26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 41:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T432,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Sample e2cde75ff9ac… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample e2cde75ff9ac…. Threat score 100/100. 0/27 AV engines flagged this file. 1 malicious and 6 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/e2cde75ff9ac1238102d03be0213a839ea0a3778aec2435b4209f042bb1d07e7","keywords":["Malicious","malware analysis","sandbox report","threat intelligence","e2cde75ff9ac1238102d03be0213a839ea0a3778aec2435b4209f042bb1d07e7"],"about":{"@type":"SoftwareApplication","name":"RobokassaElba.exe","applicationCategory":["peexe","assembly","executable"],"identifier":"e2cde75ff9ac1238102d03be0213a839ea0a3778aec2435b4209f042bb1d07e7","additionalType":"Malicious sample"},"threatScore":100,"antivirusDetections":{"malicious":0,"total":27},"behavioralIndicators":{"malicious":1,"suspicious":6},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T91d,Found reference to API "CreateSalesTable" (Indicator: "creat"; Source: "sample.bin"), Found reference to API "System.Runtime.InteropServices" (Indicator: "time"; Source: "sample.bin"), Found reference to API "SELECT name,path,hash FROM reports WHERE id=? AND shop_id=?" (Indicator: "select"; Source: "sample.bin"), Found reference to API "AmountText" (Indicator: "mount"; Source: "sample.bin"), Found reference to API "b__5" (Indicator: "read"; Source: "sample.bin"), Found reference to API "b__6" (Indicator: "read"; Source: "sample.bin"), Found reference to API "b__7" (Indicator: "read"; Source: "sample.bin"), Found reference to API "b__8" (Indicator: "read"; Source: "sample.bin"), Found reference to API "DataGridViewTriState" (Indicator: "stat"; Source: "sample.bin"), Found reference to API "set_ReadOnly" (Indicator: "read"; Source: "sample.bin"), file/memory contains long string with (Indicator: "access"; Source: "sample.bin"), file/memory contains long string with (Indicator: "security"; Source: "sample.bin"), Found reference to API "SELECT order_id,completed,gross,fee,receipt,net,description,email,source FROM sales WHERE shop_id=? AND order_id=?" (Indicator: "select"; Source: "sample.bin"), Found reference to API "DataGridViewSelectedRowCollection" (Indicator: "select"; Source: "sample.bin"), Found reference to API "b__0" (Indicator: "mount"; Source: "sample.bin"), Found reference to API "set_Multiselect" (Indicator: "select"; Source: "sample.bin"), Found reference to API "b__7" (Indicator: "read"; Source: "sample.bin"), Found reference to API "b__6" (Indicator: "read"; Source: "sample.bin"), Found reference to API "b__9" (Indicator: "read"; Source: "sample.bin"), Found reference to API "set_OverwritePrompt" (Indicator: "write"; Source: "sample.bin"), Found reference to API "b__8" (Indicator: "read"; Source: "sample.bin"), Found reference to API "set_SelectedItem" (Indicator: "select"; Source: "sample.bin"), Found reference to API "b__3" (Indicator: "read"; Source: "sample.bin"), Found reference to API "b__5" (Indicator: "read"; Source: "sample.bin"), Found reference to API "b__4" (Indicator: "read"; Source: "sample.bin"), Found reference to API "Amount" (Indicator: "mount"; Source: "sample.bin")28:T922,"SELECT name,path,hash FROM reports WHERE id=? AND shop_id=?" (Source: sample.bin, Indicator: "select name,path,hash from reports where id=? and shop_id=?"), "SELECT order_id,completed,gross,fee,receipt,net,description,email,source FROM sales WHERE shop_id=? AND order_id=?" (Source: sample.bin, Indicator: "select order_id,completed,gross,fee,receipt,net,description,email,source from sales where shop_id=? and order_id=?"), "DELETE FROM reports WHERE shop_id=? AND id=?" (Source: sample.bin, Indicator: "delete from reports where shop_id=? and id=?"), "DELETE FROM sales WHERE shop_id=? AND report_id=?" (Source: sample.bin, Indicator: "delete from sales where shop_id=? and report_id=?"), "SELECT id,name,path,hash FROM reports WHERE shop_id=? AND id<>? AND sales>0 ORDER BY imported,rowid" (Source: sample.bin, Indicator: "select id,name,path,hash from reports where shop_id=? and id<>? and sales>0 order by imported,rowid"), "INSERT INTO sales(shop_id,order_id,completed,gross,fee,receipt,net,description,email,source,fingerprint,report_id) VALUES(?,?,?,?,?,?,?,?,?,?,?,?)" (Source: sample.bin, Indicator: "insert into sales(shop_id,order_id,completed,gross,fee,receipt,net,description,email,source,fingerprint,report_id) values(?,?,?,?,?,?,?,?,?,?,?,?)"), "INSERT OR REPLACE INTO settings(key,value) VALUES('last_shop',?)" (Source: sample.bin, Indicator: "insert or replace into settings(key,value) values('last_shop',?)"), "DELETE FROM sales WHERE " (Source: sample.bin, Indicator: "delete from sales where "), "CREATE TABLE settings(key TEXT PRIMARY KEY, value TEXT NOT NULL)" (Source: sample.bin, Indicator: "create table settings(key text primary key, value text not null)"), "INSERT INTO reports(id,shop_id,hash,name,path,imported,sales,added,repeats,skipped) VALUES(?,?,?,?,?,?,?,?,?,?)" (Source: sample.bin, Indicator: "insert into reports(id,shop_id,hash,name,path,imported,sales,added,repeats,skipped) values(?,?,?,?,?,?,?,?,?,?)"), "INSERT INTO sales SELECT * FROM sales_v1" (Source: sample.bin, Indicator: "insert into sales select * from sales_v1"), "SELECT order_id,completed,gross,fee,receipt,net,description,email,source FROM sales WHERE shop_id=? AND report_id<>?" (Source: sample.bin, Indicator: "select order_id,completed,gross,fee,receipt,net,description,email,source from sales where shop_id=? and report_id<>?")29:T469,Found reference to API "SendMessage" (Indicator: "sendmessage"; Source: "00000000-00005548-00000C2C-2023061084") Found reference to API "SendMessageW" (Indicator: "sendmessage"; Source: "00000000-00005548-00000C2C-2023061161") Found reference to API "PostMessage" (Indicator: "postmessage"; Source: "00000000-00005548-00000C2C-2023643380") Found reference to API "PostMessageW" (Indicator: "postmessage"; Source: "00000000-00005548-00000C2C-2023643498") Found reference to API "sendMessageChannelCache" (Indicator: "sendmessage"; Source: "00000000-00005548.00000000.246626.03390000.00000004.mdmp, 00000000-00005548.00000001.248548.03390000.00000004.mdmp, 00000000-00005548.00000002.250469.03390000.00000004.mdmp") Found reference to API "System.ServiceModel.Activities.Configuration.SendMessageChannelCacheElement, System.ServiceModel.Activities, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35" (Indicator: "sendmessage"; Source: "00000000-00005548.00000000.246626.03390000.00000004.mdmp, 00000000-00005548.00000001.248548.03390000.00000004.mdmp, 00000000-00005548.00000002.250469.03390000.00000004.mdmp")2a:Tc6f,"RobokassaElba.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d580000020000000000000000002f49fa7f0000f02b08010000000018edef0000000000060000000000000031e4eb70fa7f000000000000000000000000000000000000f0eaef0000000000000000000000000040eaef00000000001014fc70fa7f000000000000000000009013fc70fa7f0000080000000000000065007300730074000000000000000000000000000000000031002d0031002d0060beec70fa7f000040ecef0000000000884d080100000000404d080100000000f0e60701000000000100000000000000e8c3eb70fa7f00000f0c080100000000070000000000000030ed080100000000f385eb70fa7f000030ed0801000000000000000000000000dfe2db6a (UID: 00000000-00005548) "RobokassaElba.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005548) "RobokassaElba.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005548) "RobokassaElba.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000c938306efa7f000080000000000000000000000000000000c0611201000000001033ee70fa7f000000000000000000000000e11b0000000030c1ef000000000010412d6efa7f0000b04e120100000000f0c0ef0000000000000000000000000000000000000000000100000000000000b8402d6efa7f0000000000000000000001000000000000000000e11b000000003b4d7b6efa7f00000000000000000000a8c5ef00000000000000000000000000d02af31b0000000010b3591c00000000e8f82c6efa7f000010b3591c00000000d02af31b000000000d000000000000000d00000000000000a0f6491c00000000f587ee1b00000000d02af31b (UID: 00000000-00005548) "RobokassaElba.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d58000002000000000000000000c846fa7f0000e000e970fa7f0000f0ebb61b00000000e03dd26efa7f0000f0ebb61b00000000006ddc6efa7f000060c3b51b000000000035b61b00000000000000000000000000000000000000006c15eb70fa7f00000100000000000000e034b51b000000000000e970fa7f000000007170fa7f000000000000f8000000f800c846fa7f00000000d26efa7f0000000000000000000000000000000000007ee7eb70fa7f0000010000006dcf00000000070100000000000000000000000048e3ef0000000000000000000000000031e4eb70fa7f00000000000000000000f800c846fa7f000028e8ef0000000000d917d046fa7f000090e3ef00 (UID: 00000000-00005548)2b:T1349,"RobokassaElba.exe" queries volume information of "C:\RobokassaElba.exe" at 00000000-00005548-00000C17-2017613867 "RobokassaElba.exe" queries volume information of "C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.18.10301.0_x64__8wekyb3d8bbwe\CascadiaCode.ttf" at 00000000-00005548-00000C17-2019685674 "RobokassaElba.exe" queries volume information of "C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.18.10301.0_x64__8wekyb3d8bbwe\CascadiaCode.ttf" at 00000000-00005548-00000C17-2019688866 "RobokassaElba.exe" queries volume information of "C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.18.10301.0_x64__8wekyb3d8bbwe\CascadiaCode.ttf" at 00000000-00005548-00000C17-2019691223 "RobokassaElba.exe" queries volume information of "C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.18.10301.0_x64__8wekyb3d8bbwe\CascadiaCode.ttf" at 00000000-00005548-00000C17-2019693578 "RobokassaElba.exe" queries volume information of "C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.18.10301.0_x64__8wekyb3d8bbwe\CascadiaCode.ttf" at 00000000-00005548-00000C17-2019696082 "RobokassaElba.exe" queries volume information of "C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.18.10301.0_x64__8wekyb3d8bbwe\CascadiaCodeItalic.ttf" at 00000000-00005548-00000C17-2019703625 "RobokassaElba.exe" queries volume information of "C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.18.10301.0_x64__8wekyb3d8bbwe\CascadiaCodeItalic.ttf" at 00000000-00005548-00000C17-2019707464 "RobokassaElba.exe" queries volume information of "C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.18.10301.0_x64__8wekyb3d8bbwe\CascadiaCodeItalic.ttf" at 00000000-00005548-00000C17-2019720519 "RobokassaElba.exe" queries volume information of "C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.18.10301.0_x64__8wekyb3d8bbwe\CascadiaCode.ttf" at 00000000-00005548-00000C17-2019722928 "RobokassaElba.exe" queries volume information of "C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.18.10301.0_x64__8wekyb3d8bbwe\CascadiaCodeItalic.ttf" at 00000000-00005548-00000C17-2019725442 "RobokassaElba.exe" queries volume information of "C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.18.10301.0_x64__8wekyb3d8bbwe\CascadiaCodeItalic.ttf" at 00000000-00005548-00000C17-2019728275 "RobokassaElba.exe" queries volume information of "C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.18.10301.0_x64__8wekyb3d8bbwe\CascadiaCodeItalic.ttf" at 00000000-00005548-00000C17-2019731441 "RobokassaElba.exe" queries volume information of "C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.18.10301.0_x64__8wekyb3d8bbwe\CascadiaMono.ttf" at 00000000-00005548-00000C17-2019735036 "RobokassaElba.exe" queries volume information of "C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.18.10301.0_x64__8wekyb3d8bbwe\CascadiaMono.ttf" at 00000000-00005548-00000C17-2019737567 "RobokassaElba.exe" queries volume information of "C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.18.10301.0_x64__8wekyb3d8bbwe\CascadiaMono.ttf" at 00000000-00005548-00000C17-2019740540 "RobokassaElba.exe" queries volume information of "C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.18.10301.0_x64__8wekyb3d8bbwe\CascadiaMono.ttf" at 00000000-00005548-00000C17-2019745049 "RobokassaElba.exe" queries volume information of "C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.18.10301.0_x64__8wekyb3d8bbwe\CascadiaMono.ttf" at 00000000-00005548-00000C17-2019751509 "RobokassaElba.exe" queries volume information of "C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.18.10301.0_x64__8wekyb3d8bbwe\CascadiaMonoItalic.ttf" at 00000000-00005548-00000C17-2019754878 "RobokassaElba.exe" queries volume information of "C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.18.10301.0_x64__8wekyb3d8bbwe\CascadiaMonoItalic.ttf" at 00000000-00005548-00000C17-2019762104 "RobokassaElba.exe" queries volume information of "C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.18.10301.0_x64__8wekyb3d8bbwe\CascadiaMonoItalic.ttf" at 00000000-00005548-00000C17-2019769997 "RobokassaElba.exe" queries volume information of "C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.18.10301.0_x64__8wekyb3d8bbwe\CascadiaMono.ttf" at 00000000-00005548-00000C17-2019772594 "RobokassaElba.exe" queries volume information of "C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.18.10301.0_x64__8wekyb3d8bbwe\CascadiaMonoItalic.ttf" at 00000000-00005548-00000C17-2019781431 "RobokassaElba.exe" queries volume information of "C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.18.10301.0_x64__8wekyb3d8bbwe\CascadiaMonoItalic.ttf" at 00000000-00005548-00000C17-2019783936 "RobokassaElba.exe" queries volume information of "C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.18.10301.0_x64__8wekyb3d8bbwe\CascadiaMonoItalic.ttf" at 00000000-00005548-00000C17-20197863462c:T1966,"RobokassaElba.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00005548) "RobokassaElba.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005548) "RobokassaElba.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005548) "RobokassaElba.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005548) "RobokassaElba.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00005548) "RobokassaElba.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00005548) "RobokassaElba.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00005548) "RobokassaElba.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00005548) "RobokassaElba.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005548) "RobokassaElba.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00005548) "RobokassaElba.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00005548) "RobokassaElba.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00005548) "RobokassaElba.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00005548) "RobokassaElba.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00005548) "RobokassaElba.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00005548) "RobokassaElba.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00005548) "RobokassaElba.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00005548) "RobokassaElba.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\3b9003e4f27d92e40668f0efad11e022\mscorlib.ni.dll (UID: 00000000-00005548) "RobokassaElba.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00005548) "RobokassaElba.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00005548) "RobokassaElba.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00005548) "RobokassaElba.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00005548) "RobokassaElba.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00005548) "RobokassaElba.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll (UID: 00000000-00005548) "RobokassaElba.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\ce0fd4f5b50baa17e7b80e4ee874ad11\System.ni.dll (UID: 00000000-00005548) "RobokassaElba.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Drawing\3c82a5286b5172d5a68c8df2e09c4c40\System.Drawing.ni.dll (UID: 00000000-00005548) "RobokassaElba.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\bee998043eb1e9badecd282a79540a5e\System.Windows.Forms.ni.dll (UID: 00000000-00005548) "RobokassaElba.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00005548) "RobokassaElba.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00005548) "RobokassaElba.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll (UID: 00000000-00005548) "RobokassaElba.exe" called "LoadLibrary" with a parameter uxtheme.dll (UID: 00000000-00005548) "RobokassaElba.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00005548) "RobokassaElba.exe" called "LoadLibrary" with a parameter winsqlite3.dll (UID: 00000000-00005548) "RobokassaElba.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\990501e6199819806f01c8ecac88baac\System.Core.ni.dll (UID: 00000000-00005548) "RobokassaElba.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Configuration\2a25b59872a72da9b55f952ab1b0bc8b\System.Configuration.ni.dll (UID: 00000000-00005548) "RobokassaElba.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\f0078c8c05b31633e5966c5629e65602\System.Xml.ni.dll (UID: 00000000-00005548) "RobokassaElba.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00005548) "RobokassaElba.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00005548) "RobokassaElba.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00005548) "RobokassaElba.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00005548) "RobokassaElba.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00005548) "RobokassaElba.exe" called "LoadLibrary" with a parameter gdiplus.dll (UID: 00000000-00005548) "RobokassaElba.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00005548) "RobokassaElba.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00005548) "RobokassaElba.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00005548) "RobokassaElba.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00005548) "RobokassaElba.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00005548) "RobokassaElba.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00005548) "RobokassaElba.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00005548) "RobokassaElba.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\comctl32.dll (UID: 00000000-00005548)2d:T9812,"RobokassaElba.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter RegisterShimImplCallback (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter RegisterShimImplCleanupCallback (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter SetShellShimInstance (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter OnShimDllMainCalled (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter _CorExeMain_RetAddr (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter _CorExeMain (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter UrlIsW (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter AppPolicyGetClrCompat (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter GetCurrentPackageInfo (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter GetCurrentPackagePath (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter SetRuntimeInfo (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter QuirkIsEnabled3 (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter QuirkGetData2 (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter CreateConfigStream (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter CreateConfigStream_RetAddr (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter GetNumaHighestNodeNumber (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter RtlVirtualUnwind (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter GetSystemWindowsDirectoryW (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter AddAccessAllowedAce (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter RoInitialize (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter AddSIDToBoundaryDescriptor (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter CreateBoundaryDescriptorW (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter CreatePrivateNamespaceW (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter OpenPrivateNamespaceW (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter DeleteBoundaryDescriptor (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter WerRegisterRuntimeExceptionModule (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter RaiseException (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter GetProcessMemoryInfo (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter RoUninitialize (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter GetEnabledXStateFeatures (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter sxsJitStartup (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter jitStartup (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter getJit (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter RegOpenKeyEx (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter GetFullPathName (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter GetFullPathNameW (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter IsAppThemed (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter IsAppThemedW (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter CreateActCtx (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter CreateActCtxA (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter RegisterWindowMessage (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter RegisterWindowMessageW (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter SetThreadErrorMode (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter GetFileAttributesEx (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter CreateDirectory (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter CreateDirectoryW (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter sqlite3_open_v2 (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter sqlite3_busy_timeout (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter sqlite3_prepare_v2 (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter sqlite3_step (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter sqlite3_finalize (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter sqlite3_column_count (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter sqlite3_column_text (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter sqlite3_column_bytes (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter GetUserPreferredUILanguages (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap_RetAddr (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter CompareStringOrdinal (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter GetCurrentProcessW (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter OpenProcessTokenW (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter CreateFile (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter BCryptGetFipsAlgorithmMode (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter GetFileSize (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter GetSystemMetrics (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter GetSystemDefaultLCID (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter GetSystemDefaultLCIDW (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter GetStockObject (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter GetObject (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter GetObjectW (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter GetDC (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter GdiplusStartup (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter GdipCreateFontFromLogfontW (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter ND_RI2 (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter ND_RI2_RetAddr (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter ND_RU1 (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter ND_RU1_RetAddr (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter GdipGetFontUnit (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter GdipGetFontSize (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter GdipGetFontStyle (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter GdipGetFamily (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter ReleaseDC (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter GdipCreateFromHDC (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter GdipGetDpiY (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter GdipGetFontHeight (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter GdipGetEmHeight (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter GdipGetLineSpacing (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter GdipDeleteGraphics (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter GdipCreateFont (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter GdipDeleteFont (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter GdipGetFamilyName (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter CreateCompatibleDC (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter GetCurrentObject (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter SaveDC (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter GetDeviceCaps (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter CreateFontIndirect (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter CreateFontIndirectW (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter SelectObject (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter GetMapMode (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter GetTextMetricsW (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter DrawTextExW (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter DrawTextExWW (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter GetModuleHandle (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter GetModuleHandleW (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter WideCharToMultiByte (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter LoadLibraryEx (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter ProcessIdToSessionId (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter ImmCreateContext (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter ImmDestroyContext (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter ImmNotifyIME (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter ImmAssociateContext (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter ImmReleaseContext (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter ImmGetContext (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter ImmGetCompositionStringA (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter ImmSetCompositionStringA (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter ImmGetCompositionStringW (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter ImmSetCompositionStringW (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter ImmSetCandidateWindow (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter AdjustWindowRectEx (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter GetCurrentThread (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter DuplicateHandle (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter GetCurrentThreadId (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter GetCurrentActCtx (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter ActivateActCtx (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter DefWindowProcW (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter RegisterClass (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter RegisterClassW (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter CreateWindowEx (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter CreateWindowExW (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter SetWindowLongPtr (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter SetWindowLongPtrW (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter GetWindowLongPtr (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter GetWindowLongPtrW (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter FindNLSStringEx (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter RegQueryValueEx (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter CallWindowProc (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter CallWindowProcW (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter GetClientRect (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter GetWindowRect (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter GetParent (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter DeactivateActCtx (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter GetUserObjectInformation (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter GetUserObjectInformationA (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandler (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandlerW (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter GetClassInfo (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter GetClassInfoW (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter DefWindowProc (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter GetSysColor (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter GetSysColorW (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter GdipCreateSolidFill (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter GdipCreatePen1 (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter GetTimeZoneInformation (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter GetDynamicTimeZoneInformation (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter SHGetFolderPath (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter GetFileMUIPath (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter FreeLibrary (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter FreeLibraryW (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter LoadStringW (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter GdipCreateFontFamilyFromName (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter MonitorFromRect (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter GetMonitorInfo (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter GetMonitorInfoW (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter CreateDC (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter CreateDCW (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter DeleteDC (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter OleCreatePictureIndirect (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter CoGetContextToken (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter CoGetObjectContext (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter GetIconInfo (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter DeleteObject (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter CopyImage (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter LoadCursor (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter LoadCursorW (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter GetThemeAppProperties (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter GetThemeAppPropertiesW (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter OpenThemeData (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter OpenThemeDataW (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter IsThemePartDefined (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter IsThemePartDefinedW (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter GdipCreateRegion (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter GdipGetClip (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter GdipCreateMatrix (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter GdipGetWorldTransform (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter GdipIsMatrixIdentity (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter LocalAlloc (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter GdipGetMatrixElements (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter LocalFree (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter GdipDeleteMatrix (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter GdipIsInfiniteRegion (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter GdipDeleteRegion (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter GdipGetDC (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter OffsetViewportOrgEx (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter GetThemePartSize (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter GetThemePartSizeW (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter RestoreDC (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter GdipReleaseDC (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter GetCursorPos (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter SetWindowText (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter SetWindowTextW (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter MapWindowPoints (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter SendMessage (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter SendMessageW (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter InvalidateRect (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter MonitorFromWindow (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter GetWindowThreadProcessId (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter GetWindowTextLength (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter GetWindowTextLengthW (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter GetWindowText (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter GetWindowTextW (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter SetWindowPos (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter GetFocus (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter sqlite3_bind_text (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter CoCreateGuid (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter MonitorFromPoint (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter OleInitialize (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter RegisterDragDrop (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter GetStartupInfo (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter GetStartupInfoW (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter CreateIconFromResourceEx (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter GetSystemMenu (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter GetWindowPlacement (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter EnableMenuItem (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter RedrawWindow (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter ShowWindow (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter GetWindow (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter GdipGetLogFontW (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter ND_WU1 (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter ND_WU1_RetAddr (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter SystemParametersInfo (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter SystemParametersInfoW (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter InitCommonControlsEx (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter PostMessage (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter PostMessageW (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter SetParent (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter CoRegisterMessageFilter (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter SetFocus (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter GetKeyboardLayout (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter EnumDisplayMonitors (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter GetNearestColor (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter CreateSolidBrush (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter FillRect (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter GdipCreateHalftonePalette (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter SelectPalette (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter GdipSetPageUnit (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter GdipSaveGraphics (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter SetTextColor (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter SetBkColor (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter GdipRestoreGraphics (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter PeekMessage (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter PeekMessageW (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter IsWindowUnicode (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter GetMessageW (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter TranslateMessage (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter DispatchMessageW (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter SetCursor (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter _TrackMouseEvent (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter GetKeyState (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter BeginPaint (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter EndPaint (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter GetObjectType (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter CreateCompatibleBitmap (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter GetDIBits (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter CreateDIBSection (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter GdipTranslateWorldTransform (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter GdipSetClipRectI (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter GdipCombineRegionRegion (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter GdipGetRegionHRgn (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter CreateRectRgn (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter GetClipRgn (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter SelectClipRgn (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter GdipGetTextRenderingHint (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter GetTextAlign (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter GetTextColor (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter GetBkMode (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter SetBkMode (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter BitBlt (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter ClipCursor (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter GetCapture (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter GetSysColorBrush (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter GdipDrawRectangleI (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter GdipDeletePen (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter DrawThemeBackground (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter DrawThemeBackgroundW (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter CloseThemeData (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter CloseThemeDataW (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter GdipFillRectangleI (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter GdipIsVisibleRectI (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter GdipDrawLineI (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter GdipSetClipRegion (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter WaitMessage (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter GetMessageA (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter DispatchMessageA (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter GetDlgItem (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter DestroyIcon (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter DestroyWindow (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter PostThreadMessage (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter PostThreadMessageW (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter RevokeDragDrop (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter GdipDeleteBrush (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter EnumThreadWindows (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter IsWindowVisible (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter OleUninitialize (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter sqlite3_close_v2 (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter CoWaitForMultipleHandles (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter SetClassLongPtr (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter SetClassLongPtrW (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter UnregisterClass (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter UnregisterClassW (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter IsWindow (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter DestroyWindowW (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter DestroyCursor (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter CreateActCtxW (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter AddRefActCtx (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter ReleaseActCtx (UID: 00000000-00005548) "RobokassaElba.exe" called "GetProcAddress" with a parameter QueryActCtxW (UID: 00000000-00005548)2e:Tb9f,"SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00005548.00000000.246626.03390000.00000004.mdmp 00000000-00005548.00000001.248548.03390000.00000004.mdmp 00000000-00005548.00000002.250469.03390000.00000004.mdmp "System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00005548.00000000.246626.03390000.00000004.mdmp 00000000-00005548.00000001.248548.03390000.00000004.mdmp 00000000-00005548.00000002.250469.03390000.00000004.mdmp "Software\Microsoft\.NETFramework" in Source: 00000000-00005548.00000001.248548.03390000.00000004.mdmp 00000000-00005548.00000002.250469.03390000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework" in Source: 00000000-00005548.00000001.248548.03390000.00000004.mdmp 00000000-00005548.00000002.250469.03390000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacif" in Source: 00000000-00005548.00000001.248548.03390000.00000004.mdmp 00000000-00005548.00000002.250469.03390000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones" in Source: 00000000-00005548.00000001.248548.03390000.00000004.mdmp 00000000-00005548.00000002.250469.03390000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones" in Source: 00000000-00005548.00000001.248548.03390000.00000004.mdmp 00000000-00005548.00000002.250469.03390000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time" in Source: 00000000-00005548.00000001.248548.03390000.00000004.mdmp 00000000-00005548.00000002.250469.03390000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time" in Source: 00000000-00005548.00000001.248548.03390000.00000004.mdmp 00000000-00005548.00000002.250469.03390000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time\Dynamic DST" in Source: 00000000-00005548.00000001.248548.03390000.00000004.mdmp 00000000-00005548.00000002.250469.03390000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time\Dynamic DST" in Source: 00000000-00005548.00000001.248548.03390000.00000004.mdmp 00000000-00005548.00000002.250469.03390000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00005548.00000003.256611.01070000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{9FC8E510-A27C-4B3B-B9A3-BF65F00256A8}" in Source: 00000000-00005548.00000003.256611.1BB50000.00000004.mdmp "ry\Machine\Software\Classes\WOW6432Node\CLSID\{9" in Source: 00000000-00005548.00000003.256611.1BB50000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-1271187874-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00005548.00000003.256611.1BB50000.00000004.mdmp "\Registry\Machine\Software\Classes\WOW6432No" in Source: 00000000-00005548.00000003.256611.1BB50000.00000004.mdmp2f:T5f1,"RobokassaElba.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "RobokassaElba.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "RobokassaElba.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" - [base:0; Status:c0000135] "RobokassaElba.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll" - [base:0; Status:c0000135] "RobokassaElba.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "RobokassaElba.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "RobokassaElba.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" - [base:0; Status:c0000135] "RobokassaElba.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:c0000135] "RobokassaElba.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\comctl32.dll" - [base:0; Status:c0000135]30:T487,Observed unmanaged function "sqlite3_open_v2" in "RobokassaElba.exe" Observed unmanaged function "sqlite3_close_v2" in "RobokassaElba.exe" Observed unmanaged function "sqlite3_busy_timeout" in "RobokassaElba.exe" Observed unmanaged function "sqlite3_errmsg" in "RobokassaElba.exe" Observed unmanaged function "sqlite3_prepare_v2" in "RobokassaElba.exe" Observed unmanaged function "sqlite3_step" in "RobokassaElba.exe" Observed unmanaged function "sqlite3_finalize" in "RobokassaElba.exe" Observed unmanaged function "sqlite3_bind_text" in "RobokassaElba.exe" Observed unmanaged function "sqlite3_bind_int64" in "RobokassaElba.exe" Observed unmanaged function "sqlite3_bind_null" in "RobokassaElba.exe" Observed unmanaged function "sqlite3_column_count" in "RobokassaElba.exe" Observed unmanaged function "sqlite3_column_text" in "RobokassaElba.exe" Observed unmanaged function "sqlite3_column_bytes" in "RobokassaElba.exe" Observed unmanaged function "sqlite3_backup_init" in "RobokassaElba.exe" Observed unmanaged function "sqlite3_backup_step" in "RobokassaElba.exe" Observed unmanaged function "sqlite3_backup_finish" in "RobokassaElba.exe"31:Tf92,"SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00005548.00000000.246626.03390000.00000004.mdmp "System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00005548.00000000.246626.03390000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00005548.00000001.248548.03390000.00000004.mdmp "System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00005548.00000001.248548.03390000.00000004.mdmp "Software\Microsoft\.NETFramework" in Source: 00000000-00005548.00000001.248548.03390000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework" in Source: 00000000-00005548.00000001.248548.03390000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacif" in Source: 00000000-00005548.00000001.248548.03390000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones" in Source: 00000000-00005548.00000001.248548.03390000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones" in Source: 00000000-00005548.00000001.248548.03390000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time" in Source: 00000000-00005548.00000001.248548.03390000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time" in Source: 00000000-00005548.00000001.248548.03390000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time\Dynamic DST" in Source: 00000000-00005548.00000001.248548.03390000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time\Dynamic DST" in Source: 00000000-00005548.00000001.248548.03390000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00005548.00000002.250469.03390000.00000004.mdmp "System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00005548.00000002.250469.03390000.00000004.mdmp "Software\Microsoft\.NETFramework" in Source: 00000000-00005548.00000002.250469.03390000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework" in Source: 00000000-00005548.00000002.250469.03390000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacif" in Source: 00000000-00005548.00000002.250469.03390000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones" in Source: 00000000-00005548.00000002.250469.03390000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones" in Source: 00000000-00005548.00000002.250469.03390000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time" in Source: 00000000-00005548.00000002.250469.03390000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time" in Source: 00000000-00005548.00000002.250469.03390000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time\Dynamic DST" in Source: 00000000-00005548.00000002.250469.03390000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time\Dynamic DST" in Source: 00000000-00005548.00000002.250469.03390000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00005548.00000003.256611.01070000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{9FC8E510-A27C-4B3B-B9A3-BF65F00256A8}" in Source: 00000000-00005548.00000003.256611.1BB50000.00000004.mdmp "ry\Machine\Software\Classes\WOW6432Node\CLSID\{9" in Source: 00000000-00005548.00000003.256611.1BB50000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-1271187874-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00005548.00000003.256611.1BB50000.00000004.mdmp "\Registry\Machine\Software\Classes\WOW6432No" in Source: 00000000-00005548.00000003.256611.1BB50000.00000004.mdmp32:T13be,"RobokassaElba.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ffa492f0000 "RobokassaElba.exe" loaded module "ADVAPI32.DLL" at base 7ffa70710000 "RobokassaElba.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ffa6e770000 "RobokassaElba.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ffa6e770000 "RobokassaElba.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ffa6e770000 "RobokassaElba.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSCOREEI.DLL" at base 7ffa49250000 "RobokassaElba.exe" loaded module "SHLWAPI.DLL" at base 7ffa70df0000 "RobokassaElba.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 7ffa6d300000 "RobokassaElba.exe" loaded module "VERSION.DLL" at base 7ffa62a30000 "RobokassaElba.exe" loaded module "KERNEL32" at base 7ffa6f790000 "RobokassaElba.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLR.DLL" at base 7ffa42e40000 "RobokassaElba.exe" loaded module "USER32.DLL" at base 7ffa6ed20000 "RobokassaElba.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 7ffa6e770000 "RobokassaElba.exe" loaded module "MSCOREE.DLL" at base 7ffa49780000 "RobokassaElba.exe" loaded module "NTDLL" at base 7ffa70e90000 "RobokassaElba.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 7ffa70220000 "RobokassaElba.exe" loaded module "PSAPI.DLL" at base 7ffa6f720000 "RobokassaElba.exe" loaded module "RPCRT4.DLL" at base 7ffa70100000 "RobokassaElba.exe" loaded module "KERNEL32.DLL" at base 7ffa6f790000 "RobokassaElba.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MSCORLIB\3B9003E4F27D92E40668F0EFAD11E022\MSCORLIB.NI.DLL" at base 7ffa41880000 "RobokassaElba.exe" loaded module "OLE32.DLL" at base 7ffa70870000 "RobokassaElba.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7ffa6b8e0000 "RobokassaElba.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 7ffa70220000 "RobokassaElba.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 7ffa6e770000 "RobokassaElba.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLRJIT.DLL" at base 7ffa450d0000 "RobokassaElba.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM\CE0FD4F5B50BAA17E7B80E4EE874AD11\SYSTEM.NI.DLL" at base 7ffa40c60000 "RobokassaElba.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DRAWING\3C82A5286B5172D5A68C8DF2E09C4C40\SYSTEM.DRAWING.NI.DLL" at base 7ffa3f770000 "RobokassaElba.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.WINDOWS.FORMS\BEE998043EB1E9BADECD282A79540A5E\SYSTEM.WINDOWS.FORMS.NI.DLL" at base 7ffa37e50000 "RobokassaElba.exe" loaded module "UXTHEME.DLL" at base 7ffa6b8e0000 "RobokassaElba.exe" loaded module "WINSQLITE3.DLL" at base 7ffa61a20000 "RobokassaElba.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CORE\990501E6199819806F01C8ECAC88BAAC\SYSTEM.CORE.NI.DLL" at base 7ffa373c0000 "RobokassaElba.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFIGURATION\2A25B59872A72DA9B55F952AB1B0BC8B\SYSTEM.CONFIGURATION.NI.DLL" at base 7ffa3f630000 "RobokassaElba.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.XML\F0078C8C05B31633E5966C5629E65602\SYSTEM.XML.NI.DLL" at base 7ffa36b10000 "RobokassaElba.exe" loaded module "NTDLL.DLL" at base 7ffa70e90000 "RobokassaElba.exe" loaded module "SHELL32.DLL" at base 1be10000 "RobokassaElba.exe" loaded module "BCRYPT.DLL" at base 7ffa6db90000 "RobokassaElba.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 7ffa6d270000 "RobokassaElba.exe" loaded module "GDI32.DLL" at base 7ffa705b0000 "RobokassaElba.exe" loaded module "GDIPLUS.DLL" at base 7ffa3f970000 "RobokassaElba.exe" loaded module "%WINDIR%\WINSXS\AMD64_MICROSOFT.WINDOWS.GDIPLUS_6595B64144CCF1DF_1.1.22621.1635_NONE_57FA636ACE18905C\GDIPLUS.DLL" at base 7ffa3f970000 "RobokassaElba.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 7ffa6e770000 "RobokassaElba.exe" loaded module "IMM32.DLL" at base 7ffa700c0000 "RobokassaElba.exe" loaded module "COMCTL32.DLL" at base 7ffa46c80000 "RobokassaElba.exe" loaded module "OLEAUT32.DLL" at base 7ffa70b40000 "RobokassaElba.exe" loaded module "%WINDIR%\SYSTEM32\DATAEXCHANGE.DLL" at base 7ffa54070000 "RobokassaElba.exe" loaded module "COMCTL32.DLL" at base 7ffa58ae0000 "RobokassaElba.exe" loaded module "COMCTL32" at base 7ffa58ae0000 "RobokassaElba.exe" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 7ffa6f180000 "RobokassaElba.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 7ffa70a10000 "RobokassaElba.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-WINDOW-EXT-L1-1-0.DLL" at base 7ffa6ed20000 "RobokassaElba.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-INTEGRATION-L1-1-0.DLL" at base 7ffa6ed20000 "RobokassaElba.exe" loaded module "API-MS-WIN-SECURITY-SYSTEMFUNCTIONS-L1-1-0" at base 7ffa70710000 "RobokassaElba.exe" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 7ffa7087000033:T48e,"RobokassaElba.exe" file has an entrypoint instructions - "jmp dword ptr [0x402000],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,"34:T984,"RobokassaElba.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "RobokassaElba.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "RobokassaElba.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "RU-RU") "RobokassaElba.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "RU-RU") "RobokassaElba.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "CA-ES") "RobokassaElba.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "CA-ES") "RobokassaElba.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "CS-CZ") "RobokassaElba.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "CS-CZ") "RobokassaElba.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "DA-DK") "RobokassaElba.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "DA-DK") "RobokassaElba.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "DE-DE") "RobokassaElba.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "DE-DE") "RobokassaElba.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EL-GR") "RobokassaElba.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EL-GR") "RobokassaElba.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "ES-ES_TRADNL") "RobokassaElba.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "ES-ES_TRADNL") "RobokassaElba.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "FI-FI") "RobokassaElba.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "FI-FI") "RobokassaElba.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "FR-FR") "RobokassaElba.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "FR-FR") "RobokassaElba.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "HU-HU") "RobokassaElba.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "HU-HU") "RobokassaElba.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "IT-IT") "RobokassaElba.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "IT-IT") "RobokassaElba.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "NL-NL")35:Te12,Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" [Source: 00000000-00005548-00000C2E-1811670898] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll" [Source: 00000000-00005548-00000C2B-2016805486] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" [Source: 00000000-00005548-00000C2B-2016968325] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00005548-00000C2B-2017114870] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\3b9003e4f27d92e40668f0efad11e022\mscorlib.ni.dll" [Source: 00000000-00005548-00000C2B-2017576589] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" [Source: 00000000-00005548-00000C2B-2017614713] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" [Source: 00000000-00005548-00000C2B-2017714213] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll" [Source: 00000000-00005548-00000C2B-2017878710] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System\ce0fd4f5b50baa17e7b80e4ee874ad11\System.ni.dll" [Source: 00000000-00005548-00000C2B-2017939427] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Drawing\3c82a5286b5172d5a68c8df2e09c4c40\System.Drawing.ni.dll" [Source: 00000000-00005548-00000C2B-2017973087] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\bee998043eb1e9badecd282a79540a5e\System.Windows.Forms.ni.dll" [Source: 00000000-00005548-00000C2B-2018049940] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll" [Source: 00000000-00005548-00000C2B-2018464343] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\990501e6199819806f01c8ecac88baac\System.Core.ni.dll" [Source: 00000000-00005548-00000C2B-2018815571] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Configuration\2a25b59872a72da9b55f952ab1b0bc8b\System.Configuration.ni.dll" [Source: 00000000-00005548-00000C2B-2018874221] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\f0078c8c05b31633e5966c5629e65602\System.Xml.ni.dll" [Source: 00000000-00005548-00000C2B-2018944525] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" [Source: 00000000-00005548-00000C2B-2019289554] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" [Source: 00000000-00005548-00000C2B-2022456481] Observed system executable string:"%WINDIR%\system32\en-US\tzres.dll.mui" [Source: 00000000-00005548-00000C2B-2022555058] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" [Source: 00000000-00005548-00000C2B-2022743715] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" [Source: 00000000-00005548-00000C2B-2023224174] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\comctl32.dll" [Source: 00000000-00005548-00000C2B-2023513636]36:T6a2,"RobokassaElba.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "RobokassaElba.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CODEPAGE"; Key: ""; Value: "") "RobokassaElba.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "RobokassaElba.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\STATESEPARATION\REDIRECTIONMAP\KEYS"; Key: ""; Value: "") "RobokassaElba.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "RobokassaElba.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "RobokassaElba.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "RobokassaElba.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "RobokassaElba.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "RobokassaElba.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "RobokassaElba.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: ""; Value: "") "RobokassaElba.exe" (Access type: "OPEN"; Path: "HKLM\OSDATA\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: ""; Value: "") "RobokassaElba.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\SDBUPDATES"; Key: ""; Value: "")37:Tc60,"RobokassaElba.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SAFEDLLSEARCHMODE"; Value: "") "RobokassaElba.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CODEPAGE"; Key: "ACP"; Value: "") "RobokassaElba.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CODEPAGE"; Key: "OEMCP"; Value: "") "RobokassaElba.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RAISEEXCEPTIONONPOSSIBLEDEADLOCK"; Value: "") "RobokassaElba.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "RobokassaElba.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "57A6ED1A-79F7-5011-B242-4784E5620CF7"; Value: "") "RobokassaElba.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "3C74AFB9-8D82-44E3-B52C-365DBF48382A"; Value: "") "RobokassaElba.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "B749553B-D950-5E03-6282-3145A61B1002"; Value: "") "RobokassaElba.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "05F95EFE-7F75-49C7-A994-60A55CC09571"; Value: "") "RobokassaElba.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "RobokassaElba.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "000604XX"; Value: "") "RobokassaElba.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "RobokassaElba.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "RobokassaElba.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "8CCCA27D-F1D8-4DDA-B5DD-339AEE937731"; Value: "") "RobokassaElba.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "LOGFLAGS"; Value: "") "RobokassaElba.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "18608E62-A628-49D9-8C02-55972E097D24"; Value: "") "RobokassaElba.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "SHOWDEBUGINFO"; Value: "") "RobokassaElba.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\SDBUPDATES"; Key: "SYSMAIN.SDB"; Value: "") "RobokassaElba.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\SDBUPDATES"; Key: "DISABLEDOUBLEQUERYSDBS"; Value: "") "RobokassaElba.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\SDBUPDATES"; Key: "SYSMERGE.SDB"; Value: "") "RobokassaElba.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: "CACHE"; Value: "")38:T50b,"RobokassaElba.exe" reads file "c:\windows\microsoft.net\framework64\v4.0.30319\config\machine.config" "RobokassaElba.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\mscorlib\3b9003e4f27d92e40668f0efad11e022\mscorlib.ni.dll.aux" "RobokassaElba.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\system.windows.forms\bee998043eb1e9badecd282a79540a5e\system.windows.forms.ni.dll.aux" "RobokassaElba.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\system\ce0fd4f5b50baa17e7b80e4ee874ad11\system.ni.dll.aux" "RobokassaElba.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\system.drawing\3c82a5286b5172d5a68c8df2e09c4c40\system.drawing.ni.dll.aux" "RobokassaElba.exe" reads file "c:\data\income.sqlite3" "RobokassaElba.exe" reads file "c:\data\income.sqlite3-journal" "RobokassaElba.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\system.configuration\2a25b59872a72da9b55f952ab1b0bc8b\system.configuration.ni.dll.aux" "RobokassaElba.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\system.core\990501e6199819806f01c8ecac88baac\system.core.ni.dll.aux" "RobokassaElba.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\system.xml\f0078c8c05b31633e5966c5629e65602\system.xml.ni.dll.aux"39:T9cf,"RobokassaElba.exe" trying to access non-existent file "C:\FLTLIB.DLL" "RobokassaElba.exe" trying to access non-existent file "C:\MSVCP140.dll" "RobokassaElba.exe" trying to access non-existent file "C:\VCRUNTIME140.dll" "RobokassaElba.exe" trying to access non-existent file "C:\VCRUNTIME140_1.dll" "RobokassaElba.exe" trying to access non-existent file "C:\CRYPTSP.DLL" "RobokassaElba.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\clr.dll" "RobokassaElba.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\VCRUNTIME140_1_CLR0400.dll" "RobokassaElba.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\VCRUNTIME140_CLR0400.dll" "RobokassaElba.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ucrtbase_clr0400.dll" "RobokassaElba.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" "RobokassaElba.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" "RobokassaElba.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" "RobokassaElba.exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll" "RobokassaElba.exe" trying to access non-existent file "C:\profapi.dll" "RobokassaElba.exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" "RobokassaElba.exe" trying to access non-existent file "C:\CRYPTBASE.dll" "RobokassaElba.exe" trying to access non-existent file "C:\DWrite.dll" "RobokassaElba.exe" trying to access non-existent file "C:\TextShaping.dll" "RobokassaElba.exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" "RobokassaElba.exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" "RobokassaElba.exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" "RobokassaElba.exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\comctl32.dll"3a:T150a,Pattern match: "microsoft.net/framework64/v4.0.30319/" Heuristic match: "osoft.as" Heuristic match: "ystem.windows.fo" Heuristic match: "ystelistb.co" Pattern match: "https://fs.microsoft.com/fs/windows/config.json" Pattern match: "https://fs.microsoft.com/fs/windows/config.json,config,0" Pattern match: "http://go.microsoft.com/fwlink/?linkid=42127" Pattern match: "http://www.w3.org/2000/09/xmldsig#dsa-sha1" Pattern match: "http://www.w3.org/2000/09/xmldsig#rsa-sha1" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#rsa-sha256" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#rsa-sha384" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#rsa-sha512" Pattern match: "http://www.w3.org/2000/09/xmldsig#sha1" Pattern match: "http://www.w3.org/2001/04/xmlenc#sha256" Pattern match: "http://www.w3.org/2001/04/xmlenc#sha512" Pattern match: "http://www.w3.org/2001/04/xmlenc#ripemd160" Pattern match: "http://www.w3.org/2001/04/xmlenc#des-cbc" Pattern match: "http://www.w3.org/2001/04/xmlenc#tripledes-cbc" Pattern match: "http://www.w3.org/2001/04/xmlenc#kw-tripledes" Pattern match: "http://www.w3.org/2001/04/xmlenc#aes128-cbc" Pattern match: "http://www.w3.org/2001/04/xmlenc#kw-aes128" Pattern match: "http://www.w3.org/2001/04/xmlenc#aes192-cbc" Pattern match: "http://www.w3.org/2001/04/xmlenc#kw-aes192" Pattern match: "http://www.w3.org/2001/04/xmlenc#aes256-cbc" Pattern match: "http://www.w3.org/2001/04/xmlenc#kw-aes256" Pattern match: "http://www.w3.org/tr/2001/rec-xml-c14n-20010315" Pattern match: "http://www.w3.org/tr/2001/rec-xml-c14n-20010315#withcomments" Pattern match: "http://www.w3.org/2001/10/xml-exc-c14n#" Pattern match: "http://www.w3.org/2001/10/xml-exc-c14n#withcomments" Pattern match: "http://www.w3.org/2000/09/xmldsig#base64" Pattern match: "http://www.w3.org/tr/1999/rec-xpath-19991116" Pattern match: "http://www.w3.org/tr/1999/rec-xslt-19991116" Pattern match: "http://www.w3.org/2000/09/xmldsig#enveloped-signature" Pattern match: "http://www.w3.org/2002/07/decrypt#xml" Pattern match: "http://www.w3.org/2000/09/xmldsig#" Pattern match: "http://www.w3.org/2001/04/xmlenc#" Pattern match: "http://www.w3.org/2000/09/xmldsig#hmac-sha1" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#md5" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#sha384" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#hmac-md5" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#hmac-ripemd160" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#hmac-sha256" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#hmac-sha384" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#hmac-sha512" Pattern match: "http://www.w3.org/2000/xmlns/" Pattern match: "http://www.w3.org/xml/1998/namespace" Pattern match: "http://schemas.microsoft.com/.netconfiguration/v2.0" Pattern match: "system.web/anonymousidentification" Pattern match: "system.web/authentication" Pattern match: "system.web/authorization" Pattern match: "system.web/browsercaps" Pattern match: "system.web/clienttarget" Pattern match: "system.web/compilation" Pattern match: "system.web/customerrors" Pattern match: "system.web/deployment" Pattern match: "system.web/devicefilters" Pattern match: "system.web/fulltrustassemblies" Pattern match: "system.web/globalization" Pattern match: "system.web/healthmonitoring" Pattern match: "system.web/hostingenvironment" Pattern match: "system.web/httpcookies" Pattern match: "system.web/httphandlers" Pattern match: "system.web/httpmodules" Pattern match: "system.web/httpruntime" Pattern match: "system.web/identity" Pattern match: "system.web/machinekey" Pattern match: "system.web/membership" Pattern match: "system.web/mobilecontrols" Pattern match: "system.web/pages" Pattern match: "system.web/partialtrustvisibleassemblies" Pattern match: "system.web/processmodel" Pattern match: "system.web/profile" Pattern match: "system.web/protocols" Pattern match: "system.web/rolemanager" Pattern match: "system.web/securitypolicy" Pattern match: "system.web/sessionpagestate" Pattern match: "system.web/sessionstate" Pattern match: "system.web/sitemap" Pattern match: "system.web/trace" Pattern match: "system.web/trust" Pattern match: "system.web/urlmappings" Pattern match: "system.web/webcontrols" Pattern match: "system.web/webparts" Pattern match: "system.web/webservices" Pattern match: "system.web/xhtmlconformance" Pattern match: "system.web/caching" Pattern match: "system.web/caching/cache" Pattern match: "system.web/caching/outputcache" Pattern match: "system.web/caching/outputcachesettings" Pattern match: "system.web/caching/sqlcachedependency" Pattern match: "http://www.monotype.com/html/mtname/ms_welcome.html" Pattern match: "www.monotype.com/html/mtname/ms_welcome.html" Pattern match: "http://www.monotype.com/html/designer/des_index.html" Pattern match: "http://www.monotype.com/html/type/license.html" Pattern match: "www.microsoft.com/typography/fonts" Pattern match: "www.monotype.com/html/type/license.html" Pattern match: "http://en.wikipedia.org/wiki/mit_license" Pattern match: "http://www.fontbureau.com/designers" Pattern match: "http://www.microsoft.com/typography" Pattern match: "microsoft.net/assembly/gac_msil/system.windows.forms/v4.0_4.0.0.0__b77a5c561934e089/system.windows.forms.dll"3b:T1611,Found URL "https://fs.microsoft.com/fs/windows/config.json11/03" - Source: "00000000-00005548.00000000.246626.02EB0000.00000002.mdmp") Found URL "https://fs.microsoft.com/fs/windows/config.json,config,011/03" - Source: "00000000-00005548.00000000.246626.02EB0000.00000002.mdmp") Found URL "http://user.configfile:.configfile://datadirectoryc:\robokassaelba.exe.configfile:///c:/robokassaelba.exec:/robokassaelba.exec:\robokassaelba.exehttphttpsfilegophernntpnewsmailtouuidtelnetldapnet.tcpnet.pipevsmacrostargetframeworkmonikerrflct.invalidfieldfailrflct.invalidpropfail0123456789abcdefsystem.net/machine/exe/roaming_user/local_usermachine/exe/roaming_userconfigmachine.configc:\windows\microsoft.net\framework64\v4.0.30319\c:\windows\microsoft.net\framework64\v4.0.30319\c:\windows\microsoft.net\framework64\v4.0.30319\configc:\windows\microsoft.net\framework64\v4.0.30319\config\machine.configc:\windows\microsoft.net\framework64\v4.0.30319\config\machine.configmachine.config\\.\modeaccessrightssharec:\windows\microsoft.net\framework64\v4.0.30319\config\machine.configconfig_base_unrecognized_elementsystem.security.cryptography.randomnumbergeneratorcryptonamemappingoidmapmscorlibmachine.configconfigurationversioncryptographysettingsc:\windows\microsoft.net\framework64\v4.0.30319\config\c:\users\zarmqmd\appdata\roaming\microsoft\clr" - Source: "00000000-00005548.00000000.246626.03390000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=42127" - Source: "00000000-00005548.00000000.246626.03390000.00000004.mdmp") Found URL "http://www.w3.org/2000/09/xmldsig" - Source: "00000000-00005548.00000000.246626.03390000.00000004.mdmp") Found URL "http://user.configfile:.configfile://datadirectoryc:\robokassaelba.exe.configfile:///c:/robokassaelba.exec:/robokassaelba.exec:\robokassaelba.exehttphttpsfilegophernntpnewsmailtouuidtelnetldapnet.tcpnet.pipevsmacrostargetframeworkmonikerrflct.invalidfieldfailrflct.invalidpropfail0123456789abcdefsystem.net/machine/exe/roaming_user/local_usermachine/exe/roaming_userconfigmachine.configc:\windows\microsoft.net\framework64\v4.0.30319\c:\windows\microsoft.net\framework64\v4.0.30319\c:\windows\microsoft.net\framework64\v4.0.30319\configc:\windows\microsoft.net\framework64\v4.0.30319\config\machine.configc:\windows\microsoft.net\framework64\v4.0.30319\config\machine.configmachine.config\\.\modeaccessrightssharec:\windows\microsoft.net\framework64\v4.0.30319\config\machine.configconfig_base_unrecognized_elementsystem.security.cryptography.randomnumbergeneratorcryptonamemappingoidmapmscorlibmachine.configconfigurationversioncryptographysettingsc:\windows\microsoft.net\framework64\v4.0.30319\config\c:\users\zarmqmd\appdata\roaming\microsoft\clr" - Source: "00000000-00005548.00000001.248548.03390000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=42127" - Source: "00000000-00005548.00000001.248548.03390000.00000004.mdmp") Found URL "http://www.w3.org/2000/09/xmldsig" - Source: "00000000-00005548.00000001.248548.03390000.00000004.mdmp") Found URL "http://www.monotype.com/html/mtname/ms_welcome.htmln-usn-usa-ess-cza-dkn-usn-us" - Source: "00000000-00005548.00000001.248548.1C610000.00000004.mdmp") Found URL "http://www.monotype.com/html/designer/des_index.htmln-usn-us(c)2003" - Source: "00000000-00005548.00000001.248548.1C610000.00000004.mdmp") Found URL "http://www.monotype.com/html/type/license.htmlttp://www.microsoft.com/typography/fontsopyright" - Source: "00000000-00005548.00000001.248548.1C610000.00000004.mdmp") Found URL "http://user.configfile:.configfile://datadirectoryc:\robokassaelba.exe.configfile:///c:/robokassaelba.exec:/robokassaelba.exec:\robokassaelba.exehttphttpsfilegophernntpnewsmailtouuidtelnetldapnet.tcpnet.pipevsmacrostargetframeworkmonikerrflct.invalidfieldfailrflct.invalidpropfail0123456789abcdefsystem.net/machine/exe/roaming_user/local_usermachine/exe/roaming_userconfigmachine.configc:\windows\microsoft.net\framework64\v4.0.30319\c:\windows\microsoft.net\framework64\v4.0.30319\c:\windows\microsoft.net\framework64\v4.0.30319\configc:\windows\microsoft.net\framework64\v4.0.30319\config\machine.configc:\windows\microsoft.net\framework64\v4.0.30319\config\machine.configmachine.config\\.\modeaccessrightssharec:\windows\microsoft.net\framework64\v4.0.30319\config\machine.configconfig_base_unrecognized_elementsystem.security.cryptography.randomnumbergeneratorcryptonamemappingoidmapmscorlibmachine.configconfigurationversioncryptographysettingsc:\windows\microsoft.net\framework64\v4.0.30319\config\c:\users\zarmqmd\appdata\roaming\microsoft\clr" - Source: "00000000-00005548.00000002.250469.03390000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=42127" - Source: "00000000-00005548.00000002.250469.03390000.00000004.mdmp") Found URL "http://www.w3.org/2000/09/xmldsig" - Source: "00000000-00005548.00000002.250469.03390000.00000004.mdmp") Found URL "http://en.wikipedia.org/wiki/mit_license)," - Source: "00000000-00005548.00000002.250469.1C669000.00000004.mdmp") Found URL "http://www.fontbureau.com/designershttp://www.microsoft.com/typographybodoni" - Source: "00000000-00005548.00000002.250469.1C669000.00000004.mdmp") Found URL "http://www.monotype.com/html/designer/des_index.htmln-usn-us(c)2003" - Source: "00000000-00005548.00000003.256611.1C620000.00000004.mdmp") Found URL "http://www.monotype.com/html/type/license.htmlttp://www.microsoft.com/typography/fontsopyright" - Source: "00000000-00005548.00000003.256611.1C620000.00000004.mdmp") Found URL "http://en.wikipedia.org/wiki/mit_license)," - Source: "00000000-00005548.00000003.256611.1C669000.00000004.mdmp")3c:T8a1,"RobokassaElba.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00005548) "RobokassaElba.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework64\\* (UID: 00000000-00005548) "RobokassaElba.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00005548) "RobokassaElba.exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00005548) "RobokassaElba.exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00005548) "RobokassaElba.exe" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00005548) "RobokassaElba.exe" called "FindNextFileW" with parameter SharedReg12.dll (UID: 00000000-00005548) "RobokassaElba.exe" called "FindNextFileW" with parameter v2.0.50727 (UID: 00000000-00005548) "RobokassaElba.exe" called "FindNextFileW" with parameter v3.0 (UID: 00000000-00005548) "RobokassaElba.exe" called "FindNextFileW" with parameter v3.5 (UID: 00000000-00005548) "RobokassaElba.exe" called "FindNextFileW" with parameter v4.0.30319 (UID: 00000000-00005548) "RobokassaElba.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\* (UID: 00000000-00005548) "RobokassaElba.exe" called "FindNextFileW" with parameter 3b9003e4f27d92e40668f0efad11e022 (UID: 00000000-00005548) "RobokassaElba.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\RobokassaElba\* (UID: 00000000-00005548) "RobokassaElba.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\* (UID: 00000000-00005548) "RobokassaElba.exe" called "FindNextFileW" with parameter bee998043eb1e9badecd282a79540a5e (UID: 00000000-00005548) "RobokassaElba.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\* (UID: 00000000-00005548) "RobokassaElba.exe" called "FindNextFileW" with parameter ce0fd4f5b50baa17e7b80e4ee874ad11 (UID: 00000000-00005548) "RobokassaElba.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Drawing\* (UID: 00000000-00005548)3d:T8a1,Found reference to API "84925430194,7672,111,,GetSystemMetrics,user32.dll,"01:06:49.281",RX=0,PX=0" (Indicator: "GetSystemMetrics"; Source: "00000000-00005548.00000003.256611.1BB50000.00000004.mdmp") Found reference to API "85512461318,7672,111,,GetSystemMetrics,user32.dll,"01:06:49.515",RX=0,PX=0" (Indicator: "GetSystemMetrics"; Source: "00000000-00005548.00000003.256611.1BB50000.00000004.mdmp") Found reference to API "85513734424,7672,111,,GetSystemMetrics,user32.dll,"01:06:49.515",RX=0,PX=0" (Indicator: "GetSystemMetrics"; Source: "00000000-00005548.00000003.256611.1BB50000.00000004.mdmp") Found reference to API "85485176968,7672,111,,GetSystemMetrics,user32.dll,"01:06:49.500",RX=0,PX=0" (Indicator: "GetSystemMetrics"; Source: "00000000-00005548.00000003.256611.1BB50000.00000004.mdmp") Found reference to API "84775023138,7672,111,,GetSystemMetrics,user32.dll,"01:06:49.218",RX=0,PX=0" (Indicator: "GetSystemMetrics"; Source: "00000000-00005548.00000003.256611.1BB50000.00000004.mdmp") Found reference to API "85074764346,7672,111,,GetSystemMetrics,user32.dll,"01:06:49.343",RX=0,PX=0" (Indicator: "GetSystemMetrics"; Source: "00000000-00005548.00000003.256611.1BB50000.00000004.mdmp") Found reference to API "85484629294,7672,111,,GetSystemMetrics,user32.dll,"01:06:49.500",RX=0,PX=0" (Indicator: "GetSystemMetrics"; Source: "00000000-00005548.00000003.256611.1BB50000.00000004.mdmp") Found reference to API "85074958840,7672,111,,GetSystemMetrics,user32.dll,"01:06:49.343",RX=0,PX=0" (Indicator: "GetSystemMetrics"; Source: "00000000-00005548.00000003.256611.1BB50000.00000004.mdmp") Found reference to API "85513836198,7672,111,,GetSystemMetrics,user32.dll,"01:06:49.515",RX=0,PX=0" (Indicator: "GetSystemMetrics"; Source: "00000000-00005548.00000003.256611.1BB50000.00000004.mdmp") Found reference to API "85512583628,7672,111,,GetSystemMetrics,user32.dll,"01:06:49.515",RX=0,PX=0" (Indicator: "GetSystemMetrics"; Source: "00000000-00005548.00000003.256611.1BB50000.00000004.mdmp") Found reference to API "85522140094,7672,111,,GetSystemMetrics,user32.dll,"01:06:49.515",RX=0,PX=0" (Indicator: "GetSystemMetrics"; Source: "00000000-00005548.00000003.256611.1BB50000.00000004.mdmp")3e:T5e0,Found string "passwordFormat" (Indicator: "password"; Source: "00000000-00005548.00000000.246626.03390000.00000004.mdmp, 00000000-00005548.00000001.248548.03390000.00000004.mdmp, 00000000-00005548.00000002.250469.03390000.00000004.mdmp") Found string "passwordAttemptWindow" (Indicator: "password"; Source: "00000000-00005548.00000000.246626.03390000.00000004.mdmp, 00000000-00005548.00000001.248548.03390000.00000004.mdmp, 00000000-00005548.00000002.250469.03390000.00000004.mdmp") Found string "passwordStrengthRegularExpression" (Indicator: "password"; Source: "00000000-00005548.00000000.246626.03390000.00000004.mdmp, 00000000-00005548.00000001.248548.03390000.00000004.mdmp, 00000000-00005548.00000002.250469.03390000.00000004.mdmp") Found string "passwordFormat="Hashed"" (Indicator: "password"; Source: "00000000-00005548.00000000.246626.03390000.00000004.mdmp, 00000000-00005548.00000001.248548.03390000.00000004.mdmp, 00000000-00005548.00000002.250469.03390000.00000004.mdmp") Found string "passwordAttemptWindow="10"" (Indicator: "password"; Source: "00000000-00005548.00000000.246626.03390000.00000004.mdmp, 00000000-00005548.00000001.248548.03390000.00000004.mdmp, 00000000-00005548.00000002.250469.03390000.00000004.mdmp") Found string "passwordStrengthRegularExpression="" />" (Indicator: "password"; Source: "00000000-00005548.00000000.246626.03390000.00000004.mdmp, 00000000-00005548.00000001.248548.03390000.00000004.mdmp, 00000000-00005548.00000002.250469.03390000.00000004.mdmp")3f:Tac0,Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00005548.00000000.246626.01070000.00000004.mdmp, 00000000-00005548.00000000.246626.011A0000.00000004.mdmp, 00000000-00005548.00000000.246626.02FF0000.00000004.mdmp, 00000000-00005548.00000001.248548.01070000.00000004.mdmp, 00000000-00005548.00000002.250469.01070000.00000004.mdmp, 00000000-00005548.00000002.250469.011A0000.00000004.mdmp, 00000000-00005548.00000002.250469.02FF0000.00000004.mdmp, 00000000-00005548.00000002.250469.1F4C0000.00000004.mdmp, 00000000-00005548.00000003.256611.01070000.00000004.mdmp, 00000000-00005548.00000003.256611.011A0000.00000004.mdmp, 00000000-00005548.00000003.256611.02FF0000.00000004.mdmp, 00000000-00005548.00000003.256611.1F4C0000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00005548.00000000.246626.01070000.00000004.mdmp, 00000000-00005548.00000000.246626.011A0000.00000004.mdmp, 00000000-00005548.00000000.246626.02FF0000.00000004.mdmp, 00000000-00005548.00000001.248548.01070000.00000004.mdmp, 00000000-00005548.00000002.250469.01070000.00000004.mdmp, 00000000-00005548.00000002.250469.011A0000.00000004.mdmp, 00000000-00005548.00000002.250469.02FF0000.00000004.mdmp, 00000000-00005548.00000002.250469.1F4C0000.00000004.mdmp, 00000000-00005548.00000003.256611.01070000.00000004.mdmp, 00000000-00005548.00000003.256611.011A0000.00000004.mdmp, 00000000-00005548.00000003.256611.02FF0000.00000004.mdmp, 00000000-00005548.00000003.256611.1F4C0000.00000004.mdmp") Found string "\Device\HarddiskVolume3\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" (Indicator: "\Device\"; Source: "00000000-00005548.00000000.246626.01070000.00000004.mdmp, 00000000-00005548.00000001.248548.01070000.00000004.mdmp, 00000000-00005548.00000002.250469.01070000.00000004.mdmp, 00000000-00005548.00000003.256611.01070000.00000004.mdmp") Found string "ta=C:\Windows\System32\Drivers\D" (Indicator: "\drivers\"; Source: "00000000-00005548.00000001.248548.1BB50000.00000004.mdmp, 00000000-00005548.00000002.250469.1BB50000.00000004.mdmp, 00000000-00005548.00000003.256611.1BB50000.00000004.mdmp") Found string "ta=C:\Windows\System32\Drivers\D" (Indicator: "system32\drivers"; Source: "00000000-00005548.00000001.248548.1BB50000.00000004.mdmp, 00000000-00005548.00000002.250469.1BB50000.00000004.mdmp, 00000000-00005548.00000003.256611.1BB50000.00000004.mdmp") Found string "\Device\HarddiskVolume3\RobokassaElba.exe" (Indicator: "\Device\"; Source: "00000000-00005548.00000001.248548.1BB50000.00000004.mdmp, 00000000-00005548.00000002.250469.1BB50000.00000004.mdmp, 00000000-00005548.00000003.256611.1BB50000.00000004.mdmp")40:T13f7,"RobokassaElba.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\NOTIFICATIONS\DATA"; Key: "418A073AA3BC1C75"; Value: "AC190000000000000400040001001F020200000000B31C0200F76A010152B601020909020212F80002388F020285C70102E8C20103A63A0203CBE40103F91B02043E8E02045F9A0204931A0104AF630104DADC0105DE850205F9E70106C42802079A1902088D4201089E1902095E2F0209A336010A6B6C010BE8C5010BF99C020C3131020CE9C2000D28C7010D7879000D7E3E020D7E4F020DD3F9000E091A020E303E020E9F67020F168C01101755021043E800104C8E02112969021142C20011AB3D0212E5F800130A360213951B0213E9780014FD160215B6250115E07E0216D134021793380117C06F0117DE370118208A02186C1E0219C0E2001A2D42021AE8EC011BF60B001C955C001D3083021D3BC5011D5819021E451E021EC330021ED770011F34CC011F626C021F6C76022018F200213AC30121777A00223BED0122A7730123116E01237AF80123ABE90123CC4F01246B460124ACC70024C18B0125023802254F6E01262B9401264BA801267F9D022834190228A11B012919DA0129450101297DA90129861F0229CE33022AC7DE002B2499002BD8E5012C9F7A022CA603022D22DA012D5838012E1EF0012E4A1C022E6974012E7714022F39D5002F4CE5012FA8FF0131484F003257A400329F7A0232D1A70032D45F0133FB2A0233FE38023542CC0135602102361EE10139A7C20139AFDE013A99D9013B8031023CB352003D121F023D218F023DC47F023E1CB7013E3383003E5BED01401D3E02403D670140A28E0141A8760041BC3A02420D510242264A0042B3AE0042C54D02435EBA0143AB210144A4C401454ED30045668A024677300146AB2E02483BDB0148C24F0048F9A60049CBA30149DA1B0249EAB7004AAA81004AC433024ADEE1014B2A91014B6EE3014B7207024BF474024C15AA014C41B4004C9E02024CC84B014D3ED9014E50C2014F14C2004FA53302508F000252769302534673015355E401536A3A02538AAD015408340254302F0254B7DC0054DFE20155DB8C0155E6E101560A850057426B01577AF801578A1B0257AD120158021202589E270258BB5C025953940059C43C025A0189025A0289025A0A83025A2C80015AE213025AF783025B1203025C3598015E83D7015EF05F025F83500261D42A0261D98C0162DC300262EF34026396770063EC740263FD310264054E0264C9260164D4190164F42B0265C4850265ED1D0267ABEE0167BA6B0268130102682C90006957EA0169592A0269CC4F016A3683026A61E8016A7365016A95E2016BF42B026C0B76026C137F026C6F66026D2390026DEE2C026E4538027052E20170A32C0271014902718C9A02726E4A0072A2420172CD990173422F0274A3A30175A37E007691CF0177D52F0277F98F0178159600785DD30179F99C027A5B7C027C82C9017CBAFC017D904A017DBBD6017E1044017E3732027E5030027EEE89027F16AA017F88CA00800184028106950081B0690281B942028227730082409702825B8A0282FB2A02833AC50183F16000844D260184D7780284E11E0284E6830085311B028550AE0085E34102861BDE01867B060186ECB6018754990287D5140287DE830087F0250187FC380288818702890CE901892F830289DC8B018A8093008AFAE3008BEEF2008BFD6E018C1D88028C8F94028E78A2008E90C6018ED891018FEAF901905E94029123D30091C335029259160092603302928271009369C70093CA3D0293CDFD0193CE8C019439F701945AE001945B270294A15B0195126E01959F33019697E30196A26E0197F6C40098C7F10198D7780299429B02996776029A0B73019B4A72029C429B029C4D22029CE0A8009D9D92009E1E90019F8230029F8314029FF47702A1236602A19D2A01A2050600A2065D02A2961002A3998D02A3C4E200A3C88302A3E8DD01A4580200A4778D02A4AEE901A5092E02A5ADCF00A644A600A6E9B300A736A800A7B8AD00A7C23301A7E23E02A8EA4E02AAB1FC01AAF63F02AB9FC901ABF42B02AC4D1C02AC54F900AC79D901AC930202AD2DB801AD73BF00AE4D5702AEE69101AF086501AF9C0202B09E9702B0F13802B2376E01B2827902B2BAFC01B3732002B3742D02B392FB00B4D7C501B51B6701B5661202B7750C02B7E23E02B8C37F02B91AF300B9B92A02B9FA7702BB51DD01BB8E1602BB8E8B00BBF42B02BC6EB400BCD22A01BD388F00BEAF8A02BF674602BFDC4602C0079A00C03A8E02C046AD00C1BCF101C2151602C2610B01C2DEE401C2FD7C02C33EA300C36D8100C399F300C535C900C561EA01C58D9002C5EA1602C6331902C75DD700C85C5902C8B83902C9389700CA072E02CA23B700CB533302CB74DA00CC495600CCEFEF00CDBA8302CE99E001CEE23E02CF1C0402CF74AA00CFF36501D0175600D0B00802D1D2A700D2C12702D2CF9D02D2E67302D2ED3702D3140C02D3826100D3834B01D3E88D00D4489A01D4A04002D5398801D5F78602D6231F02D6EF5802D737C501D7D2C501D7E86C02D8E79C01D940E901D997E001DA0B7301DA38C801DB7A1402DB87DD01DBE23E02DBE56F02DC451502DC5C2B02DD1B1901DE0F8702DE692702DF294302E0093602E01FA101E0BC0102E1417E02E16D9901E17E8C00E193B001E1E3D801E21B5600E2BC8802E2DB2C02E4402701E469C900E4EF1B02E5BD5C01E5E03902E6109902E63E2B0DE66C8100E6BD3902E7A3E901E7A4D900E7E23E02E88E2401E98C0A01E9D36601E9EA3402EB3B9402EB7FDF01EB8D3302EB908D02EC63C501EC95E101ECBC3602EDAA2E02EE165502EE5F9902EE930202EEAF9B02EFD67202F0694F02F07F0B02F0B91402F0E0B600F133E901F13A9102F1728102F17D5F00F1AD3D01F1FC6000F20E9302F2B4FA00F2FFA501F308DB00F3492A02F3658E02F3894001F3B82102F458EC01F4EA9502F5500D01F577C201F62D3102F6F12B02F7125E00F7D36F00F7EC8302F7ED6A00F8C13D02F9DFA101FA667802FAFB8402FB8CC601FC3A4701FC75BA01FD148602FDB0D900FDDFE501FE784F02FE8D5E02FEDC8C01FEE26301FF10DD01FF3400023900060000000DEAFC0110BE880212F7C70113F7C7011A6F93021BA02E02212E4D0225C5010228614B022E240F022EDD89023C6AF901410189024BFC6D0251B2340261057C0261367A0263CB2E0269B992026A23E20170FC8802786C6D0279DE98027E018902877B32028B2894028EE3780299345802996776029E306B02A1866302A6749502AFA32E02B0D58102B5235202B6F13B02B7F15002BB635C02C1239D01C3445D02C8D15D02CF6C8502CFF42B02D88C3F02DBB95D02DCEF8E02DFD47602E2077F02E4718902EA5B9402EBAC7502EDF38E02EF007702F02A7402F0E23E02F7CC9002FC998D020600400100001ED770014B11B4006041AE00682C9000A5ADCF00CE99E0010100420100009E1E9001010043010000C0EC7C0000")1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"e2cde75ff9ac1238102d03be0213a839ea0a3778aec2435b4209f042bb1d07e7","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1793748739733,"unified_at":"2026-11-03T23:32:19.733Z","metadata":{"hashes":{"sha256":"e2cde75ff9ac1238102d03be0213a839ea0a3778aec2435b4209f042bb1d07e7","sha1":"676651e74f6815d50592e1aa27647f80628fdced","md5":"333556fc15d2add7a7b9932b32d2a51d","sha512":"f779300ac5592be883107ea4e89a2b72b9f76df50ad8d152d4de96f6b6c2b49330f99ee5c157cf6a6f989922145eebc44256c6c2ae1cc2d29cd2e6b4a1a7e5e9","ssdeep":"1536:qc27b2OJ999CtPfgaFL9H4c/wNYTTLfHTHelRtSRVaKWRZzvNzBnk:EHjJDwtngk9HcRovaKWDk","ssdeep_chunks":["1536:qc27b2O","1536:c27b2OJ","1536:27b2OJ9","1536:7b2OJ99","1536:b2OJ999","1536:2OJ999C","1536:OJ999Ct","1536:J999CtP","1536:999CtPf","1536:99CtPfg","1536:9CtPfga","1536:CtPfgaF","1536:tPfgaFL","1536:PfgaFL9","1536:fgaFL9H","1536:gaFL9H4","1536:aFL9H4c","1536:FL9H4c/","1536:L9H4c/w","1536:9H4c/wN","1536:H4c/wNY","1536:4c/wNYT","1536:c/wNYTT","1536:/wNYTTL","1536:wNYTTLf","1536:NYTTLfH","1536:YTTLfHT","1536:TTLfHTH","1536:TLfHTHe","1536:LfHTHel","1536:fHTHelR","1536:HTHelRt","1536:THelRtS","1536:HelRtSR","1536:elRtSRV","1536:lRtSRVa","1536:RtSRVaK","1536:tSRVaKW","1536:SRVaKWR","1536:RVaKWRZ","1536:VaKWRZz","1536:aKWRZzv","1536:KWRZzvN","1536:WRZzvNz","1536:RZzvNzB","1536:ZzvNzBn","1536:zvNzBnk","3072:qc27b2O","3072:c27b2OJ","3072:27b2OJ9","3072:7b2OJ99","3072:b2OJ999","3072:2OJ999C","3072:OJ999Ct","3072:J999CtP","3072:999CtPf","3072:99CtPfg","3072:9CtPfga","3072:CtPfgaF","3072:tPfgaFL","3072:PfgaFL9","3072:fgaFL9H","3072:gaFL9H4","3072:aFL9H4c","3072:FL9H4c/","3072:L9H4c/w","3072:9H4c/wN","3072:H4c/wNY","3072:4c/wNYT","3072:c/wNYTT","3072:/wNYTTL","3072:wNYTTLf","3072:NYTTLfH","3072:YTTLfHT","3072:TTLfHTH","3072:TLfHTHe","3072:LfHTHel","3072:fHTHelR","3072:HTHelRt","3072:THelRtS","3072:HelRtSR","3072:elRtSRV","3072:lRtSRVa","3072:RtSRVaK","3072:tSRVaKW","3072:SRVaKWR","3072:RVaKWRZ","3072:VaKWRZz","3072:aKWRZzv","3072:KWRZzvN","3072:WRZzvNz","3072:RZzvNzB","3072:ZzvNzBn","3072:zvNzBnk","1536:EHjJDwt","1536:HjJDwtn","1536:jJDwtng","1536:JDwtngk","1536:Dwtngk9","1536:wtngk9H","1536:tngk9Hc","1536:ngk9HcR","1536:gk9HcRo","1536:k9HcRov","1536:9HcRova","1536:HcRovaK","1536:cRovaKW","1536:RovaKWD","1536:ovaKWDk"],"imphash":"f34d5f2d4577ed6d9ceec516c1f5a744","pehash":"87aef2f43984d0c9d3f05fd3f0e9045bcd95c5f8"},"file_info":{"file_name":"RobokassaElba.exe","file_type":["peexe","assembly","executable"],"file_type_id":".NET exe","file_size":109568,"entropy":5.76,"compile_timestamp":"2026-11-03T23:14:03","is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1793748416000,"last_seen":1793748416000,"last_multi_scan":1793748416000},"pe_metadata":{"is_dll":false,"is_packed":false,"section_count":3,"import_count":0,"export_count":0,"embedded_file_count":2,"sections":[{"name":".text","virtual_address":"0x2000","virtual_size":106676,"raw_size":107008},{"name":".rsrc","virtual_address":"0x1e000","virtual_size":1392,"raw_size":1536},{"name":".reloc","virtual_address":"0x20000","virtual_size":12,"raw_size":512}],"section_names":[".text",".rsrc",".reloc"],"imported_dlls":null,"imported_functions":null}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":null},"stats":{"av":{"malicious_count":0,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":0,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":44},"sandbox_signatures":{"informative_count":94,"suspicious_count":6,"malicious_count":1,"total":101},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"undetected","status":"clean","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{},"mitre_attacks":[{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Input file contains API references not part of its Import Address Table (IAT)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Found Native API in Dotnet file"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Able to execute applications using .NET process API"},{"type":"informative","value":"Able to execute application (.NET)"},{"type":"informative","value":"Contains ability to start a process (Dotnet)"},{"type":"informative","value":"Contains native function calls (syscalls strings)"},{"type":"informative","value":"Contains ability to execute Windows APIs"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aea6dbf7d4874794f044d22"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Reference explorer.exe process"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aea6dbf7d4874794f044d22"}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Contains SQL queries"},{"type":"informative","value":"Able to perform SQL operations"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aea6dbf7d4874794f044d22"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"},{"type":"informative","value":"Calls an API typically used to create a directory"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aea6dbf7d4874794f044d22"}]},{"tactic":"Stealth","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"suspicious","value":"Calls an API typically used to acquire handle to a key container within a CSP"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Contains ability to perform crypto operations"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Contains ability to use Cryptographic classes"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aea6dbf7d4874794f044d22"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"informative","value":"Contains ability to execute a WMI query"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aea6dbf7d4874794f044d22"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Found potential URL in binary/memory"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aea6dbf7d4874794f044d22"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Fails to load modules at runtime"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Loads the .NET runtime environment"},{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"}],"sources":[{"report_type":"sandbox","report_id":"6aea6dbf7d4874794f044d22"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"}],"sources":[{"report_type":"sandbox","report_id":"6aea6dbf7d4874794f044d22"}]},{"tactic":"Persistence","technique":"Account Manipulation","attack_id":"T1098","attack_id_wiki":"https://attack.mitre.org/techniques/T1098","identifiers":[{"type":"informative","value":"Contains ability to modify the user configuration/privilege (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aea6dbf7d4874794f044d22"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Writes registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6aea6dbf7d4874794f044d22"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aea6dbf7d4874794f044d22"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"6aea6dbf7d4874794f044d22"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"6aea6dbf7d4874794f044d22"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"6aea6dbf7d4874794f044d22"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"6aea6dbf7d4874794f044d22"}]},{"tactic":"Credential Access","technique":"Steal or Forge Kerberos Tickets","attack_id":"T1558","attack_id_wiki":"https://attack.mitre.org/techniques/T1558","identifiers":[{"type":"informative","value":"Able to access credential file using Kerberos"}],"sources":[{"report_type":"sandbox","report_id":"6aea6dbf7d4874794f044d22"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"suspicious","value":"Calls an API typically used for keylogging"},{"type":"informative","value":"Able to retrieve information about pressed keystrokes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aea6dbf7d4874794f044d22"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6aea6dbf7d4874794f044d22"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Calls an API typically used for searching a directory for files"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"}],"sources":[{"report_type":"sandbox","report_id":"6aea6dbf7d4874794f044d22"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Able to query security token membership for user discovery (API string)"},{"type":"informative","value":"Queries the user identity associated with the current process token"}],"sources":[{"report_type":"sandbox","report_id":"6aea6dbf7d4874794f044d22"}]},{"tactic":"Discovery","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using API string"}],"sources":[{"report_type":"sandbox","report_id":"6aea6dbf7d4874794f044d22"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Able to enumerate system processes using native API"},{"type":"informative","value":"Able to list processes on remote desktop session host"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Queries process information"}],"sources":[{"report_type":"sandbox","report_id":"6aea6dbf7d4874794f044d22"}]},{"tactic":"Discovery","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aea6dbf7d4874794f044d22"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Found registry location strings in memory"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6aea6dbf7d4874794f044d22"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"}],"sources":[{"report_type":"sandbox","report_id":"6aea6dbf7d4874794f044d22"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"},{"type":"informative","value":"Calls an API typically used to get active windows title"}],"sources":[{"report_type":"sandbox","report_id":"6aea6dbf7d4874794f044d22"}]},{"tactic":"Discovery","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"}],"sources":[{"report_type":"sandbox","report_id":"6aea6dbf7d4874794f044d22"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6aea6dbf7d4874794f044d22"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"suspicious","value":"Calls an API that may be used to take screenshots"}],"sources":[{"report_type":"sandbox","report_id":"6aea6dbf7d4874794f044d22"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"6aea6dbf7d4874794f044d22"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Dropped files"}],"sources":[{"report_type":"sandbox","report_id":"6aea6dbf7d4874794f044d22"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"suspicious","value":"Contains ability to open a port and listen for incoming connection"}],"sources":[{"report_type":"sandbox","report_id":"6aea6dbf7d4874794f044d22"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains reference to crypto DLLs"},{"type":"informative","value":"Contains ability to perform encryption (API string)"},{"type":"informative","value":"Able to access crypto-related API (String)"},{"type":"informative","value":"Contains reference to cryptographic keys"}],"sources":[{"report_type":"sandbox","report_id":"6aea6dbf7d4874794f044d22"}]},{"tactic":"Stealth","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Found virtual disk drive like strings"}],"sources":[{"report_type":"sandbox","report_id":"6aea6dbf7d4874794f044d22"}]},{"tactic":"Stealth","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"suspicious","value":"Opens file with deletion access rights"}],"sources":[{"report_type":"sandbox","report_id":"6aea6dbf7d4874794f044d22"}]},{"tactic":"Stealth","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","sources":[{"report_type":"sandbox","report_id":"6aea6dbf7d4874794f044d22"}]},{"tactic":"Stealth","technique":"Reflective Code Loading","attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Loads the CLR Loader DLL"}],"sources":[{"report_type":"sandbox","report_id":"6aea6dbf7d4874794f044d22"}]},{"tactic":"Stealth","technique":"Mutual Exclusion","attack_id":"T1480.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1480/002","identifiers":[{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"6aea6dbf7d4874794f044d22"}]},{"tactic":"Stealth","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Able to load content into memory (.NET)"}],"sources":[{"report_type":"sandbox","report_id":"6aea6dbf7d4874794f044d22"}]},{"tactic":"Stealth","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"6aea6dbf7d4874794f044d22"}]},{"tactic":"Stealth","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"}],"sources":[{"report_type":"sandbox","report_id":"6aea6dbf7d4874794f044d22"}]},{"tactic":"Stealth","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6aea6dbf7d4874794f044d22"}]},{"tactic":"Defense Impairment","technique":"Disable or Modify Tools","attack_id":"T1685","attack_id_wiki":"https://attack.mitre.org/techniques/T1685","identifiers":[{"type":"suspicious","value":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)"},{"type":"informative","value":"Modifies process error mode to suppress error dialogs"}],"sources":[{"report_type":"sandbox","report_id":"6aea6dbf7d4874794f044d22"}]}],"sandbox_signatures":[{"level":"malicious","category":"External Systems","name":"CrowdStrike ML for Portable Executable (On Sensor) detected file with bottom confidence","description":"\"Portable Executable (On Sensor) Model\" detected file as \"dirty\" with \"bottom\" confidence","origin":"Static Analysis","id":"mlmodel-15","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains native function calls (syscalls strings)","description":"$27","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-5000","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains SQL queries","description":"$28","origin":"sample.bin","mitre_attack_id":"T1213","id":"string-16","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aea6dbf7d4874794f044d22"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Found reference to API \"set_UseShellExecute\" (Indicator: \"ShellExecute\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-240","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aea6dbf7d4874794f044d22"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"Found reference to API (Indicator: \"MessageBox\"; Source: \"sample.bin\"), Found reference to API (Indicator: \"CreateDirectory\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-101","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aea6dbf7d4874794f044d22"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \"CreateDirectory\" (Indicator: \"CreateDirectory\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1074.001","id":"string-423","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aea6dbf7d4874794f044d22"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"0.4.2.0\"","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aea6dbf7d4874794f044d22"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"Found reference to \"HashAlgorithm\" (Indicator: \"HashAlgorithm\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1027","id":"string-138","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aea6dbf7d4874794f044d22"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"Found string \"System.Security.Cryptography\" (Indicator: \"System.Security.Cryptography\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1027","id":"string-57","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aea6dbf7d4874794f044d22"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reference explorer.exe process","description":"Found string \"explorer.exe\" (Indicator: \"explorer.exe\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055","id":"string-481","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aea6dbf7d4874794f044d22"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to execute a WMI query","description":"Found string \"INSERT INTO sales SELECT * FROM sales_v1\" (Indicator: \"select * from \"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1047","id":"string-433","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aea6dbf7d4874794f044d22"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to load content into memory (.NET)","description":"Observed namespace \"System.Runtime.InteropServices.Marshal\" and TypeReference \"ReadByte\" in \"RobokassaElba.exe\"\n Observed namespace \"System.Runtime.InteropServices.Marshal\" and TypeReference \"Copy\" in \"RobokassaElba.exe\"","origin":"Static Parser","mitre_attack_id":"T1140","relevance":5,"id":"static-107","sources":[{"report_type":"sandbox","report_id":"6aea6dbf7d4874794f044d22"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found virtual disk drive like strings","description":"Found string - \\\\.\\DISPLAY1; Source: \"00000000-00005548.00000001.248548.03390000.00000004.mdmp, 00000000-00005548.00000002.250469.03390000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-145","sources":[{"report_type":"sandbox","report_id":"6aea6dbf7d4874794f044d22"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Modifies process error mode to suppress error dialogs","description":"\"RobokassaElba.exe\" set its error mode to SEM_NOOPENFILEERRORBOX\n \"RobokassaElba.exe\" set its error mode to SEM_FAILCRITICALERRORS","origin":"API Call","mitre_attack_id":"T1685","relevance":10,"id":"api-38","sources":[{"report_type":"sandbox","report_id":"6aea6dbf7d4874794f044d22"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"\"RobokassaElba.exe\" queried SystemProcessInformation at 00000000-00005548-00000C15-2015314883 [PID: 5548]\n \"RobokassaElba.exe\" queried SystemProcessInformation at 00000000-00005548-00000C15-2015619590 [PID: 5548]\n \"RobokassaElba.exe\" queried SystemProcessInformation at 00000000-00005548-00000C15-2015626115 [PID: 5548]\n \"RobokassaElba.exe\" queried SystemProcessInformation at 00000000-00005548-00000C15-2015862026 [PID: 5548]\n \"RobokassaElba.exe\" queried SystemProcessInformation at 00000000-00005548-00000C15-2015869304 [PID: 5548]\n \"RobokassaElba.exe\" queried SystemProcessInformation at 00000000-00005548-00000C15-2019095636 [PID: 5548]\n \"RobokassaElba.exe\" queried SystemProcessInformation at 00000000-00005548-00000C15-2019102050 [PID: 5548]\n \"RobokassaElba.exe\" queried SystemProcessInformation at 00000000-00005548-00000C15-2019365393 [PID: 5548]\n \"RobokassaElba.exe\" queried SystemProcessInformation at 00000000-00005548-00000C15-2019371891 [PID: 5548]","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"6aea6dbf7d4874794f044d22"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to access crypto-related API (String)","description":"Found reference to API \"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00005548.00000000.246626.03390000.00000004.mdmp, 00000000-00005548.00000001.248548.03390000.00000004.mdmp, 00000000-00005548.00000002.250469.03390000.00000004.mdmp\")\n Found reference to API \"description=\"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\"\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00005548.00000000.246626.03390000.00000004.mdmp, 00000000-00005548.00000001.248548.03390000.00000004.mdmp, 00000000-00005548.00000002.250469.03390000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-920","sources":[{"report_type":"sandbox","report_id":"6aea6dbf7d4874794f044d22"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform crypto operations","description":"Observed namespace \"System.Security.Cryptography\" in [Source: \"RobokassaElba.exe\"]","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-118","sources":[{"report_type":"sandbox","report_id":"6aea6dbf7d4874794f044d22"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform encryption (API string)","description":"Found reference to API \"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00005548.00000000.246626.03390000.00000004.mdmp, 00000000-00005548.00000001.248548.03390000.00000004.mdmp, 00000000-00005548.00000002.250469.03390000.00000004.mdmp\")\n Found reference to API \"description=\"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\"\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00005548.00000000.246626.03390000.00000004.mdmp, 00000000-00005548.00000001.248548.03390000.00000004.mdmp, 00000000-00005548.00000002.250469.03390000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-108","sources":[{"report_type":"sandbox","report_id":"6aea6dbf7d4874794f044d22"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to crypto DLLs","description":"Found string \":\\WINDOWS\\SYSTEM32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00005548.00000000.246626.01070000.00000004.mdmp, 00000000-00005548.00000001.248548.01070000.00000004.mdmp, 00000000-00005548.00000002.250469.01070000.00000004.mdmp, 00000000-00005548.00000003.256611.01070000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-493","sources":[{"report_type":"sandbox","report_id":"6aea6dbf7d4874794f044d22"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to cryptographic keys","description":"Found string \"System.Security.Cryptography.Xml.KeyInfoEncryptedKey, System.Security, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\" (Indicator: \"encryptedkey\"; Source: \"00000000-00005548.00000000.246626.03390000.00000004.mdmp, 00000000-00005548.00000001.248548.03390000.00000004.mdmp, 00000000-00005548.00000002.250469.03390000.00000004.mdmp\")\n Found string \"http://www.w3.org/2001/04/xmlenc# EncryptedKey\" (Indicator: \"encryptedkey\"; Source: \"00000000-00005548.00000000.246626.03390000.00000004.mdmp, 00000000-00005548.00000001.248548.03390000.00000004.mdmp, 00000000-00005548.00000002.250469.03390000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-280","sources":[{"report_type":"sandbox","report_id":"6aea6dbf7d4874794f044d22"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings\n Matched sigs: Contains ability to use Cryptographic classes\n Matched sigs: Contains reference to crypto DLLs\n Matched sigs: Contains ability to perform encryption (API string)\n Matched sigs: Able to access crypto-related API (String)\n Matched sigs: Contains reference to cryptographic keys\n Matched sigs: Reads the cryptographic machine GUID\n Matched sigs: Contains ability to perform crypto operations","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6aea6dbf7d4874794f044d22"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"Found XOR loop in file \"sample.bin\" at offset 6262; code bytes = 8030","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"6aea6dbf7d4874794f044d22"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate system processes using native API","description":"Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00005548-00000C2C-2019014220\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-907","sources":[{"report_type":"sandbox","report_id":"6aea6dbf7d4874794f044d22"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00005548-00000C2C-2019014220\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"6aea6dbf7d4874794f044d22"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCursorPos\" (Indicator: \"GetCursorPos\"; Source: \"00000000-00005548-00000C2C-2023056652\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"6aea6dbf7d4874794f044d22"}]},{"level":"informative","category":"Environment Awareness","name":"Able to list processes on remote desktop session host","description":"Found reference to API \"ProcessIdToSessionId\" (Indicator: \"ProcessIdToSessionId\"; Source: \"00000000-00005548-00000C2C-2022287991\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-906","sources":[{"report_type":"sandbox","report_id":"6aea6dbf7d4874794f044d22"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; Source: \"00000000-00005548-00000C2C-2017112568\")\n Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; Source: \"00000000-00005548-00000C2C-2017113544\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"6aea6dbf7d4874794f044d22"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"$29","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"6aea6dbf7d4874794f044d22"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"RobokassaElba.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00005548)","origin":"API Call","mitre_attack_id":"T1497","relevance":3,"id":"api-296","sources":[{"report_type":"sandbox","report_id":"6aea6dbf7d4874794f044d22"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"RobokassaElba.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00005548)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"6aea6dbf7d4874794f044d22"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"RobokassaElba.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00005548)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"6aea6dbf7d4874794f044d22"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get active windows title","description":"\"RobokassaElba.exe\" called \"GetWindowTextW\" (UID: 00000000-00005548)\n \"RobokassaElba.exe\" called \"GetWindowTextW\" with parameter \"20043e0431043e043a0430044104410430042000380420002e044b0061007300730061002000922120002d043b044c04310430042000b700200014043e0445043e0434044b0420003f043e04200034043d044f043c042000b700200030002e0034002e003200\" - (UID: 00000000-00005548)\n \"RobokassaElba.exe\" called \"GetWindowTextW\" with parameter \"Novella.Today\" - (UID: 00000000-00005548)\n \"RobokassaElba.exe\" called \"GetWindowTextW\" with parameter \"1c04300433043004370438043d0420002f0020004104300439044204\" - (UID: 00000000-00005548)\n \"RobokassaElba.exe\" called \"GetWindowTextW\" with parameter \"11/3/2026\" - (UID: 00000000-00005548)\n \"RobokassaElba.exe\" called \"GetWindowTextW\" with parameter \"1420\" - (UID: 00000000-00005548)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-151","sources":[{"report_type":"sandbox","report_id":"6aea6dbf7d4874794f044d22"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"RobokassaElba.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00005548)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6aea6dbf7d4874794f044d22"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$2a","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6aea6dbf7d4874794f044d22"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"RobokassaElba.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6aea6dbf7d4874794f044d22"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"Found reference to API \"85522233532,7672,109,,GetWindowTextW,user32.dll,\"01:06:49.515\",RX=0,PX=0\" (Indicator: \"GetWindowText\"; Source: \"00000000-00005548.00000003.256611.1BB50000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"6aea6dbf7d4874794f044d22"}]},{"level":"informative","category":"Environment Awareness","name":"Queries the user identity associated with the current process token","description":"\"RobokassaElba.exe\" queried token user identity (UID: 00000000-00005548)","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-328","sources":[{"report_type":"sandbox","report_id":"6aea6dbf7d4874794f044d22"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"$2b","origin":"API Call","mitre_attack_id":"T1082","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"6aea6dbf7d4874794f044d22"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"RobokassaElba.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6aea6dbf7d4874794f044d22"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"RobokassaElba.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"6aea6dbf7d4874794f044d22"}]},{"level":"informative","category":"External Systems","name":"Sample was identified as clean by Antivirus engines","description":"0/26 Antivirus vendors marked sample as clean (0% detection rate)","origin":"External System","relevance":10,"id":"avtest-1","sources":[{"report_type":"sandbox","report_id":"6aea6dbf7d4874794f044d22"}]},{"level":"informative","category":"General","name":"Able to execute application (.NET)","description":"Observed function \"System.Diagnostics.ProcessStartInfo.UseShellExecute\" in \"RobokassaElba.exe\"","origin":"Static Parser","mitre_attack_id":"T1106","relevance":3,"id":"static-108","sources":[{"report_type":"sandbox","report_id":"6aea6dbf7d4874794f044d22"}]},{"level":"informative","category":"General","name":"Able to execute applications using .NET process API","description":"Found string \"ProcessStartInfo\" (Source: \"00000000-00005548.00000000.246626.00AF2000.00000002.mdmp\")\n Found string \"set_UseShellExecute\" (Source: \"00000000-00005548.00000000.246626.00AF2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-934","sources":[{"report_type":"sandbox","report_id":"6aea6dbf7d4874794f044d22"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"\"RobokassaElba.exe\" called \"CreateDirectoryW\" with parameter C:\\Data (UID: 00000000-00005548)\n \"RobokassaElba.exe\" called \"CreateDirectoryW\" with parameter C:\\Data\\Reports (UID: 00000000-00005548)","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"6aea6dbf7d4874794f044d22"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$2c","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"6aea6dbf7d4874794f044d22"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$2d","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6aea6dbf7d4874794f044d22"}]},{"level":"informative","category":"General","name":"Contains ability to start a process (Dotnet)","description":"Observed function \"Process.Start\" in \"RobokassaElba.exe\"","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-111","sources":[{"report_type":"sandbox","report_id":"6aea6dbf7d4874794f044d22"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$2e","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"6aea6dbf7d4874794f044d22"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"Process RobokassaElba.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\SM0:5548:304:WilStaging_02\"\n Process RobokassaElba.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5548:304:WilStaging_02\"\n Process RobokassaElba.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\SM0:5548:120:WilError_03\"\n Process RobokassaElba.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5548:120:WilError_03\"\n Process RobokassaElba.exe created mutex with name \"Local\\SM0:5548:120:WilError_03\"\n Process RobokassaElba.exe created mutex with name \"Local\\SM0:5548:304:WilStaging_02\"\n Process RobokassaElba.exe created mutex with name \"SM0:5548:304:WilStaging_02\"\n Process RobokassaElba.exe created mutex with name \"SM0:5548:120:WilError_03\"","origin":"Created Mutant","mitre_attack_id":"T1480.002","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6aea6dbf7d4874794f044d22"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"$2f","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"6aea6dbf7d4874794f044d22"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"RobokassaElba.exe\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_NO_SEH\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"6aea6dbf7d4874794f044d22"}]},{"level":"informative","category":"General","name":"Found Native API in Dotnet file","description":"$30","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-101","sources":[{"report_type":"sandbox","report_id":"6aea6dbf7d4874794f044d22"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"$31","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"6aea6dbf7d4874794f044d22"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$32","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6aea6dbf7d4874794f044d22"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"RobokassaElba.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\3b9003e4f27d92e40668f0efad11e022\\mscorlib.ni.dll\" at 41880000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-3","sources":[{"report_type":"sandbox","report_id":"6aea6dbf7d4874794f044d22"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"RobokassaElba.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 6E6F0000\n \"RobokassaElba.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 6DB90000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6aea6dbf7d4874794f044d22"}]},{"level":"informative","category":"General","name":"Loads the CLR Loader DLL","description":"\"RobokassaElba.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll\" at 42E40000","origin":"Loaded Module","mitre_attack_id":"T1620","id":"module-7","sources":[{"report_type":"sandbox","report_id":"6aea6dbf7d4874794f044d22"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"RobokassaElba.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 70100000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6aea6dbf7d4874794f044d22"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"19001a000000000020429e6efa7f0000@ntdll.dll\"\n \"220023000000000040429e6efa7f0000@ntdll.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"6aea6dbf7d4874794f044d22"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"RobokassaElba.exe\" was detected as \".NET\" and name: \"Library\"\n \"RobokassaElba.exe\" was detected as \"Microsoft Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6aea6dbf7d4874794f044d22"}]},{"level":"informative","category":"General","name":"PE file contains COM data directory","description":"\"RobokassaElba.exe\" has COM data directory \"IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR\"","origin":"Static Parser","id":"static-144","sources":[{"report_type":"sandbox","report_id":"6aea6dbf7d4874794f044d22"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"RobokassaElba.exe\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"6aea6dbf7d4874794f044d22"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"$33","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"6aea6dbf7d4874794f044d22"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"$34","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6aea6dbf7d4874794f044d22"}]},{"level":"informative","category":"General","name":"References Windows file paths for DLLs (possible dropped files)","description":"$35","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"6aea6dbf7d4874794f044d22"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"RobokassaElba.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"6aea6dbf7d4874794f044d22"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"RobokassaElba.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"6aea6dbf7d4874794f044d22"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"\"income.sqlite3\" has type \"SQLite 3.x database user version 2 (0x2) last written using SQLite version 3034001 file counter 4 database pages 13 cookie 0x6 schema 4 UTF-8 version-valid-for 4\"- Location: [C:\\Data\\income.sqlite3]- [targetUID: 00000000-00005548]\n \"income.sqlite3-journal\" has type \"SQLite Rollback Journal\"- Location: [C:\\Data\\income.sqlite3-journal]- [targetUID: 00000000-00005548]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"6aea6dbf7d4874794f044d22"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$36","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6aea6dbf7d4874794f044d22"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"RobokassaElba.exe\" queries basic process information of the \"C:\\RobokassaElba.exe\" (UID: 5548)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"6aea6dbf7d4874794f044d22"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$37","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6aea6dbf7d4874794f044d22"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"$38","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"6aea6dbf7d4874794f044d22"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Able to identify virtual environment by using API string\n Matched sigs: Able to identify virtual environment by using user activity (API string)\n Matched sigs: Queries process mitigation policy via NtQueryInformationProcess\n Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6aea6dbf7d4874794f044d22"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"\"RobokassaElba.exe\" trying to touch file \"C:\\WINDOWS\\SYSTEM32\\MSCOREE.DLL\"\n \"RobokassaElba.exe\" trying to touch file \"C:\\Windows\\System32\\mscoree.dll\"\n \"RobokassaElba.exe\" trying to touch file \"C:\\WINDOWS\\SYSTEM32\\apphelp.dll\"\n \"RobokassaElba.exe\" trying to touch file \"C:\\Windows\\System32\\apphelp.dll\"\n \"RobokassaElba.exe\" trying to touch file \"C:\\RobokassaElba.exe\"\n \"RobokassaElba.exe\" trying to touch file \"C:\\Windows\\System32\\ntdll.dll\"\n \"RobokassaElba.exe\" trying to touch file \"C:\\Windows\\System32\\kernel32.dll\"\n \"RobokassaElba.exe\" trying to touch file \"C:\\Windows\\System32\\KernelBase.dll\"\n \"RobokassaElba.exe\" trying to touch file \"C:\\Windows\\apppatch\\sysmain.sdb\"\n \"RobokassaElba.exe\" trying to touch file \"C:\\Windows\\apppatch\\MergeSdbFilesSource\\sysMerge.sdb\"\n \"RobokassaElba.exe\" trying to touch file \"C:\\windows\\temp\\VxSSL64.dll\"\n \"RobokassaElba.exe\" trying to touch file \"C:\\FLTLIB.DLL\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6aea6dbf7d4874794f044d22"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$39","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6aea6dbf7d4874794f044d22"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"\"RobokassaElba.exe\" trying to access non-existent file \"C:\\WINDOWS\\SYSTEM32\\MSCOREE.DLL.local\"\n \"RobokassaElba.exe\" trying to access non-existent file \"C:\\RobokassaElba.exe.config\"\n \"RobokassaElba.exe\" trying to access non-existent file \"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\fusion.localgac\"\n \"RobokassaElba.exe\" trying to access non-existent file \"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\RobokassaElba\"\n \"RobokassaElba.exe\" trying to access non-existent file \"C:\\RobokassaElba.INI\"\n \"RobokassaElba.exe\" trying to access non-existent file \"C:\\RobokassaElba.exe.Local\\\"\n \"RobokassaElba.exe\" trying to access non-existent file \"C:\\Windows\\System32\\uxtheme.dll.Config\"\n \"RobokassaElba.exe\" trying to access non-existent file \"C:\\Windows\\SystemResources\\USER32.dll.mun\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6aea6dbf7d4874794f044d22"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"RobokassaElba.exe\" writes file \"c:\\data\\income.sqlite3-journal\"\n \"RobokassaElba.exe\" writes file \"c:\\data\\income.sqlite3\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"6aea6dbf7d4874794f044d22"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$3a","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"6aea6dbf7d4874794f044d22"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$3b","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"6aea6dbf7d4874794f044d22"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"Found string \"+ncalrpc:[OLECB29B7CB38EE08491D5912DDF45D]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00005548.00000001.248548.1BB50000.00000004.mdmp, 00000000-00005548.00000002.250469.1BB50000.00000004.mdmp, 00000000-00005548.00000003.256611.1BB50000.00000004.mdmp\")\n Found string \"F+ncalrpc:[OLECB29B7CB38EE08491D5912DDF45D]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00005548.00000003.256611.1BB50000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"6aea6dbf7d4874794f044d22"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access credential file using Kerberos","description":"Found string \"Kerberos\" (Indicator: \"kerberos\"; Source: \"00000000-00005548.00000001.248548.01070000.00000004.mdmp, 00000000-00005548.00000002.250469.01070000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1558","relevance":1,"id":"string-868","sources":[{"report_type":"sandbox","report_id":"6aea6dbf7d4874794f044d22"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to perform SQL operations","description":"Found string \"System.Data.SqlClient\" (Indicator: \"System.Data.SqlClient\"; Source: \"00000000-00005548.00000000.246626.03390000.00000004.mdmp, 00000000-00005548.00000001.248548.03390000.00000004.mdmp, 00000000-00005548.00000002.250469.03390000.00000004.mdmp\")\n Found string \"\" (Indicator: \"System.Data.SqlClient\"; Source: \"00000000-00005548.00000000.246626.03390000.00000004.mdmp, 00000000-00005548.00000001.248548.03390000.00000004.mdmp, 00000000-00005548.00000002.250469.03390000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1213","relevance":3,"id":"string-836","sources":[{"report_type":"sandbox","report_id":"6aea6dbf7d4874794f044d22"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve information about pressed keystrokes (API string)","description":"Found reference to API \"84069710132,7672,104,,GetKeyState,user32.dll,\"01:06:48.921\",RX=0,PX=0\" (Indicator: \"GetKeyState\"; Source: \"00000000-00005548.00000003.256611.1BB50000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-88","sources":[{"report_type":"sandbox","report_id":"6aea6dbf7d4874794f044d22"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$3c","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"6aea6dbf7d4874794f044d22"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"RobokassaElba.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6aea6dbf7d4874794f044d22"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"RobokassaElba.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"09000000001000000000010000000000fffffeffff7f0000ff0000000000000008000000d8210000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"6aea6dbf7d4874794f044d22"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"$3d","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-131","sources":[{"report_type":"sandbox","report_id":"6aea6dbf7d4874794f044d22"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"$3e","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"6aea6dbf7d4874794f044d22"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"$3f","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"6aea6dbf7d4874794f044d22"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify the user configuration/privilege (API string)","description":"Found reference to API \"85455989034,7672,113,,SystemParametersInfoW,user32.dll,\"01:06:49.500\",RX=0,PX=0\" (Indicator: \"SystemParametersInfo\"; Source: \"00000000-00005548.00000003.256611.1BB50000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1098","relevance":1,"id":"string-132","sources":[{"report_type":"sandbox","report_id":"6aea6dbf7d4874794f044d22"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"RobokassaElba.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"6aea6dbf7d4874794f044d22"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"\"RobokassaElba.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\FONTCACHE\\PARAMETERS\"; Key: \"CLIENTCACHESIZE\"; Value: \"\")","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"6aea6dbf7d4874794f044d22"}]},{"level":"informative","category":"System Security","name":"Writes registry keys","description":"$40","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"6aea6dbf7d4874794f044d22"}]},{"level":"informative","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"Found string \"Rectangle\" (Source: RobokassaElba.exe, API is part of module: GDI32FULL.DLL)\n Found string \"rename\" (Source: RobokassaElba.exe, API is part of module: UCRTBASE_CLR0400.DLL)","origin":"File/Memory","mitre_attack_id":"T1106","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"6aea6dbf7d4874794f044d22"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"RobokassaElba.exe\" was detected as \"Microsoft Visual C# v7.0 / Basic .NET\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"6aea6dbf7d4874794f044d22"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"\"RobokassaElba.exe\" is allocating memory with PAGE_GUARD access rights (Handle: FFFFFFFFFFFFFFFF); (PID: 5548)","origin":"API Call","mitre_attack_id":"T1685","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"6aea6dbf7d4874794f044d22"}]},{"level":"suspicious","category":"Cryptographic Related","name":"Calls an API typically used to acquire handle to a key container within a CSP","description":"\"RobokassaElba.exe\" called \"CryptAcquireContextW\" with parameters {\"phProv\": \"9003120100000000\"\n \"szProvider\": \"Microsoft Enhanced RSA and AES Cryptographic Provider\"\n \"dwProvType\": \"24\"\n \"dwFlags\": \"4026531840\"}","origin":"API Call","mitre_attack_id":"T1027","relevance":1,"id":"api-228","sources":[{"report_type":"sandbox","report_id":"6aea6dbf7d4874794f044d22"}]},{"level":"suspicious","category":"Network Related","name":"Contains ability to open a port and listen for incoming connection","description":"RobokassaElba.Sqlite::sqlite3_bind_null(System.IntPtr,System.Int32) at 333556fc15d2add7a7b9932b32d2a51d-6000083-Sqlite~Query","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1571","relevance":5,"id":"stream-85","sources":[{"report_type":"sandbox","report_id":"6aea6dbf7d4874794f044d22"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API that may be used to take screenshots","description":"\"RobokassaElba.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"73010871\"\n \"cx\": \"1\"\n \"cy\": \"1\"}\n \"RobokassaElba.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"330109c4\"\n \"cx\": \"1\"\n \"cy\": \"1\"}","origin":"API Call","mitre_attack_id":"T1113","relevance":1,"id":"api-105","sources":[{"report_type":"sandbox","report_id":"6aea6dbf7d4874794f044d22"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used for keylogging","description":"\"RobokassaElba.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"1\"}\n \"RobokassaElba.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"2\"}\n \"RobokassaElba.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"4\"}\n \"RobokassaElba.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"5\"}\n \"RobokassaElba.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"6\"}","origin":"API Call","mitre_attack_id":"T1056.001","relevance":5,"id":"api-40","sources":[{"report_type":"sandbox","report_id":"6aea6dbf7d4874794f044d22"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"RobokassaElba.exe\" opened \"C:\\Data\\income.sqlite3-journal\" with delete access","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"6aea6dbf7d4874794f044d22"}]}],"intel_graph":{"map":{"File:8e8656ccc5713ed366fe67751ebb146a4a872d3c792e9406be7e928ebf3e1f81":{"type":"File","value":"8e8656ccc5713ed366fe67751ebb146a4a872d3c792e9406be7e928ebf3e1f81"},"File:8f83c7831903dbca54164d4a5d3957a13f3e840203f39077ec0a551964154eab":{"type":"File","value":"8f83c7831903dbca54164d4a5d3957a13f3e840203f39077ec0a551964154eab"},"File:e2cde75ff9ac1238102d03be0213a839ea0a3778aec2435b4209f042bb1d07e7":{"type":"File","value":"e2cde75ff9ac1238102d03be0213a839ea0a3778aec2435b4209f042bb1d07e7","verdict":{"verdict":"suspicious","verdict_source":"static analysis","reasons":["Associated with known suspicious activity"]},"filetype":"PE32 executable for MS Windows 4.00 (GUI), Intel i386 Mono/.Net assembly, 3 sections","filetype_short":"PE32","mime_type":"application/x-dosexec"}},"chains":[{"id":"1567319203412374679","root":"File:e2cde75ff9ac1238102d03be0213a839ea0a3778aec2435b4209f042bb1d07e7","edges":[],"verdict":{"verdict":"suspicious","verdict_source":"static analysis","reasons":["Associated with known suspicious activity"]}},{"id":"sandbox_files","root":"File:e2cde75ff9ac1238102d03be0213a839ea0a3778aec2435b4209f042bb1d07e7","edges":[{"edge_kind":"extracted","from_key":"File:e2cde75ff9ac1238102d03be0213a839ea0a3778aec2435b4209f042bb1d07e7","to_key":"File:8e8656ccc5713ed366fe67751ebb146a4a872d3c792e9406be7e928ebf3e1f81"},{"edge_kind":"extracted","from_key":"File:e2cde75ff9ac1238102d03be0213a839ea0a3778aec2435b4209f042bb1d07e7","to_key":"File:8f83c7831903dbca54164d4a5d3957a13f3e840203f39077ec0a551964154eab"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}}]}},"activity":{"stats":{"process_count":1,"spawned_processes_count":1,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":8,"imported_dlls_count":65,"dropped_files_count":0,"extracted_files_count":2,"files_written_count":5,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"sample_flags":["Extracted Files"],"sandbox_reports":[{"id":"6aea6dbf7d4874794f044d22","environment_id":140,"environment_description":"Windows 11 64 bit","state":"SUCCESS","verdict":"no specific threat","submit_name":"RobokassaElba.exe","analysis_start_time":"2026-11-03T23:26:56+00:00","indicators_count":{"informative":93,"suspicious":11,"malicious":0},"tags":["Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6aea6dbf7d4874794f044d22"}],"processes":[{"pid":5548,"ppid":0,"name":"RobokassaElba.exe","command_line":"","sha256":"e2cde75ff9ac1238102d03be0213a839ea0a3778aec2435b4209f042bb1d07e7","normalized_path":"C:\\RobokassaElba.exe","uid":"00000000-00005548","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAACKUlEQVR4Xu2WS08TYRSGu+qdYql/QZfEvyVqVYq9ACJewPsFF01YmfR3iFoZ5Y5a66WKmvgzujmec775ZoZz+NJZYEoCkzxp08X7vO+ZTROJk+fYP41aBRq1qSFRgYT+8fDxPO/AT4IL9Pv9oXD0CrRaLWg2mwx9t7+fe/EXTj//g/yG0hLy7BeyB6WnxE8Ye4I8/gFjj4geFB/2YHx5b2CuKuCitETCUMrCQNoLpMUH36B4P0TmSOIXOHDldxQSvvDeVzhF3P3CjC52VY5EFXCdyi41Kx3SRZQufDbcIToDc1UBF+FprdBKuxEhcruDfILCLeTmR5UjiV0gXNk1LHQjwg4LR1mKzH+AkRvErsqRqAKuU8nTFiIrmUCKzO3CyPUdZlCuKuAiulRJSTi3w+Rnt322ID+zpXIksQsEQqQQSO3SbZZZctObkGsg9Q2VI1EFXKeKLs2TkFZaKQs3DCjN1dYhW11jpFCiCrigpfas+Wm70hey1Aiz1feQvYZMvWNkjiR2AVq5bymttFIS+mQqHmQmiVVG5khUAdcryNWNMFhqpbgyUyF86dVVSF95a7jcVkKJKuDCSjP+aQMhS63QSNPlN5C6RLxWOZL4BUjsS9O0MpC2IYXCdLnNQubiK0hdQCZWVI5EFXC9Aj6tkLKYhVa6AskJ4iUkzxukUKIKuDg7v25WlvevTLI0FEY5M+OpHEnsAv+Lo1GgXh3e3/J6FQucPMf++QdaW1M4YcDGqAAAAABJRU5ErkJggg=="}],"all_imported_dlls":["ntdll.dll","cryptsp.dll","msctf.dll","CoreMessaging.dll","win32u.dll","vcruntime140_clr0400.dll","WinTypes.dll","rsaenh.dll","cryptbase.dll","TextInputFramework.dll","kernel32.dll","user32.dll","psapi.dll","combase.dll","uxtheme.dll","clrjit.dll","System.Xml.ni.dll","TextShaping.dll","gdi32.dll","ucrtbase_clr0400.dll","bcryptprimitives.dll","DataExchange.dll","sechost.dll","System.ni.dll","System.Drawing.ni.dll","System.Windows.Forms.ni.dll","DWrite.dll","KernelBase.dll","kernel.appcore.dll","SHCore.dll","clbcatq.dll","mscoree.dll","msvcp140.dll","vcruntime140_1.dll","vcruntime140_1_clr0400.dll","GdiPlus.dll","comctl32.dll","ucrtbase.dll","imm32.dll","version.dll","ole32.dll","gdi32full.dll","vcruntime140.dll","clr.dll","windows.storage.dll","CoreUIComponents.dll","ws2_32.dll","shell32.dll","msvcp_win.dll","oleaut32.dll","System.Core.ni.dll","System.Configuration.ni.dll","twinapi.appcore.dll","rpcrt4.dll","fltLib.dll","advapi32.dll","msvcrt.dll","winsqlite3.dll","bcrypt.dll","mscoreei.dll","profapi.dll","apphelp.dll","VxSSL64.dll","shlwapi.dll","mscorlib.ni.dll"]},"file_activity":{"dropped_files":[],"extracted_files":[{"name":"income.sqlite3","sha256":"8e8656ccc5713ed366fe67751ebb146a4a872d3c792e9406be7e928ebf3e1f81","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aea6dbf7d4874794f044d22"}]},{"name":"income.sqlite3-journal","sha256":"8f83c7831903dbca54164d4a5d3957a13f3e840203f39077ec0a551964154eab","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aea6dbf7d4874794f044d22"}]}],"files_written":[{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"6aea6dbf7d4874794f044d22"}]},{"path":"C:\\Data\\income.sqlite3","sources":[{"report_type":"sandbox","report_id":"6aea6dbf7d4874794f044d22"}]},{"path":"C:\\Data\\income.sqlite3-journal","sources":[{"report_type":"sandbox","report_id":"6aea6dbf7d4874794f044d22"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"6aea6dbf7d4874794f044d22"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"6aea6dbf7d4874794f044d22"}]}],"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5548:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aea6dbf7d4874794f044d22"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5548:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aea6dbf7d4874794f044d22"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5548:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6aea6dbf7d4874794f044d22"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5548:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6aea6dbf7d4874794f044d22"}]},{"name":"Local\\SM0:5548:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6aea6dbf7d4874794f044d22"}]},{"name":"Local\\SM0:5548:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aea6dbf7d4874794f044d22"}]},{"name":"SM0:5548:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aea6dbf7d4874794f044d22"}]},{"name":"SM0:5548:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6aea6dbf7d4874794f044d22"}]}]}},"report_ids":{"sandbox_job_ids":["6aea6dbf7d4874794f044d22"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Sample e2cde75ff9ac… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample e2cde75ff9ac…. Threat score 100/100. 0/27 AV engines flagged this file. 1 malicious and 6 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/e2cde75ff9ac1238102d03be0213a839ea0a3778aec2435b4209f042bb1d07e7"}],["$","meta","4",{"property":"og:title","content":"Malicious Sample e2cde75ff9ac… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample e2cde75ff9ac…. Threat score 100/100. 0/27 AV engines flagged this file. 1 malicious and 6 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/e2cde75ff9ac1238102d03be0213a839ea0a3778aec2435b4209f042bb1d07e7"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Sample e2cde75ff9ac… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample e2cde75ff9ac…. Threat score 100/100. 0/27 AV engines flagged this file. 1 malicious and 6 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L41","11",{}]]