to "%APPDATA%\Wireshark\recent.HPvdi8peh" "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" renamed original file"C:\Users\%OSUSER%\AppData\Roaming\Wireshark\recent_common" to "%APPDATA%\Wireshark\recent_common.HPvdi8peh" "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" renamed original file"C:\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\profiles.ini" to "%APPDATA%\Mozilla\Firefox\profiles.ini.HPvdi8peh" "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" renamed original file"C:\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Profiles\ywzu7870.default\addons.json" to "%APPDATA%\Mozilla\Firefox\Profiles\ywzu7870.default\addons.json.HPvdi8peh" "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" renamed original file"C:\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Profiles\ywzu7870.default\addonStartup.json.lz4" to "%APPDATA%\Mozilla\Firefox\Profiles\ywzu7870.default\addonStartup.json.lz4.HPvdi8peh" "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" renamed original file"C:\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Profiles\ywzu7870.default\blocklist.xml" to "%APPDATA%\Mozilla\Firefox\Profiles\ywzu7870.default\blocklist.xml.HPvdi8peh" "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" renamed original file"C:\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Profiles\ywzu7870.default\cert9.db" to "%APPDATA%\Mozilla\Firefox\Profiles\ywzu7870.default\cert9.db.HPvdi8peh" "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" renamed original file"C:\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Profiles\ywzu7870.default\compatibility.ini" to "%APPDATA%\Mozilla\Firefox\Profiles\ywzu7870.default\compatibility.ini.HPvdi8peh" "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" renamed original file"C:\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Profiles\ywzu7870.default\containers.json" to "%APPDATA%\Mozilla\Firefox\Profiles\ywzu7870.default\containers.json.HPvdi8peh" "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" renamed original file"C:\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Profiles\ywzu7870.default\content-prefs.sqlite" to "%APPDATA%\Mozilla\Firefox\Profiles\ywzu7870.default\content-prefs.sqlite.HPvdi8peh"37:T1a62,"de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000009e29d17780ec6a020000000028000000240000000000690298ee4f000000000000000000000000000000000000000000d0071c0030000000000000001000000000001c0034ee4f009000d471000000000000000058e96a0238b0690210000000000000002000000000001c00d0011c00140c1c0000000000100c1c004800000090ee4f0050f5d07780ec6a02f8ee4f0044ef4f00 (UID: 00000000-00003504) "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003504) "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003504) "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000000060ee4f0004ee4f00226eca740000ac04000000002d6eca744ac879422d000000ecb7ad7588ee4f0000001c0050e16a0210b069020700000080000000c8ed4f0000001c004cee4f0070c8cb74b657e636feffffff2d000000d0ccbc75270000001cee4f00856acc741c23d1745cee4f00f85fcc7408000000bb69cb74b269cb7412c879422d000000ecb7ad7527000000d0ccbc7530ee4f002d000000d0ccbc752700000060ee4f00856acc741c23d174a8ee4f007e8abb75ee8cbb75738abb75e84b6b7c2d000000ecb7ad7527000000d0ccbc752c11ac04c010ac04e84b6b7c70ee4f00fc52f9755cef4f00e084bb757854d309feffffff738abb75 (UID: 00000000-00003504) "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" called "RtlGetVersion" with parameter 240100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003504) "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000ca740000ac04000000002d6eca7492cb794211000000181ab97260ee4f000000ac00e03eac04110000000000000080000000a0ed4f000000000024ee4f0070c8cb74b657e636feffffff11000000503cba720e000000f4ed4f00856acc741c23d17434ee4f00f85fcc7408000000bb69cb74b269cb747ac8794211000000181ab9720e000000503cba7208ee4f0011000000503cba720e00000038ee4f00856acc741c23d17480ee4f00b90eba723614ba72ae0eba727921671b11000000181ab9720e000000503cba72802eac04482eac047921671b48ee4f000a5eb97234ef4f004014ba72a16d9369feffffffae0eba72c80eba72503cba72b0ee4f00 (UID: 00000000-00003504) "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003504) "9ED.tmp" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006432) "9ED.tmp" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006432) "9ED.tmp" called "RtlGetVersion" (UID: 00000000-00006432) "9ED.tmp" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006432)38:T15d4,"de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" called "CopyFileW" to copy \\?\C:\HPvdi8peh.README.txt to new location \\?\C:\Users\HPvdi8peh.README.txt (UID: 00000000-00003504) "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" called "CopyFileW" to copy \\?\C:\HPvdi8peh.README.txt to new location \\?\%USERPROFILE%\HPvdi8peh.README.txt (UID: 00000000-00003504) "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" called "CopyFileW" to copy \\?\C:\HPvdi8peh.README.txt to new location \\?\%USERPROFILE%\Videos\HPvdi8peh.README.txt (UID: 00000000-00003504) "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" called "CopyFileW" to copy \\?\C:\HPvdi8peh.README.txt to new location \\?\%USERPROFILE%\Searches\HPvdi8peh.README.txt (UID: 00000000-00003504) "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" called "CopyFileW" to copy \\?\C:\HPvdi8peh.README.txt to new location \\?\%USERPROFILE%\Saved Games\HPvdi8peh.README.txt (UID: 00000000-00003504) "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" called "CopyFileW" to copy \\?\C:\HPvdi8peh.README.txt to new location \\?\%USERPROFILE%\Pictures\HPvdi8peh.README.txt (UID: 00000000-00003504) "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" called "CopyFileW" to copy \\?\C:\HPvdi8peh.README.txt to new location \\?\%USERPROFILE%\Pictures\Saved Pictures\HPvdi8peh.README.txt (UID: 00000000-00003504) "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" called "CopyFileW" to copy \\?\C:\HPvdi8peh.README.txt to new location \\?\%USERPROFILE%\Pictures\Camera Roll\HPvdi8peh.README.txt (UID: 00000000-00003504) "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" called "CopyFileW" to copy \\?\C:\HPvdi8peh.README.txt to new location \\?\%USERPROFILE%\OneDrive\HPvdi8peh.README.txt (UID: 00000000-00003504) "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" called "CopyFileW" to copy \\?\C:\HPvdi8peh.README.txt to new location \\?\%USERPROFILE%\Music\HPvdi8peh.README.txt (UID: 00000000-00003504) "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" called "CopyFileW" to copy \\?\C:\HPvdi8peh.README.txt to new location \\?\%USERPROFILE%\MicrosoftEdgeBackups\HPvdi8peh.README.txt (UID: 00000000-00003504) "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" called "CopyFileW" to copy \\?\C:\HPvdi8peh.README.txt to new location \\?\%USERPROFILE%\MicrosoftEdgeBackups\backups\HPvdi8peh.README.txt (UID: 00000000-00003504) "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" called "CopyFileW" to copy \\?\C:\HPvdi8peh.README.txt to new location \\?\%USERPROFILE%\MicrosoftEdgeBackups\backups\MicrosoftEdgeBackup20231002\HPvdi8peh.README.txt (UID: 00000000-00003504) "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" called "CopyFileW" to copy \\?\C:\HPvdi8peh.README.txt to new location \\?\%USERPROFILE%\Links\HPvdi8peh.README.txt (UID: 00000000-00003504) "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" called "CopyFileW" to copy \\?\C:\HPvdi8peh.README.txt to new location \\?\%USERPROFILE%\Favorites\HPvdi8peh.README.txt (UID: 00000000-00003504) "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" called "CopyFileW" to copy \\?\C:\HPvdi8peh.README.txt to new location \\?\%USERPROFILE%\Favorites\Links\HPvdi8peh.README.txt (UID: 00000000-00003504) "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" called "CopyFileW" to copy \\?\C:\HPvdi8peh.README.txt to new location \\?\%USERPROFILE%\Downloads\HPvdi8peh.README.txt (UID: 00000000-00003504) "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" called "CopyFileW" to copy \\?\C:\HPvdi8peh.README.txt to new location \\?\%USERPROFILE%\Documents\HPvdi8peh.README.txt (UID: 00000000-00003504) "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" called "CopyFileW" to copy \\?\C:\HPvdi8peh.README.txt to new location \\?\%USERPROFILE%\Documents\Outlook Files\HPvdi8peh.README.txt (UID: 00000000-00003504) "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" called "CopyFileW" to copy \\?\C:\HPvdi8peh.README.txt to new location \\?\%USERPROFILE%\Documents\OneNote Notebooks\HPvdi8peh.README.txt (UID: 00000000-00003504) "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" called "CopyFileW" to copy \\?\C:\HPvdi8peh.README.txt to new location \\?\%USERPROFILE%\Documents\OneNote Notebooks\OneNote 2010 Guide\HPvdi8peh.README.txt (UID: 00000000-00003504) "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" called "CopyFileW" to copy \\?\C:\HPvdi8peh.README.txt to new location \\?\%USERPROFILE%\Documents\OneNote Notebooks\My Notebook\HPvdi8peh.README.txt (UID: 00000000-00003504) "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" called "CopyFileW" to copy \\?\C:\HPvdi8peh.README.txt to new location \\?\%USERPROFILE%\Desktop\HPvdi8peh.README.txt (UID: 00000000-00003504) "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" called "CopyFileW" to copy \\?\C:\HPvdi8peh.README.txt to new location \\?\%USERPROFILE%\Contacts\HPvdi8peh.README.txt (UID: 00000000-00003504) "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" called "CopyFileW" to copy \\?\C:\HPvdi8peh.README.txt to new location \\?\%USERPROFILE%\AppData\HPvdi8peh.README.txt (UID: 00000000-00003504)39:T47a,"de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003504) "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003504) "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003504) "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003504) "9ED.tmp" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006432) "9ED.tmp" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006432) "9ED.tmp" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006432) "9ED.tmp" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006432) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006568)3a:T2d70,"de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00003504) "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00003504) "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00003504) "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003504) "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00003504) "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00003504) "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00003504) "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00003504) "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00003504) "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00003504) "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00003504) "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00003504) "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00003504) "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00003504) "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00003504) "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00003504) "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00003504) "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00003504) "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00003504) "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00003504) "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00003504) "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00003504) "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00003504) "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00003504) "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00003504) "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00003504) "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00003504) "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00003504) "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00003504) "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00003504) "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00003504) "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00003504) "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00003504) "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00003504) "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00003504) "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00003504) "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00003504) "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00003504) "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00003504) "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00003504) "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00003504) "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00003504) "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00003504) "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00003504) "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00003504) "9ED.tmp" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00006432) "9ED.tmp" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00006432) "9ED.tmp" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00006432) "9ED.tmp" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00006432) "9ED.tmp" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00006432) "9ED.tmp" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00006432) "9ED.tmp" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00006432) "9ED.tmp" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00006432) "9ED.tmp" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00006432) "9ED.tmp" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00006432) "9ED.tmp" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00006432) "9ED.tmp" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00006432) "9ED.tmp" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00006432) "9ED.tmp" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00006432) "9ED.tmp" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00006432) "9ED.tmp" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00006432) "9ED.tmp" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00006432) "9ED.tmp" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00006432) "9ED.tmp" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00006432) "9ED.tmp" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00006432) "9ED.tmp" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00006432) "9ED.tmp" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00006432) "9ED.tmp" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00006432) "9ED.tmp" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00006432) "9ED.tmp" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00006432) "9ED.tmp" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00006432) "9ED.tmp" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00006432) "9ED.tmp" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00006432) "9ED.tmp" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00006432) "9ED.tmp" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00006432) "9ED.tmp" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00006432) "9ED.tmp" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00006432) "9ED.tmp" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00006432) "9ED.tmp" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00006432) "9ED.tmp" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00006432) "9ED.tmp" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00006432) "9ED.tmp" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00006432) "9ED.tmp" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00006432) "9ED.tmp" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00006432) "9ED.tmp" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00006432) "9ED.tmp" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00006432) "9ED.tmp" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00006432) "9ED.tmp" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00006432) "9ED.tmp" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00006432) "9ED.tmp" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00006432) "cmd.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00006568)3b:Tb43,Found reference to API (Indicator: "FreeLibrary"; File: "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe") Found reference to API (Indicator: "GetLastError"; File: "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe") Found reference to API (Indicator: "LoadLibraryW"; File: "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe") Found reference to API (Indicator: "SetLastError"; File: "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe") Found reference to API (Indicator: "GetTickCount"; File: "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe") Found reference to API (Indicator: "GetCommandLineA"; File: "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe") Found reference to API (Indicator: "GetCommandLineW"; File: "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe") Found reference to API (Indicator: "CreateMenu"; File: "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe") Found reference to API (Indicator: "GetWindowTextW"; File: "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe") Found reference to API (Indicator: "GetKeyNameTextW"; File: "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe") Found reference to API (Indicator: "DefWindowProcW"; File: "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe") Found reference to API (Indicator: "LoadMenuW"; File: "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe") Found reference to API (Indicator: "LoadImageW"; File: "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe") Found reference to API (Indicator: "GetDeviceCaps"; File: "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe") Found reference to API (Indicator: "CreateSolidBrush"; File: "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe") Found reference to API (Indicator: "GetTextColor"; File: "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe") Found reference to API (Indicator: "GetLocaleInfoW"; File: "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe") Found reference to API (Indicator: "GetModuleHandleW"; File: "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe") Found reference to API (Indicator: "GetProcAddress"; File: "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe") Found reference to API (Indicator: "GetModuleHandleA"; File: "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe") Found reference to API (Indicator: "CreateWindowExW"; File: "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe") Found reference to API (Indicator: "SelectObject"; File: "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe")3c:T530,"Registry\Machine\Software\Classes\CLSID\{4590F812-1D3A-11D0-891F-00AA004B2E24}" in Source: 00000000-00003504.00000000.129037.02690000.00000004.mdmp 00000000-00003504.00000001.130959.02690000.00000004.mdmp 00000000-00003504.00000002.132877.02690000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}" in Source: 00000000-00003504.00000000.129037.02690000.00000004.mdmp 00000000-00003504.00000001.130959.02690000.00000004.mdmp 00000000-00003504.00000002.132877.02690000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}" in Source: 00000000-00003504.00000000.129037.02690000.00000004.mdmp 00000000-00003504.00000001.130959.02690000.00000004.mdmp 00000000-00003504.00000002.132877.02690000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{E7D35CFA-348B-485E-B524-252725D697CA}" in Source: 00000000-00003504.00000000.129037.02690000.00000004.mdmp 00000000-00003504.00000001.130959.02690000.00000004.mdmp 00000000-00003504.00000002.132877.02690000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}" in Source: 00000000-00003504.00000000.129037.02690000.00000004.mdmp 00000000-00003504.00000001.130959.02690000.00000004.mdmp 00000000-00003504.00000002.132877.02690000.00000004.mdmp3d:T18d5,"de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 75760000 "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 75760000 "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 75760000 "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" loaded module "KERNEL32" at base 75670000 "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 73370000 "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" loaded module "NTDLL" at base 77cd0000 "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" loaded module "NTDLL.DLL" at base 77cd0000 "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" loaded module "KERNEL32.DLL" at base 75670000 "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" loaded module "ADVAPI32.DLL" at base 77c50000 "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" loaded module "CRYPTBASE" at base 746e0000 "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" loaded module "USERENV.DLL" at base 732a0000 "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" loaded module "USER32.DLL" at base 74e50000 "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" loaded module "GDI32.DLL" at base 75020000 "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" loaded module "SHELL32.DLL" at base 75ab0000 "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" loaded module "OLE32.DLL" at base 753c0000 "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" loaded module "API-MS-WIN-CORE-COM-L1-1-0" at base 74960000 "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" loaded module "SHLWAPI.DLL" at base 75200000 "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" loaded module "OLEAUT32.DLL" at base 750e0000 "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" loaded module "WTSAPI32.DLL" at base 74360000 "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" loaded module "RSTRTMGR.DLL" at base 73270000 "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" loaded module "NETAPI32.DLL" at base 73200000 "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" loaded module "WKSCLI" at base 734e0000 "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" loaded module "SRVCLI" at base 731e0000 "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" loaded module "SAMCLI" at base 731c0000 "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" loaded module "NETUTILS" at base 734a0000 "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" loaded module "LOGONCLI" at base 73190000 "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" loaded module "ACTIVEDS.DLL" at base 73150000 "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" loaded module "WININET.DLL" at base 72e40000 "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" loaded module "WSOCK32.DLL" at base 72e30000 "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" loaded module "WS2_32" at base 74d20000 "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" loaded module "MPR.DLL" at base 745f0000 "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" loaded module "WINSPOOL.DRV" at base 72dc0000 "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" loaded module "GPEDIT.DLL" at base 72cb0000 "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" loaded module "RPCRT4.DLL" at base 74780000 "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 741a0000 "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 75760000 "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMPROX.DLL" at base 72b10000 "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\FASTPROX.DLL" at base 729e0000 "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMSVC.DLL" at base 729d0000 "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL" at base 75760000 "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-1-0.DLL" at base 75760000 "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" loaded module "%WINDIR%\SYSTEM32\ADSLDP.DLL" at base 72ab0000 "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74640000 "9ED.tmp" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 75760000 "9ED.tmp" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 75760000 "9ED.tmp" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 75760000 "9ED.tmp" loaded module "KERNEL32" at base 75670000 "9ED.tmp" loaded module "KERNEL32.DLL" at base 75670000 "9ED.tmp" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 741a0000 "9ED.tmp" loaded module "NTDLL.DLL" at base 77cd0000 "9ED.tmp" loaded module "%WINDIR%\SYSWOW64\\WINDOWS.STATEREPOSITORYPS.DLL" at base 73110000 "9ED.tmp" loaded module "API-MS-WIN-CORE-PROCESSTHREADS-L1-1-2.DLL" at base 75670000 "9ED.tmp" loaded module "MSISO.DLL" at base 730b0000 "cmd.exe" loaded module "KERNEL32" at base 75670000 "cmd.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 75760000 "cmd.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 75760000 "cmd.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 75760000 "cmd.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 757600003e:T4a3,"0f001000d4f74f00b013d17754f84f00@ntdll.dll" "07000800b0f74f0080fddb7730f84f00@ntdll.dll" "09000a00b0f74f00c0fddb7730f84f00@ntdll.dll" "08000900b0f74f00e0fcdb7730f84f00@ntdll.dll" "07000800b0f74f00e085cf7730f84f00@ntdll.dll" "09000a00b0f74f008057cf7730f84f00@ntdll.dll" "08000900b0f74f00e056cf7730f84f00@ntdll.dll" "11001200b0f74f00702a6e7430f84f00@CRYPTBASE.dll" "11001200b0f74f00e02a6e7430f84f00@CRYPTBASE.dll" "0c000d00b0f74f00003da57430f84f00@combase.dll" "0e000f00b0f74f00106e9f7430f84f00@combase.dll" "0e000f00b0f74f00606e9f7430f84f00@combase.dll" "14001500b0f74f0020239c7430f84f00@combase.dll" "10001100b0f74f0080049f7430f84f00@combase.dll" "12001300b0f74f0010c7a57430f84f00@combase.dll" "11001200b0f74f0050bc9f7430f84f00@combase.dll" "15001600b0f74f00c0324e7330f84f00@WKSCLI.DLL" "0c000d00b0f74f0010431e7330f84f00@SRVCLI.DLL" "0b000c00b0f74f0080391c7330f84f00@SAMCLI.DLL" "0e000f00b0f74f00d0da1c7330f84f00@SAMCLI.DLL" "0e000f00b0f74f00403e1c7330f84f00@SAMCLI.DLL" "10001100b0f74f00d0174a7330f84f00@NETUTILS.DLL" "0c000d00b0f74f0050ef197330f84f00@LOGONCLI.DLL" "0c000d00b0f74f0050cf1a7330f84f00@LOGONCLI.DLL" "0c000d00b0f74f00d0cd1a7330f84f00@LOGONCLI.DLL"3f:Tab1,"de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" touched "LDAP Namespace Object" (Path: "HKCU\WOW6432NODE\CLSID\{228D9A82-C302-11CF-9AA4-00AA004A5691}\INPROCSERVER32") "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" touched "WinNT Namespace Object" (Path: "HKCU\WOW6432NODE\CLSID\{250E91A0-0367-11CF-ABC4-02608C9E7553}\INPROCSERVER32") "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" touched "WbemAdministrativeLocator Class" (Path: "HKCU\WOW6432NODE\CLSID\{CB8555CC-9128-11D1-AD9B-00C04FD8FDFF}") "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" touched "Microsoft WBEM Call Context" (Path: "HKCU\WOW6432NODE\CLSID\{674B6698-EE92-11D0-AD71-00C04FD8FDFF}\TREATAS") "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" touched "Windows Management and Instrumentation" (Path: "HKCU\WOW6432NODE\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\TREATAS") "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" touched "PSFactoryBuffer" (Path: "HKCU\WOW6432NODE\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\TREATAS") "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemServices" (Path: "HKCU\WOW6432NODE\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\TREATAS") "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" touched "Microsoft WBEM (non)Standard Marshaling for IEnumWbemClassObject" (Path: "HKCU\WOW6432NODE\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\TREATAS") "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" touched "Microsoft WBEM WbemClassObject Marshalling proxy" (Path: "HKCU\WOW6432NODE\CLSID\{4590F812-1D3A-11D0-891F-00AA004B2E24}\TREATAS") "9ED.tmp" touched "Computer" (Path: "HKCU\WOW6432NODE\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "9ED.tmp" touched "Memory Mapped Cache Mgr" (Path: "HKCU\WOW6432NODE\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\TREATAS") "9ED.tmp" touched "Sync root manager" (Path: "HKCU\WOW6432NODE\CLSID\{F324E4F9-8496-40B2-A1FF-9617C1C9AFFE}\INSTANCE") "9ED.tmp" touched "Property System Both Class Factory" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\TREATAS") "9ED.tmp" touched "Security Manager" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}") "9ED.tmp" touched "ShellItemArray Shell Namespace helper" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{CDC82860-468D-4D4E-B7E7-C298FF23AB2C}\INPROCSERVER32") "9ED.tmp" touched "ShellItem Shell Namespace helper" (Path: "HKCU\WOW6432NODE\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}\INPROCSERVER32")40:T46c,"de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" file has an entrypoint instructions - "nop ,nop word ptr [eax + eax],call 0x419000,nop dword ptr [eax],call 0x40639c,nop ,call 0x409990,nop dword ptr [eax],call 0x417458,nop word ptr [eax + eax],push 0,call dword ptr [0x4255c8],nop word ptr [eax + eax],call 0x418dd6,call 0x418dca,call 0x418dbe,call 0x418dd0,call 0x418dbe,call 0x418dbe,call 0x418dc4," "9ED.tmp" file has an entrypoint instructions - "dec ebp,fadd qword ptr [esi - 0x23],pop ds,and bl, byte ptr [esp + edx - 0x10],sets byte ptr [esi],jns 0x403969,mov cl, 0xa2,inc esi,outsb dx, byte ptr [esi],jae 0x403994,leave ,pop ecx,pop esi,add al, 0x1c,adc esi, dword ptr [0x2a4dc271],push ecx,inc edx,imul edx, dword ptr [edi + 0x3469be44], 0x8822181b,wait ,or al, 0xf2,test al, 0xd6,test al, 0xd,mov bl, bh,movsb byte ptr es:[edi], byte ptr [esi],jb 0x4039a4,fsubr qword ptr [edi - 0x31],jl 0x40397b,sbb al, 0xa5,mov bh, 0xfa,pop ss,push 0x73,and al, bl,sbb byte ptr [edi], al,xlatb ,les edx, ptr [eax - 0x56dc40e0],or byte ptr [esi - 0x1bd161c8], bh,jecxz 0x403a03,loope 0x403a0c,mov esp, 0x86a10260,"41:T4c5,"de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN") "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN") "9ED.tmp" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "9ED.tmp" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "9ED.tmp" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "cmd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY")42:T1767,"places.sqlite.HPvdi8peh" has type "DOS executable (COM)"- Location: [%APPDATA%\Mozilla\Firefox\Profiles\ywzu7870.default\places.sqlite.HPvdi8peh]- [targetUID: 00000000-00003504] "OneNote Guide.one.HPvdi8peh" has type "OpenPGP Public Key"- Location: [%USERPROFILE%\Documents\OneNote Notebooks\OneNote 2010 Guide\OneNote Guide.one.HPvdi8peh]- [targetUID: 00000000-00003504] "data_1.HPvdi8peh" has type "DOS executable (COM)"- Location: [%LOCALAPPDATA%\Google\Chrome\User Data\GrShaderCache\data_1.HPvdi8peh]- [targetUID: 00000000-00003504] "object.html.HPvdi8peh" has type "DOS executable (COM)"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Doc\html\c-api\object.html.HPvdi8peh]- [targetUID: 00000000-00003504] "langthaimodel.cpython-311.pyc.HPvdi8peh" has type "DOS executable (COM)"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\pip\_vendor\chardet\__pycache__\langthaimodel.cpython-311.pyc.HPvdi8peh]- [targetUID: 00000000-00003504] "test_tracemalloc.py.HPvdi8peh" has type "DOS executable (COM)"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\test\test_tracemalloc.py.HPvdi8peh]- [targetUID: 00000000-00003504] "_collections_abc.py.HPvdi8peh" has type "DOS executable (COM)"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\_collections_abc.py.HPvdi8peh]- [targetUID: 00000000-00003504] "build.cpython-311.pyc.HPvdi8peh" has type "DOS executable (COM)"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\win32com\client\__pycache__\build.cpython-311.pyc.HPvdi8peh]- [targetUID: 00000000-00003504] "live.cpython-311.pyc.HPvdi8peh" has type "DOS executable (COM)"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\pip\_vendor\rich\__pycache__\live.cpython-311.pyc.HPvdi8peh]- [targetUID: 00000000-00003504] "test_binascii.py.HPvdi8peh" has type "DOS executable (COM)"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\test\test_binascii.py.HPvdi8peh]- [targetUID: 00000000-00003504] "util.cpython-311.pyc.HPvdi8peh" has type "DOS executable (COM)"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\pkg_resources\_vendor\pyparsing\__pycache__\util.cpython-311.pyc.HPvdi8peh]- [targetUID: 00000000-00003504] "9ED.tmp" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%ALLUSERSPROFILE%\9ED.tmp]- [targetUID: 00000000-00003504] "hierlist.py.HPvdi8peh" has type "DOS executable (COM)"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\pythonwin\pywin\tools\hierlist.py.HPvdi8peh]- [targetUID: 00000000-00003504] "core.cpython-311.pyc.HPvdi8peh" has type "DOS executable (COM)"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\setuptools\_distutils\__pycache__\core.cpython-311.pyc.HPvdi8peh]- [targetUID: 00000000-00003504] "crypto_scalarmult.py.HPvdi8peh" has type "DOS executable (COM)"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\nacl\bindings\crypto_scalarmult.py.HPvdi8peh]- [targetUID: 00000000-00003504] "test_poll.py.HPvdi8peh" has type "DOS executable (COM)"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\test\test_poll.py.HPvdi8peh]- [targetUID: 00000000-00003504] "6C5ABAD761F989B263EB9F0911CB84A3994590EC.HPvdi8peh" has type "COM executable for MS-DOS"- [targetUID: N/A] "utils.cpython-311.pyc.HPvdi8peh" has type "DOS executable (COM)"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\nacl\bindings\__pycache__\utils.cpython-311.pyc.HPvdi8peh]- [targetUID: 00000000-00003504] "test___package__.py.HPvdi8peh" has type "DOS executable (COM)"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\test\test_importlib\import_\test___package__.py.HPvdi8peh]- [targetUID: 00000000-00003504] "test_pstats.py.HPvdi8peh" has type "DOS executable (COM)"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\test\test_pstats.py.HPvdi8peh]- [targetUID: 00000000-00003504] "base.cpython-311.pyc.HPvdi8peh" has type "DOS executable (COM)"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\pip\_internal\locations\__pycache__\base.cpython-311.pyc.HPvdi8peh]- [targetUID: 00000000-00003504] "test_bdist_dumb.py.HPvdi8peh" has type "DOS executable (COM)"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\distutils\tests\test_bdist_dumb.py.HPvdi8peh]- [targetUID: 00000000-00003504] "cmdline.cpython-311.pyc.HPvdi8peh" has type "DOS executable (COM)"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\pythonwin\pywin\framework\__pycache__\cmdline.cpython-311.pyc.HPvdi8peh]- [targetUID: 00000000-00003504] "HPvdi8peh.README.txt" has type "ASCII text with CRLF line terminators"- Location: [%LOCALAPPDATA%\Packages\Microsoft.VCLibs.140.00.UWPDesktop_8wekyb3d8bbwe\AC\Temp\HPvdi8peh.README.txt]- [targetUID: 00000000-00003504] "__init__.cpython-311.pyc.HPvdi8peh" has type "DOS executable (COM)"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\setuptools\command\__pycache__\__init__.cpython-311.pyc.HPvdi8peh]- [targetUID: 00000000-00003504] "__init__.py.HPvdi8peh" has type "DOS executable (COM)"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\setuptools\_vendor\packaging\__init__.py.HPvdi8peh]- [targetUID: 00000000-00003504] "model-info.pb.HPvdi8peh" has type "DOS executable (COM)"- [targetUID: 00000000-00003504] "__init__.cpython-311.pyc.HPvdi8peh" has type "DOS executable (COM)"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\urllib3\contrib\__pycache__\__init__.cpython-311.pyc.HPvdi8peh]- [targetUID: 00000000-00003504] "Thimphu.HPvdi8peh" has type "DOS executable (COM)"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\tcl\tcl8.6\tzdata\Asia\Thimphu.HPvdi8peh]- [targetUID: 00000000-00003504] "simple-ns.xml.HPvdi8peh" has type "DOS executable (COM)"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\test\xmltestdata\simple-ns.xml.HPvdi8peh]- [targetUID: 00000000-00003504]43:T7d3,"de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: ""; Value: "") "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: ""; Value: "") "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\DISABLE8AND16BITMITIGATION"; Key: ""; Value: "")44:Te5a,"de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: "DE96AF271BF52BDCECAAF555A711F8A1397ED4B8BE0D9C16F483253D29DEAF62.EXE"; Value: "") "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "LOGFLAGS"; Value: "") "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "SHOWDEBUGINFO"; Value: "") "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: "CACHE"; Value: "") "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY"; Value: "") "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK"; Value: "") "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "TYPE"; Value: "") "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "ALTERNATECODEPAGE"; Value: "") "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "ENABLED"; Value: "") "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: "FIPSALGORITHMPOLICY"; Value: "") "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "MDMENABLED"; Value: "") "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORUSESYSTEMHEAP"; Value: "")45:T1019,"de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" reads file "c:\users\%osuser%\searches\microsoft office outlook.searchconnector-ms.hpvdi8peh" "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" reads file "c:\users\%osuser%\searches\microsoft onenote.searchconnector-ms.hpvdi8peh" "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" reads file "c:\users\%osuser%\microsoftedgebackups\backups\microsoftedgebackup20231002\microsoftedgefavoritesbackup.html.hpvdi8peh" "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" reads file "c:\users\%osuser%\downloads\microsoftedgesetup.exe.xlzor0p.partial.hpvdi8peh" "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" reads file "c:\users\%osuser%\documents\onenote notebooks\unfiled notes.one.hpvdi8peh" "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" reads file "c:\users\%osuser%\appdata\roaming\wireshark\recent.hpvdi8peh" "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" reads file "c:\users\%osuser%\appdata\roaming\mozilla\firefox\profiles\ywzu7870.default\search.json.mozlz4.hpvdi8peh" "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" reads file "c:\users\%osuser%\appdata\roaming\mozilla\firefox\profiles\ywzu7870.default\sessionstore-backups\previous.jsonlz4.hpvdi8peh" "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" reads file "c:\users\%osuser%\appdata\roaming\mozilla\firefox\profiles\ywzu7870.default\gmp-widevinecdm\1.4.8.1008\license.txt.hpvdi8peh" "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" reads file "c:\users\%osuser%\appdata\roaming\mozilla\firefox\profiles\ywzu7870.default\gmp-widevinecdm\1.4.8.1008\widevinecdm.dll.sig.hpvdi8peh" "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" reads file "c:\users\%osuser%\appdata\roaming\mozilla\firefox\profiles\ywzu7870.default\gmp-gmpopenh264\1.7.1\gmpopenh264.info.hpvdi8peh" "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" reads file "c:\users\%osuser%\appdata\roaming\mozilla\firefox\profiles\ywzu7870.default\datareporting\archived\2019-01\1548802337969.060851d8-e3cd-4b3b-bf31-953c9394bac3.update.jsonlz4.hpvdi8peh" "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" reads file "c:\users\%osuser%\appdata\roaming\mozilla\firefox\profiles\ywzu7870.default\datareporting\archived\2019-01\1548802343813.a5395005-91f5-4b03-a1c0-14cb14ebcc53.main.jsonlz4.hpvdi8peh" "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" reads file "c:\users\%osuser%\appdata\roaming\mozilla\firefox\profiles\ywzu7870.default\datareporting\archived\2019-01\1548806901884.c3549252-b3eb-42c8-9a2f-9187b30d48d9.main.jsonlz4.hpvdi8peh" "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" reads file "c:\users\%osuser%\appdata\roaming\mozilla\firefox\profiles\ywzu7870.default\bookmarkbackups\bookmarks-2018-07-17_14_h9tf3ab2yswviawded7aow==.jsonlz4.hpvdi8peh" "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" reads file "c:\users\%osuser%\appdata\roaming\mozilla\firefox\crash reports\installtime20180206200532.hpvdi8peh" "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" reads file "c:\users\%osuser%\appdata\roaming\macromedia\flash player\macromedia.com\support\flashplayer\sys\settings.sol.hpvdi8peh" "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" reads file "c:\users\%osuser%\appdata\roaming\macromedia\flash player\macromedia.com\support\flashplayer\sys\#www.xinhuanet.com\settings.sol.hpvdi8peh" "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" reads file "c:\users\%osuser%\appdata\roaming\macromedia\flash player\macromedia.com\support\flashplayer\sys\#www.friv.com\settings.sol.hpvdi8peh" "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" reads file "c:\users\%osuser%\appdata\roaming\macromedia\flash player\macromedia.com\support\flashplayer\sys\#v.6.cn\settings.sol.hpvdi8peh"46:T69d,"de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" trying to touch file "C:\Windows\System32\WOW64LOG.DLL" "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" trying to touch file "C:\Windows\SysWOW64\apphelp.dll" "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" trying to touch file "C:\de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" trying to touch file "C:\Windows\SysWOW64\ntdll.dll" "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" trying to touch file "C:\Windows\SysWOW64\kernel32.dll" "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" trying to touch file "C:\Windows\SysWOW64\KernelBase.dll" "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" trying to touch file "C:\Windows\apppatch\sysmain.sdb" "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" trying to touch file "C:\Windows\SysWOW64\ucrtbase.dll" "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" trying to touch file "C:\Windows\SysWOW64\msvcp_win.dll" "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" trying to touch file "C:\Windows\SysWOW64\win32u.dll" "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" trying to touch file "C:\Windows\SysWOW64\user32.dll" "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" trying to touch file "C:\Windows\SysWOW64\gdi32full.dll" "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" trying to touch file "C:\Windows\SysWOW64\gdi32.dll"47:T9bc,"de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL" "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" trying to access non-existent file "C:\FLTLIB.DLL" "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" trying to access non-existent file "C:\CRYPTSP.DLL" "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" trying to access non-existent file "C:\USERENV.DLL" "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" trying to access non-existent file "C:\userenv.dll" "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" trying to access non-existent file "C:\WTSAPI32.DLL" "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" trying to access non-existent file "C:\wtsapi32.dll" "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" trying to access non-existent file "C:\RSTRTMGR.DLL" "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" trying to access non-existent file "C:\RstrtMgr.dll" "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" trying to access non-existent file "C:\NCRYPT.DLL" "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" trying to access non-existent file "C:\ncrypt.dll" "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" trying to access non-existent file "C:\BCRYPT.DLL" "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" trying to access non-existent file "C:\bcrypt.dll" "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" trying to access non-existent file "C:\NTASN1.DLL" "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" trying to access non-existent file "C:\NTASN1.dll" "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" trying to access non-existent file "C:\NETAPI32.DLL" "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" trying to access non-existent file "C:\netapi32.dll" "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" trying to access non-existent file "C:\WKSCLI.DLL" "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" trying to access non-existent file "C:\SRVCLI.DLL" "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" trying to access non-existent file "C:\SAMCLI.DLL"48:Tbfb,"de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" writes file "c:\users\%osuser%\searches\winrt--{s-1-5-21-735145574-3570218355-1207367261-1001}-.searchconnector-ms.hpvdi8peh" "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" writes file "c:\users\%osuser%\microsoftedgebackups\backups\microsoftedgebackup20231002\microsoftedgefavoritesbackup.html.hpvdi8peh" "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" writes file "c:\users\%osuser%\favorites\bing.url.hpvdi8peh" "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" writes file "c:\users\%osuser%\downloads\microsoftedgesetup.exe.xlzor0p.partial.hpvdi8peh" "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" writes file "c:\users\%osuser%\downloads\npp.8.4.7.portable.x64.zip.hpvdi8peh" "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" writes file "c:\users\%osuser%\documents\database1.accdb.hpvdi8peh" "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" writes file "c:\users\%osuser%\documents\outlook files\outlook.pst.hpvdi8peh" "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" writes file "c:\users\%osuser%\documents\outlook files\outlook1.pst.hpvdi8peh" "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" writes file "c:\users\%osuser%\documents\onenote notebooks\unfiled notes.one.hpvdi8peh" "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" writes file "c:\users\%osuser%\documents\onenote notebooks\onenote 2010 guide\onenote guide.one.hpvdi8peh" "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" writes file "c:\users\%osuser%\documents\onenote notebooks\onenote 2010 guide\open notebook.onetoc2.hpvdi8peh" "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" writes file "c:\users\%osuser%\documents\onenote notebooks\my notebook\open notebook.onetoc2.hpvdi8peh" "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" writes file "c:\users\%osuser%\documents\onenote notebooks\my notebook\quick notes.one.hpvdi8peh" "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" writes file "c:\users\%osuser%\appdata\roaming\wireshark\recent_common.hpvdi8peh" "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" writes file "c:\users\%osuser%\appdata\roaming\mozilla\firefox\profiles.ini.hpvdi8peh" "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" writes file "c:\users\%osuser%\appdata\roaming\mozilla\firefox\profiles\ywzu7870.default\search.json.mozlz4.hpvdi8peh" "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" writes file "c:\users\%osuser%\appdata\roaming\mozilla\firefox\profiles\ywzu7870.default\sessioncheckpoints.json.hpvdi8peh" "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" writes file "c:\users\%osuser%\appdata\roaming\mozilla\firefox\profiles\ywzu7870.default\sessionstore-backups\previous.jsonlz4.hpvdi8peh"49:T673,"de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" writes a file "C:\Users\%OSUSER%\AppData\Roaming\Adobe\Acrobat\11.0\Security\services_rdr.dat.HPvdi8peh" "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" writes a file "C:\Users\%OSUSER%\AppData\Roaming\Adobe\Acrobat\11.0\Security\services_rdri.dat.HPvdi8peh" "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" writes a file "C:\Users\%OSUSER%\AppData\Roaming\Adobe\Acrobat\11.0\Security\services_rdrk.dat.HPvdi8peh" "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" writes a file "C:\Users\%OSUSER%\AppData\Local\TileDataLayer\Database\EDB.log.HPvdi8peh" "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" writes a file "C:\Users\%OSUSER%\AppData\Local\TileDataLayer\Database\EDB00002.log.HPvdi8peh" "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" writes a file "C:\Users\%OSUSER%\AppData\Local\TileDataLayer\Database\EDBtmp.log.HPvdi8peh" "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" writes a file "C:\Users\%OSUSER%\AppData\Local\Temp\vxaction.log.HPvdi8peh" "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" writes a file "%APPDATA%\Mozilla\Firefox\Profiles\ywzu7870.default\cert9.db.HPvdi8peh" "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" writes a file "%APPDATA%\Mozilla\Firefox\Profiles\ywzu7870.default\key4.db.HPvdi8peh" "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" writes a file "%APPDATA%\Mozilla\Firefox\Profiles\ywzu7870.default\pluginreg.dat.HPvdi8peh"4a:T2d12,Pattern match: "u.sf//b*^wll" Pattern match: "fzlz3ash.gd/av" Pattern match: "https://www.torproject.org/write" Pattern match: "www.xinhuanet.com\hpvdi8peh.r" Pattern match: "www.friv.com\hpvdi8peh.readme" Pattern match: "www.xinhuanet.com\hpvdi8peh.readme.txt" Pattern match: "www.xinhuanet.com\2014websit\hpvdi8peh.readme" Pattern match: "www.xinhuanet.com\2014websit\js\hpvdi8peh.rea" Pattern match: "www.xinhuanet.com\2014websit\js\kkplayer2.0_x" Pattern match: "www.friv.com\hpvdi8peh.readme.txt" Heuristic match: "\\?\%localappdata%\programs\python\python311\lib\test\test_tomllib\data\invalid\multiline-literal-str\hpvdi8peh.re" Heuristic match: "\\?\%localappdata%\programs\python\python311\lib\test\test_importlib\namespace_pkgs\both_portions\foo\hpvdi8peh.re" Heuristic match: "\\?\%localappdata%\programs\python\python311\lib\site-packages\win32\scripts\versionstamp\__pycache__\hpvdi8peh.re" Heuristic match: "\\?\%localappdata%\programs\python\python311\lib\site-packages\urllib3\packages\backports\__pycache__\hpvdi8peh.re" Heuristic match: "\\?\%localappdata%\programs\python\python311\lib\site-packages\setuptools\_vendor\importlib_resources\hpvdi8peh.re" Heuristic match: "\\?\%localappdata%\programs\python\python311\lib\site-packages\pythonwin\pywin\framework\editor\color\hpvdi8peh.re" Heuristic match: "\\?\%localappdata%\programs\python\python311\lib\site-packages\pip\_vendor\urllib3\packages\backports\hpvdi8peh.re" Heuristic match: "\?\c:\users\xh4rhxe\appdata\roaming\macromedia\flash player\macromedia.com\support\flashplayer\sys\#v.6.cn" Heuristic match: "??\c:\users\xh4rhxe\appdata\roaming\macromedia\flash player\macromedia.com\support\flashplayer\sys\#v.6.cn" Heuristic match: "\?\c:\users\xh4rhxe\appdata\roaming\macromedia\flash player\macromedia.com\support\flashplayer\sys\#an.moonbasa.com" Pattern match: "http://www.w3.org/2001/xmlschema-instance" Pattern match: "https://www.torproject.org/" Heuristic match: ":\users\xh4rhxe\appdata\roaming\macromedia\flash player\macromedia.com\support\flashplayer\sys\#v.6.cn" Pattern match: "www.friv.com\" Pattern match: "www.xinhuanet.com\settings.sol" Heuristic match: "\?\c:\users\xh4rhxe\appdata\roaming\macromedia\flash player\macromedia.com\support\flashplayer\sys\#aa.online-metrix.net" Heuristic match: "\?\c:\users\xh4rhxe\appdata\roaming\macromedia\flash player\macromedia.com\support\flashplayer\sys\#irs01.net" Heuristic match: "\?\c:\users\xh4rhxe\appdata\roaming\macromedia\flash player\macromedia.com\support\flashplayer\sys\#auction.co.kr" Heuristic match: "\?\c:\users\xh4rhxe\appdata\roaming\macromedia\flash player\macromedia.com\support\flashplayer\sys\#baifendian.com" Pattern match: "www.friv.com" Pattern match: "www.friv.com\*" Heuristic match: ":\users\xh4rhxe\appdata\roaming\macromedia\flash player\macromedia.com\support\flashplayer\sys\#tagged.com" Heuristic match: "??\c:\users\xh4rhxe\appdata\roaming\macromedia\flash player\macromedia.com\support\flashplayer\sys\#tagged.com" Heuristic match: "??\c:\users\xh4rhxe\appdata\local\programs\python\python311\lib\turtledemo\nim.py" Heuristic match: "??\c:\users\xh4rhxe\appdata\local\programs\python\python311\lib\unittest\_log.py" Heuristic match: "??\c:\users\xh4rhxe\appdata\local\programs\python\python311\lib\unittest\loader.py" Heuristic match: "\?\c:\users\xh4rhxe\appdata\local\programs\python\python311\lib\tomllib\_types.py" Heuristic match: "??\c:\users\xh4rhxe\appdata\local\programs\python\python311\lib\tomllib\_types.py" Heuristic match: "??\c:\users\xh4rhxe\appdata\local\programs\python\python311\lib\unittest\runner.py" Heuristic match: "\?\c:\users\xh4rhxe\appdata\local\programs\python\python311\lib\turtledemo\tree.py" Heuristic match: "??\c:\users\xh4rhxe\appdata\local\programs\python\python311\lib\tomllib\_parser.py" Heuristic match: "indenmayer.py" Heuristic match: "olorchooser.py" Heuristic match: "\??\c:\users\xh4rhxe\appdata\local\programs\python\python311\lib\turtledemo\__init__.py.hpvdi8peh_.py" Heuristic match: "ound_dance.py" Heuristic match: "??\c:\users\xh4rhxe\appdata\local\programs\python\python311\lib\unittest\test\testmock\testmagicmethods.py" Heuristic match: "_main__.py" Heuristic match: "_init__.py" Heuristic match: "estsentinel.py" Heuristic match: "enerate_stdlib_module_names.py" Heuristic match: "est_functiontestcase.py" Heuristic match: "estmagicmethods.py" Heuristic match: "??\c:\users\xh4rhxe\appdata\local\programs\python\python311\lib\unittest\test\testmock\testhelpers.py" Heuristic match: "osette.py" Heuristic match: "??\c:\users\xh4rhxe\appdata\local\programs\python\python311\lib\unittest\test\testmock\testasync.py" Heuristic match: "??\c:\users\xh4rhxe\appdata\local\programs\python\python311\lib\unittest\test\test_functiontestcase.py" Heuristic match: "??\c:\users\xh4rhxe\appdata\local\programs\python\python311\lib\unittest\test\testmock\__main__.py" Heuristic match: "??\c:\users\xh4rhxe\appdata\local\programs\python\python311\lib\unittest\test\testmock\testsentinel.py" Heuristic match: "\?\c:\users\xh4rhxe\appdata\local\programs\python\python311\lib\sqlite3\dump.py" Heuristic match: "??\c:\users\xh4rhxe\appdata\local\programs\python\python311\lib\sqlite3\dbapi2.py" Heuristic match: "??\c:\users\xh4rhxe\appdata\local\programs\python\python311\lib\sqlite3\dump.py" Heuristic match: "??\c:\users\xh4rhxe\appdata\local\programs\python\python311\lib\site-packages\setuptools\_vendor\tomli\_re.py" Heuristic match: "??\c:\users\xh4rhxe\appdata\local\programs\python\python311\lib\site-packages\setuptools\unicode_utils.py" Heuristic match: "\?\c:\users\xh4rhxe\appdata\local\programs\python\python311\lib\site-packages\setuptools\_entry_points.py" Heuristic match: "??\c:\users\xh4rhxe\appdata\local\programs\python\python311\lib\site-packages\setuptools\_entry_points.py" Heuristic match: "??\c:\users\xh4rhxe\appdata\local\programs\python\python311\lib\site-packages\setuptools\_vendor\zipp.py" Heuristic match: "\?\c:\users\xh4rhxe\appdata\local\programs\python\python311\lib\site-packages\setuptools\_vendor\zipp.py" Heuristic match: "policy_info.py" Heuristic match: "??\c:\users\xh4rhxe\appdata\local\programs\python\python311\lib\site-packages\setuptools\_vendor\jaraco\text\__init__.py" Heuristic match: "??\c:\users\xh4rhxe\appdata\local\programs\python\python311\lib\site-packages\setuptools\_vendor\more_itertools\more.py" Heuristic match: "??\c:\users\xh4rhxe\appdata\local\programs\python\python311\lib\site-packages\setuptools\_vendor\more_itertools\recipes.py" Heuristic match: "??\c:\users\xh4rhxe\appdata\local\programs\python\python311\lib\site-packages\setuptools\_vendor\packaging\_structures.py" Heuristic match: "??\c:\users\xh4rhxe\appdata\local\programs\python\python311\lib\site-packages\setuptools\_vendor\packaging\_musllinux.py" Heuristic match: "??\c:\users\xh4rhxe\appdata\local\programs\python\python311\lib\site-packages\setuptools\_vendor\packaging\__about__.py" Heuristic match: "??\c:\users\xh4rhxe\appdata\local\programs\python\python311\lib\site-packages\setuptools\_vendor\packaging\specifiers.py" Heuristic match: "??\c:\users\xh4rhxe\appdata\local\programs\python\python311\lib\site-packages\setuptools\_vendor\pyparsing\exceptions.py" Heuristic match: "\?\c:\users\xh4rhxe\appdata\local\programs\python\python311\lib\site-packages\setuptools\_vendor\packaging\_manylinux.py" Heuristic match: "\?\c:\users\xh4rhxe\appdata\local\programs\python\python311\lib\site-packages\setuptools\_vendor\more_itertools\more.py" Heuristic match: "\?\c:\users\xh4rhxe\appdata\local\programs\python\python311\lib\site-packages\setuptools\_vendor\packaging\_musllinux.py" Heuristic match: "??\c:\users\xh4rhxe\appdata\local\programs\python\python311\lib\site-packages\setuptools\_vendor\packaging\_manylinux.py" Heuristic match: "\?\c:\users\xh4rhxe\appdata\local\programs\python\python311\lib\site-packages\setuptools\_vendor\jaraco\text\__init__.py" Heuristic match: "\?\c:\users\xh4rhxe\appdata\local\programs\python\python311\lib\site-packages\setuptools\_vendor\more_itertools\recipes.py" Heuristic match: "\?\c:\users\xh4rhxe\appdata\local\programs\python\python311\lib\site-packages\setuptools\_vendor\importlib_resources\readers.py" Heuristic match: "??\c:\users\xh4rhxe\appdata\local\programs\python\python311\lib\site-packages\setuptools\_vendor\importlib_resources\readers.py" Heuristic match: "??\c:\users\xh4rhxe\appdata\local\programs\python\python311\lib\site-packages\setuptools\_vendor\importlib_resources\abc.py" Heuristic match: "\?\c:\users\xh4rhxe\appdata\local\programs\python\python311\lib\site-packages\setuptools\_vendor\importlib_resources\simple.py" Heuristic match: "??\c:\users\xh4rhxe\appdata\local\programs\python\python311\lib\site-packages\setuptools\_vendor\importlib_resources\simple.py" Heuristic match: "at.py" Heuristic match: "??\c:\users\xh4rhxe\appdata\local\programs\python\python311\lib\site-packages\setuptools\msvc.py" Heuristic match: "??\c:\users\xh4rhxe\appdata\local\programs\python\python311\lib\site-packages\setuptools\__init__.py" Heuristic match: "??\c:\users\xh4rhxe\appdata\local\programs\python\python311\lib\site-packages\setuptools\version.py" Heuristic match: "l\programs\python\python311\lib\test\test_wait4.py" Heuristic match: "??\c:\users\xh4rhxe\appdata\local\programs\python\python311\lib\test\test_wave.py" Heuristic match: "\?\c:\users\xh4rhxe\appdata\local\programs\python\python311\lib\test\test_with.py" Heuristic match: "??\c:\users\xh4rhxe\appdata\local\programs\python\python311\lib\test\test_wait4.py" Heuristic match: "??\c:\users\xh4rhxe\appdata\local\programs\python\python311\lib\test\test_with.py" Heuristic match: "??\c:\users\xh4rhxe\appdata\local\programs\python\python311\lib\test\test_uu.py" Heuristic match: "??\c:\users\xh4rhxe\appdata\local\programs\python\python311\lib\test\test_wait3.py" Heuristic match: "??\c:\users\xh4rhxe\appdata\local\programs\python\python311\lib\test\test_uuid.py" Heuristic match: "hxe\appdata\local\programs\python\python311\lib\test\test_with.py" Heuristic match: "??\c:\users\xh4rhxe\appdata\local\programs\python\python311\lib\test\__init__.py" Heuristic match: "??\c:\users\xh4rhxe\appdata\local\programs\python\python311\lib\test\__main__.py" Heuristic match: "??\c:\users\xh4rhxe\appdata\local\programs\python\python311\lib\test\test_zlib.py" Heuristic match: "uptools\_reqs.py" Heuristic match: "lib3\util\wait.py" Heuristic match: "uptools\_path.py" Heuristic match: "uptools\wheel.py" Heuristic match: "uptools\monkey.py" Heuristic match: "uptools\_imp.py" Heuristic match: "bc.py" Heuristic match: "??\c:\users\xh4rhxe\appdata\local\programs\python\python311\lib\site-packages\setuptools\_vendor\jaraco\context.py" Heuristic match: "??\c:\users\xh4rhxe\appdata\local\programs\python\python311\lib\site-packages\setuptools\_vendor\packaging\tags.py" Heuristic match: "\?\c:\users\xh4rhxe\appdata\local\programs\python\python311\lib\site-packages\setuptools\_vendor\ordered_set.py" Heuristic match: "??\c:\users\xh4rhxe\appdata\local\programs\python\python311\lib\site-packages\setuptools\_vendor\pyparsing\core.py" Heuristic match: "??\c:\users\xh4rhxe\appdata\local\programs\python\python311\lib\site-packages\setuptools\_vendor\pyparsing\util.py" Heuristic match: "imple.py" Heuristic match: "eaders.py" Heuristic match: "t__.py" Heuristic match: "??\c:\users\xh4rhxe\appdata\local\programs\python\python311\lib\site-packages\pythoncom.py"4b:Tebc,"de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" called "FindFirstFileW" with parameter %WINDIR%\System32\*.dll (UID: 00000000-00003504) "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" called "FindNextFileW" with parameter aadtb.dll (UID: 00000000-00003504) "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" called "FindNextFileW" with parameter AboveLockAppHost.dll (UID: 00000000-00003504) "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" called "FindNextFileW" with parameter accessibilitycpl.dll (UID: 00000000-00003504) "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" called "FindNextFileW" with parameter accountaccessor.dll (UID: 00000000-00003504) "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" called "FindNextFileW" with parameter AccountsRt.dll (UID: 00000000-00003504) "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" called "FindNextFileW" with parameter AcGenral.dll (UID: 00000000-00003504) "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" called "FindNextFileW" with parameter AcLayers.dll (UID: 00000000-00003504) "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" called "FindNextFileW" with parameter acledit.dll (UID: 00000000-00003504) "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" called "FindNextFileW" with parameter aclui.dll (UID: 00000000-00003504) "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" called "FindNextFileW" with parameter acppage.dll (UID: 00000000-00003504) "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" called "FindNextFileW" with parameter AcSpecfc.dll (UID: 00000000-00003504) "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" called "FindNextFileW" with parameter ActionCenter.dll (UID: 00000000-00003504) "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" called "FindNextFileW" with parameter ActionCenterCPL.dll (UID: 00000000-00003504) "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" called "FindNextFileW" with parameter ActivationClient.dll (UID: 00000000-00003504) "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" called "FindNextFileW" with parameter ActivationManager.dll (UID: 00000000-00003504) "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" called "FindNextFileW" with parameter activeds.dll (UID: 00000000-00003504) "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" called "FindNextFileW" with parameter ActiveSyncProvider.dll (UID: 00000000-00003504) "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" called "FindNextFileW" with parameter actxprxy.dll (UID: 00000000-00003504) "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" called "FindNextFileW" with parameter AcWinRT.dll (UID: 00000000-00003504) "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" called "FindNextFileW" with parameter acwow64.dll (UID: 00000000-00003504) "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" called "FindNextFileW" with parameter AcXtrnal.dll (UID: 00000000-00003504) "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" called "FindNextFileW" with parameter AdaptiveCards.dll (UID: 00000000-00003504) "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" called "FindNextFileW" with parameter AddressParser.dll (UID: 00000000-00003504) "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" called "FindNextFileW" with parameter AdmTmpl.dll (UID: 00000000-00003504)4c:T8f3,Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00003504.00000000.129037.02690000.00000004.mdmp, 00000000-00003504.00000001.130959.02690000.00000004.mdmp, 00000000-00003504.00000002.132877.02690000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00003504.00000000.129037.02690000.00000004.mdmp, 00000000-00003504.00000001.130959.02690000.00000004.mdmp, 00000000-00003504.00000002.132877.02690000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00003504.00000000.129037.02690000.00000004.mdmp, 00000000-00003504.00000001.130959.02690000.00000004.mdmp, 00000000-00003504.00000002.132877.02690000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00003504.00000000.129037.02690000.00000004.mdmp, 00000000-00003504.00000001.130959.02690000.00000004.mdmp, 00000000-00003504.00000002.132877.02690000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00003504.00000000.129037.02690000.00000004.mdmp, 00000000-00003504.00000001.130959.02690000.00000004.mdmp, 00000000-00003504.00000002.132877.02690000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00003504.00000000.129037.02690000.00000004.mdmp, 00000000-00003504.00000001.130959.02690000.00000004.mdmp, 00000000-00003504.00000002.132877.02690000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00003504.00000000.129037.02690000.00000004.mdmp, 00000000-00003504.00000001.130959.02690000.00000004.mdmp, 00000000-00003504.00000002.132877.02690000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00003504.00000000.129037.02690000.00000004.mdmp, 00000000-00003504.00000001.130959.02690000.00000004.mdmp, 00000000-00003504.00000002.132877.02690000.00000004.mdmp")4d:T1326,Found reference to API "11859325102,656,3118,,FindNextFileW,kernel32.dll,"00:33:36.187",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00003504.00000000.129037.02690000.00000004.mdmp") Found reference to API "11821249129,656,3118,,FindNextFileW,kernel32.dll,"00:33:36.171",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00003504.00000000.129037.02690000.00000004.mdmp") Found reference to API "11859696910,656,3118,,FindNextFileW,kernel32.dll,"00:33:36.187",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00003504.00000000.129037.02690000.00000004.mdmp") Found reference to API "11741935056,656,3118,,FindNextFileW,kernel32.dll,"00:33:36.140",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00003504.00000000.129037.02690000.00000004.mdmp") Found reference to API "11821075861,656,3118,,FindNextFileW,kernel32.dll,"00:33:36.171",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00003504.00000000.129037.02690000.00000004.mdmp") Found reference to API "11859206046,656,3118,,FindNextFileW,kernel32.dll,"00:33:36.187",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00003504.00000000.129037.02690000.00000004.mdmp") Found reference to API "11804462378,656,3118,,FindNextFileW,kernel32.dll,"00:33:36.171",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00003504.00000000.129037.02690000.00000004.mdmp") Found reference to API "11548588366,656,3118,,FindNextFileW,kernel32.dll,"00:33:36.062",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00003504.00000000.129037.02690000.00000004.mdmp") Found reference to API "11781647832,656,3118,,FindNextFileW,kernel32.dll,"00:33:36.156",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00003504.00000000.129037.02690000.00000004.mdmp") Found reference to API "11843807919,656,3118,,FindNextFileW,kernel32.dll,"00:33:36.187",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00003504.00000000.129037.02690000.00000004.mdmp") Found reference to API "83829389177,656,3118,,FindNextFileW,kernel32.dll,"00:34:06.187",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00003504.00000001.130959.02690000.00000004.mdmp") Found reference to API "83225284215,656,3118,,FindNextFileW,kernel32.dll,"00:34:05.921",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00003504.00000001.130959.02690000.00000004.mdmp") Found reference to API "83829228153,656,3118,,FindNextFileW,kernel32.dll,"00:34:06.187",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00003504.00000001.130959.02690000.00000004.mdmp") Found reference to API "83871641349,656,3118,,FindNextFileW,kernel32.dll,"00:34:06.203",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00003504.00000001.130959.02690000.00000004.mdmp") Found reference to API "83917354540,656,3118,,FindNextFileW,kernel32.dll,"00:34:06.218",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00003504.00000001.130959.02690000.00000004.mdmp") Found reference to API "83852437713,656,3118,,FindNextFileW,kernel32.dll,"00:34:06.187",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00003504.00000001.130959.02690000.00000004.mdmp") Found reference to API "83917274974,656,3118,,FindNextFileW,kernel32.dll,"00:34:06.218",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00003504.00000001.130959.02690000.00000004.mdmp") Found reference to API "83799138735,656,3118,,FindNextFileW,kernel32.dll,"00:34:06.171",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00003504.00000001.130959.02690000.00000004.mdmp") Found reference to API "83902378165,656,3118,,FindNextFileW,kernel32.dll,"00:34:06.218",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00003504.00000001.130959.02690000.00000004.mdmp") Found reference to API "83932487910,656,3118,,FindNextFileW,kernel32.dll,"00:34:06.218",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00003504.00000001.130959.02690000.00000004.mdmp") Found reference to API "83932582002,656,3118,,FindNextFileW,kernel32.dll,"00:34:06.218",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00003504.00000001.130959.02690000.00000004.mdmp") Found reference to API "155604874708,656,3118,,FindNextFileW,kernel32.dll,"00:34:36.093",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00003504.00000002.132877.02690000.00000004.mdmp") Found reference to API "155750892278,656,3118,,FindNextFileW,kernel32.dll,"00:34:36.140",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00003504.00000002.132877.02690000.00000004.mdmp") Found reference to API "155709817291,656,3118,,FindNextFileW,kernel32.dll,"00:34:36.125",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00003504.00000002.132877.02690000.00000004.mdmp") Found reference to API "155819386040,656,3118,,FindNextFileW,kernel32.dll,"00:34:36.171",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00003504.00000002.132877.02690000.00000004.mdmp")4e:T14b2,"de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LANMANWORKSTATION\PARAMETERS"; Key: "RPCCACHETIMEOUT"; Value: "") "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "LDAPCLIENTINTEGRITY"; Value: "") "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "USEOLDHOSTRESOLUTIONORDER"; Value: "") "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "USEHOSTNAMEASALIAS"; Value: "") "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000003"; Key: "PACKEDCATALOGITEM"; Value: "") "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000005"; Key: "PACKEDCATALOGITEM"; Value: "") "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000008"; Key: "PACKEDCATALOGITEM"; Value: "") "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000013"; Key: "PACKEDCATALOGITEM"; Value: "") "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\NAMESPACE_CATALOG5\CATALOG_ENTRIES\000000000001"; Key: "VERSION"; Value: "") "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\NAMESPACE_CATALOG5\CATALOG_ENTRIES\000000000002"; Key: "DISPLAYSTRING"; Value: "") "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\NAMESPACE_CATALOG5\CATALOG_ENTRIES\000000000002"; Key: "PROVIDERINFO"; Value: "") "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\NAMESPACE_CATALOG5\CATALOG_ENTRIES\000000000003"; Key: "DISPLAYSTRING"; Value: "") "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\NAMESPACE_CATALOG5\CATALOG_ENTRIES\000000000003"; Key: "STORESSERVICECLASSINFO"; Value: "") "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\NAMESPACE_CATALOG5\CATALOG_ENTRIES\000000000005"; Key: "PROVIDERID"; Value: "") "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "USEDOMAINNAMEDEVOLUTION"; Value: "") "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "SCREENUNREACHABLESERVERS"; Value: "") "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "DIRECTACCESSQUERYORDER"; Value: "") "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "PREFERLOCALOVERLOWERBINDINGDNS"; Value: "") "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "UDPRECVBUFFERSIZE"; Value: "") "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "REGISTERADAPTERNAME"; Value: "") "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "REGISTERREVERSELOOKUP"; Value: "") "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "DNSTEST"; Value: "") "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "RESOLVERREGISTRATIONONLY"; Value: "") "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\PROGRAMDATA\9ED.TMP"; Value: "")4f:T12ef,Dropped file: "places.sqlite.HPvdi8peh" - Location: [%APPDATA%\Mozilla\Firefox\Profiles\ywzu7870.default\places.sqlite.HPvdi8peh]- [targetUID: 00000000-00003504] Dropped file: "data_1.HPvdi8peh" - Location: [%LOCALAPPDATA%\Google\Chrome\User Data\GrShaderCache\data_1.HPvdi8peh]- [targetUID: 00000000-00003504] Dropped file: "object.html.HPvdi8peh" - Location: [%LOCALAPPDATA%\Programs\Python\Python311\Doc\html\c-api\object.html.HPvdi8peh]- [targetUID: 00000000-00003504] Dropped file: "langthaimodel.cpython-311.pyc.HPvdi8peh" - Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\pip\_vendor\chardet\__pycache__\langthaimodel.cpython-311.pyc.HPvdi8peh]- [targetUID: 00000000-00003504] Dropped file: "test_tracemalloc.py.HPvdi8peh" - Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\test\test_tracemalloc.py.HPvdi8peh]- [targetUID: 00000000-00003504] Dropped file: "_collections_abc.py.HPvdi8peh" - Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\_collections_abc.py.HPvdi8peh]- [targetUID: 00000000-00003504] Dropped file: "build.cpython-311.pyc.HPvdi8peh" - Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\win32com\client\__pycache__\build.cpython-311.pyc.HPvdi8peh]- [targetUID: 00000000-00003504] Dropped file: "live.cpython-311.pyc.HPvdi8peh" - Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\pip\_vendor\rich\__pycache__\live.cpython-311.pyc.HPvdi8peh]- [targetUID: 00000000-00003504] Dropped file: "test_binascii.py.HPvdi8peh" - Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\test\test_binascii.py.HPvdi8peh]- [targetUID: 00000000-00003504] Dropped file: "util.cpython-311.pyc.HPvdi8peh" - Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\pkg_resources\_vendor\pyparsing\__pycache__\util.cpython-311.pyc.HPvdi8peh]- [targetUID: 00000000-00003504] Dropped file: "hierlist.py.HPvdi8peh" - Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\pythonwin\pywin\tools\hierlist.py.HPvdi8peh]- [targetUID: 00000000-00003504] Dropped file: "core.cpython-311.pyc.HPvdi8peh" - Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\setuptools\_distutils\__pycache__\core.cpython-311.pyc.HPvdi8peh]- [targetUID: 00000000-00003504] Dropped file: "crypto_scalarmult.py.HPvdi8peh" - Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\nacl\bindings\crypto_scalarmult.py.HPvdi8peh]- [targetUID: 00000000-00003504] Dropped file: "test_poll.py.HPvdi8peh" - Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\test\test_poll.py.HPvdi8peh]- [targetUID: 00000000-00003504] Dropped file: "utils.cpython-311.pyc.HPvdi8peh" - Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\nacl\bindings\__pycache__\utils.cpython-311.pyc.HPvdi8peh]- [targetUID: 00000000-00003504] Dropped file: "test___package__.py.HPvdi8peh" - Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\test\test_importlib\import_\test___package__.py.HPvdi8peh]- [targetUID: 00000000-00003504] Dropped file: "test_pstats.py.HPvdi8peh" - Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\test\test_pstats.py.HPvdi8peh]- [targetUID: 00000000-00003504] Dropped file: "base.cpython-311.pyc.HPvdi8peh" - Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\pip\_internal\locations\__pycache__\base.cpython-311.pyc.HPvdi8peh]- [targetUID: 00000000-00003504] Dropped file: "test_bdist_dumb.py.HPvdi8peh" - Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\distutils\tests\test_bdist_dumb.py.HPvdi8peh]- [targetUID: 00000000-00003504] Dropped file: "cmdline.cpython-311.pyc.HPvdi8peh" - Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\pythonwin\pywin\framework\__pycache__\cmdline.cpython-311.pyc.HPvdi8peh]- [targetUID: 00000000-00003504] Dropped file: "HPvdi8peh.README.txt" - Location: [%LOCALAPPDATA%\Packages\Microsoft.VCLibs.140.00.UWPDesktop_8wekyb3d8bbwe\AC\Temp\HPvdi8peh.README.txt]- [targetUID: 00000000-00003504] Dropped file: "__init__.cpython-311.pyc.HPvdi8peh" - Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\setuptools\command\__pycache__\__init__.cpython-311.pyc.HPvdi8peh]- [targetUID: 00000000-00003504] Dropped file: "__init__.py.HPvdi8peh" - Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\setuptools\_vendor\packaging\__init__.py.HPvdi8peh]- [targetUID: 00000000-00003504] Dropped file: "__init__.cpython-311.pyc.HPvdi8peh" - Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\urllib3\contrib\__pycache__\__init__.cpython-311.pyc.HPvdi8peh]- [targetUID: 00000000-00003504] Dropped file: "Thimphu.HPvdi8peh" - Location: [%LOCALAPPDATA%\Programs\Python\Python311\tcl\tcl8.6\tzdata\Asia\Thimphu.HPvdi8peh]- [targetUID: 00000000-00003504]50:Tf34,Dropped file "%USERPROFILE%\Documents\OneNote Notebooks\OneNote 2010 Guide\OneNote Guide.one.HPvdi8peh" has high entropy 7.948055693887378 Dropped file "%LOCALAPPDATA%\Google\Chrome\User Data\GrShaderCache\data_1.HPvdi8peh" has high entropy 7.999274651318216 Dropped file "%LOCALAPPDATA%\Programs\Python\Python311\Doc\html\c-api\object.html.HPvdi8peh" has high entropy 7.997701699714876 Dropped file "%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\pip\_vendor\chardet\__pycache__\langthaimodel.cpython-311.pyc.HPvdi8peh" has high entropy 7.997902605739075 Dropped file "%LOCALAPPDATA%\Programs\Python\Python311\Lib\test\test_tracemalloc.py.HPvdi8peh" has high entropy 7.995403985518604 Dropped file "%LOCALAPPDATA%\Programs\Python\Python311\Lib\_collections_abc.py.HPvdi8peh" has high entropy 7.994027145302226 Dropped file "%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\win32com\client\__pycache__\build.cpython-311.pyc.HPvdi8peh" has high entropy 7.99383680792551 Dropped file "%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\pip\_vendor\rich\__pycache__\live.cpython-311.pyc.HPvdi8peh" has high entropy 7.990304960400469 Dropped file "%LOCALAPPDATA%\Programs\Python\Python311\Lib\test\test_binascii.py.HPvdi8peh" has high entropy 7.991420762387056 Dropped file "%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\pkg_resources\_vendor\pyparsing\__pycache__\util.cpython-311.pyc.HPvdi8peh" has high entropy 7.987851936845277 Dropped file "%ALLUSERSPROFILE%\9ED.tmp" has high entropy 7.4998500975364095 Dropped file "%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\pythonwin\pywin\tools\hierlist.py.HPvdi8peh" has high entropy 7.984528091524998 Dropped file "%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\setuptools\_distutils\__pycache__\core.cpython-311.pyc.HPvdi8peh" has high entropy 7.982932723959832 Dropped file "%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\nacl\bindings\crypto_scalarmult.py.HPvdi8peh" has high entropy 7.975166548579883 Dropped file "%LOCALAPPDATA%\Programs\Python\Python311\Lib\test\test_poll.py.HPvdi8peh" has high entropy 7.97427912889229 Dropped file "%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\nacl\bindings\__pycache__\utils.cpython-311.pyc.HPvdi8peh" has high entropy 7.973156134611986 Dropped file "%LOCALAPPDATA%\Programs\Python\Python311\Lib\test\test_importlib\import_\test___package__.py.HPvdi8peh" has high entropy 7.976327589615859 Dropped file "%LOCALAPPDATA%\Programs\Python\Python311\Lib\test\test_pstats.py.HPvdi8peh" has high entropy 7.959564157955567 Dropped file "%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\pip\_internal\locations\__pycache__\base.cpython-311.pyc.HPvdi8peh" has high entropy 7.955723595661193 Dropped file "%LOCALAPPDATA%\Programs\Python\Python311\Lib\distutils\tests\test_bdist_dumb.py.HPvdi8peh" has high entropy 7.944187354144319 Dropped file "%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\pythonwin\pywin\framework\__pycache__\cmdline.cpython-311.pyc.HPvdi8peh" has high entropy 7.93182225852132 Dropped file "%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\setuptools\command\__pycache__\__init__.cpython-311.pyc.HPvdi8peh" has high entropy 7.7768033111683295 Dropped file "%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\setuptools\_vendor\packaging\__init__.py.HPvdi8peh" has high entropy 7.75970977973932 Dropped file "%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\urllib3\contrib\__pycache__\__init__.cpython-311.pyc.HPvdi8peh" has high entropy 7.535408358990844 Dropped file "%LOCALAPPDATA%\Programs\Python\Python311\tcl\tcl8.6\tzdata\Asia\Thimphu.HPvdi8peh" has high entropy 7.496925922883933 Dropped file "%LOCALAPPDATA%\Programs\Python\Python311\Lib\test\xmltestdata\simple-ns.xml.HPvdi8peh" has high entropy 7.410977233168889551:T15c8,"places.sqlite.HPvdi8peh" has type "DOS executable (COM)"- Location: [%APPDATA%\Mozilla\Firefox\Profiles\ywzu7870.default\places.sqlite.HPvdi8peh]- [targetUID: 00000000-00003504] "data_1.HPvdi8peh" has type "DOS executable (COM)"- Location: [%LOCALAPPDATA%\Google\Chrome\User Data\GrShaderCache\data_1.HPvdi8peh]- [targetUID: 00000000-00003504] "object.html.HPvdi8peh" has type "DOS executable (COM)"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Doc\html\c-api\object.html.HPvdi8peh]- [targetUID: 00000000-00003504] "langthaimodel.cpython-311.pyc.HPvdi8peh" has type "DOS executable (COM)"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\pip\_vendor\chardet\__pycache__\langthaimodel.cpython-311.pyc.HPvdi8peh]- [targetUID: 00000000-00003504] "test_tracemalloc.py.HPvdi8peh" has type "DOS executable (COM)"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\test\test_tracemalloc.py.HPvdi8peh]- [targetUID: 00000000-00003504] "_collections_abc.py.HPvdi8peh" has type "DOS executable (COM)"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\_collections_abc.py.HPvdi8peh]- [targetUID: 00000000-00003504] "build.cpython-311.pyc.HPvdi8peh" has type "DOS executable (COM)"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\win32com\client\__pycache__\build.cpython-311.pyc.HPvdi8peh]- [targetUID: 00000000-00003504] "live.cpython-311.pyc.HPvdi8peh" has type "DOS executable (COM)"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\pip\_vendor\rich\__pycache__\live.cpython-311.pyc.HPvdi8peh]- [targetUID: 00000000-00003504] "test_binascii.py.HPvdi8peh" has type "DOS executable (COM)"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\test\test_binascii.py.HPvdi8peh]- [targetUID: 00000000-00003504] "util.cpython-311.pyc.HPvdi8peh" has type "DOS executable (COM)"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\pkg_resources\_vendor\pyparsing\__pycache__\util.cpython-311.pyc.HPvdi8peh]- [targetUID: 00000000-00003504] "9ED.tmp" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%ALLUSERSPROFILE%\9ED.tmp]- [targetUID: 00000000-00003504] "hierlist.py.HPvdi8peh" has type "DOS executable (COM)"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\pythonwin\pywin\tools\hierlist.py.HPvdi8peh]- [targetUID: 00000000-00003504] "core.cpython-311.pyc.HPvdi8peh" has type "DOS executable (COM)"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\setuptools\_distutils\__pycache__\core.cpython-311.pyc.HPvdi8peh]- [targetUID: 00000000-00003504] "crypto_scalarmult.py.HPvdi8peh" has type "DOS executable (COM)"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\nacl\bindings\crypto_scalarmult.py.HPvdi8peh]- [targetUID: 00000000-00003504] "test_poll.py.HPvdi8peh" has type "DOS executable (COM)"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\test\test_poll.py.HPvdi8peh]- [targetUID: 00000000-00003504] "6C5ABAD761F989B263EB9F0911CB84A3994590EC.HPvdi8peh" has type "COM executable for MS-DOS"- [targetUID: N/A] "utils.cpython-311.pyc.HPvdi8peh" has type "DOS executable (COM)"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\nacl\bindings\__pycache__\utils.cpython-311.pyc.HPvdi8peh]- [targetUID: 00000000-00003504] "test___package__.py.HPvdi8peh" has type "DOS executable (COM)"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\test\test_importlib\import_\test___package__.py.HPvdi8peh]- [targetUID: 00000000-00003504] "test_pstats.py.HPvdi8peh" has type "DOS executable (COM)"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\test\test_pstats.py.HPvdi8peh]- [targetUID: 00000000-00003504] "base.cpython-311.pyc.HPvdi8peh" has type "DOS executable (COM)"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\pip\_internal\locations\__pycache__\base.cpython-311.pyc.HPvdi8peh]- [targetUID: 00000000-00003504] "test_bdist_dumb.py.HPvdi8peh" has type "DOS executable (COM)"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\distutils\tests\test_bdist_dumb.py.HPvdi8peh]- [targetUID: 00000000-00003504] "cmdline.cpython-311.pyc.HPvdi8peh" has type "DOS executable (COM)"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\pythonwin\pywin\framework\__pycache__\cmdline.cpython-311.pyc.HPvdi8peh]- [targetUID: 00000000-00003504] "__init__.cpython-311.pyc.HPvdi8peh" has type "DOS executable (COM)"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\setuptools\command\__pycache__\__init__.cpython-311.pyc.HPvdi8peh]- [targetUID: 00000000-00003504] "__init__.py.HPvdi8peh" has type "DOS executable (COM)"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\setuptools\_vendor\packaging\__init__.py.HPvdi8peh]- [targetUID: 00000000-00003504] "model-info.pb.HPvdi8peh" has type "DOS executable (COM)"- [targetUID: 00000000-00003504] "__init__.cpython-311.pyc.HPvdi8peh" has type "DOS executable (COM)"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\urllib3\contrib\__pycache__\__init__.cpython-311.pyc.HPvdi8peh]- [targetUID: 00000000-00003504] "Thimphu.HPvdi8peh" has type "DOS executable (COM)"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\tcl\tcl8.6\tzdata\Asia\Thimphu.HPvdi8peh]- [targetUID: 00000000-00003504] "simple-ns.xml.HPvdi8peh" has type "DOS executable (COM)"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\test\xmltestdata\simple-ns.xml.HPvdi8peh]- [targetUID: 00000000-00003504]52:T1108,"de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" opened "C:\Users\%OSUSER%\Searches\Microsoft Office Outlook.searchconnector-ms" with delete access "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" opened "C:\Users\%OSUSER%\Searches\Microsoft OneNote.searchconnector-ms" with delete access "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" opened "C:\Users\%OSUSER%\Searches\winrt--{S-1-5-21-735145574-3570218355-1207367261-1001}-.searchconnector-ms" with delete access "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" opened "C:\Users\%OSUSER%\MicrosoftEdgeBackups\backups\MicrosoftEdgeBackup20231002\MicrosoftEdgeFavoritesBackup.html" with delete access "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" opened "C:\Users\%OSUSER%\Favorites\Bing.url" with delete access "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" opened "C:\Users\%OSUSER%\Downloads\MicrosoftEdgeSetup.exe.xlzor0p.partial" with delete access "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" opened "C:\Users\%OSUSER%\Downloads\npp.8.4.7.portable.x64.zip" with delete access "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" opened "C:\Users\%OSUSER%\Documents\Database1.accdb" with delete access "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" opened "C:\Users\%OSUSER%\Documents\Outlook Files\Outlook.pst" with delete access "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" opened "C:\Users\%OSUSER%\Documents\Outlook Files\Outlook1.pst" with delete access "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" opened "C:\Users\%OSUSER%\Documents\OneNote Notebooks\Unfiled Notes.one" with delete access "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" opened "C:\Users\%OSUSER%\Documents\OneNote Notebooks\OneNote 2010 Guide\OneNote Guide.one" with delete access "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" opened "C:\Users\%OSUSER%\Documents\OneNote Notebooks\OneNote 2010 Guide\Open Notebook.onetoc2" with delete access "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" opened "C:\Users\%OSUSER%\Documents\OneNote Notebooks\My Notebook\Open Notebook.onetoc2" with delete access "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" opened "C:\Users\%OSUSER%\Documents\OneNote Notebooks\My Notebook\Quick Notes.one" with delete access "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" opened "C:\Users\%OSUSER%\AppData\Roaming\Wireshark\recent" with delete access "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" opened "C:\Users\%OSUSER%\AppData\Roaming\Wireshark\recent_common" with delete access "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" opened "C:\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\profiles.ini" with delete access "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" opened "C:\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Profiles\ywzu7870.default\addons.json" with delete access "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" opened "C:\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Profiles\ywzu7870.default\addonStartup.json.lz4" with delete access "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" opened "C:\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Profiles\ywzu7870.default\blocklist.xml" with delete access "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" opened "C:\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Profiles\ywzu7870.default\cert9.db" with delete access "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" opened "C:\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Profiles\ywzu7870.default\compatibility.ini" with delete access "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" opened "C:\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Profiles\ywzu7870.default\containers.json" with delete access "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" opened "C:\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Profiles\ywzu7870.default\content-prefs.sqlite" with delete access53:Tb09,"de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\profiles.ini" "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\profiles.ini.HPvdi8peh" "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Profiles\ywzu7870.default\addons.json" "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Profiles\ywzu7870.default\addons.json.HPvdi8peh" "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Profiles\ywzu7870.default\addonStartup.json.lz4" "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Profiles\ywzu7870.default\addonStartup.json.lz4.HPvdi8peh" "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Profiles\ywzu7870.default\blocklist.xml" "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Profiles\ywzu7870.default\blocklist.xml.HPvdi8peh" "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Profiles\ywzu7870.default\cert9.db" "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Profiles\ywzu7870.default\cert9.db.HPvdi8peh" "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Profiles\ywzu7870.default\compatibility.ini" "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Profiles\ywzu7870.default\compatibility.ini.HPvdi8peh" "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Profiles\ywzu7870.default\containers.json" "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Profiles\ywzu7870.default\containers.json.HPvdi8peh" "de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Profiles\ywzu7870.default\content-prefs.sqlite"30:["$","$Lc",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$33"}}],["$","$L35",null,{"initialData":{"schema_version":"1.0.17","sha256":"de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1793890074966,"unified_at":"2026-11-05T14:47:54.966Z","metadata":{"hashes":{"sha256":"de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62","sha1":"202307528cfd6cc5d35d3d459f9fbe714ac8937c","md5":"396443e02532fb4a5da590188b708548","sha512":"4191d5a05f43698e1901a63b5b7bef3a783277835c3005587ebbb768cf70d3d20c298fc6dc000978134346c43e6efb0c1823be66b699fb52c676bc795c2fb62b","ssdeep":"3072:y6glyuxE4GsUPnliByocWepqvKQoWQqcd:y6gDBGpvEByocWeovK2bcd","ssdeep_chunks":["3072:y6glyux","3072:6glyuxE","3072:glyuxE4","3072:lyuxE4G","3072:yuxE4Gs","3072:uxE4GsU","3072:xE4GsUP","3072:E4GsUPn","3072:4GsUPnl","3072:GsUPnli","3072:sUPnliB","3072:UPnliBy","3072:PnliByo","3072:nliByoc","3072:liByocW","3072:iByocWe","3072:ByocWep","3072:yocWepq","3072:ocWepqv","3072:cWepqvK","3072:WepqvKQ","3072:epqvKQo","3072:pqvKQoW","3072:qvKQoWQ","3072:vKQoWQq","3072:KQoWQqc","3072:QoWQqcd","6144:y6glyux","6144:6glyuxE","6144:glyuxE4","6144:lyuxE4G","6144:yuxE4Gs","6144:uxE4GsU","6144:xE4GsUP","6144:E4GsUPn","6144:4GsUPnl","6144:GsUPnli","6144:sUPnliB","6144:UPnliBy","6144:PnliByo","6144:nliByoc","6144:liByocW","6144:iByocWe","6144:ByocWep","6144:yocWepq","6144:ocWepqv","6144:cWepqvK","6144:WepqvKQ","6144:epqvKQo","6144:pqvKQoW","6144:qvKQoWQ","6144:vKQoWQq","6144:KQoWQqc","6144:QoWQqcd","3072:y6gDBGp","3072:6gDBGpv","3072:gDBGpvE","3072:DBGpvEB","3072:BGpvEBy","3072:GpvEByo","3072:pvEByoc","3072:vEByocW","3072:EByocWe","3072:ByocWeo","3072:yocWeov","3072:ocWeovK","3072:cWeovK2","3072:WeovK2b","3072:eovK2bc","3072:ovK2bcd"],"imphash":"41fb8cb2943df6de998b35a9d28668e8"},"file_info":{"file_name":"xxx.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":152064,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1745505332000,"last_seen":1745521149000,"last_multi_scan":1745521149000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["lockbit","lockbitblack","criminal","ransomware","evasive"]},"stats":{"av":{"malicious_count":19,"suspicious_count":0,"total_engines":24},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":57},"sandbox_signatures":{"informative_count":97,"suspicious_count":12,"malicious_count":5,"total":114},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Ransomware/Win.LockBit","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.LockBit","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Trojan.Ransom.PIC","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"malicious","threat_name":"Win.Ransomware.BlackMatter-9965914-0","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cylance":{"name":"Cylance","success":true,"verdict":"malicious","threat_name":"Malware_-10","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan.Ransom.PIC (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win32/Filecoder.BlackMatter.O trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"malicious","threat_name":"Ransom.Win32.LockBit.tr","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Ransomware ( 005a74ef1 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Lockbit.tsu4","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"BlackMatter!396443E02532","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Virus.Win32.Gen.ccmw","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/Lockbit-W","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/BlackMatter.C.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Ransom.Win32.LockBit.GEN","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"TrojanRansom.Win32.LockBit","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware_40.6","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Filecoder.Win32.26912","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Ransom.LockBit","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to dynamically load libraries"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Imports GetCommandLine API"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Calls an API typically used to create a process"}],"sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"informative","value":"Contains ability to execute a WMI query"},{"type":"informative","value":"Executes WMI queries"}],"sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"}],"sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Found named pipe like strings"}],"sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Creates or modifies windows services"}],"sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"malicious","value":"Creates a process in suspended mode (likely for process injection)"},{"type":"suspicious","value":"Spawned processes likely due to injection"},{"type":"malicious","value":"Writes data to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"tactic":"Privilege Escalation","technique":"Thread Local Storage","attack_id":"T1055.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/005","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to check debugger is running (API string)"}],"sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"suspicious","value":"Opens file with deletion access rights"},{"type":"suspicious","value":"Marks file for deletion"},{"type":"informative","value":"Contains ability to delete files"}],"sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"suspicious","value":"Possibly tries to evade analysis by sleeping many times"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"}],"sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Renames files"},{"type":"informative","value":"Drops files inside appdata directory"}],"sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"tactic":"Defense Evasion","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Found virtual disk drive like strings"}],"sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"suspicious","value":"CRC value set in PE header does not match actual value"},{"type":"suspicious","value":"Dropped file has high entropy (likely encrypted/compressed content)"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Sample file has high entropy (likely encrypted/compressed content)"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"YARA signature match - AES encryption"},{"type":"informative","value":"Shows ability to obfuscate file or information"}],"sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Creates mutants"},{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"tactic":"Defense Evasion","technique":"Double File Extension","attack_id":"T1036.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1036/007","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"tactic":"Defense Evasion","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"suspicious","value":"Section contains high entropy"}],"sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Contains ability to detect virtual environment (API)"}],"sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal","attack_id":"T1070","attack_id_wiki":"https://attack.mitre.org/techniques/T1070","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"}],"sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"informative","value":"Contains ability to retrieve information about pressed keystrokes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"tactic":"Credential Access","technique":"Credentials from Web Browsers","attack_id":"T1555.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1555/003","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"suspicious","value":"Contains ability to retrieve open application windows"},{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"},{"type":"informative","value":"Calls an API typically used to enumerate active windows"},{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"}],"sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Contains ability to query system locale (API string)"}],"sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"}],"sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"References to WMI query strings used for information discovery"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Calls an API typically used to open an existing named mutex object"},{"type":"informative","value":"Contains ability to read software policies"}],"sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"References Windows filepaths for DLLs (possible dropped files)"},{"type":"informative","value":"Calls an API typically used for searching a directory for files"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Touches files"}],"sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Spawns new processes that are not known child processes"}],"sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Contains ability to retrieve system language (API string)"},{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Calls an API typically used to create an instance of a named pipe"}],"sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"tactic":"Collection","technique":"Local Email Collection","attack_id":"T1114.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1114/001","identifiers":[{"type":"informative","value":"Contains reference to Outlook data files path"},{"type":"informative","value":"Attempts to read Outlook-related files (file access)"}],"sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Contains ability to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"malicious","value":"Tries to steal browser sensitive information (file access)"},{"type":"informative","value":"Writes files in a temp directory"},{"type":"informative","value":"Calls an API typically used to copy file from one location to another"}],"sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Writes log files"}],"sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Contains SQL queries"}],"sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Found potential IP address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"suspicious","value":"Drops executable files"},{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Drops temp files"}],"sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"malicious","value":"Renames many files with double extensions (often indicator of ransomware infection)"}],"sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"tactic":"Impact","technique":"Internal Defacement","attack_id":"T1491.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1491/001","identifiers":[{"type":"suspicious","value":"The input sample dropped very many files"}],"sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"tactic":"Impact","technique":"Defacement","attack_id":"T1491","attack_id_wiki":"https://attack.mitre.org/techniques/T1491","identifiers":[{"type":"suspicious","value":"Changes the desktop background picture"}],"sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; File: \"de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe\")\n Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; File: \"de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to pass information to a window procedure (API string)","description":"Found reference to API \"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00003504.00000000.129037.02690000.00000004.mdmp, 00000000-00003504.00000001.130959.02690000.00000004.mdmp, 00000000-00003504.00000002.132877.02690000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Found virtual disk drive like strings","description":"Found string - \\\\.\\pipe\\{649F4E29-16CB-DD42-8922-9FFF0592856B}; Source: \"00000000-00003504-00000C56-1239522127\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-145","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Renames files","description":"$36","origin":"API Call","mitre_attack_id":"T1036","relevance":1,"id":"api-162","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"Assembly shows XOR instruction xor eax\n 10035FFFh in Stream UID: 32530-186-0040B470\n Assembly shows XOR instruction xor byte ptr [ebx-5CDFFFFFh]\n ah in Stream UID: 32530-757-0041791E\n Assembly shows XOR instruction xor ah\n byte ptr [ecx+eax+01A42000h] in Stream UID: 32530-774-00418DDC","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"level":"informative","category":"Cryptographic Related","name":"Sample file has high entropy (likely encrypted/compressed content)","description":"Sample file \"sample.bin\" has high entropy 7.225252559312906","origin":"Binary File","mitre_attack_id":"T1027","relevance":1,"id":"binary-71","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: YARA signature match - AES encryption","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Dropped file has high entropy (likely encrypted/compressed content)\n Matched sigs: Sample file has high entropy (likely encrypted/compressed content)\n Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: YARA signature match - AES encryption","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: YARA signature match - AES encryption\n Matched sigs: Found potential URL in binary/memory\n Matched sigs: Found potential IP address in binary/memory","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe\")\n Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe\")\n file/memory contains long string with (Indicator: \"GetCommandLine\"; File: \"9ED.tmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"Found reference to API \"\" (Indicator: \"enumchildwindows\"; Source: \"00000000-00003504.00000000.129037.02690000.00000004.mdmp, 00000000-00003504.00000001.130959.02690000.00000004.mdmp, 00000000-00003504.00000002.132877.02690000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API possibly used to retrieve a handle to the foreground window","description":"\"9ED.tmp\" called \"GetForegroundWindow\" (UID: 00000000-00006432)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-142","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to enumerate active windows","description":"\"de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe\" called \"EnumWindows\" with parameter \"40628428\" - (UID: 00000000-00003504)\n \"de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe\" called \"EnumWindows\" with parameter \"40629132\" - (UID: 00000000-00003504)\n \"de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe\" called \"EnumWindows\" with parameter \"40627724\" - (UID: 00000000-00003504)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-152","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00003504)\n \"de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe\" called \"RtlGetNtProductType\" (UID: 00000000-00003504)\n \"9ED.tmp\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00006432)\n \"9ED.tmp\" called \"RtlGetNtProductType\" (UID: 00000000-00006432)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$37","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to open an existing named mutex object","description":"\"de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe\" called \"OpenMutexW\" with parameter \"Global\\cc18e1d5b03aee9c17c1afeddba79344\" - (UID: 00000000-00003504)\n \"9ED.tmp\" called \"OpenMutexW\" (UID: 00000000-00006432)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-144","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to detect virtual environment (API)","description":"GetTickCount@KERNEL32.dll at 32530-780-00418DD6","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497","relevance":3,"id":"stream-87","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to execute a WMI query","description":"Found string \"SELECT * FROM Win32_ShadowCopy\" (Indicator: \"select * from \"; Source: \"00000000-00003504.00000000.129037.026D4000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":1,"id":"string-433","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query system locale (API string)","description":"Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; File: \"de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe\")","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")\n \"9ED.tmp\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"9ED.tmp\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")\n \"cmd.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"Found reference to API \"GetWindowTextW\" (Indicator: \"GetWindowText\"; File: \"de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve system language (API string)","description":"Found reference to API \"GetTextCharset\" (Indicator: \"GetTextCharset\"; File: \"de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe\")","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"level":"informative","category":"Environment Awareness","name":"Executes WMI queries","description":"\"de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe\" issued a query \"SELECT * FROM Win32_ShadowCopy\"","origin":"API Call","mitre_attack_id":"T1047","relevance":10,"id":"api-56","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\DE96AF271BF52BDCECAAF555A711F8A1397ED4B8BE0D9C16F483253D29DEAF62.EXE\")","origin":"Registry Access","mitre_attack_id":"T1518","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"level":"informative","category":"General","name":"Attempts to read Outlook-related files (file access)","description":"\"de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe\" tries to access a file \"C:\\Users\\%OSUSER%\\Documents\\Outlook Files\\Outlook.pst\"\n \"de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe\" tries to access a file \"C:\\Users\\%OSUSER%\\Documents\\Outlook Files\\Outlook1.pst\"\n \"de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe\" tries to access a file \"%USERPROFILE%\\Documents\\Outlook Files\\Outlook.pst\"\n \"de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe\" tries to access a file \"%USERPROFILE%\\Documents\\Outlook Files\\Outlook1.pst\"","origin":"API Call","mitre_attack_id":"T1114.001","relevance":3,"id":"api-157","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"level":"informative","category":"General","name":"Calls an API typically used to copy file from one location to another","description":"$38","origin":"API Call","mitre_attack_id":"T1005","relevance":3,"id":"api-123","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"\"de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe\" called \"CreateProcessW\" with parameter \"\"%ALLUSERSPROFILE%\\9ED.tmp\"\" - (UID: 00000000-00003504)\n \"9ED.tmp\" called \"CreateProcessW\" with parameter \"\"%WINDIR%\\System32\\cmd.exe\" /C DEL /F /Q C:\\PROGRA~3\\9ED.tmp >> NUL\" - (UID: 00000000-00006432)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create an instance of a named pipe","description":"\"de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\\{649F4E29-16CB-DD42-8922-9FFF0592856B}\" - (UID: 00000000-00003504)","origin":"API Call","mitre_attack_id":"T1570","relevance":3,"id":"api-138","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$39","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$3a","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"level":"informative","category":"General","name":"Contains SQL queries","description":"\"SELECT * FROM Win32_ShadowCopy\" (Source: 00000000-00003504.00000000.129037.026D4000.00000004.mdmp, Indicator: \"select * from win32_shadowcopy\")","origin":"File/Memory","mitre_attack_id":"T1213","relevance":2,"id":"string-16","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically load libraries","description":"LoadLibraryW@KERNEL32.dll at 32530-774-00418DDC","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":3,"id":"stream-108","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$3b","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe\")\n Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; File: \"de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; File: \"de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$3c","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"Local\\SM0:3504:168:WilStaging_02\"\n \"SM0:3504:168:WilStaging_02\"\n \"Local\\SM0:6432:168:WilStaging_02\"\n \"Local\\SM0:6432:64:WilError_01\"\n \"SM0:6432:64:WilError_01\"","origin":"Created Mutant","mitre_attack_id":"T1480","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"level":"informative","category":"General","name":"Found named pipe like strings","description":"Found string - \\\\.\\pipe\\{649F4E29-16CB-DD42-8922-9FFF0592856B}","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-146","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$3d","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 75610000\n \"de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 734C0000\n \"9ED.tmp\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 75610000\n \"9ED.tmp\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 734C0000\n \"cmd.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 75610000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 74780000\n \"9ED.tmp\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 74780000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"$3e","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe\" was detected as \"Microsoft Linker\" and name: \"Linker\"\n \"9ED.tmp\" was detected as \"Microsoft Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$3f","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"level":"informative","category":"General","name":"PE file contains Debug data directory","description":"\"de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"\n \"9ED.tmp\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"","origin":"Static Parser","id":"static-146","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe\" has an executable section named \".text\"\n \"de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe\" has an executable section named \".itext\"\n \"9ED.tmp\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe\" has an writable section named \".data\"\n \"de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe\" has an writable section named \".pdata\"\n \"9ED.tmp\" has an writable section named \".data\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"$40","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"Observed system executable string:\"%WINDIR%\\SysWOW64\\cmd.exe\" [Source: 00000000-00006432-00000BC0-1240634595]\n Observed system executable string:\"%WINDIR%\\System32\\cmd.exe\" [Source: 00000000-00006432-00000C45-2514812285]\n Observed system executable string:\"\"%WINDIR%\\System32\\cmd.exe\" /C DEL /F /Q C:\\PROGRA~3\\9ED.tmp >> NUL\" [Source: 00000000-00006432-00000C45-2514812285]","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"9ED.tmp\" (UID: 00000000-00006432) was launched with new environment variables: \"USERDNSDOMAIN=\"DESKTOP-FVVF82A\", PROCESSOR_ARCHITEW6432=\"AMD64\"\"\n Process \"9ED.tmp\" (UID: 00000000-00006432) was launched with modified environment variables: \"PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles, NUMBER_OF_PROCESSORS\"","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"$41","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"level":"informative","category":"General","name":"References Windows filepaths for DLLs (possible dropped files)","description":"Observed system executable string:\"%WINDIR%\\System32\\*.dll\" [Source: 00000000-00003504-00000C2C-1488496786]","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"9ED.tmp\" (UID: 00000000-00006432)\n Spawned process \"cmd.exe\" with commandline \"/C DEL /F /Q C:\\\\PROGRA~3\\\\9ED.tmp >> NUL\" (UID: 00000000-00006568)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"9ED.tmp\" (UID: 00000000-00006432)\n Spawned process \"cmd.exe\" with commandline \"/C DEL /F /Q C:\\\\PROGRA~3\\\\9ED.tmp >> NUL\" (UID: 00000000-00006568)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"9ED.tmp\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"level":"informative","category":"General","name":"Writes files in a temp directory","description":"\"de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\vxaction.log.HPvdi8peh\"\n \"de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\BITF35B.tmp.HPvdi8peh\"\n \"de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\edge_BITS_1276_1869898894\\BIT1FEB.tmp.HPvdi8peh\"","origin":"API Call","mitre_attack_id":"T1005","relevance":1,"id":"api-267","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; File: \"de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$42","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"level":"informative","category":"Installation/Persistence","name":"Drops temp files","description":"\"9ED.tmp\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\" - Location: [%ALLUSERSPROFILE%\\9ED.tmp]","origin":"Binary File","mitre_attack_id":"T1105","relevance":1,"id":"binary-53","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$43","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe\" queries basic process information of the \"C:\\de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe\" (UID: 3504)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$44","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"$45","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: Able to identify virtual environment by using user activity (API string)\n Matched sigs: Contains ability to detect virtual environment (API)\n Matched sigs: Possibly tries to evade analysis by sleeping many times","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$46","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"\"9ED.tmp\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\Caches\"","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$47","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"\"de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe\" trying to access non-existent file \"C:\\WINSPOOL.DRV\"\n \"de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe\" trying to access non-existent file \"C:\\winspool.drv\"\n \"de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe\" trying to access non-existent file \"C:\\DE96AF271BF52BDCECAAF555A711F8A1397ED4B8BE0D9C16F483253D29DEAF62.EXE.LOCAL\"\n \"de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe\" trying to access non-existent file \"C:\\de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe.Local\\\"\n \"de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe\" trying to access non-existent file \"Z:\\\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"$48","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes log files","description":"$49","origin":"API Call","mitre_attack_id":"T1074.001","relevance":1,"id":"api-159","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"192.168.0.2\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$4a","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - AES encryption","description":"YARA signature for AES encryption matched on file \"sample.bin\"\n YARA signature for AES encryption matched on process \"00000000-00003504\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-103","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"Found string \"B+ncalrpc:[OLE016C53E1ACEFCBF94F030C33B05C]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00003504.00000000.129037.02690000.00000004.mdmp, 00000000-00003504.00000000.129037.026D4000.00000004.mdmp, 00000000-00003504.00000001.130959.02690000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$4b","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"9ED.tmp\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"cmd.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to capture screen (API string)","description":"$4c","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"$4d","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; File: \"de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe\")\n Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; File: \"de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; File: \"de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe\")\n Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; File: \"de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about pressed keystrokes (API string)","description":"Found reference to API \"GetKeyNameTextW\" (Indicator: \"GetKeyNameText\"; File: \"de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-88","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains reference to Outlook data files path","description":"Found string \"\\\\?\\%USERPROFILE%\\Documents\\Outlook Files\\HPvdi8peh.README.txt\" (Indicator: \"\\documents\\outlook files\"; Source: \"00000000-00003504-00000C3B-7995408654\")\n Found string \"\\?\\C:\\Users\\xh4rHxe\\Documents\\Outlook Files\\Outlook.pst.HPvdi8peh\" (Indicator: \"\\documents\\outlook files\"; Source: \"00000000-00003504.00000000.129037.02690000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1114.001","relevance":3,"id":"string-570","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"Found string \"You can provide us accounting data for the access to any company, for example, login and password to RDP, VPN, corporate email, etc.\" (Indicator: \"password\"; Source: \"00000000-00003504.00000000.129037.02690000.00000004.mdmp, 00000000-00003504.00000002.132877.02690000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Imports GetCommandLine API","description":"Observed import api \"GetCommandLineA\" which can \"Retrieves the command-line string for the current process\" [Source: de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe]","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-88","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"References to WMI query strings used for information discovery","description":"Found string \"SELECT * FROM Win32_ShadowCopy\" (Indicator: \" Win32_Shadowcopy\"; Source: \"00000000-00003504.00000000.129037.026D4000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-507","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"Found string \":\\WINDOWS\\system32\\DRIVERS\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00003504.00000000.129037.02690000.00000004.mdmp, 00000000-00003504.00000001.130959.02690000.00000004.mdmp, 00000000-00003504.00000002.132877.02690000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files","description":"Observed string: \"\"%WINDIR%\\System32\\cmd.exe\" /C DEL /F /Q C:\\PROGRA~3\\9ED.tmp >> NUL\" (Indicator: \"/c del \") in Source: 00000000-00006432-00000C45-2514812285\n Observed string: \"/C DEL /F /Q C:\\PROGRA~3\\9ED.tmp >> NUL\" (Indicator: \"/c del \") in Source: cmd.exe","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-408","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\EVENTLOG\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$4e","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"$4f","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"9ED.tmp\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Section contains high entropy","description":"\"de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe\" has section name .text with entropy \"6.634079266913224\"\n \"de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe\" has section name .data with entropy \"7.987500124069146\"\n \"de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe\" has section name .pdata with entropy \"7.691028081102254\"\n \"de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe\" has section name .reloc with entropy \"6.738987246879603\"\n \"9ED.tmp\" has section name .text with entropy \"7.985216639497568\"","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"level":"suspicious","category":"Cryptographic Related","name":"Dropped file has high entropy (likely encrypted/compressed content)","description":"$50","origin":"Binary File","mitre_attack_id":"T1027","relevance":5,"id":"binary-60","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to retrieve open application windows","description":"GetWindowTextW@USER32.dll at 32530-766-00418DA6","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1010","relevance":3,"id":"stream-125","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"level":"suspicious","category":"Environment Awareness","name":"Possibly tries to evade analysis by sleeping many times","description":"\"de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe\" (Thread ID: 1820) slept \"525\" times (threshold: 500)","origin":"API Call","mitre_attack_id":"T1497.003","relevance":10,"id":"api-47","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"$51","origin":"Binary File","mitre_attack_id":"T1105","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"level":"suspicious","category":"Network Related","name":"Spawned processes likely due to injection","description":"Process \"%ALLUSERSPROFILE%\\9ED.tmp\" spawned likely due to injection","origin":"Monitored Target","mitre_attack_id":"T1055","relevance":3,"id":"target-413","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Changes the desktop background picture","description":"\"de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\CONTROL PANEL\\DESKTOP\"; Key: \"WALLPAPER\"; Value: \"%ALLUSERSPROFILE%\\HPvdi8peh.bmp\")\n \"de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\CONTROL PANEL\\DESKTOP\"; Key: \"WALLPAPERSTYLE\"; Value: \"310030000000\")","origin":"Registry Access","mitre_attack_id":"T1491","relevance":10,"id":"registry-22","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"The input sample dropped very many files","description":"The input sample dropped 2754 files (often an indicator for ransomware)","origin":"Binary File","mitre_attack_id":"T1491.001","relevance":5,"id":"binary-10","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"9ED.tmp\" marked \"C:\\ZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZ\" for deletion","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"$52","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe\" claimed CRC 209700 while the actual is CRC 202250\n \"9ED.tmp\" claimed CRC 36816 while the actual is CRC 20262","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"LoadLibraryW\n GetTickCount\n GetCommandLineA\n GetCommandLineW\n GetModuleHandleW\n GetProcAddress\n GetModuleHandleA","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Creates a process in suspended mode (likely for process injection)","description":"\"de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe\" called \"CreateProcessW\" with parameter \"\"%ALLUSERSPROFILE%\\9ED.tmp\"\" - (UID: 00000000-00003504)\n \"9ED.tmp\" called \"CreateProcessW\" with parameter \"\"%WINDIR%\\System32\\cmd.exe\" /C DEL /F /Q C:\\PROGRA~3\\9ED.tmp >> NUL\" - (UID: 00000000-00006432)","origin":"API Call","mitre_attack_id":"T1055","relevance":10,"id":"api-129","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"\"de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe\" wrote 00000004 bytes to a remote process \"C:\\ProgramData\\9ED.tmp\" (Handle: 1232)\n \"de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe\" wrote 00002C00 bytes to a remote process \"C:\\ProgramData\\9ED.tmp\" (Handle: 1232)","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Tries to steal browser sensitive information (file access)","description":"$53","origin":"API Call","mitre_attack_id":"T1005","relevance":10,"id":"api-96","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Renames many files with double extensions (often indicator of ransomware infection)","description":"\"de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe\" renames more than 100 files with extension \".sol.HPvdi8peh\"","origin":"API Call","mitre_attack_id":"T1486","relevance":10,"id":"api-200","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]}],"incidents":[{"name":"Ransomware","details_count":1,"details":[{"detail":"Changes the desktop background picture"}],"sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"name":"Spyware","details_count":2,"details":[{"detail":"Found a string that may be used as part of an injection method"},{"detail":"Tries to steal browser sensitive information (file access)"}],"sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"name":"Persistence","details_count":2,"details":[{"detail":"Writes data to a remote process"},{"detail":"Drops executable files to the application program directory (%ProgramData%)"}],"sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"name":"Fingerprint","details_count":1,"details":[{"detail":"Queries process information"}],"sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"name":"Evasive","details_count":2,"details":[{"detail":"Marks file for deletion"},{"detail":"Possibly tries to evade analysis by sleeping many times"}],"sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]}]},"activity":{"stats":{"process_count":3,"spawned_processes_count":3,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":5,"imported_dlls_count":80,"dropped_files_count":0,"extracted_files_count":19,"files_written_count":121,"files_deleted_count":0,"registry_keys_created_count":125,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":125,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["lockbit","lockbitblack","criminal","ransomware","evasive"],"sample_flags":["Multi-Process","Extracted Files"],"sandbox_reports":[{"id":"680a89fcd69ef7678306befa","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"submit_name":"de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe","analysis_start_time":"2025-04-24T18:59:09+00:00","indicators_count":{"informative":97,"suspicious":41,"malicious":7},"tags":["Multi-Process","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}],"processes":[{"pid":3504,"ppid":0,"name":"de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe","command_line":"","sha256":"de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62","normalized_path":"C:\\de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe","uid":"00000000-00003504","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="},{"pid":6432,"ppid":3504,"name":"9ED.tmp","command_line":"","sha256":"917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2","normalized_path":"%ALLUSERSPROFILE%\\9ED.tmp","parent_uid":"00000000-00003504","uid":"00000000-00006432"},{"pid":6568,"ppid":6432,"name":"cmd.exe","command_line":"/C DEL /F /Q C:\\PROGRA~3\\9ED.tmp >> NUL","sha256":"4c3ea4c44aab74350355c419826b8c9e6172c3bd8f0bb5817ecf7be50b629051","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00000000-00006432","uid":"00000000-00006568"}],"all_imported_dlls":["activeds.dll","dsrole.dll","Windows.StateRepositoryPS.dll","kernel32.dll","fltLib.dll","kernel.appcore.dll","dssec.dll","ntdll.dll","user32.dll","sspicli.dll","VxSSL32.dll","clbcatq.dll","wbemprox.dll","fastprox.dll","propsys.dll","Wldap32.dll","wininet.dll","cfgmgr32.dll","wtsapi32.dll","adsldpc.dll","uxtheme.dll","KernelBase.dll","ucrtbase.dll","combase.dll","oleaut32.dll","RstrtMgr.dll","adsldp.dll","iertutil.dll","imm32.dll","windows.storage.dll","bcrypt.dll","samcli.dll","apphelp.dll","gdi32.dll","framedynos.dll","wbemcomn.dll","cldapi.dll","bcryptprimitives.dll","sechost.dll","SHCore.dll","wkscli.dll","wow64.dll","gdi32full.dll","userenv.dll","netapi32.dll","mpr.dll","comctl32.dll","urlmon.dll","profapi.dll","ncrypt.dll","dsuiext.dll","ntdsapi.dll","msIso.dll","wow64win.dll","win32u.dll","ws2_32.dll","advapi32.dll","authz.dll","ntmarta.dll","aepic.dll","rpcrt4.dll","ole32.dll","cryptsp.dll","powrprof.dll","netutils.dll","gpapi.dll","edputil.dll","msvcrt.dll","IPHLPAPI.DLL","gpedit.dll","msvcp_win.dll","cryptbase.dll","shell32.dll","shlwapi.dll","ntasn1.dll","srvcli.dll","logoncli.dll","wbemsvc.dll","wow64cpu.dll","wsock32.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"9ED.tmp","sha256":"917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"name":"places.sqlite.HPvdi8peh","sha256":"7102f6f179193575e7e1911409800afe70143e0838bdef9d8fb49533d1cd4784","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"name":"data_1.HPvdi8peh","sha256":"c0d798e377e56ea85be8c58cb49bf8e8174d1807d7455baef84812bc233f34e6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"name":"HPvdi8peh.README.txt","sha256":"626d5d11a19ff3cdd791ef93d28bcafa1697834ff045dd4aba3568ee0d98abda","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"name":"object.html.HPvdi8peh","sha256":"ddf1db484862ef78a5f76b7db5e0e7f0be5ed09968f09ccf6af8737ce4ab95d6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"name":"_collections_abc.py.HPvdi8peh","sha256":"75ad9d160c074b849f8607091b8715e97683a91dd11464899ec4c70315ac275a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"name":"test_bdist_dumb.py.HPvdi8peh","sha256":"ede68390a77f69900611b1cb418147ad3dc9d3475085a7a154230c0b1acaa5f7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"name":"utils.cpython-311.pyc.HPvdi8peh","sha256":"3d31d27760703f5bfea3e928c7389002da2ffa771dad581d19a918214910d94e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"name":"crypto_scalarmult.py.HPvdi8peh","sha256":"7a945771716d88b5a3d73083c6c90b5a070936e7608916b1688baa88173dbc42","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"name":"base.cpython-311.pyc.HPvdi8peh","sha256":"1f859e3b0b778f7c3571a4193807a9bbccf4e26587ae94f9ddc791a0d5c8f58b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"name":"langthaimodel.cpython-311.pyc.HPvdi8peh","sha256":"82eb270d240c88fc726ac31a1c965f9b9c3268ac66315d3e0aee78e1c47078ac","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"name":"live.cpython-311.pyc.HPvdi8peh","sha256":"717c122f4e912be7c7ba7e70695c44c0c94b513dd7053a9db0b4080b563a951b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"name":"util.cpython-311.pyc.HPvdi8peh","sha256":"1192359a4fa6b97b468acfa134fb7031fb4c6413d3911ba5db59a0c10446a7e2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"name":"cmdline.cpython-311.pyc.HPvdi8peh","sha256":"537ba1849fb0412e247a3827819cb0c2c6e5b8feb1923a0d9b537559a6bf76e6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"name":"hierlist.py.HPvdi8peh","sha256":"371c98c41b02b55a19f5b67b9e55a5c9270780102fd8826f2a7c87617bc61b5a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"name":"core.cpython-311.pyc.HPvdi8peh","sha256":"7243546f8e4fcde24227c7954c5063edf4e05393595ff4e1b1213aac77af3815","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"name":"__init__.py.HPvdi8peh","sha256":"eda031b5705d2bdb9d497756ee24a7feaa4ef69097893b951fee4f43ad5673ad","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"name":"__init__.cpython-311.pyc.HPvdi8peh","sha256":"b721861be6177795fca8d88ddb4b8920996d3c61ead9ea8ce0ba998c6f47d46a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"name":"build.cpython-311.pyc.HPvdi8peh","sha256":"32fee39a459ca5f9cc4f302954eed39d29d81f5e277edf5d49334f3a00335e46","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]}],"files_written":[{"path":"%ALLUSERSPROFILE%\\HPvdi8peh.ico","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"path":"C:\\HPvdi8peh.README.txt","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"path":"C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"path":"C:\\$Recycle.Bin\\S-1-5-21-735145574-3570218355-1207367261-1001\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"path":"C:\\Users\\HPvdi8peh.README.txt","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"path":"%USERPROFILE%\\HPvdi8peh.README.txt","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"path":"%USERPROFILE%\\Videos\\HPvdi8peh.README.txt","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"path":"%USERPROFILE%\\Searches\\HPvdi8peh.README.txt","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"path":"%USERPROFILE%\\Searches\\Microsoft Office Outlook.searchconnector-ms.HPvdi8peh","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"path":"%USERPROFILE%\\Searches\\Microsoft OneNote.searchconnector-ms.HPvdi8peh","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"path":"%USERPROFILE%\\Saved Games\\HPvdi8peh.README.txt","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"path":"%USERPROFILE%\\Searches\\winrt--{S-1-5-21-735145574-3570218355-1207367261-1001}-.searchconnector-ms.HPvdi8peh","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"path":"%USERPROFILE%\\Pictures\\HPvdi8peh.README.txt","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"path":"%USERPROFILE%\\Pictures\\Saved Pictures\\HPvdi8peh.README.txt","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"path":"%USERPROFILE%\\Pictures\\Camera Roll\\HPvdi8peh.README.txt","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"path":"%USERPROFILE%\\OneDrive\\HPvdi8peh.README.txt","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"path":"%USERPROFILE%\\Music\\HPvdi8peh.README.txt","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"path":"%USERPROFILE%\\MicrosoftEdgeBackups\\HPvdi8peh.README.txt","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"path":"%USERPROFILE%\\MicrosoftEdgeBackups\\backups\\HPvdi8peh.README.txt","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"path":"%USERPROFILE%\\MicrosoftEdgeBackups\\backups\\MicrosoftEdgeBackup20231002\\HPvdi8peh.README.txt","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"path":"%USERPROFILE%\\Links\\HPvdi8peh.README.txt","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"path":"%USERPROFILE%\\MicrosoftEdgeBackups\\backups\\MicrosoftEdgeBackup20231002\\MicrosoftEdgeFavoritesBackup.html.HPvdi8peh","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"path":"%USERPROFILE%\\Favorites\\HPvdi8peh.README.txt","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\HPvdi8peh.README.txt","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"path":"%USERPROFILE%\\Favorites\\Bing.url.HPvdi8peh","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"path":"%USERPROFILE%\\Downloads\\HPvdi8peh.README.txt","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"path":"%USERPROFILE%\\Downloads\\MicrosoftEdgeSetup.exe.xlzor0p.partial.HPvdi8peh","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"path":"%USERPROFILE%\\Documents\\HPvdi8peh.README.txt","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"path":"%USERPROFILE%\\Downloads\\npp.8.4.7.portable.x64.zip.HPvdi8peh","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"path":"%USERPROFILE%\\Documents\\Outlook Files\\HPvdi8peh.README.txt","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"path":"%USERPROFILE%\\Documents\\Database1.accdb.HPvdi8peh","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"path":"%USERPROFILE%\\Documents\\Outlook Files\\Outlook.pst.HPvdi8peh","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"path":"%USERPROFILE%\\Documents\\OneNote Notebooks\\HPvdi8peh.README.txt","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"path":"%USERPROFILE%\\Documents\\Outlook Files\\Outlook1.pst.HPvdi8peh","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"path":"%USERPROFILE%\\Documents\\OneNote Notebooks\\Unfiled Notes.one.HPvdi8peh","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"path":"%USERPROFILE%\\Documents\\OneNote Notebooks\\OneNote 2010 Guide\\HPvdi8peh.README.txt","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"path":"%USERPROFILE%\\Documents\\OneNote Notebooks\\My Notebook\\HPvdi8peh.README.txt","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"path":"%USERPROFILE%\\Documents\\OneNote Notebooks\\OneNote 2010 Guide\\Open Notebook.onetoc2.HPvdi8peh","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"path":"%USERPROFILE%\\Documents\\OneNote Notebooks\\OneNote 2010 Guide\\OneNote Guide.one.HPvdi8peh","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"path":"%USERPROFILE%\\Documents\\OneNote Notebooks\\My Notebook\\Open Notebook.onetoc2.HPvdi8peh","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"path":"%USERPROFILE%\\Desktop\\HPvdi8peh.README.txt","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"path":"%USERPROFILE%\\Contacts\\HPvdi8peh.README.txt","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"path":"%USERPROFILE%\\Documents\\OneNote Notebooks\\My Notebook\\Quick Notes.one.HPvdi8peh","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"path":"%USERPROFILE%\\AppData\\HPvdi8peh.README.txt","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"path":"%APPDATA%\\HPvdi8peh.README.txt","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"path":"%APPDATA%\\Wireshark\\HPvdi8peh.README.txt","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"path":"%APPDATA%\\Wireshark\\recent.HPvdi8peh","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"path":"%APPDATA%\\Wireshark\\recent_common.HPvdi8peh","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"path":"%APPDATA%\\Wireshark\\profiles\\HPvdi8peh.README.txt","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"path":"%APPDATA%\\Sun\\HPvdi8peh.README.txt","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"path":"%APPDATA%\\Sun\\Java\\HPvdi8peh.README.txt","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"path":"%APPDATA%\\Sun\\Java\\Deployment\\HPvdi8peh.README.txt","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"path":"%APPDATA%\\Mozilla\\HPvdi8peh.README.txt","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"path":"%APPDATA%\\Mozilla\\SystemExtensionsDev\\HPvdi8peh.README.txt","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\HPvdi8peh.README.txt","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\HPvdi8peh.README.txt","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\ywzu7870.default\\HPvdi8peh.README.txt","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\profiles.ini.HPvdi8peh","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\ywzu7870.default\\addons.json.HPvdi8peh","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\ywzu7870.default\\addonStartup.json.lz4.HPvdi8peh","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\ywzu7870.default\\blocklist.xml.HPvdi8peh","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\ywzu7870.default\\cert9.db.HPvdi8peh","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\ywzu7870.default\\compatibility.ini.HPvdi8peh","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\ywzu7870.default\\containers.json.HPvdi8peh","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\ywzu7870.default\\content-prefs.sqlite.HPvdi8peh","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\ywzu7870.default\\cookies.sqlite.HPvdi8peh","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\ywzu7870.default\\extensions.json.HPvdi8peh","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\ywzu7870.default\\favicons.sqlite.HPvdi8peh","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\ywzu7870.default\\formhistory.sqlite.HPvdi8peh","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\ywzu7870.default\\handlers.json.HPvdi8peh","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\ywzu7870.default\\key4.db.HPvdi8peh","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\ywzu7870.default\\permissions.sqlite.HPvdi8peh","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\ywzu7870.default\\pkcs11.txt.HPvdi8peh","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\ywzu7870.default\\pluginreg.dat.HPvdi8peh","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\ywzu7870.default\\prefs.js.HPvdi8peh","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\ywzu7870.default\\revocations.txt.HPvdi8peh","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\ywzu7870.default\\places.sqlite.HPvdi8peh","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\ywzu7870.default\\search.json.mozlz4.HPvdi8peh","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\ywzu7870.default\\sessionCheckpoints.json.HPvdi8peh","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\ywzu7870.default\\shield-preference-experiments.json.HPvdi8peh","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\ywzu7870.default\\shield-recipe-client.json.HPvdi8peh","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\ywzu7870.default\\SiteSecurityServiceState.txt.HPvdi8peh","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\ywzu7870.default\\storage.sqlite.HPvdi8peh","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\ywzu7870.default\\times.json.HPvdi8peh","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\ywzu7870.default\\user.js.HPvdi8peh","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\ywzu7870.default\\webappsstore.sqlite.HPvdi8peh","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\ywzu7870.default\\xulstore.json.HPvdi8peh","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\ywzu7870.default\\weave\\HPvdi8peh.README.txt","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\ywzu7870.default\\weave\\toFetch\\HPvdi8peh.README.txt","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\ywzu7870.default\\weave\\failed\\HPvdi8peh.README.txt","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\ywzu7870.default\\weave\\toFetch\\tabs.json.HPvdi8peh","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\ywzu7870.default\\storage\\HPvdi8peh.README.txt","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\ywzu7870.default\\storage\\temporary\\HPvdi8peh.README.txt","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\ywzu7870.default\\storage\\permanent\\HPvdi8peh.README.txt","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\ywzu7870.default\\weave\\failed\\tabs.json.HPvdi8peh","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\ywzu7870.default\\storage\\permanent\\chrome\\HPvdi8peh.README.txt","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\ywzu7870.default\\storage\\permanent\\chrome\\.metadata.HPvdi8peh","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\ywzu7870.default\\storage\\permanent\\chrome\\idb\\HPvdi8peh.README.txt","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\ywzu7870.default\\storage\\permanent\\chrome\\.metadata-v2.HPvdi8peh","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\ywzu7870.default\\storage\\permanent\\chrome\\idb\\1451318868ntouromlalnodry--epcr.sqlite.HPvdi8peh","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\ywzu7870.default\\storage\\permanent\\chrome\\idb\\1657114595AmcateirvtiSty.sqlite.HPvdi8peh","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\ywzu7870.default\\storage\\permanent\\chrome\\idb\\2918063365piupsah.sqlite.HPvdi8peh","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\ywzu7870.default\\storage\\permanent\\chrome\\idb\\3561288849sdhlie.sqlite.HPvdi8peh","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\ywzu7870.default\\storage\\permanent\\chrome\\idb\\3870112724rsegmnoittet-es.files\\HPvdi8peh.README.txt","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\ywzu7870.default\\storage\\permanent\\chrome\\idb\\3561288849sdhlie.files\\HPvdi8peh.README.txt","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\ywzu7870.default\\storage\\permanent\\chrome\\idb\\3870112724rsegmnoittet-es.sqlite.HPvdi8peh","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\ywzu7870.default\\storage\\permanent\\chrome\\idb\\2918063365piupsah.files\\HPvdi8peh.README.txt","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\ywzu7870.default\\storage\\permanent\\chrome\\idb\\1657114595AmcateirvtiSty.files\\HPvdi8peh.README.txt","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\ywzu7870.default\\storage\\permanent\\chrome\\idb\\1451318868ntouromlalnodry--epcr.files\\HPvdi8peh.README.txt","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\ywzu7870.default\\sessionstore-backups\\HPvdi8peh.README.txt","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\ywzu7870.default\\sessionstore-backups\\previous.jsonlz4.HPvdi8peh","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\ywzu7870.default\\sessionstore-backups\\recovery.baklz4.HPvdi8peh","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\ywzu7870.default\\sessionstore-backups\\recovery.jsonlz4.HPvdi8peh","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\ywzu7870.default\\sessionstore-backups\\upgrade.jsonlz4-20180206200532.HPvdi8peh","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\ywzu7870.default\\saved-telemetry-pings\\HPvdi8peh.README.txt","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\ywzu7870.default\\saved-telemetry-pings\\057b56e5-3bf5-47d5-a0c6-299bafb55b4d.HPvdi8peh","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\ywzu7870.default\\saved-telemetry-pings\\060851d8-e3cd-4b3b-bf31-953c9394bac3.HPvdi8peh","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\ywzu7870.default\\saved-telemetry-pings\\7c6a8b8f-5dfd-4881-b146-eb5af56f0eb4.HPvdi8peh","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\ywzu7870.default\\minidumps\\HPvdi8peh.README.txt","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\ywzu7870.default\\gmp-widevinecdm\\HPvdi8peh.README.txt","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"path":"C:\\de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62.exe","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINEVT\\CHANNELS\\","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINEVT\\CHANNELS\\AIRSPACECHANNEL\\","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINEVT\\CHANNELS\\AMSI/OPERATIONAL\\","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINEVT\\CHANNELS\\ANALYTIC\\","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINEVT\\CHANNELS\\DEBUGCHANNEL\\","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINEVT\\CHANNELS\\DIRECTSHOWFILTERGRAPH\\","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINEVT\\CHANNELS\\DIRECTSHOWPLUGINCONTROL\\","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINEVT\\CHANNELS\\ELS_HYPHENATION/ANALYTIC\\","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINEVT\\CHANNELS\\ENDPOINTMAPPER\\","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINEVT\\CHANNELS\\FIRSTUXPERF-ANALYTIC\\","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINEVT\\CHANNELS\\FORWARDEDEVENTS\\","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINEVT\\CHANNELS\\GENERAL LOGGING\\","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINEVT\\CHANNELS\\IHM_DEBUGCHANNEL\\","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINEVT\\CHANNELS\\INSTALLUXPERFORMANCE-ANALYTIC\\","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINEVT\\CHANNELS\\INTEL-IALPSS-GPIO/ANALYTIC\\","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINEVT\\CHANNELS\\INTEL-IALPSS-I2C/ANALYTIC\\","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINEVT\\CHANNELS\\INTEL-IALPSS2-GPIO2/DEBUG\\","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINEVT\\CHANNELS\\INTEL-IALPSS2-GPIO2/PERFORMANCE\\","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINEVT\\CHANNELS\\INTEL-IALPSS2-I2C/DEBUG\\","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINEVT\\CHANNELS\\INTEL-IALPSS2-I2C/PERFORMANCE\\","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINEVT\\CHANNELS\\MEDAFOUNDATIONVIDEOPROC\\","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINEVT\\CHANNELS\\MEDAFOUNDATIONVIDEOPROCD3D\\","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINEVT\\CHANNELS\\MEDIAFOUNDATIONASYNCWRAPPER\\","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINEVT\\CHANNELS\\MEDIAFOUNDATIONCONTENTPROTECTION\\","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINEVT\\CHANNELS\\MEDIAFOUNDATIONDEVICEPROXY\\","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINEVT\\CHANNELS\\MEDIAFOUNDATIONDS\\","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINEVT\\CHANNELS\\MEDIAFOUNDATIONMEDIAENGINE\\","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINEVT\\CHANNELS\\MEDIAFOUNDATIONPERFORMANCE\\","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINEVT\\CHANNELS\\MEDIAFOUNDATIONPERFORMANCECORE\\","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINEVT\\CHANNELS\\MEDIAFOUNDATIONPIPELINE\\","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINEVT\\CHANNELS\\MEDIAFOUNDATIONPLATFORM\\","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINEVT\\CHANNELS\\MEDIAFOUNDATIONSRCPREFETCH\\","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINEVT\\CHANNELS\\MF_MEDIAFOUNDATIONDEVICEPROXY\\","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINEVT\\CHANNELS\\MICROSOFT-APPV-CLIENT-STREAMINGUX/DEBUG\\","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINEVT\\CHANNELS\\MICROSOFT-APPV-CLIENT/ADMIN\\","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINEVT\\CHANNELS\\MICROSOFT-APPV-CLIENT/DEBUG\\","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINEVT\\CHANNELS\\MICROSOFT-APPV-CLIENT/OPERATIONAL\\","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINEVT\\CHANNELS\\MICROSOFT-APPV-CLIENT/VIRTUAL APPLICATIONS\\","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINEVT\\CHANNELS\\MICROSOFT-APPV-SHAREDPERFORMANCE/ANALYTIC\\","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINEVT\\CHANNELS\\MICROSOFT-CLIENT-LICENSING-PLATFORM/ADMIN\\","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINEVT\\CHANNELS\\MICROSOFT-CLIENT-LICENSING-PLATFORM/DEBUG\\","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINEVT\\CHANNELS\\MICROSOFT-IE-READINGVIEW/DIAGNOSTIC\\","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINEVT\\CHANNELS\\MICROSOFT-IE/DIAGNOSTIC\\","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINEVT\\CHANNELS\\MICROSOFT-IEFRAME/DIAGNOSTIC\\","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINEVT\\CHANNELS\\MICROSOFT-JSDUMPHEAP/DIAGNOSTIC\\","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINEVT\\CHANNELS\\MICROSOFT-ONECORE-SETUP/ANALYTIC\\","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINEVT\\CHANNELS\\MICROSOFT-PERFTRACK-IEFRAME/DIAGNOSTIC\\","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINEVT\\CHANNELS\\MICROSOFT-PERFTRACK-MSHTML/DIAGNOSTIC\\","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINEVT\\CHANNELS\\MICROSOFT-USER EXPERIENCE VIRTUALIZATION-ADMIN/DEBUG\\","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINEVT\\CHANNELS\\MICROSOFT-USER EXPERIENCE VIRTUALIZATION-AGENT DRIVER/DEBUG\\","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINEVT\\CHANNELS\\MICROSOFT-USER EXPERIENCE VIRTUALIZATION-AGENT DRIVER/OPERATIONAL\\","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINEVT\\CHANNELS\\MICROSOFT-USER EXPERIENCE VIRTUALIZATION-APP AGENT/ANALYTIC\\","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINEVT\\CHANNELS\\MICROSOFT-USER EXPERIENCE VIRTUALIZATION-APP AGENT/DEBUG\\","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINEVT\\CHANNELS\\MICROSOFT-USER EXPERIENCE VIRTUALIZATION-APP AGENT/OPERATIONAL\\","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINEVT\\CHANNELS\\MICROSOFT-USER EXPERIENCE VIRTUALIZATION-IPC/OPERATIONAL\\","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINEVT\\CHANNELS\\MICROSOFT-USER EXPERIENCE VIRTUALIZATION-SQM UPLOADER/ANALYTIC\\","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINEVT\\CHANNELS\\MICROSOFT-USER EXPERIENCE VIRTUALIZATION-SQM UPLOADER/DEBUG\\","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINEVT\\CHANNELS\\MICROSOFT-USER EXPERIENCE VIRTUALIZATION-SQM UPLOADER/OPERATIONAL\\","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINEVT\\CHANNELS\\MICROSOFT-WINDOWS-AAD/ANALYTIC\\","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINEVT\\CHANNELS\\MICROSOFT-WINDOWS-AAD/OPERATIONAL\\","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINEVT\\CHANNELS\\MICROSOFT-WINDOWS-ACTIONQUEUE/ANALYTIC\\","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINEVT\\CHANNELS\\MICROSOFT-WINDOWS-ADSI/DEBUG\\","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINEVT\\CHANNELS\\MICROSOFT-WINDOWS-ALL-USER-INSTALL-AGENT/ADMIN\\","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINEVT\\CHANNELS\\MICROSOFT-WINDOWS-ALLJOYN/DEBUG\\","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINEVT\\CHANNELS\\MICROSOFT-WINDOWS-ALLJOYN/OPERATIONAL\\","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINEVT\\CHANNELS\\MICROSOFT-WINDOWS-ANYTIME-UPGRADE-EVENTS/OPERATIONAL\\","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINEVT\\CHANNELS\\MICROSOFT-WINDOWS-ANYTIME-UPGRADE/ANALYTIC\\","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINEVT\\CHANNELS\\MICROSOFT-WINDOWS-APPHOST/ADMIN\\","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINEVT\\CHANNELS\\MICROSOFT-WINDOWS-APPHOST/APPLICATIONTRACING\\","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINEVT\\CHANNELS\\MICROSOFT-WINDOWS-APPHOST/DIAGNOSTIC\\","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINEVT\\CHANNELS\\MICROSOFT-WINDOWS-APPHOST/INTERNAL\\","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINEVT\\CHANNELS\\MICROSOFT-WINDOWS-APPID/OPERATIONAL\\","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINEVT\\CHANNELS\\MICROSOFT-WINDOWS-APPLICABILITYENGINE/ANALYTIC\\","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINEVT\\CHANNELS\\MICROSOFT-WINDOWS-APPLICABILITYENGINE/OPERATIONAL\\","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINEVT\\CHANNELS\\MICROSOFT-WINDOWS-APPLICATION SERVER-APPLICATIONS/ADMIN\\","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINEVT\\CHANNELS\\MICROSOFT-WINDOWS-APPLICATION SERVER-APPLICATIONS/ANALYTIC\\","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINEVT\\CHANNELS\\MICROSOFT-WINDOWS-APPLICATION SERVER-APPLICATIONS/DEBUG\\","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINEVT\\CHANNELS\\MICROSOFT-WINDOWS-APPLICATION SERVER-APPLICATIONS/OPERATIONAL\\","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINEVT\\CHANNELS\\MICROSOFT-WINDOWS-APPLICATION-EXPERIENCE/COMPATIBILITY-INFRASTRUCTURE-DEBUG\\","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINEVT\\CHANNELS\\MICROSOFT-WINDOWS-APPLICATION-EXPERIENCE/PROGRAM-COMPATIBILITY-ASSISTANT\\","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINEVT\\CHANNELS\\MICROSOFT-WINDOWS-APPLICATION-EXPERIENCE/PROGRAM-COMPATIBILITY-ASSISTANT/ANALYTIC\\","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINEVT\\CHANNELS\\MICROSOFT-WINDOWS-APPLICATION-EXPERIENCE/PROGRAM-COMPATIBILITY-ASSISTANT/TRACE\\","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINEVT\\CHANNELS\\MICROSOFT-WINDOWS-APPLICATION-EXPERIENCE/PROGRAM-COMPATIBILITY-TROUBLESHOOTER\\","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINEVT\\CHANNELS\\MICROSOFT-WINDOWS-APPLICATION-EXPERIENCE/PROGRAM-INVENTORY\\","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINEVT\\CHANNELS\\MICROSOFT-WINDOWS-APPLICATION-EXPERIENCE/PROGRAM-TELEMETRY\\","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINEVT\\CHANNELS\\MICROSOFT-WINDOWS-APPLICATION-EXPERIENCE/STEPS-RECORDER\\","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINEVT\\CHANNELS\\MICROSOFT-WINDOWS-APPLICATIONRESOURCEMANAGEMENTSYSTEM/DIAGNOSTIC\\","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINEVT\\CHANNELS\\MICROSOFT-WINDOWS-APPLICATIONRESOURCEMANAGEMENTSYSTEM/OPERATIONAL\\","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINEVT\\CHANNELS\\MICROSOFT-WINDOWS-APPLOCKER/EXE AND DLL\\","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINEVT\\CHANNELS\\MICROSOFT-WINDOWS-APPLOCKER/MSI AND SCRIPT\\","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINEVT\\CHANNELS\\MICROSOFT-WINDOWS-APPLOCKER/PACKAGED APP-DEPLOYMENT\\","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINEVT\\CHANNELS\\MICROSOFT-WINDOWS-APPLOCKER/PACKAGED APP-EXECUTION\\","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINEVT\\CHANNELS\\MICROSOFT-WINDOWS-APPMODEL-RUNTIME/ADMIN\\","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINEVT\\CHANNELS\\MICROSOFT-WINDOWS-APPMODEL-RUNTIME/ANALYTIC\\","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINEVT\\CHANNELS\\MICROSOFT-WINDOWS-APPMODEL-RUNTIME/DEBUG\\","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINEVT\\CHANNELS\\MICROSOFT-WINDOWS-APPMODEL-RUNTIME/DIAGNOSTICS\\","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINEVT\\CHANNELS\\MICROSOFT-WINDOWS-APPMODEL-STATE/DEBUG\\","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINEVT\\CHANNELS\\MICROSOFT-WINDOWS-APPMODEL-STATE/DIAGNOSTIC\\","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINEVT\\CHANNELS\\MICROSOFT-WINDOWS-APPREADINESS/ADMIN\\","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINEVT\\CHANNELS\\MICROSOFT-WINDOWS-APPREADINESS/DEBUG\\","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINEVT\\CHANNELS\\MICROSOFT-WINDOWS-APPREADINESS/OPERATIONAL\\","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINEVT\\CHANNELS\\MICROSOFT-WINDOWS-APPSRUPROV\\","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINEVT\\CHANNELS\\MICROSOFT-WINDOWS-APPXDEPLOYMENT/DIAGNOSTIC\\","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINEVT\\CHANNELS\\MICROSOFT-WINDOWS-APPXDEPLOYMENT/OPERATIONAL\\","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINEVT\\CHANNELS\\MICROSOFT-WINDOWS-APPXDEPLOYMENTSERVER/DEBUG\\","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINEVT\\CHANNELS\\MICROSOFT-WINDOWS-APPXDEPLOYMENTSERVER/DIAGNOSTIC\\","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINEVT\\CHANNELS\\MICROSOFT-WINDOWS-APPXDEPLOYMENTSERVER/OPERATIONAL\\","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINEVT\\CHANNELS\\MICROSOFT-WINDOWS-APPXDEPLOYMENTSERVER/RESTRICTED\\","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINEVT\\CHANNELS\\MICROSOFT-WINDOWS-APPXPACKAGING/DEBUG\\","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINEVT\\CHANNELS\\MICROSOFT-WINDOWS-APPXPACKAGING/OPERATIONAL\\","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINEVT\\CHANNELS\\MICROSOFT-WINDOWS-APPXPACKAGING/PERFORMANCE\\","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINEVT\\CHANNELS\\MICROSOFT-WINDOWS-ASN1/OPERATIONAL\\","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINEVT\\CHANNELS\\MICROSOFT-WINDOWS-ASSIGNEDACCESS/ADMIN\\","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINEVT\\CHANNELS\\MICROSOFT-WINDOWS-ASSIGNEDACCESS/OPERATIONAL\\","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINEVT\\CHANNELS\\MICROSOFT-WINDOWS-ASSIGNEDACCESSBROKER/ADMIN\\","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINEVT\\CHANNELS\\MICROSOFT-WINDOWS-ASSIGNEDACCESSBROKER/OPERATIONAL\\","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINEVT\\CHANNELS\\MICROSOFT-WINDOWS-ASYNCHRONOUSCAUSALITY/CAUSALITY\\","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINEVT\\CHANNELS\\MICROSOFT-WINDOWS-ATAPORT/GENERAL\\","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINEVT\\CHANNELS\\MICROSOFT-WINDOWS-ATAPORT/SATA-LPM\\","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINEVT\\CHANNELS\\MICROSOFT-WINDOWS-AUDIO/CAPTUREMONITOR\\","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINEVT\\CHANNELS\\MICROSOFT-WINDOWS-AUDIO/GLITCHDETECTION\\","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINEVT\\CHANNELS\\MICROSOFT-WINDOWS-AUDIO/INFORMATIONAL\\","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINEVT\\CHANNELS\\MICROSOFT-WINDOWS-AUDIO/OPERATIONAL\\","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINEVT\\CHANNELS\\MICROSOFT-WINDOWS-AUDIO/PERFORMANCE\\","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINEVT\\CHANNELS\\MICROSOFT-WINDOWS-AUDIO/PLAYBACKMANAGER\\","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"Local\\SM0:3504:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"name":"SM0:3504:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"name":"Local\\SM0:6432:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"name":"Local\\SM0:6432:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]},{"name":"SM0:6432:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"680a89fcd69ef7678306befa"}]}]}},"report_ids":{"sandbox_job_ids":["680a89fcd69ef7678306befa"]}}}]]}] 2c:[["$","title","0",{"children":"Malicious Ransom.LockBit Sample de96af271bf5… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample de96af271bf5…. Malware family: Ransom.LockBit. Threat score 100/100. 19/24 AV engines flagged this file. 5 malicious and 12 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62"}],["$","meta","4",{"property":"og:title","content":"Malicious Ransom.LockBit Sample de96af271bf5… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample de96af271bf5…. Malware family: Ransom.LockBit. Threat score 100/100. 19/24 AV engines flagged this file. 5 malicious and 12 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/de96af271bf52bdcecaaf555a711f8a1397ed4b8be0d9c16f483253d29deaf62"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Ransom.LockBit Sample de96af271bf5… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample de96af271bf5…. Malware family: Ransom.LockBit. Threat score 100/100. 19/24 AV engines flagged this file. 5 malicious and 12 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L54","11",{}]] 32:null