26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 30:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4bf,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win/malicious_confidence_100% Sample e1ecf0f7bd90… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample e1ecf0f7bd90…. Malware family: Win/malicious_confidence_100%. Threat score 100/100. 12/28 AV engines flagged this file. 4 malicious and 4 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/e1ecf0f7bd90553baaa83dcdc177e1d2b20d6ee5520f5d9b44cdf59389432b10","keywords":["Malicious","Win/malicious_confidence_100%","malware analysis","sandbox report","threat intelligence","e1ecf0f7bd90553baaa83dcdc177e1d2b20d6ee5520f5d9b44cdf59389432b10"],"about":{"@type":"SoftwareApplication","name":"2","applicationCategory":["pedll","64bits","executable"],"identifier":"e1ecf0f7bd90553baaa83dcdc177e1d2b20d6ee5520f5d9b44cdf59389432b10","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Win/malicious_confidence_100%","antivirusDetections":{"malicious":12,"total":28},"behavioralIndicators":{"malicious":4,"suspicious":4},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T402,"$[![Button 1]!]" onClick='$[![some_function()]!]'/>$[0[]0][>END<]!$[FingerTextData FingerTextData]@# br Ext:html
[>END<]!$[FingerTextData FingerTextData]@# big Ext:html $[0[]0][>END<]!$[FingerTextData FingerTextData]@# b Ext:html $[0[]0][>END<]!$[FingerTextData FingerTextData]@# a Ext:html $[![{text}]!][>END<]!$[FingerTextData FingerTextData]@# visualstudio Ext:gitignore /bin/* /Unicode Debug/* /Unicode Release/* /Ansi Debug/* /Ansi Release/* /Debug/* /Release/* *.aps *.pdb[>END<]!$[FingerTextData FingerTextData]@# heroku_rails Ext:gitignore log/*.log tmp/**/* config/database.yml db/*.sqlite3 .bundle [>END<]!$[FingerTextData FingerTextData]@# partial Ext:erb <%= render :partial => '$[![(path)]!]' %>[>END<]!$[FingerTextData FingerTextData]@# fftf Ext:erb f.text_field :$[![{attribute}]!][>END<]!$[FingerTextData FingerTextData]@# ffta Ext:erb f.text_area :$[![{attribute}]!][>END<]!$[FingerTextData FingerTextData]@# ffrb Ext:erb f.radio_button :$[![{attribute}]!]"28:T418,"UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;" "UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q AND (type='table' OR type='index' OR type='trigger');" "UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;" "INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);" "SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';'FROM main.sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND rootpage>0" "SELECT 'DELETE FROM vacuum_db.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence'" "SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';"29:Taba,"e1ecf0f7bd90553baaa83dcdc177e1d2b20d6ee5520f5d9b44cdf59389432b10.bin" contains export function called "CLRCreateInstance" at ordinal 1 "e1ecf0f7bd90553baaa83dcdc177e1d2b20d6ee5520f5d9b44cdf59389432b10.bin" contains export function called "CallFunctionShim" at ordinal 2 "e1ecf0f7bd90553baaa83dcdc177e1d2b20d6ee5520f5d9b44cdf59389432b10.bin" contains export function called "CloseCtrs" at ordinal 3 "e1ecf0f7bd90553baaa83dcdc177e1d2b20d6ee5520f5d9b44cdf59389432b10.bin" contains export function called "ClrCreateManagedInstance" at ordinal 4 "e1ecf0f7bd90553baaa83dcdc177e1d2b20d6ee5520f5d9b44cdf59389432b10.bin" contains export function called "CoEEShutDownCOM" at ordinal 5 "e1ecf0f7bd90553baaa83dcdc177e1d2b20d6ee5520f5d9b44cdf59389432b10.bin" contains export function called "CoInitializeCor" at ordinal 6 "e1ecf0f7bd90553baaa83dcdc177e1d2b20d6ee5520f5d9b44cdf59389432b10.bin" contains export function called "CoInitializeEE" at ordinal 7 "e1ecf0f7bd90553baaa83dcdc177e1d2b20d6ee5520f5d9b44cdf59389432b10.bin" contains export function called "CoUninitializeCor" at ordinal 8 "e1ecf0f7bd90553baaa83dcdc177e1d2b20d6ee5520f5d9b44cdf59389432b10.bin" contains export function called "CoUninitializeEE" at ordinal 9 "e1ecf0f7bd90553baaa83dcdc177e1d2b20d6ee5520f5d9b44cdf59389432b10.bin" contains export function called "CollectCtrs" at ordinal 10 "e1ecf0f7bd90553baaa83dcdc177e1d2b20d6ee5520f5d9b44cdf59389432b10.bin" contains export function called "CorBindToCurrentRuntime" at ordinal 11 "e1ecf0f7bd90553baaa83dcdc177e1d2b20d6ee5520f5d9b44cdf59389432b10.bin" contains export function called "CorBindToRuntime" at ordinal 12 "e1ecf0f7bd90553baaa83dcdc177e1d2b20d6ee5520f5d9b44cdf59389432b10.bin" contains export function called "CorBindToRuntimeByCfg" at ordinal 13 "e1ecf0f7bd90553baaa83dcdc177e1d2b20d6ee5520f5d9b44cdf59389432b10.bin" contains export function called "CorBindToRuntimeByPath" at ordinal 14 "e1ecf0f7bd90553baaa83dcdc177e1d2b20d6ee5520f5d9b44cdf59389432b10.bin" contains export function called "CorBindToRuntimeByPathEx" at ordinal 15 "e1ecf0f7bd90553baaa83dcdc177e1d2b20d6ee5520f5d9b44cdf59389432b10.bin" contains export function called "CorBindToRuntimeEx" at ordinal 16 "e1ecf0f7bd90553baaa83dcdc177e1d2b20d6ee5520f5d9b44cdf59389432b10.bin" contains export function called "CorBindToRuntimeHost" at ordinal 17 "e1ecf0f7bd90553baaa83dcdc177e1d2b20d6ee5520f5d9b44cdf59389432b10.bin" contains export function called "CorDllMainWorker" at ordinal 18 "e1ecf0f7bd90553baaa83dcdc177e1d2b20d6ee5520f5d9b44cdf59389432b10.bin" contains export function called "CorExitProcess" at ordinal 19 "e1ecf0f7bd90553baaa83dcdc177e1d2b20d6ee5520f5d9b44cdf59389432b10.bin" contains export function called "CorGetSvc" at ordinal 202a:Ta02,"CorExitProcess" (Indicator: "ExitProcess") "GetLastActivePopup" (Indicator: "GetLastActivePopup") "GetActiveWindow" (Indicator: "GetActiveWindow") "MessageBoxW" (Indicator: "MessageBoxW") "Too many open files" (Indicator: "open") "Too many open files in system" (Indicator: "open") ", you can go to the %Notepad++ folder%\plugins\FingerText and get the old database file Snippets.db3. Rename is to FingerText.db3 and move it to the config\FingerText folder after update. Upgrading from 0.3.5 or below FingerText 0.3.5 or below use a 'one snippet per file' system to store snippets, which is not compatibile with current version. If you really have a lot of snippets created using these early version, please send your snippets to erinata@gmail.com. I will try my best to import them into the database in the current version." (Indicator: "send") "; This is the config file of FingerText. ; Do NOT mess up with the settings unless you know what you are doing ; You need to restart Notepad++ to apply the changes ; ; version -- Don't change this ; snippet_list_order_tagtype -- 0: The SnippetDock will order the snippets by trigger text ; 1: The SnippetDock will order the snippets by scope ; indent_reference -- 0: The snippnet content will be inserted without any change in ; indentation ; 1: The snippnet content will be inserted at the same indentation ; level as the trigger text ; chain_limit -- This is the maximum number dynamic hotspots that can be triggered in one ; snippet. Default is 100 ; tab_tag_completion -- 0: When a snippet is not found when the user hit [tab] key, FingerText ; will just send" (Indicator: "send") "The file cannot be opened." (Indicator: "open") "bind or column index out of range" (Indicator: "bind") "unable to open database file" (Indicator: "open") "reverse_unordered_selects" (Indicator: "select") "API call with %s database connection pointer" (Indicator: "connect") "bind on a busy prepared statement: [%s]" (Indicator: "bind") "cannot open savepoint - SQL statements in progress" (Indicator: "open") "cannot open value of type %s" (Indicator: "open") "cannot open virtual table: %s" (Indicator: "open") "cannot open view: %s" (Indicator: "open") "cannot open %s column for writing" (Indicator: "open") "unable to open database: %s" (Indicator: "open")2b:T13e4,Process "rundll32.exe" (UID: 00000000-00002588) was launched with new environment variables: "PROCESSOR_ARCHITEW6432="AMD64"" Process "rundll32.exe" (UID: 00000000-00002588) was launched with modified environment variables: "CommonProgramFiles, PROCESSOR_ARCHITECTURE, ProgramFiles" Process "WerFault.exe" (UID: 00000000-00004092) was launched with modified environment variables: "CommonProgramFiles, PROCESSOR_ARCHITECTURE, ProgramFiles" Process "WerFault.exe" (UID: 00000000-00004092) was launched with missing environment variables: "PROCESSOR_ARCHITEW6432" Process "rundll32.exe" (UID: 00000000-00002436) was launched with new environment variables: "PROCESSOR_ARCHITEW6432="AMD64"" Process "rundll32.exe" (UID: 00000000-00002436) was launched with modified environment variables: "CommonProgramFiles, PROCESSOR_ARCHITECTURE, ProgramFiles" Process "WerFault.exe" (UID: 00000000-00002660) was launched with modified environment variables: "CommonProgramFiles, PROCESSOR_ARCHITECTURE, ProgramFiles" Process "WerFault.exe" (UID: 00000000-00002660) was launched with missing environment variables: "PROCESSOR_ARCHITEW6432" Process "rundll32.exe" (UID: 00000000-00002636) was launched with new environment variables: "PROCESSOR_ARCHITEW6432="AMD64"" Process "rundll32.exe" (UID: 00000000-00002636) was launched with modified environment variables: "CommonProgramFiles, PROCESSOR_ARCHITECTURE, ProgramFiles" Process "WerFault.exe" (UID: 00000000-00003780) was launched with modified environment variables: "CommonProgramFiles, PROCESSOR_ARCHITECTURE, ProgramFiles" Process "WerFault.exe" (UID: 00000000-00003780) was launched with missing environment variables: "PROCESSOR_ARCHITEW6432" Process "rundll32.exe" (UID: 00000000-00003040) was launched with new environment variables: "PROCESSOR_ARCHITEW6432="AMD64"" Process "rundll32.exe" (UID: 00000000-00003040) was launched with modified environment variables: "CommonProgramFiles, PROCESSOR_ARCHITECTURE, ProgramFiles" Process "WerFault.exe" (UID: 00000000-00001172) was launched with modified environment variables: "CommonProgramFiles, PROCESSOR_ARCHITECTURE, ProgramFiles" Process "WerFault.exe" (UID: 00000000-00001172) was launched with missing environment variables: "PROCESSOR_ARCHITEW6432" Process "rundll32.exe" (UID: 00000000-00000364) was launched with new environment variables: "PROCESSOR_ARCHITEW6432="AMD64"" Process "rundll32.exe" (UID: 00000000-00000364) was launched with modified environment variables: "CommonProgramFiles, PROCESSOR_ARCHITECTURE, ProgramFiles" Process "WerFault.exe" (UID: 00000000-00003480) was launched with modified environment variables: "CommonProgramFiles, PROCESSOR_ARCHITECTURE, ProgramFiles" Process "WerFault.exe" (UID: 00000000-00003480) was launched with missing environment variables: "PROCESSOR_ARCHITEW6432" Process "rundll32.exe" (UID: 00000000-00002824) was launched with new environment variables: "PROCESSOR_ARCHITEW6432="AMD64"" Process "rundll32.exe" (UID: 00000000-00002824) was launched with modified environment variables: "CommonProgramFiles, PROCESSOR_ARCHITECTURE, ProgramFiles" Process "WerFault.exe" (UID: 00000000-00001076) was launched with modified environment variables: "CommonProgramFiles, PROCESSOR_ARCHITECTURE, ProgramFiles" Process "WerFault.exe" (UID: 00000000-00001076) was launched with missing environment variables: "PROCESSOR_ARCHITEW6432" Process "rundll32.exe" (UID: 00000000-00001656) was launched with new environment variables: "PROCESSOR_ARCHITEW6432="AMD64"" Process "rundll32.exe" (UID: 00000000-00001656) was launched with modified environment variables: "CommonProgramFiles, PROCESSOR_ARCHITECTURE, ProgramFiles" Process "WerFault.exe" (UID: 00000000-00002340) was launched with modified environment variables: "CommonProgramFiles, PROCESSOR_ARCHITECTURE, ProgramFiles" Process "WerFault.exe" (UID: 00000000-00002340) was launched with missing environment variables: "PROCESSOR_ARCHITEW6432" Process "rundll32.exe" (UID: 00000000-00003124) was launched with new environment variables: "PROCESSOR_ARCHITEW6432="AMD64"" Process "rundll32.exe" (UID: 00000000-00003124) was launched with modified environment variables: "CommonProgramFiles, PROCESSOR_ARCHITECTURE, ProgramFiles" Process "WerFault.exe" (UID: 00000000-00003248) was launched with modified environment variables: "CommonProgramFiles, PROCESSOR_ARCHITECTURE, ProgramFiles" Process "WerFault.exe" (UID: 00000000-00003248) was launched with missing environment variables: "PROCESSOR_ARCHITEW6432" Process "rundll32.exe" (UID: 00000000-00003612) was launched with new environment variables: "PROCESSOR_ARCHITEW6432="AMD64"" Process "rundll32.exe" (UID: 00000000-00003612) was launched with modified environment variables: "CommonProgramFiles, PROCESSOR_ARCHITECTURE, ProgramFiles" Process "WerFault.exe" (UID: 00000000-00000880) was launched with modified environment variables: "CommonProgramFiles, PROCESSOR_ARCHITECTURE, ProgramFiles" Process "WerFault.exe" (UID: 00000000-00000880) was launched with missing environment variables: "PROCESSOR_ARCHITEW6432"2c:T728,Spawned process "rundll32.exe" with commandline ""C:\2.dll",#1" (UID: 00000000-00002588) Spawned process "rundll32.exe" with commandline ""C:\2.dll",#2" (UID: 00000000-00000276) Spawned process "rundll32.exe" with commandline ""C:\2.dll",#3" (UID: 00000000-00003360) Spawned process "rundll32.exe" with commandline ""C:\2.dll",#4" (UID: 00000000-00003616) Spawned process "WerFault.exe" with commandline "-u -p 2588 -s 208" (UID: 00000000-00004092) Spawned process "WerFault.exe" with commandline "-u -p 276 -s 208" (UID: 00000000-00004048) Spawned process "WerFault.exe" with commandline "-u -p 3360 -s 208" (UID: 00000000-00004084) Spawned process "WerFault.exe" with commandline "-u -p 3616 -s 208" (UID: 00000000-00000388) Spawned process "rundll32.exe" with commandline ""C:\2.dll",#5" (UID: 00000000-00002436) Spawned process "rundll32.exe" with commandline ""C:\2.dll",#6" (UID: 00000000-00003128) Spawned process "rundll32.exe" with commandline ""C:\2.dll",#7" (UID: 00000000-00001800) Spawned process "rundll32.exe" with commandline ""C:\2.dll",#8" (UID: 00000000-00003696) Spawned process "WerFault.exe" with commandline "-u -p 2436 -s 208" (UID: 00000000-00002660) Spawned process "WerFault.exe" with commandline "-u -p 1800 -s 208" (UID: 00000000-00001904) Spawned process "WerFault.exe" with commandline "-u -p 3128 -s 208" (UID: 00000000-00003800) Spawned process "WerFault.exe" with commandline "-u -p 3696 -s 208" (UID: 00000000-00002832) Spawned process "rundll32.exe" with commandline ""C:\2.dll",#9" (UID: 00000000-00002636) Spawned process "rundll32.exe" with commandline ""C:\2.dll",#10" (UID: 00000000-00003512) Spawned process "rundll32.exe" with commandline ""C:\2.dll",#11" (UID: 00000000-00002816) Spawned process "rundll32.exe" with commandline ""C:\2.dll",#12" (UID: 00000000-00002528)2d:T728,Spawned process "rundll32.exe" with commandline ""C:\2.dll",#1" (UID: 00000000-00002588) Spawned process "rundll32.exe" with commandline ""C:\2.dll",#2" (UID: 00000000-00000276) Spawned process "rundll32.exe" with commandline ""C:\2.dll",#3" (UID: 00000000-00003360) Spawned process "rundll32.exe" with commandline ""C:\2.dll",#4" (UID: 00000000-00003616) Spawned process "WerFault.exe" with commandline "-u -p 2588 -s 208" (UID: 00000000-00004092) Spawned process "WerFault.exe" with commandline "-u -p 276 -s 208" (UID: 00000000-00004048) Spawned process "WerFault.exe" with commandline "-u -p 3360 -s 208" (UID: 00000000-00004084) Spawned process "WerFault.exe" with commandline "-u -p 3616 -s 208" (UID: 00000000-00000388) Spawned process "rundll32.exe" with commandline ""C:\2.dll",#5" (UID: 00000000-00002436) Spawned process "rundll32.exe" with commandline ""C:\2.dll",#6" (UID: 00000000-00003128) Spawned process "rundll32.exe" with commandline ""C:\2.dll",#7" (UID: 00000000-00001800) Spawned process "rundll32.exe" with commandline ""C:\2.dll",#8" (UID: 00000000-00003696) Spawned process "WerFault.exe" with commandline "-u -p 2436 -s 208" (UID: 00000000-00002660) Spawned process "WerFault.exe" with commandline "-u -p 1800 -s 208" (UID: 00000000-00001904) Spawned process "WerFault.exe" with commandline "-u -p 3128 -s 208" (UID: 00000000-00003800) Spawned process "WerFault.exe" with commandline "-u -p 3696 -s 208" (UID: 00000000-00002832) Spawned process "rundll32.exe" with commandline ""C:\2.dll",#9" (UID: 00000000-00002636) Spawned process "rundll32.exe" with commandline ""C:\2.dll",#10" (UID: 00000000-00003512) Spawned process "rundll32.exe" with commandline ""C:\2.dll",#11" (UID: 00000000-00002816) Spawned process "rundll32.exe" with commandline ""C:\2.dll",#12" (UID: 00000000-00002528)2e:T576,"rundll32.exe" called "GetNativeSystemInfo" (UID: 00000000-00002588) "rundll32.exe" called "GetNativeSystemInfo" (UID: 00000000-00000276) "rundll32.exe" called "GetNativeSystemInfo" (UID: 00000000-00003360) "rundll32.exe" called "GetNativeSystemInfo" (UID: 00000000-00003616) "rundll32.exe" called "GetNativeSystemInfo" (UID: 00000000-00002436) "rundll32.exe" called "GetNativeSystemInfo" (UID: 00000000-00001800) "rundll32.exe" called "GetNativeSystemInfo" (UID: 00000000-00003696) "rundll32.exe" called "GetNativeSystemInfo" (UID: 00000000-00002528) "rundll32.exe" called "GetNativeSystemInfo" (UID: 00000000-00003040) "rundll32.exe" called "GetNativeSystemInfo" (UID: 00000000-00003728) "rundll32.exe" called "GetNativeSystemInfo" (UID: 00000000-00003092) "rundll32.exe" called "GetNativeSystemInfo" (UID: 00000000-00000364) "rundll32.exe" called "GetNativeSystemInfo" (UID: 00000000-00003180) "rundll32.exe" called "GetNativeSystemInfo" (UID: 00000000-00003972) "rundll32.exe" called "GetNativeSystemInfo" (UID: 00000000-00003396) "rundll32.exe" called "GetNativeSystemInfo" (UID: 00000000-00002824) "rundll32.exe" called "GetNativeSystemInfo" (UID: 00000000-00000828) "rundll32.exe" called "GetNativeSystemInfo" (UID: 00000000-00003724) "rundll32.exe" called "GetNativeSystemInfo" (UID: 00000000-00001656) "regsvr32.exe" called "GetNativeSystemInfo" (UID: 00000000-00002320)2f:Tb59,Spawned process "WerFault.exe" with commandline "-u -p 2588 -s 208" (UID: 00000000-00004092) Spawned process "WerFault.exe" with commandline "-u -p 276 -s 208" (UID: 00000000-00004048) Spawned process "WerFault.exe" with commandline "-u -p 3360 -s 208" (UID: 00000000-00004084) Spawned process "WerFault.exe" with commandline "-u -p 3616 -s 208" (UID: 00000000-00000388) Spawned process "WerFault.exe" with commandline "-u -p 2436 -s 208" (UID: 00000000-00002660) Spawned process "WerFault.exe" with commandline "-u -p 1800 -s 208" (UID: 00000000-00001904) Spawned process "WerFault.exe" with commandline "-u -p 3128 -s 208" (UID: 00000000-00003800) Spawned process "WerFault.exe" with commandline "-u -p 3696 -s 208" (UID: 00000000-00002832) Spawned process "WerFault.exe" with commandline "-u -p 3512 -s 208" (UID: 00000000-00003780) Spawned process "WerFault.exe" with commandline "-u -p 2528 -s 208" (UID: 00000000-00002464) Spawned process "WerFault.exe" with commandline "-u -p 2636 -s 208" (UID: 00000000-00002616) Spawned process "WerFault.exe" with commandline "-u -p 2816 -s 208" (UID: 00000000-00003988) Spawned process "WerFault.exe" with commandline "-u -p 3728 -s 208" (UID: 00000000-00001172) Spawned process "WerFault.exe" with commandline "-u -p 2268 -s 208" (UID: 00000000-00002232) Spawned process "WerFault.exe" with commandline "-u -p 3040 -s 208" (UID: 00000000-00002924) Spawned process "WerFault.exe" with commandline "-u -p 3092 -s 208" (UID: 00000000-00003208) Spawned process "WerFault.exe" with commandline "-u -p 3180 -s 208" (UID: 00000000-00003480) Spawned process "WerFault.exe" with commandline "-u -p 364 -s 208" (UID: 00000000-00002352) Spawned process "WerFault.exe" with commandline "-u -p 3396 -s 208" (UID: 00000000-00001400) Spawned process "WerFault.exe" with commandline "-u -p 2824 -s 208" (UID: 00000000-00001076) Spawned process "WerFault.exe" with commandline "-u -p 1252 -s 208" (UID: 00000000-00001620) Spawned process "WerFault.exe" with commandline "-u -p 828 -s 208" (UID: 00000000-00000736) Spawned process "WerFault.exe" with commandline "-u -p 3724 -s 212" (UID: 00000000-00002836) Spawned process "regsvr32.exe" with commandline "/s "C:\2.dll"" (UID: 00000000-00002320) Spawned process "WerFault.exe" with commandline "-u -p 2320 -s 252" (UID: 00000000-00002340) Spawned process "WerFault.exe" with commandline "-u -p 1656 -s 208" (UID: 00000000-00002344) Spawned process "WerFault.exe" with commandline "-u -p 1280 -s 208" (UID: 00000000-00002696) Spawned process "WerFault.exe" with commandline "-u -p 2712 -s 208" (UID: 00000000-00003556) Spawned process "WerFault.exe" with commandline "-u -p 3124 -s 208" (UID: 00000000-00003248) Spawned process "WerFault.exe" with commandline "-u -p 3612 -s 208" (UID: 00000000-00000880) Spawned process "WerFault.exe" with commandline "-u -p 3052 -s 212" (UID: 00000000-00002088)1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"e1ecf0f7bd90553baaa83dcdc177e1d2b20d6ee5520f5d9b44cdf59389432b10","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1791243538057,"unified_at":"2026-10-05T23:38:58.057Z","metadata":{"hashes":{"sha256":"e1ecf0f7bd90553baaa83dcdc177e1d2b20d6ee5520f5d9b44cdf59389432b10","sha1":"56dddfda80d3eb6d6cd3f0531719cf9fac5abf4a","md5":"05b6f459be513bf6120e9b2b85f6c844","sha512":"ffca469d604fc0e6c3c5ff2c86674f33e9c4b5d4bed297fd9bb7992669ae12bc569f5087bfe9566f397eb7f5f087f477fc028ae5898352c22efeec54bc28f4c8","ssdeep":"24576:m7ppILRKvKboseNnZOIO0MB0wFQCb1d+dER99QEM6ay8U:m3ILRKvnvaIO0MtQCbPso9Qhy","ssdeep_chunks":["24576:m7ppILR","24576:7ppILRK","24576:ppILRKv","24576:pILRKvK","24576:ILRKvKb","24576:LRKvKbo","24576:RKvKbos","24576:KvKbose","24576:vKboseN","24576:KboseNn","24576:boseNnZ","24576:oseNnZO","24576:seNnZOI","24576:eNnZOIO","24576:NnZOIO0","24576:nZOIO0M","24576:ZOIO0MB","24576:OIO0MB0","24576:IO0MB0w","24576:O0MB0wF","24576:0MB0wFQ","24576:MB0wFQC","24576:B0wFQCb","24576:0wFQCb1","24576:wFQCb1d","24576:FQCb1d+","24576:QCb1d+d","24576:Cb1d+dE","24576:b1d+dER","24576:1d+dER9","24576:d+dER99","24576:+dER99Q","24576:dER99QE","24576:ER99QEM","24576:R99QEM6","24576:99QEM6a","24576:9QEM6ay","24576:QEM6ay8","24576:EM6ay8U","49152:m7ppILR","49152:7ppILRK","49152:ppILRKv","49152:pILRKvK","49152:ILRKvKb","49152:LRKvKbo","49152:RKvKbos","49152:KvKbose","49152:vKboseN","49152:KboseNn","49152:boseNnZ","49152:oseNnZO","49152:seNnZOI","49152:eNnZOIO","49152:NnZOIO0","49152:nZOIO0M","49152:ZOIO0MB","49152:OIO0MB0","49152:IO0MB0w","49152:O0MB0wF","49152:0MB0wFQ","49152:MB0wFQC","49152:B0wFQCb","49152:0wFQCb1","49152:wFQCb1d","49152:FQCb1d+","49152:QCb1d+d","49152:Cb1d+dE","49152:b1d+dER","49152:1d+dER9","49152:d+dER99","49152:+dER99Q","49152:dER99QE","49152:ER99QEM","49152:R99QEM6","49152:99QEM6a","49152:9QEM6ay","49152:QEM6ay8","49152:EM6ay8U","24576:m3ILRKv","24576:3ILRKvn","24576:ILRKvnv","24576:LRKvnva","24576:RKvnvaI","24576:KvnvaIO","24576:vnvaIO0","24576:nvaIO0M","24576:vaIO0Mt","24576:aIO0MtQ","24576:IO0MtQC","24576:O0MtQCb","24576:0MtQCbP","24576:MtQCbPs","24576:tQCbPso","24576:QCbPso9","24576:CbPso9Q","24576:bPso9Qh","24576:Pso9Qhy"],"imphash":"4c2c167a499f4140e8f92ab4e66832ac"},"file_info":{"file_name":"2","file_type":["pedll","64bits","executable"],"file_type_id":"64-bit dll","file_size":1145344,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1664547218000,"last_seen":1679302437000,"last_multi_scan":1679302437000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["dxpdown","labyrinthchollima","targeted"]},"stats":{"av":{"malicious_count":12,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":10},"sandbox_signatures":{"informative_count":23,"suspicious_count":4,"malicious_count":4,"total":31},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win.Agent","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Trojan.ZetaNile.B","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"malicious","threat_name":"W64/ABRisk.UJDP-2734","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan.ZetaNile.B (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win64/NukeSped.NC trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 00598ec81 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"Trojan.Win64.Agentb.ktzr","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"microsoftdefender":{"name":"Microsoft Defender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win64.NukeSped.jtdbvc","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"malicious","threat_name":"TROJ_FR.723AA791","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"malicious","threat_name":"TROJ_FR.723AA791","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.NukeSped.Win64.347","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Win/malicious_confidence_100%","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Imports GetCommandLine API"},{"type":"informative","value":"Contains ability to retrieve the NetBIOS name of the local computer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6336f99058e6b22302251a9a"}]},{"tactic":"Privilege Escalation","technique":"Process Hollowing","attack_id":"T1055.012","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/012","identifiers":[{"type":"informative","value":"Contains ability to install a hook procedure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6336f99058e6b22302251a9a"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Imports system security related APIs"}],"sources":[{"report_type":"sandbox","report_id":"6336f99058e6b22302251a9a"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","sources":[{"report_type":"sandbox","report_id":"6336f99058e6b22302251a9a"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"informative","value":"Contains ability to retrieve information about pressed keystrokes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6336f99058e6b22302251a9a"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"suspicious","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Contains ability to read software policies"}],"sources":[{"report_type":"sandbox","report_id":"6336f99058e6b22302251a9a"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Contains ability to enumerate processes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6336f99058e6b22302251a9a"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"suspicious","value":"Reads information about supported languages"},{"type":"informative","value":"Contains registry location strings"}],"sources":[{"report_type":"sandbox","report_id":"6336f99058e6b22302251a9a"}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Contains SQL queries"}],"sources":[{"report_type":"sandbox","report_id":"6336f99058e6b22302251a9a"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","sources":[{"report_type":"sandbox","report_id":"6336f99058e6b22302251a9a"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to install a hook procedure (API string)","description":"Observed api string:\"SetWindowsHookExW\" [Source: e1ecf0f7bd90553baaa83dcdc177e1d2b20d6ee5520f5d9b44cdf59389432b10.bin]","origin":"File/Memory","mitre_attack_id":"T1055.012","relevance":1,"id":"string-91","sources":[{"report_type":"sandbox","report_id":"6336f99058e6b22302251a9a"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"rundll32.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"rundll32.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6336f99058e6b22302251a9a"}]},{"level":"informative","category":"General","name":"An application crash occurred","description":"Report process \"WerFault.exe\" was created by \"rundll32.exe\"","origin":"Monitored Target","id":"target-2","sources":[{"report_type":"sandbox","report_id":"6336f99058e6b22302251a9a"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"$27","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"6336f99058e6b22302251a9a"}]},{"level":"informative","category":"General","name":"Contains SQL queries","description":"$28","origin":"File/Memory","mitre_attack_id":"T1213","relevance":2,"id":"string-16","sources":[{"report_type":"sandbox","report_id":"6336f99058e6b22302251a9a"}]},{"level":"informative","category":"General","name":"Contains export functions","description":"$29","origin":"Static Parser","relevance":1,"id":"static-78","sources":[{"report_type":"sandbox","report_id":"6336f99058e6b22302251a9a"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"\"SOFTWARE\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\"","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"6336f99058e6b22302251a9a"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\DBWinMutex\"\n \"DBWinMutex\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6336f99058e6b22302251a9a"}]},{"level":"informative","category":"General","name":"Found API related strings","description":"$2a","origin":"File/Memory","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"6336f99058e6b22302251a9a"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"e1ecf0f7bd90553baaa83dcdc177e1d2b20d6ee5520f5d9b44cdf59389432b10.bin\" has an executable section named \".text\"\n \"e1ecf0f7bd90553baaa83dcdc177e1d2b20d6ee5520f5d9b44cdf59389432b10.bin\" has an executable section named \"text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"6336f99058e6b22302251a9a"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"e1ecf0f7bd90553baaa83dcdc177e1d2b20d6ee5520f5d9b44cdf59389432b10.bin\" has an writable section named \".data\"","origin":"Static Parser","relevance":1,"id":"static-95","sources":[{"report_type":"sandbox","report_id":"6336f99058e6b22302251a9a"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"\"e1ecf0f7bd90553baaa83dcdc177e1d2b20d6ee5520f5d9b44cdf59389432b10.bin\" file has an entrypoint instructions - \"movqword ptr [rsp + 8], rbx,movqword ptr [rsp + 0x10], rsi,pushrdi,subrsp, 0x20,movrdi, r8,movebx, edx,movrsi, rcx,cmpedx, 1,jne0x1800ac59d,call0x1800b58bc,movr8, rdi,movedx, ebx,movrcx, rsi,movrbx, qword ptr [rsp + 0x30],movrsi, qword ptr [rsp + 0x38],addrsp, 0x20,poprdi,jmp0x1800ac460,int3,int3,int3,movqword ptr [rsp + 8], rcx,subrsp, 0x88,learcx, [rip + 0x4f861],callqword ptr [rip + 0x1dd8b],movrax, qword ptr [rip + 0x4f94c],\"","origin":"Static Parser","relevance":1,"id":"static-96","sources":[{"report_type":"sandbox","report_id":"6336f99058e6b22302251a9a"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"$2b","origin":"Monitored Target","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"6336f99058e6b22302251a9a"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"$2c","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"6336f99058e6b22302251a9a"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"$2d","origin":"Monitored Target","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"6336f99058e6b22302251a9a"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"\"regsvr32.exe\" touched file \"%WINDIR%\\AppPatch\\AppPatch64\\sysmain.sdb\"","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"6336f99058e6b22302251a9a"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd|html\"\n Pattern match: \"http://github.com/erinata/FingerText\"\n Heuristic match: \"Email: erinata@gmail.com\"\n Pattern match: \"http://sourceforge.net/projects/fingertext/\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"6336f99058e6b22302251a9a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate processes (API string)","description":"Observed api string:\"Process32FirstW\" [Source: e1ecf0f7bd90553baaa83dcdc177e1d2b20d6ee5520f5d9b44cdf59389432b10.bin]\n Observed api string:\"Process32NextW\" [Source: e1ecf0f7bd90553baaa83dcdc177e1d2b20d6ee5520f5d9b44cdf59389432b10.bin]\n Observed api string:\"CreateToolhelp32Snapshot\" [Source: e1ecf0f7bd90553baaa83dcdc177e1d2b20d6ee5520f5d9b44cdf59389432b10.bin]","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"6336f99058e6b22302251a9a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about pressed keystrokes (API string)","description":"Observed api string:\"GetKeyState\" [Source: e1ecf0f7bd90553baaa83dcdc177e1d2b20d6ee5520f5d9b44cdf59389432b10.bin]","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-88","sources":[{"report_type":"sandbox","report_id":"6336f99058e6b22302251a9a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the NetBIOS name of the local computer (API string)","description":"Observed api string:\"GetComputerNameA\" [Source: e1ecf0f7bd90553baaa83dcdc177e1d2b20d6ee5520f5d9b44cdf59389432b10.bin]\n Observed api string:\"GetComputerNameW\" [Source: e1ecf0f7bd90553baaa83dcdc177e1d2b20d6ee5520f5d9b44cdf59389432b10.bin]","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-122","sources":[{"report_type":"sandbox","report_id":"6336f99058e6b22302251a9a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieves the class object from a DLL object handler (API string)","description":"Observed api string:\"EEDllGetClassObjectFromClass\" [Source: e1ecf0f7bd90553baaa83dcdc177e1d2b20d6ee5520f5d9b44cdf59389432b10.bin]","origin":"File/Memory","relevance":1,"id":"string-82","sources":[{"report_type":"sandbox","report_id":"6336f99058e6b22302251a9a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Imports GetCommandLine API","description":"Observed import api \"GetCommandLineA\" which can \"Retrieves the command-line string for the current process\" [Source: e1ecf0f7bd90553baaa83dcdc177e1d2b20d6ee5520f5d9b44cdf59389432b10.bin]","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-88","sources":[{"report_type":"sandbox","report_id":"6336f99058e6b22302251a9a"}]},{"level":"informative","category":"System Security","name":"Imports system security related APIs","description":"Observed import api \"GetTokenInformation\" which can \"Retrieves a specified type of information about an access token\" [Source: e1ecf0f7bd90553baaa83dcdc177e1d2b20d6ee5520f5d9b44cdf59389432b10.bin]","origin":"Static Parser","mitre_attack_id":"T1134.001","relevance":1,"id":"static-87","sources":[{"report_type":"sandbox","report_id":"6336f99058e6b22302251a9a"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"14/70 Antivirus vendors marked sample as malicious (20% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6336f99058e6b22302251a9a"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"$2e","origin":"API Call","mitre_attack_id":"T1082","relevance":5,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"6336f99058e6b22302251a9a"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"OpenProcessToken\n CryptEncrypt\n RegOpenKeyExA\n GetFileAttributesA\n GetFileAttributesW\n GetTempPathA\n GetTempPathW\n GetModuleFileNameW\n IsDebuggerPresent\n GetModuleFileNameA\n UnhandledExceptionFilter\n TerminateProcess\n CreateToolhelp32Snapshot\n LoadLibraryW\n GetVersionExW\n GetTickCount\n LoadLibraryA\n GetFileSize\n OpenProcess\n DeleteFileA\n GetStartupInfoW\n CreateDirectoryW\n DeleteFileW\n GetComputerNameW\n WriteFile\n GetComputerNameA\n GetProcAddress\n CreateFileW\n CreateFileA\n CreateFileMappingW\n GetSystemInfo\n Process32NextW\n LockResource\n GetCommandLineW\n GetCommandLineA\n Process32FirstW\n MapViewOfFile\n GetModuleHandleW\n GetFileAttributesExW\n FindResourceW\n CreateProcessW\n Sleep\n VirtualAlloc\n SetWindowsHookExW\n HttpSendRequestA\n InternetQueryDataAvailable\n InternetConnectW\n InternetCloseHandle\n InternetCrackUrlW\n InternetOpenA\n InternetReadFile","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"6336f99058e6b22302251a9a"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"rundll32.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"rundll32.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6336f99058e6b22302251a9a"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"6336f99058e6b22302251a9a"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"14/70 Antivirus vendors marked sample as malicious (20% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"6336f99058e6b22302251a9a"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted Antivirus engine","description":"No specific details available","origin":"External System","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"6336f99058e6b22302251a9a"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"$2f","origin":"Monitored Target","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"6336f99058e6b22302251a9a"}]}],"incidents":[{"name":"Persistence","details_count":1,"details":[{"detail":"Spawns a lot of processes"}],"sources":[{"report_type":"sandbox","report_id":"6336f99058e6b22302251a9a"}]}]},"activity":{"stats":{"process_count":64,"spawned_processes_count":64,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":2,"imported_dlls_count":49,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":0,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["dxpdown","labyrinthchollima","targeted"],"sample_flags":["Multi-Process","Sample Crashed","Sample not shared"],"sandbox_reports":[{"id":"6336f99058e6b22302251a9a","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"UDS:Trojan.Win64.Agentb","submit_name":"2","analysis_start_time":"2022-09-30T14:13:38+00:00","indicators_count":{"informative":23,"suspicious":9,"malicious":4},"tags":["Multi-Process","Sample Crashed","Sample not shared"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6336f99058e6b22302251a9a"}],"processes":[{"pid":3524,"ppid":0,"name":"","command_line":"","normalized_path":"","uid":"00000000-00003524"},{"pid":2588,"ppid":3524,"name":"rundll32.exe","command_line":"\"C:\\2.dll\",#1","sha256":"405f03534be8b45185695f68deb47d4daf04dcd6df9d351ca6831d3721b1efc4","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00000000-00003524","uid":"00000000-00002588"},{"pid":4092,"ppid":2588,"name":"WerFault.exe","command_line":"-u -p 2588 -s 208","sha256":"e59c349b964f585c27f63fbf7c1b5d7c6cf8cc958bd35100a36d57542dc13972","normalized_path":"%WINDIR%\\system32\\WerFault.exe","parent_uid":"00000000-00002588","uid":"00000000-00004092"},{"pid":276,"ppid":3524,"name":"rundll32.exe","command_line":"\"C:\\2.dll\",#2","sha256":"405f03534be8b45185695f68deb47d4daf04dcd6df9d351ca6831d3721b1efc4","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00000000-00003524","uid":"00000000-00000276"},{"pid":4048,"ppid":276,"name":"WerFault.exe","command_line":"-u -p 276 -s 208","sha256":"e59c349b964f585c27f63fbf7c1b5d7c6cf8cc958bd35100a36d57542dc13972","normalized_path":"%WINDIR%\\system32\\WerFault.exe","parent_uid":"00000000-00000276","uid":"00000000-00004048"},{"pid":3360,"ppid":3524,"name":"rundll32.exe","command_line":"\"C:\\2.dll\",#3","sha256":"405f03534be8b45185695f68deb47d4daf04dcd6df9d351ca6831d3721b1efc4","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00000000-00003524","uid":"00000000-00003360"},{"pid":4084,"ppid":3360,"name":"WerFault.exe","command_line":"-u -p 3360 -s 208","sha256":"e59c349b964f585c27f63fbf7c1b5d7c6cf8cc958bd35100a36d57542dc13972","normalized_path":"%WINDIR%\\system32\\WerFault.exe","parent_uid":"00000000-00003360","uid":"00000000-00004084"},{"pid":3616,"ppid":3524,"name":"rundll32.exe","command_line":"\"C:\\2.dll\",#4","sha256":"405f03534be8b45185695f68deb47d4daf04dcd6df9d351ca6831d3721b1efc4","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00000000-00003524","uid":"00000000-00003616"},{"pid":388,"ppid":3616,"name":"WerFault.exe","command_line":"-u -p 3616 -s 208","sha256":"e59c349b964f585c27f63fbf7c1b5d7c6cf8cc958bd35100a36d57542dc13972","normalized_path":"%WINDIR%\\system32\\WerFault.exe","parent_uid":"00000000-00003616","uid":"00000000-00000388"},{"pid":2436,"ppid":3524,"name":"rundll32.exe","command_line":"\"C:\\2.dll\",#5","sha256":"405f03534be8b45185695f68deb47d4daf04dcd6df9d351ca6831d3721b1efc4","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00000000-00003524","uid":"00000000-00002436"},{"pid":2660,"ppid":2436,"name":"WerFault.exe","command_line":"-u -p 2436 -s 208","sha256":"e59c349b964f585c27f63fbf7c1b5d7c6cf8cc958bd35100a36d57542dc13972","normalized_path":"%WINDIR%\\system32\\WerFault.exe","parent_uid":"00000000-00002436","uid":"00000000-00002660"},{"pid":3128,"ppid":3524,"name":"rundll32.exe","command_line":"\"C:\\2.dll\",#6","sha256":"405f03534be8b45185695f68deb47d4daf04dcd6df9d351ca6831d3721b1efc4","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00000000-00003524","uid":"00000000-00003128"},{"pid":3800,"ppid":3128,"name":"WerFault.exe","command_line":"-u -p 3128 -s 208","sha256":"e59c349b964f585c27f63fbf7c1b5d7c6cf8cc958bd35100a36d57542dc13972","normalized_path":"%WINDIR%\\system32\\WerFault.exe","parent_uid":"00000000-00003128","uid":"00000000-00003800"},{"pid":1800,"ppid":3524,"name":"rundll32.exe","command_line":"\"C:\\2.dll\",#7","sha256":"405f03534be8b45185695f68deb47d4daf04dcd6df9d351ca6831d3721b1efc4","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00000000-00003524","uid":"00000000-00001800"},{"pid":1904,"ppid":1800,"name":"WerFault.exe","command_line":"-u -p 1800 -s 208","sha256":"e59c349b964f585c27f63fbf7c1b5d7c6cf8cc958bd35100a36d57542dc13972","normalized_path":"%WINDIR%\\system32\\WerFault.exe","parent_uid":"00000000-00001800","uid":"00000000-00001904"},{"pid":3696,"ppid":3524,"name":"rundll32.exe","command_line":"\"C:\\2.dll\",#8","sha256":"405f03534be8b45185695f68deb47d4daf04dcd6df9d351ca6831d3721b1efc4","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00000000-00003524","uid":"00000000-00003696"},{"pid":2832,"ppid":3696,"name":"WerFault.exe","command_line":"-u -p 3696 -s 208","sha256":"e59c349b964f585c27f63fbf7c1b5d7c6cf8cc958bd35100a36d57542dc13972","normalized_path":"%WINDIR%\\system32\\WerFault.exe","parent_uid":"00000000-00003696","uid":"00000000-00002832"},{"pid":2636,"ppid":3524,"name":"rundll32.exe","command_line":"\"C:\\2.dll\",#9","sha256":"405f03534be8b45185695f68deb47d4daf04dcd6df9d351ca6831d3721b1efc4","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00000000-00003524","uid":"00000000-00002636"},{"pid":2616,"ppid":2636,"name":"WerFault.exe","command_line":"-u -p 2636 -s 208","sha256":"e59c349b964f585c27f63fbf7c1b5d7c6cf8cc958bd35100a36d57542dc13972","normalized_path":"%WINDIR%\\system32\\WerFault.exe","parent_uid":"00000000-00002636","uid":"00000000-00002616"},{"pid":3512,"ppid":3524,"name":"rundll32.exe","command_line":"\"C:\\2.dll\",#10","sha256":"405f03534be8b45185695f68deb47d4daf04dcd6df9d351ca6831d3721b1efc4","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00000000-00003524","uid":"00000000-00003512"},{"pid":3780,"ppid":3512,"name":"WerFault.exe","command_line":"-u -p 3512 -s 208","sha256":"e59c349b964f585c27f63fbf7c1b5d7c6cf8cc958bd35100a36d57542dc13972","normalized_path":"%WINDIR%\\system32\\WerFault.exe","parent_uid":"00000000-00003512","uid":"00000000-00003780"},{"pid":2816,"ppid":3524,"name":"rundll32.exe","command_line":"\"C:\\2.dll\",#11","sha256":"405f03534be8b45185695f68deb47d4daf04dcd6df9d351ca6831d3721b1efc4","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00000000-00003524","uid":"00000000-00002816"},{"pid":3988,"ppid":2816,"name":"WerFault.exe","command_line":"-u -p 2816 -s 208","sha256":"e59c349b964f585c27f63fbf7c1b5d7c6cf8cc958bd35100a36d57542dc13972","normalized_path":"%WINDIR%\\system32\\WerFault.exe","parent_uid":"00000000-00002816","uid":"00000000-00003988"},{"pid":2528,"ppid":3524,"name":"rundll32.exe","command_line":"\"C:\\2.dll\",#12","sha256":"405f03534be8b45185695f68deb47d4daf04dcd6df9d351ca6831d3721b1efc4","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00000000-00003524","uid":"00000000-00002528"},{"pid":2464,"ppid":2528,"name":"WerFault.exe","command_line":"-u -p 2528 -s 208","sha256":"e59c349b964f585c27f63fbf7c1b5d7c6cf8cc958bd35100a36d57542dc13972","normalized_path":"%WINDIR%\\system32\\WerFault.exe","parent_uid":"00000000-00002528","uid":"00000000-00002464"},{"pid":3040,"ppid":3524,"name":"rundll32.exe","command_line":"\"C:\\2.dll\",#13","sha256":"405f03534be8b45185695f68deb47d4daf04dcd6df9d351ca6831d3721b1efc4","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00000000-00003524","uid":"00000000-00003040"},{"pid":2924,"ppid":3040,"name":"WerFault.exe","command_line":"-u -p 3040 -s 208","sha256":"e59c349b964f585c27f63fbf7c1b5d7c6cf8cc958bd35100a36d57542dc13972","normalized_path":"%WINDIR%\\system32\\WerFault.exe","parent_uid":"00000000-00003040","uid":"00000000-00002924"},{"pid":3728,"ppid":3524,"name":"rundll32.exe","command_line":"\"C:\\2.dll\",#14","sha256":"405f03534be8b45185695f68deb47d4daf04dcd6df9d351ca6831d3721b1efc4","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00000000-00003524","uid":"00000000-00003728"},{"pid":1172,"ppid":3728,"name":"WerFault.exe","command_line":"-u -p 3728 -s 208","sha256":"e59c349b964f585c27f63fbf7c1b5d7c6cf8cc958bd35100a36d57542dc13972","normalized_path":"%WINDIR%\\system32\\WerFault.exe","parent_uid":"00000000-00003728","uid":"00000000-00001172"},{"pid":3092,"ppid":3524,"name":"rundll32.exe","command_line":"\"C:\\2.dll\",#15","sha256":"405f03534be8b45185695f68deb47d4daf04dcd6df9d351ca6831d3721b1efc4","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00000000-00003524","uid":"00000000-00003092"},{"pid":3208,"ppid":3092,"name":"WerFault.exe","command_line":"-u -p 3092 -s 208","sha256":"e59c349b964f585c27f63fbf7c1b5d7c6cf8cc958bd35100a36d57542dc13972","normalized_path":"%WINDIR%\\system32\\WerFault.exe","parent_uid":"00000000-00003092","uid":"00000000-00003208"},{"pid":2268,"ppid":3524,"name":"rundll32.exe","command_line":"\"C:\\2.dll\",#16","sha256":"405f03534be8b45185695f68deb47d4daf04dcd6df9d351ca6831d3721b1efc4","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00000000-00003524","uid":"00000000-00002268"},{"pid":2232,"ppid":2268,"name":"WerFault.exe","command_line":"-u -p 2268 -s 208","sha256":"e59c349b964f585c27f63fbf7c1b5d7c6cf8cc958bd35100a36d57542dc13972","normalized_path":"%WINDIR%\\system32\\WerFault.exe","parent_uid":"00000000-00002268","uid":"00000000-00002232"},{"pid":364,"ppid":3524,"name":"rundll32.exe","command_line":"\"C:\\2.dll\",#17","sha256":"405f03534be8b45185695f68deb47d4daf04dcd6df9d351ca6831d3721b1efc4","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00000000-00003524","uid":"00000000-00000364"},{"pid":2352,"ppid":364,"name":"WerFault.exe","command_line":"-u -p 364 -s 208","sha256":"e59c349b964f585c27f63fbf7c1b5d7c6cf8cc958bd35100a36d57542dc13972","normalized_path":"%WINDIR%\\system32\\WerFault.exe","parent_uid":"00000000-00000364","uid":"00000000-00002352"},{"pid":3180,"ppid":3524,"name":"rundll32.exe","command_line":"\"C:\\2.dll\",#18","sha256":"405f03534be8b45185695f68deb47d4daf04dcd6df9d351ca6831d3721b1efc4","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00000000-00003524","uid":"00000000-00003180"},{"pid":3480,"ppid":3180,"name":"WerFault.exe","command_line":"-u -p 3180 -s 208","sha256":"e59c349b964f585c27f63fbf7c1b5d7c6cf8cc958bd35100a36d57542dc13972","normalized_path":"%WINDIR%\\system32\\WerFault.exe","parent_uid":"00000000-00003180","uid":"00000000-00003480"},{"pid":3972,"ppid":3524,"name":"rundll32.exe","command_line":"\"C:\\2.dll\",#19","sha256":"405f03534be8b45185695f68deb47d4daf04dcd6df9d351ca6831d3721b1efc4","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00000000-00003524","uid":"00000000-00003972"},{"pid":3396,"ppid":3524,"name":"rundll32.exe","command_line":"\"C:\\2.dll\",#20","sha256":"405f03534be8b45185695f68deb47d4daf04dcd6df9d351ca6831d3721b1efc4","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00000000-00003524","uid":"00000000-00003396"},{"pid":1400,"ppid":3396,"name":"WerFault.exe","command_line":"-u -p 3396 -s 208","sha256":"e59c349b964f585c27f63fbf7c1b5d7c6cf8cc958bd35100a36d57542dc13972","normalized_path":"%WINDIR%\\system32\\WerFault.exe","parent_uid":"00000000-00003396","uid":"00000000-00001400"},{"pid":2824,"ppid":3524,"name":"rundll32.exe","command_line":"\"C:\\2.dll\",#21","sha256":"405f03534be8b45185695f68deb47d4daf04dcd6df9d351ca6831d3721b1efc4","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00000000-00003524","uid":"00000000-00002824"},{"pid":1076,"ppid":2824,"name":"WerFault.exe","command_line":"-u -p 2824 -s 208","sha256":"e59c349b964f585c27f63fbf7c1b5d7c6cf8cc958bd35100a36d57542dc13972","normalized_path":"%WINDIR%\\system32\\WerFault.exe","parent_uid":"00000000-00002824","uid":"00000000-00001076"},{"pid":1252,"ppid":3524,"name":"rundll32.exe","command_line":"\"C:\\2.dll\",#22","sha256":"405f03534be8b45185695f68deb47d4daf04dcd6df9d351ca6831d3721b1efc4","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00000000-00003524","uid":"00000000-00001252"},{"pid":1620,"ppid":1252,"name":"WerFault.exe","command_line":"-u -p 1252 -s 208","sha256":"e59c349b964f585c27f63fbf7c1b5d7c6cf8cc958bd35100a36d57542dc13972","normalized_path":"%WINDIR%\\system32\\WerFault.exe","parent_uid":"00000000-00001252","uid":"00000000-00001620"},{"pid":828,"ppid":3524,"name":"rundll32.exe","command_line":"\"C:\\2.dll\",#23","sha256":"405f03534be8b45185695f68deb47d4daf04dcd6df9d351ca6831d3721b1efc4","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00000000-00003524","uid":"00000000-00000828"},{"pid":736,"ppid":828,"name":"WerFault.exe","command_line":"-u -p 828 -s 208","sha256":"e59c349b964f585c27f63fbf7c1b5d7c6cf8cc958bd35100a36d57542dc13972","normalized_path":"%WINDIR%\\system32\\WerFault.exe","parent_uid":"00000000-00000828","uid":"00000000-00000736"},{"pid":3724,"ppid":3524,"name":"rundll32.exe","command_line":"\"C:\\2.dll\",#24","sha256":"405f03534be8b45185695f68deb47d4daf04dcd6df9d351ca6831d3721b1efc4","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00000000-00003524","uid":"00000000-00003724"},{"pid":2836,"ppid":3724,"name":"WerFault.exe","command_line":"-u -p 3724 -s 212","sha256":"e59c349b964f585c27f63fbf7c1b5d7c6cf8cc958bd35100a36d57542dc13972","normalized_path":"%WINDIR%\\system32\\WerFault.exe","parent_uid":"00000000-00003724","uid":"00000000-00002836"},{"pid":1656,"ppid":3524,"name":"rundll32.exe","command_line":"\"C:\\2.dll\",#25","sha256":"405f03534be8b45185695f68deb47d4daf04dcd6df9d351ca6831d3721b1efc4","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00000000-00003524","uid":"00000000-00001656"},{"pid":2344,"ppid":1656,"name":"WerFault.exe","command_line":"-u -p 1656 -s 208","sha256":"e59c349b964f585c27f63fbf7c1b5d7c6cf8cc958bd35100a36d57542dc13972","normalized_path":"%WINDIR%\\system32\\WerFault.exe","parent_uid":"00000000-00001656","uid":"00000000-00002344"},{"pid":1280,"ppid":3524,"name":"rundll32.exe","command_line":"\"C:\\2.dll\",#26","sha256":"405f03534be8b45185695f68deb47d4daf04dcd6df9d351ca6831d3721b1efc4","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00000000-00003524","uid":"00000000-00001280"},{"pid":2696,"ppid":1280,"name":"WerFault.exe","command_line":"-u -p 1280 -s 208","sha256":"e59c349b964f585c27f63fbf7c1b5d7c6cf8cc958bd35100a36d57542dc13972","normalized_path":"%WINDIR%\\system32\\WerFault.exe","parent_uid":"00000000-00001280","uid":"00000000-00002696"},{"pid":2320,"ppid":3524,"name":"regsvr32.exe","command_line":"/s \"C:\\2.dll\"","sha256":"ca24aef558647274d019dfb4d7fd1506d84ec278795c30ba53b81bb36130dc57","normalized_path":"%WINDIR%\\System32\\regsvr32.exe","parent_uid":"00000000-00003524","uid":"00000000-00002320"},{"pid":2340,"ppid":2320,"name":"WerFault.exe","command_line":"-u -p 2320 -s 252","sha256":"e59c349b964f585c27f63fbf7c1b5d7c6cf8cc958bd35100a36d57542dc13972","normalized_path":"%WINDIR%\\system32\\WerFault.exe","parent_uid":"00000000-00002320","uid":"00000000-00002340"},{"pid":2712,"ppid":3524,"name":"rundll32.exe","command_line":"\"C:\\2.dll\",#28","sha256":"405f03534be8b45185695f68deb47d4daf04dcd6df9d351ca6831d3721b1efc4","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00000000-00003524","uid":"00000000-00002712"},{"pid":3556,"ppid":2712,"name":"WerFault.exe","command_line":"-u -p 2712 -s 208","sha256":"e59c349b964f585c27f63fbf7c1b5d7c6cf8cc958bd35100a36d57542dc13972","normalized_path":"%WINDIR%\\system32\\WerFault.exe","parent_uid":"00000000-00002712","uid":"00000000-00003556"},{"pid":3124,"ppid":3524,"name":"rundll32.exe","command_line":"\"C:\\2.dll\",#29","sha256":"405f03534be8b45185695f68deb47d4daf04dcd6df9d351ca6831d3721b1efc4","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00000000-00003524","uid":"00000000-00003124"},{"pid":3248,"ppid":3124,"name":"WerFault.exe","command_line":"-u -p 3124 -s 208","sha256":"e59c349b964f585c27f63fbf7c1b5d7c6cf8cc958bd35100a36d57542dc13972","normalized_path":"%WINDIR%\\system32\\WerFault.exe","parent_uid":"00000000-00003124","uid":"00000000-00003248"},{"pid":3612,"ppid":3524,"name":"rundll32.exe","command_line":"\"C:\\2.dll\",#30","sha256":"405f03534be8b45185695f68deb47d4daf04dcd6df9d351ca6831d3721b1efc4","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00000000-00003524","uid":"00000000-00003612"},{"pid":880,"ppid":3612,"name":"WerFault.exe","command_line":"-u -p 3612 -s 208","sha256":"e59c349b964f585c27f63fbf7c1b5d7c6cf8cc958bd35100a36d57542dc13972","normalized_path":"%WINDIR%\\system32\\WerFault.exe","parent_uid":"00000000-00003612","uid":"00000000-00000880"},{"pid":1132,"ppid":3524,"name":"rundll32.exe","command_line":"\"C:\\2.dll\",#31","sha256":"405f03534be8b45185695f68deb47d4daf04dcd6df9d351ca6831d3721b1efc4","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00000000-00003524","uid":"00000000-00001132"},{"pid":3052,"ppid":3524,"name":"rundll32.exe","command_line":"\"C:\\2.dll\",#32","sha256":"405f03534be8b45185695f68deb47d4daf04dcd6df9d351ca6831d3721b1efc4","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00000000-00003524","uid":"00000000-00003052"},{"pid":2088,"ppid":3052,"name":"WerFault.exe","command_line":"-u -p 3052 -s 212","sha256":"e59c349b964f585c27f63fbf7c1b5d7c6cf8cc958bd35100a36d57542dc13972","normalized_path":"%WINDIR%\\system32\\WerFault.exe","parent_uid":"00000000-00003052","uid":"00000000-00002088"},{"pid":4080,"ppid":3524,"name":"rundll32.exe","command_line":"\"C:\\2.dll\",#33","sha256":"405f03534be8b45185695f68deb47d4daf04dcd6df9d351ca6831d3721b1efc4","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00000000-00003524","uid":"00000000-00004080"}],"all_imported_dlls":["rpcrt4.dll","2.dll","comdlg32.dll","api-ms-win-downlevel-user32-l1-1-0.dll","uxtheme.dll","api-ms-win-core-synch-l1-2-0.dll","lpk.dll","shlwapi.dll","msctf.dll","ws2_32.dll","api-ms-win-downlevel-version-l1-1-0.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","ole32.dll","sfc_os.dll","nsi.dll","comctl32.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","mpr.dll","usp10.dll","imagehlp.dll","advapi32.dll","VxSSL64.dll","webio.dll","shell32.dll","AcGenral.dll","gdi32.dll","winhttp.dll","profapi.dll","cryptbase.dll","imm32.dll","version.dll","userenv.dll","dwmapi.dll","apphelp.dll","sspicli.dll","ntdll.dll","msvcrt.dll","sechost.dll","fltLib.dll","iertutil.dll","kernel32.dll","wininet.dll","normaliz.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll","oleaut32.dll","sfc.dll","rpcss.dll","KernelBase.dll","user32.dll"]},"file_activity":{"dropped_files":null,"extracted_files":null,"files_written":null,"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\DBWinMutex","sources":[{"report_type":"sandbox","report_id":"6336f99058e6b22302251a9a"}]},{"name":"DBWinMutex","sources":[{"report_type":"sandbox","report_id":"6336f99058e6b22302251a9a"}]}]}},"report_ids":{"sandbox_job_ids":["6336f99058e6b22302251a9a"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Win/malicious_confidence_100% Sample e1ecf0f7bd90… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample e1ecf0f7bd90…. Malware family: Win/malicious_confidence_100%. Threat score 100/100. 12/28 AV engines flagged this file. 4 malicious and 4 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/e1ecf0f7bd90553baaa83dcdc177e1d2b20d6ee5520f5d9b44cdf59389432b10"}],["$","meta","4",{"property":"og:title","content":"Malicious Win/malicious_confidence_100% Sample e1ecf0f7bd90… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample e1ecf0f7bd90…. Malware family: Win/malicious_confidence_100%. Threat score 100/100. 12/28 AV engines flagged this file. 4 malicious and 4 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/e1ecf0f7bd90553baaa83dcdc177e1d2b20d6ee5520f5d9b44cdf59389432b10"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Win/malicious_confidence_100% Sample e1ecf0f7bd90… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample e1ecf0f7bd90…. Malware family: Win/malicious_confidence_100%. Threat score 100/100. 12/28 AV engines flagged this file. 4 malicious and 4 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L30","11",{}]]