26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 44:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4d0,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win/malicious_confidence_70% Sample e96aed97b899… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample e96aed97b899…. Malware family: Win/malicious_confidence_70%. Threat score 100/100. 2/28 AV engines flagged this file. 11 malicious and 23 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/e96aed97b899d7cfc37b229f045f6b87623f9abd97b15256fa6322685cb2c5f0","keywords":["Malicious","Win/malicious_confidence_70%","malware analysis","sandbox report","threat intelligence","e96aed97b899d7cfc37b229f045f6b87623f9abd97b15256fa6322685cb2c5f0"],"about":{"@type":"SoftwareApplication","name":"Arrival notice.exe","applicationCategory":["peexe","assembly","executable"],"identifier":"e96aed97b899d7cfc37b229f045f6b87623f9abd97b15256fa6322685cb2c5f0","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Win/malicious_confidence_70%","antivirusDetections":{"malicious":2,"total":28},"behavioralIndicators":{"malicious":11,"suspicious":23},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:Tc18,Observed string: "-----BEGIN RSA PRIVATE KEY-----" (Indicator: "private key") in Source: 00000000-00001544.00000000.70129.00400000.00000040.mdmp 00000000-00001544.00000001.72051.00400000.00000040.mdmp 00000000-00001544.00000002.73969.00400000.00000040.mdmp Observed string: "-----END RSA PRIVATE KEY-----" (Indicator: "private key") in Source: 00000000-00001544.00000000.70129.00400000.00000040.mdmp 00000000-00001544.00000001.72051.00400000.00000040.mdmp 00000000-00001544.00000002.73969.00400000.00000040.mdmp Observed string: "-----BEGIN PRIVATE KEY-----" (Indicator: "private key") in Source: 00000000-00001544.00000000.70129.00400000.00000040.mdmp 00000000-00001544.00000001.72051.00400000.00000040.mdmp 00000000-00001544.00000002.73969.00400000.00000040.mdmp Observed string: "-----END PRIVATE KEY-----" (Indicator: "private key") in Source: 00000000-00001544.00000000.70129.00400000.00000040.mdmp 00000000-00001544.00000001.72051.00400000.00000040.mdmp 00000000-00001544.00000002.73969.00400000.00000040.mdmp Observed string: "-----BEGIN ENCRYPTED PRIVATE KEY-----" (Indicator: "private key") in Source: 00000000-00001544.00000000.70129.00400000.00000040.mdmp 00000000-00001544.00000001.72051.00400000.00000040.mdmp 00000000-00001544.00000002.73969.00400000.00000040.mdmp Observed string: "-----END ENCRYPTED PRIVATE KEY-----" (Indicator: "private key") in Source: 00000000-00001544.00000000.70129.00400000.00000040.mdmp 00000000-00001544.00000001.72051.00400000.00000040.mdmp 00000000-00001544.00000002.73969.00400000.00000040.mdmp Observed string: "-----BEGIN EC PRIVATE KEY-----" (Indicator: "private key") in Source: 00000000-00001544.00000000.70129.00400000.00000040.mdmp 00000000-00001544.00000001.72051.00400000.00000040.mdmp 00000000-00001544.00000002.73969.00400000.00000040.mdmp Observed string: "-----END EC PRIVATE KEY-----" (Indicator: "private key") in Source: 00000000-00001544.00000000.70129.00400000.00000040.mdmp 00000000-00001544.00000001.72051.00400000.00000040.mdmp 00000000-00001544.00000002.73969.00400000.00000040.mdmp Observed string: "-----BEGIN DSA PRIVATE KEY-----" (Indicator: "private key") in Source: 00000000-00001544.00000000.70129.00400000.00000040.mdmp 00000000-00001544.00000001.72051.00400000.00000040.mdmp 00000000-00001544.00000002.73969.00400000.00000040.mdmp Observed string: "-----END DSA PRIVATE KEY-----" (Indicator: "private key") in Source: 00000000-00001544.00000000.70129.00400000.00000040.mdmp 00000000-00001544.00000001.72051.00400000.00000040.mdmp 00000000-00001544.00000002.73969.00400000.00000040.mdmp Observed string: "-----BEGIN PUBLIC KEY-----" (Indicator: "public key") in Source: 00000000-00001544.00000000.70129.00400000.00000040.mdmp 00000000-00001544.00000001.72051.00400000.00000040.mdmp 00000000-00001544.00000002.73969.00400000.00000040.mdmp Observed string: "-----END PUBLIC KEY-----" (Indicator: "public key") in Source: 00000000-00001544.00000000.70129.00400000.00000040.mdmp 00000000-00001544.00000001.72051.00400000.00000040.mdmp 00000000-00001544.00000002.73969.00400000.00000040.mdmp28:Ta3c,".exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003880) ".exe" called "RtlGetVersion" (UID: 00000000-00003880) ".exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003880) ".exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000ae3809300010000000000000008000000030093000d62a00fce8df2f000100000000000000020000000c000000409b2f00409b2f003b9b2f000000000084f41e0000002c0038093001c8f31e0090f41e00e8f91e0095e1d17717560700feffffff435cd5775059d57794000000a00000003a9b2f00389b2f00940000006cf51e00fdfe5576280f00001000000014f51e0018f51e00010000001c5cd4772e91ee75ffffffff1a000000f8f41e000400000000000000ffffffff68f51e0039f93a6d0000000078f51e00006b38690100000047f93a6d0300000000000000a0000000 (UID: 00000000-00003880) ".exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000000000000000003d00ca00130200001000000013000000d0333d640000803f000000000000000000000000000000000000803f000000000000000000000000000000000000803f000000000000000000000000000000000000803f74d91e008d2c27640000803f000000000000000000000000000000000000803f000000000000000000000000000000000000803f000000000000000000000000000000000000803f5cda1e005cda1e00d93827640000803f20000000b8d91e0084c5ea69481e3500081e3500140000001500000000000000b0d91e00a617ec69d03df069ecd91e00 (UID: 00000000-00003880)29:T467,Observed string: "GetSystemTimePreciseAsFileTime" (Indicator: "GetSystemTime") in Source: 00000000-00003880-00000C1E-10304012 Observed string: "GetSystemTimePreciseAsFileTime" (Indicator: "GetSystemTime") in Source: 00000000-00001544.00000000.70129.00400000.00000040.mdmp 00000000-00001544.00000001.72051.00400000.00000040.mdmp 00000000-00001544.00000002.73969.00400000.00000040.mdmp Observed string: "GetSystemTimes" (Indicator: "GetSystemTime") in Source: 00000000-00001544.00000000.70129.00400000.00000040.mdmp 00000000-00001544.00000001.72051.00400000.00000040.mdmp 00000000-00001544.00000002.73969.00400000.00000040.mdmp Observed string: "GetLocalTime" (Indicator: "GetLocalTime") in Source: 00000000-00001544.00000000.70129.00400000.00000040.mdmp 00000000-00001544.00000001.72051.00400000.00000040.mdmp 00000000-00001544.00000002.73969.00400000.00000040.mdmp Observed string: "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime") in Source: 00000000-00001544.00000000.70129.00400000.00000040.mdmp 00000000-00001544.00000001.72051.00400000.00000040.mdmp 00000000-00001544.00000002.73969.00400000.00000040.mdmp2a:T66d,Observed string: "GetLocaleInfoEx" [Source: 00000000-00003880-00000C1E-10306150] Observed string: "EnumSystemLocalesEx" [Source: 00000000-00003880-00000C1E-20282078] Observed string: "GetSystemDefaultLCID" [Source: 00000000-00003880-00000C1E-21585408] Observed string: "GetSystemDefaultLCIDW" [Source: 00000000-00003880-00000C1E-21586091] Observed string: "GetLocaleInfoEx" [Source: 00000000-00001544.00000000.70129.00400000.00000040.mdmp 00000000-00001544.00000001.72051.00400000.00000040.mdmp 00000000-00001544.00000002.73969.00400000.00000040.mdmp] Observed string: "EnumSystemLocalesEx" [Source: 00000000-00001544.00000000.70129.00400000.00000040.mdmp 00000000-00001544.00000001.72051.00400000.00000040.mdmp 00000000-00001544.00000002.73969.00400000.00000040.mdmp] Observed string: "GetLocaleInfoA" [Source: 00000000-00001544.00000000.70129.00400000.00000040.mdmp 00000000-00001544.00000001.72051.00400000.00000040.mdmp 00000000-00001544.00000002.73969.00400000.00000040.mdmp] Observed string: "GetLocaleInfoW" [Source: 00000000-00001544.00000000.70129.00400000.00000040.mdmp 00000000-00001544.00000001.72051.00400000.00000040.mdmp 00000000-00001544.00000002.73969.00400000.00000040.mdmp] Observed string: "GetUserDefaultLCID" [Source: 00000000-00001544.00000000.70129.00400000.00000040.mdmp 00000000-00001544.00000001.72051.00400000.00000040.mdmp 00000000-00001544.00000002.73969.00400000.00000040.mdmp] Observed string: "EnumSystemLocalesW" [Source: 00000000-00001544.00000000.70129.00400000.00000040.mdmp 00000000-00001544.00000001.72051.00400000.00000040.mdmp 00000000-00001544.00000002.73969.00400000.00000040.mdmp]2b:T53f,".exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") ".exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "WScript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "WScript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "WScript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LEVELS") "WScript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "DEFAULTLEVEL") "WScript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "SAFERFLAGS") "WScript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "POLICYSCOPE") "WScript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LOGFILENAME") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "oos.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED")2c:T467,Observed string: "GetSystemTimePreciseAsFileTime" (Indicator: "GetSystemTime") in Source: 00000000-00003880-00000C1E-10304012 Observed string: "GetSystemTimePreciseAsFileTime" (Indicator: "GetSystemTime") in Source: 00000000-00001544.00000000.70129.00400000.00000040.mdmp 00000000-00001544.00000001.72051.00400000.00000040.mdmp 00000000-00001544.00000002.73969.00400000.00000040.mdmp Observed string: "GetSystemTimes" (Indicator: "GetSystemTime") in Source: 00000000-00001544.00000000.70129.00400000.00000040.mdmp 00000000-00001544.00000001.72051.00400000.00000040.mdmp 00000000-00001544.00000002.73969.00400000.00000040.mdmp Observed string: "GetLocalTime" (Indicator: "GetLocalTime") in Source: 00000000-00001544.00000000.70129.00400000.00000040.mdmp 00000000-00001544.00000001.72051.00400000.00000040.mdmp 00000000-00001544.00000002.73969.00400000.00000040.mdmp Observed string: "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime") in Source: 00000000-00001544.00000000.70129.00400000.00000040.mdmp 00000000-00001544.00000001.72051.00400000.00000040.mdmp 00000000-00001544.00000002.73969.00400000.00000040.mdmp2d:T70e,"oos.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{90A066FE-591C-47F3-850D-9644B684FBA5}"; Key: "ENABLEDHCP"; Value: "") "oos.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{90A066FE-591C-47F3-850D-9644B684FBA5}"; Key: "REGISTRATIONENABLED"; Value: "") "oos.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{90A066FE-591C-47F3-850D-9644B684FBA5}"; Key: "REGISTERADAPTERNAME"; Value: "") "oos.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{90A066FE-591C-47F3-850D-9644B684FBA5}"; Key: "DOMAIN"; Value: "") "oos.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{90A066FE-591C-47F3-850D-9644B684FBA5}"; Key: "DHCPDOMAIN"; Value: "") "oos.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "oos.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "oos.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "oos.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "oos.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "")2e:T49f,".exe" called "CreateDirectoryW" with parameter C:\Users\%OSUSER% (UID: 00000000-00003880) ".exe" called "CreateDirectoryW" with parameter %USERPROFILE%\AppData\Roaming (UID: 00000000-00003880) ".exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Microsoft\Windows\Caches (UID: 00000000-00004056) "WScript.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Microsoft\Windows\Caches (UID: 00000000-00003596) "oos.exe" called "CreateDirectoryW" with parameter C:\Users\%OSUSER% (UID: 00000000-00003236) "oos.exe" called "CreateDirectoryW" with parameter %USERPROFILE%\AppData\Local (UID: 00000000-00001544) "oos.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files (UID: 00000000-00001544) "oos.exe" called "CreateDirectoryW" (UID: 00000000-00001544) "oos.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Microsoft\Windows\History (UID: 00000000-00001544) "oos.exe" called "CreateDirectoryW" with parameter C:\Users\%OSUSER% (UID: 00000000-00001544) "oos.exe" called "CreateDirectoryW" with parameter %ALLUSERSPROFILE%\remcos (UID: 00000000-00001544)2f:T77b,".exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00003880) ".exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00003880) ".exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00003880) ".exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003880) ".exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003880) ".exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003880) ".exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00003880) ".exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00003880) ".exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00003880) ".exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00003880) ".exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00003880) ".exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00003880) ".exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\WPF\PresentationNative_v0400.dll (UID: 00000000-00003880) ".exe" called "LoadLibrary" with a parameter PresentationNative_v0400.dll (UID: 00000000-00003880) ".exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll (UID: 00000000-00003880) ".exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00003880)30:T695,".exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00003880) ".exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00003880) ".exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00003880) ".exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00003880) ".exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00003880) ".exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00003880) ".exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00003880) ".exe" called "GetProcAddress" with a parameter UrlIsW (UID: 00000000-00003880) ".exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00003880) ".exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00003880) ".exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00003880) ".exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003880) ".exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00003880) ".exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00003880) ".exe" called "GetProcAddress" with a parameter CreateConfigStream_RetAddr (UID: 00000000-00003880) ".exe" called "GetProcAddress" with a parameter CreateConfigStream (UID: 00000000-00003880)31:T663,Observed API string: "CreateThread" [Source: 00000000-00003880-00000C1E-10301702] Observed API string: "CreateThread" [Source: 00000000-00003880-00000C1E-10302316] Observed API string: "CreateThread" [Source: 00000000-00003880-00000C1E-10305551] Observed API string: "GetThreadContext" [Source: 00000000-00003880-00000C1E-14545290] Observed API string: "GetThreadContext" [Source: 00000000-00003880-00000C1E-14548241] Observed API string: "OpenThread" [Source: 00000000-00003880-00000C1E-19613813] Observed API string: "ResumeThread" [Source: 00000000-00003880-00000C1E-27855183] Observed API string: "SetThreadContext" [Source: 00000000-00003880-00000C1E-27883230] Observed API string: "SetThreadContext" [Source: 00000000-00003880-00000C1E-27902653] Observed API string: "CreateThread" [Source: 00000000-00001544.00000000.70129.00400000.00000040.mdmp 00000000-00001544.00000001.72051.00400000.00000040.mdmp 00000000-00001544.00000002.73969.00400000.00000040.mdmp] Observed API string: "ResumeThread" [Source: 00000000-00001544.00000000.70129.00400000.00000040.mdmp 00000000-00001544.00000001.72051.00400000.00000040.mdmp 00000000-00001544.00000002.73969.00400000.00000040.mdmp] Observed API string: "GetThreadContext" [Source: 00000000-00001544.00000000.70129.00400000.00000040.mdmp 00000000-00001544.00000001.72051.00400000.00000040.mdmp 00000000-00001544.00000002.73969.00400000.00000040.mdmp] Observed API string: "SetThreadContext" [Source: 00000000-00001544.00000000.70129.00400000.00000040.mdmp 00000000-00001544.00000001.72051.00400000.00000040.mdmp 00000000-00001544.00000002.73969.00400000.00000040.mdmp]32:T48d,Observed string: "OpenProcessToken" (Indicator: "OpenProcess") in Source: 00000000-00003880-00000C1E-19056254 Observed string: "OpenProcessTokenW" (Indicator: "OpenProcess") in Source: 00000000-00003880-00000C1E-20932651 Observed string: "OpenProcess" (Indicator: "OpenProcess") in Source: 00000000-00003236-00000C1E-26937260 Observed string: "OpenProcessW" (Indicator: "OpenProcess") in Source: 00000000-00003236-00000C1E-26937955 Observed string: "GetProcessHeap" (Indicator: "GetProcessHeap") in Source: 00000000-00001544.00000000.70129.00400000.00000040.mdmp 00000000-00001544.00000001.72051.00400000.00000040.mdmp 00000000-00001544.00000002.73969.00400000.00000040.mdmp Observed string: "OpenProcess" (Indicator: "OpenProcess") in Source: 00000000-00001544.00000000.70129.00400000.00000040.mdmp 00000000-00001544.00000001.72051.00400000.00000040.mdmp 00000000-00001544.00000002.73969.00400000.00000040.mdmp Observed string: "OpenProcessToken" (Indicator: "OpenProcess") in Source: 00000000-00001544.00000000.70129.00400000.00000040.mdmp 00000000-00001544.00000001.72051.00400000.00000040.mdmp 00000000-00001544.00000002.73969.00400000.00000040.mdmp33:T438,Observed string: "EnumServicesStatusW" [Source: 00000000-00001544.00000000.70129.00400000.00000040.mdmp 00000000-00001544.00000001.72051.00400000.00000040.mdmp 00000000-00001544.00000002.73969.00400000.00000040.mdmp] Observed string: "OpenServiceW" [Source: 00000000-00001544.00000000.70129.00400000.00000040.mdmp 00000000-00001544.00000001.72051.00400000.00000040.mdmp 00000000-00001544.00000002.73969.00400000.00000040.mdmp] Observed string: "OpenSCManagerA" [Source: 00000000-00001544.00000000.70129.00400000.00000040.mdmp 00000000-00001544.00000001.72051.00400000.00000040.mdmp 00000000-00001544.00000002.73969.00400000.00000040.mdmp] Observed string: "OpenSCManagerW" [Source: 00000000-00001544.00000000.70129.00400000.00000040.mdmp 00000000-00001544.00000001.72051.00400000.00000040.mdmp 00000000-00001544.00000002.73969.00400000.00000040.mdmp] Observed string: "QueryServiceStatus" [Source: 00000000-00001544.00000000.70129.00400000.00000040.mdmp 00000000-00001544.00000001.72051.00400000.00000040.mdmp 00000000-00001544.00000002.73969.00400000.00000040.mdmp]34:T6f3,".exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2.dll" - [base:0; Status:c0000135] ".exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] ".exe" failed to load missing module "api-ms-win-core-quirks-l1-1-0.dll" - [base:0; Status:c0000135] ".exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] ".exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-0.dll" - [base:0; Status:c0000135] ".exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] ".exe" failed to load missing module "%WINDIR%\system32\combase.dll" - [base:0; Status:c0000135] ".exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] ".exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\ucrtbase_clr0400.dll" - [base:0; Status:c0000135] ".exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\SHLWAPI.dll" - [base:0; Status:c0000135] ".exe" failed to load missing module "api-ms-win-core-datetime-l1-1-1" - [base:0; Status:c0000135] ".exe" failed to load missing module "api-ms-win-core-localization-obsolete-l1-2-0" - [base:0; Status:c0000135] ".exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\WindowsBase\v4.0_4.0.0.0__31bf3856ad364e35\PresentationNative_v0400.dll" - [base:0; Status:c0000135]35:T13337,Found string "connectionId" (Indicator: "connect"; in File: "e96aed97b899d7cfc37b229f045f6b87623f9abd97b15256fa6322685cb2c5f0.bin") Found string "FillRectangle" (Indicator: "FillRect"; in File: "e96aed97b899d7cfc37b229f045f6b87623f9abd97b15256fa6322685cb2c5f0.bin") Found string "connection" (Indicator: "connect"; in File: "e96aed97b899d7cfc37b229f045f6b87623f9abd97b15256fa6322685cb2c5f0.bin") Found string "Sleep" (Indicator: "Sleep"; in File: "e96aed97b899d7cfc37b229f045f6b87623f9abd97b15256fa6322685cb2c5f0.bin") Found string "selected:" (Indicator: "select"; in File: "e96aed97b899d7cfc37b229f045f6b87623f9abd97b15256fa6322685cb2c5f0.bin") Found string "GetConsoleWindow" (Indicator: "GetConsoleWindow"; in Source: "00000000-00001544.00000000.70129.00130000.00000004.mdmp, 00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00130000.00000004.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00130000.00000004.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "selected:" (Indicator: "select"; in Source: "00000000-00001544.00000000.70129.00252000.00000020.mdmp, 00000000-00001544.00000001.72051.00252000.00000020.mdmp, 00000000-00001544.00000002.73969.00252000.00000020.mdmp") Found string "connectionId" (Indicator: "connect"; in Source: "00000000-00001544.00000000.70129.00252000.00000020.mdmp, 00000000-00001544.00000001.72051.00252000.00000020.mdmp, 00000000-00001544.00000002.73969.00252000.00000020.mdmp") Found string "FillRectangle" (Indicator: "FillRect"; in Source: "00000000-00001544.00000000.70129.00252000.00000020.mdmp, 00000000-00001544.00000001.72051.00252000.00000020.mdmp, 00000000-00001544.00000002.73969.00252000.00000020.mdmp") Found string "connection" (Indicator: "connect"; in Source: "00000000-00001544.00000000.70129.00252000.00000020.mdmp, 00000000-00001544.00000000.70129.015B0000.00000004.mdmp, 00000000-00001544.00000001.72051.00252000.00000020.mdmp, 00000000-00001544.00000001.72051.015B0000.00000004.mdmp, 00000000-00001544.00000002.73969.00252000.00000020.mdmp, 00000000-00001544.00000002.73969.015B0000.00000004.mdmp") Found string "Sleep" (Indicator: "Sleep"; in Source: "00000000-00001544.00000000.70129.00252000.00000020.mdmp, 00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00252000.00000020.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00252000.00000020.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "WScript.Sleep 1000" (Indicator: "Sleep"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "DisplayVersion" (Indicator: "DisplayVersion"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "SleepConditionVariableCS" (Indicator: "Sleep"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "WakeAllConditionVariable" (Indicator: "WakeAllConditionVariable"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "not a socket" (Indicator: "socket"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "not connected" (Indicator: "connect"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "already connected" (Indicator: "connect"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "connection aborted" (Indicator: "connect"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "connection already in progress" (Indicator: "connect"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "connection refused" (Indicator: "connect"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "connection reset" (Indicator: "connect"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "FlsGetValue" (Indicator: "FlsGetValue"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "FlsSetValue" (Indicator: "FlsSetValue"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "InitializeCriticalSectionEx" (Indicator: "InitializeCriticalSection"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "CreateThreadpoolTimer" (Indicator: "CreateThread"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "CreateThreadpoolWait" (Indicator: "CreateThread"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "FreeLibraryWhenCallbackReturns" (Indicator: "FreeLibrary"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "GetCurrentProcessorNumber" (Indicator: "GetCurrentProcess"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "GetTickCount64" (Indicator: "GetTickCount"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "GetFileInformationByHandleEx" (Indicator: "GetFileInfo"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "GetSystemTimePreciseAsFileTime" (Indicator: "GetSystemTime"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "AcquireSRWLockExclusive" (Indicator: "AcquireSRWLockExclusive"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "TryAcquireSRWLockExclusive" (Indicator: "AcquireSRWLockExclusive"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "ReleaseSRWLockExclusive" (Indicator: "ReleaseSRWLockExclusive"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "SleepConditionVariableSRW" (Indicator: "Sleep"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "CreateThreadpoolWork" (Indicator: "CreateThread"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "GetLocaleInfoEx" (Indicator: "GetLocaleInfo"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "CorExitProcess" (Indicator: "ExitProcess"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "GetDateFormatEx" (Indicator: "GetDateFormatEx"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "GetTimeFormatEx" (Indicator: "GetTimeFormatEx"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "GetUserDefaultLocaleName" (Indicator: "GetUserDefaultLocaleName"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "IsValidLocaleName" (Indicator: "IsValidLocale"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "LocaleNameToLCID" (Indicator: "LocaleNameToLCID"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "SetFilePointerEx error" (Indicator: "SetFilePointer"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "ReadFile error" (Indicator: "ReadFile"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "SHDeleteKeyW" (Indicator: "SHDeleteKeyW"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "Connection Error: Unable to create socket" (Indicator: "socket"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "Disconnected" (Indicator: "connect"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "GetCursorInfo" (Indicator: "GetCursor"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "GetLastInputInfo" (Indicator: "GetLastInputInfo"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "GetModuleFileNameExA" (Indicator: "GetModuleFileNameExA"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "GetModuleFileNameExW" (Indicator: "GetModuleFileNameExW"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "NtUnmapViewOfSection" (Indicator: "NtUnmapViewOfSection"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "GlobalMemoryStatusEx" (Indicator: "GlobalMemoryStatus"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "IsWow64Process" (Indicator: "IsWow64Process"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "GetComputerNameExW" (Indicator: "GetComputerName"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "SetProcessDEPPolicy" (Indicator: "SetProcessDEPPolicy"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "GetSystemTimes" (Indicator: "GetSystemTime"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "CreateDirectoryW" (Indicator: "CreateDirectoryW"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "WriteFile" (Indicator: "WriteFile"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "CreateFileW" (Indicator: "CreateFileW"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "ExitThread" (Indicator: "ExitThread"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "CloseHandle" (Indicator: "CloseHandle"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "GetModuleFileNameW" (Indicator: "GetModuleFileNameW"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "WaitForSingleObject" (Indicator: "WaitForSingleObject"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "CreateEventW" (Indicator: "CreateEventW"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "SetEvent" (Indicator: "SetEvent"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "CreateThread" (Indicator: "CreateThread"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "GetLocalTime" (Indicator: "GetLocalTime"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "CreateEventA" (Indicator: "CreateEventA"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "HeapCreate" (Indicator: "HeapCreate"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "HeapFree" (Indicator: "HeapFree"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "ReadFile" (Indicator: "ReadFile"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "TerminateProcess" (Indicator: "TerminateProcess"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "CreatePipe" (Indicator: "CreatePipe"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "PeekNamedPipe" (Indicator: "PeekNamedPipe"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "CreateProcessA" (Indicator: "CreateProcessA"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "ExitProcess" (Indicator: "ExitProcess"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "FindFirstFileW" (Indicator: "FindFirstFileW"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "GetFileSizeEx" (Indicator: "GetFileSize"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "FindNextFileW" (Indicator: "FindNextFileW"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "GetDriveTypeA" (Indicator: "GetDriveTypeA"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "lstrlenA" (Indicator: "lstrlenA"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "FindClose" (Indicator: "FindClose"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "GetFileAttributesW" (Indicator: "GetFileAttributesW"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "DeleteFileA" (Indicator: "DeleteFileA"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "DeleteFileW" (Indicator: "DeleteFileW"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "GetLogicalDriveStringsA" (Indicator: "GetLogicalDriveStringsA"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "SetFilePointerEx" (Indicator: "SetFilePointer"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "MoveFileW" (Indicator: "MoveFile"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "RemoveDirectoryW" (Indicator: "RemoveDirectoryW"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "GetModuleHandleA" (Indicator: "GetModuleHandleA"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "SetFileAttributesW" (Indicator: "SetFileAttributesW"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "GetLastError" (Indicator: "GetLastError"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "TerminateThread" (Indicator: "TerminateThread"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "GetFileSize" (Indicator: "GetFileSize"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "FindFirstFileA" (Indicator: "FindFirstFileA"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "FindNextFileA" (Indicator: "FindNextFileA"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "ExpandEnvironmentStringsA" (Indicator: "ExpandEnvironmentStringsA"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "GetLongPathNameW" (Indicator: "GetLongPathNameW"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "CopyFileW" (Indicator: "CopyFileW"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "CreateMutexA" (Indicator: "CreateMutexA"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "GetLocaleInfoA" (Indicator: "GetLocaleInfo"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "OpenMutexA" (Indicator: "OpenMutexA"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "Process32NextW" (Indicator: "Process32Next"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "Process32FirstW" (Indicator: "Process32First"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "VirtualProtect" (Indicator: "VirtualProtect"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "SetLastError" (Indicator: "SetLastError"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "VirtualFree" (Indicator: "VirtualFree"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "VirtualAlloc" (Indicator: "VirtualAlloc"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "LoadLibraryA" (Indicator: "LoadLibraryA"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "GetNativeSystemInfo" (Indicator: "GetNativeSystemInfo"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "HeapAlloc" (Indicator: "HeapAlloc"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "GetProcAddress" (Indicator: "GetProcAddress"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "GetProcessHeap" (Indicator: "GetProcessHeap"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "FreeLibrary" (Indicator: "FreeLibrary"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "IsBadReadPtr" (Indicator: "IsBadReadPtr"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "GetTempPathW" (Indicator: "GetTempPathW"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "OpenProcess" (Indicator: "OpenProcess"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "lstrcatW" (Indicator: "lstrcat"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "GetTempFileNameW" (Indicator: "GetTempFileNameW"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "GetCurrentProcess" (Indicator: "GetCurrentProcess"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "GetSystemDirectoryA" (Indicator: "GetSystemDirectoryA"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "GlobalAlloc" (Indicator: "GlobalAlloc"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "GlobalLock" (Indicator: "GlobalLock"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "GetTickCount" (Indicator: "GetTickCount"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "GlobalUnlock" (Indicator: "GlobalUnlock"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "WriteProcessMemory" (Indicator: "WriteProcessMemory"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "ResumeThread" (Indicator: "ResumeThread"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "GetThreadContext" (Indicator: "GetThreadContext"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "VirtualAllocEx" (Indicator: "VirtualAlloc"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "ReadProcessMemory" (Indicator: "ReadProcessMemory"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "CreateProcessW" (Indicator: "CreateProcessW"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "SetThreadContext" (Indicator: "SetThreadContext"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "LocalAlloc" (Indicator: "LocalAlloc"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "GlobalFree" (Indicator: "GlobalFree"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "MulDiv" (Indicator: "MulDiv"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "SizeofResource" (Indicator: "SizeofResource"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "SetFilePointer" (Indicator: "SetFilePointer"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "FindResourceA" (Indicator: "FindResourceA"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "LockResource" (Indicator: "LockResource"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "LoadResource" (Indicator: "LoadResource"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "LocalFree" (Indicator: "LocalFree"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "FormatMessageA" (Indicator: "FormatMessageA"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "GetModuleFileNameA" (Indicator: "GetModuleFileNameA"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "lstrcpynA" (Indicator: "lstrcpynA"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "AllocConsole" (Indicator: "AllocConsole"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "EnterCriticalSection" (Indicator: "EnterCriticalSection"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "LeaveCriticalSection" (Indicator: "LeaveCriticalSection"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "InitializeCriticalSection" (Indicator: "InitializeCriticalSection"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "DeleteCriticalSection" (Indicator: "DeleteCriticalSection"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "TranslateMessage" (Indicator: "TranslateMessage"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "DispatchMessageA" (Indicator: "DispatchMessageA"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "GetMessageA" (Indicator: "GetMessageA"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "GetWindowTextW" (Indicator: "GetWindow"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "wsprintfW" (Indicator: "wsprintfW"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "GetClipboardData" (Indicator: "GetClipboardData"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "UnhookWindowsHookEx" (Indicator: "UnhookWindowsHookEx"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "GetForegroundWindow" (Indicator: "GetForegroundWindow"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "ToUnicodeEx" (Indicator: "ToUnicodeEx"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "GetKeyboardLayout" (Indicator: "GetKeyboardLayout"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "SetWindowsHookExA" (Indicator: "SetWindowsHookExA"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "CloseClipboard" (Indicator: "CloseClipboard"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "OpenClipboard" (Indicator: "OpenClipboard"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "GetKeyboardState" (Indicator: "GetKeyboardState"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "CallNextHookEx" (Indicator: "CallNextHookEx"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "GetKeyboardLayoutNameA" (Indicator: "GetKeyboardLayout"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "GetKeyState" (Indicator: "GetKeyState"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "GetWindowTextLengthW" (Indicator: "GetWindow"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "GetWindowThreadProcessId" (Indicator: "GetWindow"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "SetForegroundWindow" (Indicator: "SetForegroundWindow"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "SetClipboardData" (Indicator: "SetClipboardData"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "EnumWindows" (Indicator: "EnumWindows"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "ExitWindowsEx" (Indicator: "ExitWindowsEx"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "EmptyClipboard" (Indicator: "EmptyClipboard"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "ShowWindow" (Indicator: "ShowWindow"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "SetWindowTextW" (Indicator: "SetWindowTextW"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "MessageBoxW" (Indicator: "MessageBoxW"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "IsWindowVisible" (Indicator: "IsWindow"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "CloseWindow" (Indicator: "CloseWindow"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "SendInput" (Indicator: "SendInput"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "DrawIcon" (Indicator: "DrawIcon"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "GetSystemMetrics" (Indicator: "GetSystemMetrics"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "GetIconInfo" (Indicator: "GetIconInfo"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "SystemParametersInfoW" (Indicator: "SystemParametersInfoW"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "GetCursorPos" (Indicator: "GetCursor"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "RegisterClassExA" (Indicator: "RegisterClassExA"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "AppendMenuA" (Indicator: "AppendMenuA"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "CreateWindowExA" (Indicator: "CreateWindowExA"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "DefWindowProcA" (Indicator: "DefWindowProcA"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "TrackPopupMenu" (Indicator: "TrackPopupMenu"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "CreatePopupMenu" (Indicator: "CreatePopupMenu"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "GetObjectA" (Indicator: "GetObjectA"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "CreateDCA" (Indicator: "CreateDCA"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "DeleteObject" (Indicator: "DeleteObject"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "DeleteDC" (Indicator: "DeleteDC"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "GetDIBits" (Indicator: "GetDIBits"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "StretchBlt" (Indicator: "StretchBlt"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "SelectObject" (Indicator: "SelectObject"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "CreateCompatibleBitmap" (Indicator: "CreateCompatibleBitmap"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "RegDeleteKeyA" (Indicator: "RegDeleteKeyA"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "RegQueryValueExW" (Indicator: "RegQueryValueExW"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "RegEnumValueW" (Indicator: "RegEnumValueW"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "RegDeleteValueW" (Indicator: "RegDeleteValueW"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "RegCreateKeyW" (Indicator: "RegCreateKeyW"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "RegOpenKeyExW" (Indicator: "RegOpenKeyExW"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "RegOpenKeyExA" (Indicator: "RegOpenKeyExA"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "RegSetValueExA" (Indicator: "RegSetValueExA"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "RegSetValueExW" (Indicator: "RegSetValueExW"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "RegEnumKeyExW" (Indicator: "RegEnumKeyExW"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "RegCreateKeyExW" (Indicator: "RegCreateKeyExW"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "RegQueryValueExA" (Indicator: "RegQueryValueExA"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "RegQueryInfoKeyW" (Indicator: "RegQueryInfoKeyW"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "RegCloseKey" (Indicator: "RegCloseKey"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "RegCreateKeyA" (Indicator: "RegCreateKeyA"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "OpenProcessToken" (Indicator: "OpenProcess"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "LookupPrivilegeValueA" (Indicator: "LookupPrivilegeValueA"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "EnumServicesStatusW" (Indicator: "EnumServicesStatus"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "OpenServiceW" (Indicator: "OpenService"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "ChangeServiceConfigW" (Indicator: "ChangeServiceConfigW"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "QueryServiceConfigW" (Indicator: "QueryServiceConfigW"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "StartServiceW" (Indicator: "StartServiceW"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "ControlService" (Indicator: "ControlService"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "OpenSCManagerA" (Indicator: "OpenSCManager"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "OpenSCManagerW" (Indicator: "OpenSCManager"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "CloseServiceHandle" (Indicator: "CloseServiceHandle"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "QueryServiceStatus" (Indicator: "QueryServiceStatus"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "RegEnumKeyExA" (Indicator: "RegEnumKeyExA"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "GetUserNameW" (Indicator: "GetUserName"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "CryptReleaseContext" (Indicator: "CryptReleaseContext"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "CryptGenRandom" (Indicator: "CryptGenRandom"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "CryptAcquireContextA" (Indicator: "CryptAcquireContextA"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "ShellExecuteW" (Indicator: "ShellExecuteW"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "ShellExecuteExA" (Indicator: "ShellExecuteExA"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "Shell_NotifyIconA" (Indicator: "Shell_NotifyIconA"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "ExtractIconA" (Indicator: "ExtractIconA"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "StrToIntA" (Indicator: "StrToIntA"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "PathFileExistsW" (Indicator: "PathFileExistsW"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "PathFileExistsA" (Indicator: "PathFileExistsA"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "URLDownloadToFileW" (Indicator: "URLDownloadToFile"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "URLOpenBlockingStreamW" (Indicator: "URLOpenBlockingStream"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "InternetOpenUrlW" (Indicator: "InternetOpenUrlW"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "InternetOpenW" (Indicator: "InternetOpenW"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "InternetCloseHandle" (Indicator: "CloseHandle"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "InternetReadFile" (Indicator: "InternetReadFile"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "ResetEvent" (Indicator: "ResetEvent"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "GetModuleHandleW" (Indicator: "GetModuleHandleW"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "IsDebuggerPresent" (Indicator: "IsDebuggerPresent"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "UnhandledExceptionFilter" (Indicator: "UnhandledExceptionFilter"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "SetUnhandledExceptionFilter" (Indicator: "SetUnhandledExceptionFilter"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "GetStartupInfoW" (Indicator: "GetStartupInfoW"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "IsProcessorFeaturePresent" (Indicator: "IsProcessorFeaturePresent"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "GetCurrentThreadId" (Indicator: "GetCurrentThread"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "InitializeSListHead" (Indicator: "InitializeSListHead"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "WideCharToMultiByte" (Indicator: "WideCharToMultiByte"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "EncodePointer" (Indicator: "EncodePointer"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "DecodePointer" (Indicator: "DecodePointer"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "MultiByteToWideChar" (Indicator: "MultiByteToWideChar"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "InitializeCriticalSectionAndSpinCount" (Indicator: "InitializeCriticalSection"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "TlsAlloc" (Indicator: "TlsAlloc"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "TlsGetValue" (Indicator: "TlsGetValue"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "TlsSetValue" (Indicator: "TlsSetValue"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "TlsFree" (Indicator: "TlsFree"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "CompareStringW" (Indicator: "CompareStringW"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "LCMapStringW" (Indicator: "LCMapStringW"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "GetStringTypeW" (Indicator: "GetStringTypeW"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "GetCPInfo" (Indicator: "GetCPInfo"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "LoadLibraryExW" (Indicator: "LoadLibraryExW"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "RaiseException" (Indicator: "RaiseException"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "RtlUnwind" (Indicator: "RtlUnwind"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "MoveFileExW" (Indicator: "MoveFile"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "GetModuleHandleExW" (Indicator: "GetModuleHandleExW"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "GetStdHandle" (Indicator: "GetStdHandle"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "GetACP" (Indicator: "GetACP"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "HeapReAlloc" (Indicator: "HeapReAlloc"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "GetDateFormatW" (Indicator: "GetDateFormatW"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "GetTimeFormatW" (Indicator: "GetTimeFormatW"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "IsValidLocale" (Indicator: "IsValidLocale"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "GetUserDefaultLCID" (Indicator: "GetUserDefaultLCID"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "EnumSystemLocalesW" (Indicator: "EnumSystemLocalesW"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "GetTimeZoneInformation" (Indicator: "GetTimeZoneInformation"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "GetFileType" (Indicator: "GetFileType"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "FlushFileBuffers" (Indicator: "FlushFileBuffers"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "GetConsoleCP" (Indicator: "GetConsoleCP"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "GetConsoleMode" (Indicator: "GetConsoleMode"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "ReadConsoleW" (Indicator: "ReadConsoleW"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "FindFirstFileExA" (Indicator: "FindFirstFileExA"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "IsValidCodePage" (Indicator: "IsValidCodePage"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "GetOEMCP" (Indicator: "GetOEMCP"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "GetCommandLineA" (Indicator: "GetCommandLineA"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "GetCommandLineW" (Indicator: "GetCommandLineW"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "FreeEnvironmentStringsW" (Indicator: "FreeEnvironmentStringsW"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "SetEnvironmentVariableA" (Indicator: "SetEnvironmentVariableA"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "SetEnvironmentVariableW" (Indicator: "SetEnvironmentVariableW"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "SetStdHandle" (Indicator: "SetStdHandle"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "WriteConsoleW" (Indicator: "WriteConsoleW"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "HeapSize" (Indicator: "HeapSize"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "SetEndOfFile" (Indicator: "SetEndOfFile"; in Source: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") Found string "3121,,CreateDirectoryW,kerne" (Indicator: "CreateDirectoryW"; in Source: "00000000-00001544.00000000.70129.0061C000.00000004.mdmp, 00000000-00001544.00000001.72051.00654000.00000004.mdmp, 00000000-00001544.00000002.73969.00654000.00000004.mdmp") Found string "57731889598,692,3121,,CreateDirectoryW,kernel32.dll,"252:05:15.375",RX=0,PX=0" (Indicator: "CreateDirectoryW"; in Source: "00000000-00001544.00000001.72051.0065F000.00000004.mdmp, 00000000-00001544.00000002.73969.0065F000.00000004.mdmp") Found string "84546365299,692,3121,,CreateDirectoryW,kernel32.dll,"252:05:45.375",RX=0,PX=0" (Indicator: "CreateDirectoryW"; in Source: "00000000-00001544.00000002.73969.00654000.00000004.mdmp") Found string "selected:" (Indicator: "select"; in Source: "00000000-00002460.00000000.70120.00252000.00000020.mdmp, 00000000-00002460.00000000.70124.00252000.00000020.mdmp") Found string "connectionId" (Indicator: "connect"; in Source: "00000000-00002460.00000000.70120.00252000.00000020.mdmp, 00000000-00002460.00000000.70124.00252000.00000020.mdmp") Found string "FillRectangle" (Indicator: "FillRect"; in Source: "00000000-00002460.00000000.70120.00252000.00000020.mdmp, 00000000-00002460.00000000.70124.00252000.00000020.mdmp") Found string "connection" (Indicator: "connect"; in Source: "00000000-00002460.00000000.70120.00252000.00000020.mdmp, 00000000-00002460.00000000.70124.00252000.00000020.mdmp") Found string "Sleep" (Indicator: "Sleep"; in Source: "00000000-00002460.00000000.70120.00252000.00000020.mdmp, 00000000-00002460.00000000.70124.00252000.00000020.mdmp") Found string "Sleep" (Indicator: "Sleep"; in Source: "00000000-00003236.00000000.68539.00210000.00000004.mdmp, 00000000-00003236.00000000.68539.00252000.00000020.mdmp, 00000000-00003236.00000000.68539.01B70000.00000004.mdmp, 00000000-00003236.00000001.69833.00210000.00000004.mdmp, 00000000-00003236.00000001.69833.00252000.00000020.mdmp, 00000000-00003236.00000001.69833.01910000.00000004.mdmp") Found string "selected:" (Indicator: "select"; in Source: "00000000-00003236.00000000.68539.00252000.00000020.mdmp, 00000000-00003236.00000001.69833.00252000.00000020.mdmp") Found string "connectionId" (Indicator: "connect"; in Source: "00000000-00003236.00000000.68539.00252000.00000020.mdmp, 00000000-00003236.00000001.69833.00252000.00000020.mdmp") Found string "FillRectangle" (Indicator: "FillRect"; in Source: "00000000-00003236.00000000.68539.00252000.00000020.mdmp, 00000000-00003236.00000001.69833.00252000.00000020.mdmp") Found string "connection" (Indicator: "connect"; in Source: "00000000-00003236.00000000.68539.00252000.00000020.mdmp, 00000000-00003236.00000001.69833.00252000.00000020.mdmp")36:T45c,".exe" loaded module "ADVAPI32.DLL" at base 763a0000 ".exe" loaded module "SHLWAPI.DLL" at base 778d0000 ".exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 0 ".exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 ".exe" loaded module "KERNEL32" at base 76510000 ".exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 73350000 ".exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 0 ".exe" loaded module "KERNEL32.DLL" at base 76510000 ".exe" loaded module "OLE32.DLL" at base 77ba0000 ".exe" loaded module "CRYPTBASE.DLL" at base 75b00000 ".exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 74640000 ".exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 75ee0000 ".exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\WPF\PRESENTATIONNATIVE_V0400.DLL" at base 64180000 ".exe" loaded module "PRESENTATIONNATIVE_V0400.DLL" at base 6418000037:T9db,".exe" touched "Computer" (Path: "HKCU\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") ".exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}") ".exe" touched "UsersFiles" (Path: "HKCU\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\SHELLFOLDER") ".exe" touched "Property System Both Class Factory" (Path: "HKCU\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}") ".exe" touched "delegate folder that appears in Users Files Folder" (Path: "HKCU\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\SHELLFOLDER") ".exe" touched "Shell File System Folder" (Path: "HKCU\CLSID\{0E5AAE11-A475-4C5B-AB00-C66DE400274E}\INPROCSERVER32") ".exe" touched "Security Manager" (Path: "HKCU\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\TREATAS") "WScript.exe" touched "Network" (Path: "HKCU\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\SHELLFOLDER") "WScript.exe" touched "Recycle Bin" (Path: "HKCU\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\SHELLFOLDER") "WScript.exe" touched "Control Panel" (Path: "HKCU\CLSID\{26EE0668-A00A-44D7-9371-BEB064C98683}\SHELLFOLDER") "WScript.exe" touched "UsersLibraries" (Path: "HKCU\CLSID\{031E4825-7B94-4DC3-B131-E946B44C8DD5}\SHELLFOLDER") "WScript.exe" touched "CLSID_SearchFolder" (Path: "HKCU\CLSID\{04731B67-D933-450A-90E6-4ACD2E9408FE}\SHELLFOLDER") "WScript.exe" touched "Microsoft OneNote Namespace Extension for Windows Desktop Search" (Path: "HKCU\CLSID\{0875DCB6-C686-4243-9432-ADCCF0B9F2D7}\SHELLFOLDER") "WScript.exe" touched "IE History and Feeds Shell Data Source for Windows Search" (Path: "HKCU\CLSID\{11016101-E366-4D22-BC06-4ADA335C892B}\SHELLFOLDER") "WScript.exe" touched "@C:\Program Files (x86)\Microsoft Office\Office15\MAPISHELL.DLL,-110" (Path: "HKCU\CLSID\{138508BC-1E03-49EA-9C8F-EA9E1D05D65D}\SHELLFOLDER") "WScript.exe" touched "Public Folder" (Path: "HKCU\CLSID\{4336A54D-038B-4685-AB02-99BB52D3FB8B}\SHELLFOLDER") "WScript.exe" touched "Control Panel command object for Start menu and desktop" (Path: "HKCU\CLSID\{5399E694-6CE5-4D6C-8FCE-1D8870FDCBA0}\SHELLFOLDER") "WScript.exe" touched "@%systemroot%\system32\mssvp.dll,-110" (Path: "HKCU\CLSID\{89D83576-6BD1-4C86-9454-BEB04E94C819}\SHELLFOLDER") "WScript.exe" touched "DXP" (Path: "HKCU\CLSID\{8FD8B88D-30E1-4F25-AC2B-553D3D65F0EA}\SHELLFOLDER") "WScript.exe" touched "CLSID_SearchHome" (Path: "HKCU\CLSID\{9343812E-1C37-4A49-A12E-4B2D810D956B}\SHELLFOLDER")38:T947,"e96aed97b899d7cfc37b229f045f6b87623f9abd97b15256fa6322685cb2c5f0.bin" file has an entrypoint instructions - "jmp dword ptr [0x402000],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al," "oos.exe" file has an entrypoint instructions - "jmp dword ptr [0x402000],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,"39:T595,".exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") ".exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") ".exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") ".exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN") ".exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN") "WScript.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "WScript.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "WScript.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "cmd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "cmd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "cmd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "oos.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "oos.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "oos.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "oos.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN") "oos.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN")3a:T6b0,".exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll" ".exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll" ".exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll" ".exe" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\clr.dll" ".exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll" ".exe" touched file "C:\Windows\System32\en\WScript.exe.mui" ".exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches" ".exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches" "WScript.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches" "WScript.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches" "cmd.exe" touched file "C:\Windows\AppPatch\sysmain.sdb" "oos.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll" "oos.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll" "oos.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll" "oos.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll" "oos.exe" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\clr.dll" "oos.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat" "oos.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files" "oos.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Cookies" "oos.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\History"3b:T66a,".exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-fibers-l1-1-1.DLL" ".exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-localization-l1-2-1.DLL" ".exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-appmodel-runtime-l1-1-0.dll" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" ".exe" trying to access non-existent file "C:\Windows\system32\combase.dll" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ole32.dll" ".exe" trying to access non-existent file "C:\CRYPTSP.dll" ".exe" trying to access non-existent file "C:\Windows\Microsoft.Net\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\ucrtbase_clr0400.dll" ".exe" trying to access non-existent file "C:\Windows\Microsoft.Net\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\SHLWAPI.dll" ".exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-datetime-l1-1-1.DLL" ".exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-localization-obsolete-l1-2-0.DLL" ".exe" trying to access non-existent file "C:\Windows\Microsoft.Net\assembly\GAC_MSIL\WindowsBase\v4.0_4.0.0.0__31bf3856ad364e35\PresentationNative_v0400.dll" ".exe" trying to access non-existent file "C:\Windows\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll"3c:T634,".exe" trying to access non-existent file "C:\Windows\SYSTEM32\MSCOREE.DLL.local" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\fusion.localgac" ".exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_32\kCkguPX\" ".exe" trying to access non-existent file "C:\e96aed97b899d7cfc37b229f045f6b87623f9abd97b15256fa6322685cb2c5f0.INI" ".exe" trying to access non-existent file "C:\e96aed97b899d7cfc37b229f045f6b87623f9abd97b15256fa6322685cb2c5f0.exe.Local\" ".exe" trying to access non-existent file "C:\E96AED97B899D7CFC37B229F045F6B87623F9ABD97B15256FA6322685CB2C5F0.EXE.CONFIG" ".exe" trying to access non-existent file "C:\e96aed97b899d7cfc37b229f045f6b87623f9abd97b15256fa6322685cb2c5f0.exe:Zone.Identifier" ".exe" trying to access non-existent file "C:\Windows\System32\MSCOREE.DLL.LOCAL" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\FUSION.LOCALGAC" ".exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_32\KCKGUPX" ".exe" trying to access non-existent file "C:\E96AED97B899D7CFC37B229F045F6B87623F9ABD97B15256FA6322685CB2C5F0.INI" ".exe" trying to access non-existent file "C:\Windows\assembly\GAC\PUBLISHERPOLICY.TME" ".exe" trying to access non-existent file "C:\E96AED97B899D7CFC37B229F045F6B87623F9ABD97B15256FA6322685CB2C5F0.EXE.LOCAL"3d:T6a7a,Pattern match: "http://schemas.microsoft.com/winfx/2006/xaml" Pattern match: "http://schemas.openxmlformats.org/markup-compatibility/2006" Heuristic match: "p:yZ.gE" Heuristic match: ".exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00003880) ".exe" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00003880) ".exe" called "FindNextFileW" with parameter sbs_diasymreader.dll (UID: 00000000-00003880) ".exe" called "FindNextFileW" with parameter sbs_microsoft.jscript.dll (UID: 00000000-00003880) ".exe" called "FindNextFileW" with parameter sbs_microsoft.vsa.vb.codedomprocessor.dll (UID: 00000000-00003880) ".exe" called "FindNextFileW" with parameter sbs_mscorrc.dll (UID: 00000000-00003880) ".exe" called "FindNextFileW" with parameter sbs_system.configuration.install.dll (UID: 00000000-00003880) ".exe" called "FindNextFileW" with parameter v1.0.3705 (UID: 00000000-00003880) ".exe" called "FindNextFileW" with parameter v1.1.4322 (UID: 00000000-00003880) ".exe" called "FindNextFileW" with parameter v2.0.50727 (UID: 00000000-00003880) ".exe" called "FindNextFileW" with parameter v3.0 (UID: 00000000-00003880) ".exe" called "FindNextFileW" with parameter v3.5 (UID: 00000000-00003880) ".exe" called "FindNextFileW" with parameter v4.0.30319 (UID: 00000000-00003880) ".exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\* (UID: 00000000-00003880) ".exe" called "FindNextFileW" with parameter .. (UID: 00000000-00003880) ".exe" called "FindNextFileW" with parameter 36eaccfde177c2e7b93b8dbdde4e012a (UID: 00000000-00003880) ".exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\kCkguPX\* (UID: 00000000-00003880) ".exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Presentatio5ae0f00f#\* (UID: 00000000-00003880)3f:Ta5a,Observed string: "RegOpenKeyExW" (Indicator: "RegOpenKey") in Source: 00000000-00003880-00000C1E-9135650 Observed string: "RegQueryValueEx" (Indicator: "RegQueryValue") in Source: 00000000-00003880-00000C1E-10742431 Observed string: "RegQueryValueExW" (Indicator: "RegQueryValue") in Source: 00000000-00003880-00000C1E-10742610 Observed string: "RegOpenKeyEx" (Indicator: "RegOpenKey") in Source: 00000000-00003880-00000C1E-20638294 Observed string: "RegGetValueW" (Indicator: "RegGetValue") in Source: 00000000-00004056-00000C1E-30701546 Observed string: "RegOpenKeyW" (Indicator: "RegOpenKey") in Source: 00000000-00003596-00000C1E-32250572 Observed string: "RegQueryValueW" (Indicator: "RegQueryValue") in Source: 00000000-00003596-00000C1E-32252909 Observed string: "RegEnumKeyExW" (Indicator: "RegEnumKey") in Source: 00000000-00003236-00000C1E-34288179 Observed string: "RegGetValueA" (Indicator: "RegGetValue") in Source: 00000000-00001544-00000C1E-28507201 Observed string: "RegOpenKeyExA" (Indicator: "RegOpenKey") in Source: 00000000-00001544-00000C1E-28534645 Observed string: "RegQueryValueExA" (Indicator: "RegQueryValue") in Source: 00000000-00001544-00000C1E-45195986 Observed string: "RegQueryValueExW" (Indicator: "RegQueryValue") in Source: 00000000-00001544.00000000.70129.00400000.00000040.mdmp 00000000-00001544.00000001.72051.00400000.00000040.mdmp 00000000-00001544.00000002.73969.00400000.00000040.mdmp Observed string: "RegOpenKeyExW" (Indicator: "RegOpenKey") in Source: 00000000-00001544.00000000.70129.00400000.00000040.mdmp 00000000-00001544.00000001.72051.00400000.00000040.mdmp 00000000-00001544.00000002.73969.00400000.00000040.mdmp Observed string: "RegOpenKeyExA" (Indicator: "RegOpenKey") in Source: 00000000-00001544.00000000.70129.00400000.00000040.mdmp 00000000-00001544.00000001.72051.00400000.00000040.mdmp 00000000-00001544.00000002.73969.00400000.00000040.mdmp Observed string: "RegEnumKeyExW" (Indicator: "RegEnumKey") in Source: 00000000-00001544.00000000.70129.00400000.00000040.mdmp 00000000-00001544.00000001.72051.00400000.00000040.mdmp 00000000-00001544.00000002.73969.00400000.00000040.mdmp Observed string: "RegQueryValueExA" (Indicator: "RegQueryValue") in Source: 00000000-00001544.00000000.70129.00400000.00000040.mdmp 00000000-00001544.00000001.72051.00400000.00000040.mdmp 00000000-00001544.00000002.73969.00400000.00000040.mdmp Observed string: "RegEnumKeyExA" (Indicator: "RegEnumKey") in Source: 00000000-00001544.00000000.70129.00400000.00000040.mdmp 00000000-00001544.00000001.72051.00400000.00000040.mdmp 00000000-00001544.00000002.73969.00400000.00000040.mdmp40:T77f,Observed string: "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfo") in Source: 00000000-00003880-00000C1E-18695156 Observed string: "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfoSize") in Source: 00000000-00003880-00000C1E-18695156 Observed string: "GetFileVersionInfoW" (Indicator: "GetFileVersionInfo") in Source: 00000000-00003880-00000C1E-18745665 Observed string: "GetFileSize" (Indicator: "GetFileSize") in Source: 00000000-00003880-00000C1E-21109165 Observed string: "GetTempPath" (Indicator: "GetTempPath") in Source: 00000000-00003880-00000C1E-27476517 Observed string: "GetTempPathW" (Indicator: "GetTempPath") in Source: 00000000-00003880-00000C1E-27477244 Observed string: "GetFileSizeEx" (Indicator: "GetFileSize") in Source: 00000000-00001544.00000000.70129.00400000.00000040.mdmp 00000000-00001544.00000001.72051.00400000.00000040.mdmp 00000000-00001544.00000002.73969.00400000.00000040.mdmp Observed string: "GetFileSize" (Indicator: "GetFileSize") in Source: 00000000-00001544.00000000.70129.00400000.00000040.mdmp 00000000-00001544.00000001.72051.00400000.00000040.mdmp 00000000-00001544.00000002.73969.00400000.00000040.mdmp Observed string: "GetTempPathW" (Indicator: "GetTempPath") in Source: 00000000-00001544.00000000.70129.00400000.00000040.mdmp 00000000-00001544.00000001.72051.00400000.00000040.mdmp 00000000-00001544.00000002.73969.00400000.00000040.mdmp Observed string: "GetTempFileNameW" (Indicator: "GetTempFileName") in Source: 00000000-00001544.00000000.70129.00400000.00000040.mdmp 00000000-00001544.00000001.72051.00400000.00000040.mdmp 00000000-00001544.00000002.73969.00400000.00000040.mdmp Observed string: "GetSystemDirectoryA" (Indicator: "GetSystemDirectory") in Source: 00000000-00001544.00000000.70129.00400000.00000040.mdmp 00000000-00001544.00000001.72051.00400000.00000040.mdmp 00000000-00001544.00000002.73969.00400000.00000040.mdmp41:T502,".exe" (Access type: "DELETEVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS") ".exe" (Access type: "DELETEVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS") "WScript.exe" (Access type: "DELETEVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS") "WScript.exe" (Access type: "DELETEVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS") "oos.exe" (Access type: "DELETEVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS") "oos.exe" (Access type: "DELETEVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS") "oos.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "PROXYENABLE"; Value: "00000000") "oos.exe" (Access type: "DELETEVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "PROXYSERVER") "oos.exe" (Access type: "DELETEVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "PROXYOVERRIDE")42:Td82,".exe" wrote 32 bytes to a remote process "C:\e96aed97b899d7cfc37b229f045f6b87623f9abd97b15256fa6322685cb2c5f0.exe" (Handle: 752) ".exe" wrote 52 bytes to a remote process "C:\e96aed97b899d7cfc37b229f045f6b87623f9abd97b15256fa6322685cb2c5f0.exe" (Handle: 752) ".exe" wrote 1024 bytes to a remote process "C:\e96aed97b899d7cfc37b229f045f6b87623f9abd97b15256fa6322685cb2c5f0.exe" (Handle: 752) ".exe" wrote 340992 bytes to a remote process "C:\e96aed97b899d7cfc37b229f045f6b87623f9abd97b15256fa6322685cb2c5f0.exe" (Handle: 752) ".exe" wrote 94720 bytes to a remote process "C:\e96aed97b899d7cfc37b229f045f6b87623f9abd97b15256fa6322685cb2c5f0.exe" (Handle: 752) ".exe" wrote 3584 bytes to a remote process "C:\e96aed97b899d7cfc37b229f045f6b87623f9abd97b15256fa6322685cb2c5f0.exe" (Handle: 752) ".exe" wrote 512 bytes to a remote process "C:\e96aed97b899d7cfc37b229f045f6b87623f9abd97b15256fa6322685cb2c5f0.exe" (Handle: 752) ".exe" wrote 19456 bytes to a remote process "C:\e96aed97b899d7cfc37b229f045f6b87623f9abd97b15256fa6322685cb2c5f0.exe" (Handle: 752) ".exe" wrote 14848 bytes to a remote process "C:\e96aed97b899d7cfc37b229f045f6b87623f9abd97b15256fa6322685cb2c5f0.exe" (Handle: 752) ".exe" wrote 4 bytes to a remote process "C:\e96aed97b899d7cfc37b229f045f6b87623f9abd97b15256fa6322685cb2c5f0.exe" (Handle: 752) ".exe" wrote 32 bytes to a remote process "C:\Windows\System32\wscript.exe" (Handle: 608) ".exe" wrote 52 bytes to a remote process "C:\Windows\System32\wscript.exe" (Handle: 608) ".exe" wrote 4 bytes to a remote process "C:\Windows\System32\wscript.exe" (Handle: 608) "cmd.exe" wrote 32 bytes to a remote process "C:\Users\%OSUSER%\AppData\Roaming\oos.exe" (Handle: 140) "cmd.exe" wrote 52 bytes to a remote process "C:\Users\%OSUSER%\AppData\Roaming\oos.exe" (Handle: 140) "cmd.exe" wrote 4 bytes to a remote process "C:\Users\%OSUSER%\AppData\Roaming\oos.exe" (Handle: 140) "oos.exe" wrote 32 bytes to a remote process "C:\Users\%OSUSER%\AppData\Roaming\oos.exe" (Handle: 752) "oos.exe" wrote 52 bytes to a remote process "C:\Users\%OSUSER%\AppData\Roaming\oos.exe" (Handle: 752) "oos.exe" wrote 4 bytes to a remote process "C:\Users\%OSUSER%\AppData\Roaming\oos.exe" (Handle: 752) "oos.exe" wrote 32 bytes to a remote process "C:\Users\%OSUSER%\AppData\Roaming\oos.exe" (Handle: 760) "oos.exe" wrote 52 bytes to a remote process "C:\Users\%OSUSER%\AppData\Roaming\oos.exe" (Handle: 760) "oos.exe" wrote 4 bytes to a remote process "C:\Users\%OSUSER%\AppData\Roaming\oos.exe" (Handle: 760) "oos.exe" wrote 1024 bytes to a remote process "C:\Users\%OSUSER%\AppData\Roaming\oos.exe" (Handle: 760) "oos.exe" wrote 340992 bytes to a remote process "C:\Users\%OSUSER%\AppData\Roaming\oos.exe" (Handle: 760) "oos.exe" wrote 94720 bytes to a remote process "C:\Users\%OSUSER%\AppData\Roaming\oos.exe" (Handle: 760) "oos.exe" wrote 3584 bytes to a remote process "C:\Users\%OSUSER%\AppData\Roaming\oos.exe" (Handle: 760) "oos.exe" wrote 512 bytes to a remote process "C:\Users\%OSUSER%\AppData\Roaming\oos.exe" (Handle: 760) "oos.exe" wrote 19456 bytes to a remote process "C:\Users\%OSUSER%\AppData\Roaming\oos.exe" (Handle: 760) "oos.exe" wrote 14848 bytes to a remote process "C:\Users\%OSUSER%\AppData\Roaming\oos.exe" (Handle: 760)43:T92e,"geoplugin.net" (Indicator: "geoplugin.net"; File: "PCAP") "GET /json.gp HTTP/1.1Host: geoplugin.netCache-Control: no-cache" (Indicator: "geoplugin.net"; File: "PCAP") "http://geoplugin.net/json.gp" (Indicator: "geoplugin.net"; File: "00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000000.70129.0061C000.00000004.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp") "tp://geoplugin.net/json.gp" (Indicator: "geoplugin.net"; File: "00000000-00001544.00000000.70129.005C0000.00000004.mdmp, 00000000-00001544.00000000.70129.0061C000.00000004.mdmp, 00000000-00001544.00000001.72051.005C0000.00000004.mdmp, 00000000-00001544.00000002.73969.005C0000.00000004.mdmp") "ttp://geoplugin.net/json.gp" (Indicator: "geoplugin.net"; File: "00000000-00001544.00000000.70129.005C0000.00000004.mdmp, 00000000-00001544.00000001.72051.005C0000.00000004.mdmp, 00000000-00001544.00000002.73969.005C0000.00000004.mdmp") ""geoplugin_credit":"Some of the returned data includes GeoLite data created by MaxMind available from http:\/\/www.maxmind.com<\/a>."," (Indicator: "maxmind.com"; File: "00000000-00001544.00000000.70129.005C0000.00000004.mdmp, 00000000-00001544.00000000.70129.0061C000.00000004.mdmp, 00000000-00001544.00000001.72051.0065F000.00000004.mdmp, 00000000-00001544.00000002.73969.0065F000.00000004.mdmp") "geoplugin.net" (Indicator: "geoplugin.net"; File: "00000000-00001544.00000000.70129.0061C000.00000004.mdmp, 00000000-00001544.00000001.72051.005C0000.00000004.mdmp, 00000000-00001544.00000002.73969.005C0000.00000004.mdmp") "st: geoplugin.net" (Indicator: "geoplugin.net"; File: "00000000-00001544.00000000.70129.0061C000.00000004.mdmp, 00000000-00001544.00000001.72051.005C0000.00000004.mdmp, 00000000-00001544.00000002.73969.005C0000.00000004.mdmp") "Host: geoplugin.net" (Indicator: "geoplugin.net"; File: "00000000-00001544.00000000.70129.0061C000.00000004.mdmp, 00000000-00001544.00000001.72051.0065F000.00000004.mdmp, 00000000-00001544.00000002.73969.0065F000.00000004.mdmp") "ble from http:\/\/www.maxmind.com<\/a>." " (Indicator: "maxmind.com"; File: "00000000-00001544.00000001.72051.0065F000.00000004.mdmp 00000000-00001544.00000002.73969.0065F000.00000004.mdmp")1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"e96aed97b899d7cfc37b229f045f6b87623f9abd97b15256fa6322685cb2c5f0","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790591415982,"unified_at":"2026-09-28T10:30:15.982Z","metadata":{"hashes":{"sha256":"e96aed97b899d7cfc37b229f045f6b87623f9abd97b15256fa6322685cb2c5f0","sha1":"fd92ca627cc15e4ed350478fa5aa575ef39adacf","md5":"cd4bacd0528a0f7efdea9be27414c6e7","sha512":"bd7c3e1a86bc2eeb21105a308ceaa94b9b930d9c179b255d1563491f6dfad010f3efcf3796d25a110769f54484aae9a8f0224f7d6788007a4651c7d70beef37a","ssdeep":"12288:I4stXCxGE7FyfV3RuK7EmImLu6krd2ks1v2bZ4OQN2EjWPPtiUQ+8+t5pX5PO9PD:IBtXkGEiVMcENmL1aeOQDoi+pX5eoHw","ssdeep_chunks":["12288:I4stXCx","12288:4stXCxG","12288:stXCxGE","12288:tXCxGE7","12288:XCxGE7F","12288:CxGE7Fy","12288:xGE7Fyf","12288:GE7FyfV","12288:E7FyfV3","12288:7FyfV3R","12288:FyfV3Ru","12288:yfV3RuK","12288:fV3RuK7","12288:V3RuK7E","12288:3RuK7Em","12288:RuK7EmI","12288:uK7EmIm","12288:K7EmImL","12288:7EmImLu","12288:EmImLu6","12288:mImLu6k","12288:ImLu6kr","12288:mLu6krd","12288:Lu6krd2","12288:u6krd2k","12288:6krd2ks","12288:krd2ks1","12288:rd2ks1v","12288:d2ks1v2","12288:2ks1v2b","12288:ks1v2bZ","12288:s1v2bZ4","12288:1v2bZ4O","12288:v2bZ4OQ","12288:2bZ4OQN","12288:bZ4OQN2","12288:Z4OQN2E","12288:4OQN2Ej","12288:OQN2EjW","12288:QN2EjWP","12288:N2EjWPP","12288:2EjWPPt","12288:EjWPPti","12288:jWPPtiU","12288:WPPtiUQ","12288:PPtiUQ+","12288:PtiUQ+8","12288:tiUQ+8+","12288:iUQ+8+t","12288:UQ+8+t5","12288:Q+8+t5p","12288:+8+t5pX","12288:8+t5pX5","12288:+t5pX5P","12288:t5pX5PO","12288:5pX5PO9","12288:pX5PO9P","12288:X5PO9PD","24576:I4stXCx","24576:4stXCxG","24576:stXCxGE","24576:tXCxGE7","24576:XCxGE7F","24576:CxGE7Fy","24576:xGE7Fyf","24576:GE7FyfV","24576:E7FyfV3","24576:7FyfV3R","24576:FyfV3Ru","24576:yfV3RuK","24576:fV3RuK7","24576:V3RuK7E","24576:3RuK7Em","24576:RuK7EmI","24576:uK7EmIm","24576:K7EmImL","24576:7EmImLu","24576:EmImLu6","24576:mImLu6k","24576:ImLu6kr","24576:mLu6krd","24576:Lu6krd2","24576:u6krd2k","24576:6krd2ks","24576:krd2ks1","24576:rd2ks1v","24576:d2ks1v2","24576:2ks1v2b","24576:ks1v2bZ","24576:s1v2bZ4","24576:1v2bZ4O","24576:v2bZ4OQ","24576:2bZ4OQN","24576:bZ4OQN2","24576:Z4OQN2E","24576:4OQN2Ej","24576:OQN2EjW","24576:QN2EjWP","24576:N2EjWPP","24576:2EjWPPt","24576:EjWPPti","24576:jWPPtiU","24576:WPPtiUQ","24576:PPtiUQ+","24576:PtiUQ+8","24576:tiUQ+8+","24576:iUQ+8+t","24576:UQ+8+t5","24576:Q+8+t5p","24576:+8+t5pX","24576:8+t5pX5","24576:+t5pX5P","24576:t5pX5PO","24576:5pX5PO9","24576:pX5PO9P","24576:X5PO9PD","12288:IBtXkGE","12288:BtXkGEi","12288:tXkGEiV","12288:XkGEiVM","12288:kGEiVMc","12288:GEiVMcE","12288:EiVMcEN","12288:iVMcENm","12288:VMcENmL","12288:McENmL1","12288:cENmL1a","12288:ENmL1ae","12288:NmL1aeO","12288:mL1aeOQ","12288:L1aeOQD","12288:1aeOQDo","12288:aeOQDoi","12288:eOQDoi+","12288:OQDoi+p","12288:QDoi+pX","12288:Doi+pX5","12288:oi+pX5e","12288:i+pX5eo","12288:+pX5eoH","12288:pX5eoHw"],"imphash":"f34d5f2d4577ed6d9ceec516c1f5a744"},"file_info":{"file_name":"Arrival notice.exe","file_type":["peexe","assembly","executable"],"file_type_id":".NET exe","file_size":955392,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1680646806000,"last_seen":1680649320000,"last_multi_scan":1680649320000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["commodity","credentialharvesting","criminal","remcos"]},"stats":{"av":{"malicious_count":2,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":68},"sandbox_signatures":{"informative_count":137,"suspicious_count":23,"malicious_count":11,"total":171},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_70% (D)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"microsoftdefender":{"name":"Microsoft Defender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Win/malicious_confidence_70%","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Resource Development","technique":"Email Accounts","attack_id":"T1585.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1585/002","identifiers":[{"type":"informative","value":"Found email domains (string)"}],"sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Loads the .NET runtime environment"}],"sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to create files (API string)"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"suspicious","value":"Input file contains API references not part of its Import Address Table (IAT)"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"},{"type":"informative","value":"Found Windows API related strings"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function address"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Contains ability to modify process thread functionality (API string)"}],"sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Connects to LPC ports"},{"type":"informative","value":"Contains ability to create/connect to a named pipe (API string)"}],"sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"tactic":"Execution","technique":"Malicious File","attack_id":"T1204.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1204/002","identifiers":[{"type":"malicious","value":"The analysis spawned a process that was identified as malicious"},{"type":"suspicious","value":"The analysis extracted a file that was identified as malicious"}],"sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"tactic":"Execution","technique":"Command and Scripting Interpreter","attack_id":"T1059","attack_id_wiki":"https://attack.mitre.org/techniques/T1059","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"tactic":"Execution","technique":"Visual Basic","attack_id":"T1059.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/005","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Runs shell commands"},{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"tactic":"Persistence","technique":"DLL Side-Loading","attack_id":"T1574.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/002","identifiers":[{"type":"informative","value":"Fails to load modules at runtime"}],"sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"},{"type":"informative","value":"Contains reference to Hijacked CLSID(s)"}],"sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"tactic":"Persistence","technique":"Registry Run Keys / Startup Folder","attack_id":"T1547.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/001","identifiers":[{"type":"suspicious","value":"Modifies auto-execute functionality by setting/creating a value in the registry"},{"type":"informative","value":"References user shell folders registry key string"}],"sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve/open a process (API string)"},{"type":"informative","value":"Contains the ability to modify system service (API string)"},{"type":"informative","value":"Contains ability to start a service (API string)"},{"type":"informative","value":"Creates or modifies windows services"}],"sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"tactic":"Persistence","technique":"Account Manipulation","attack_id":"T1098","attack_id_wiki":"https://attack.mitre.org/techniques/T1098","identifiers":[{"type":"informative","value":"Contains ability to update the user profile (API string)"}],"sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"malicious","value":"Writes data to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"tactic":"Privilege Escalation","technique":"Portable Executable Injection","attack_id":"T1055.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/002","identifiers":[{"type":"malicious","value":"Writes PE header to memory"}],"sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"tactic":"Privilege Escalation","technique":"Process Hollowing","attack_id":"T1055.012","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/012","identifiers":[{"type":"malicious","value":"Allocates virtual memory in a remote process"},{"type":"informative","value":"Contains ability to write data into process memory (API string)"},{"type":"malicious","value":"Creates a process in suspended mode (likely for process injection)"}],"sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to modify access token privileges (API string)"}],"sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to free a loaded DLL module (API string)"}],"sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Contains ability to modify process memory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"tactic":"Privilege Escalation","technique":"Process Doppelgänging","attack_id":"T1055.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/013","identifiers":[{"type":"informative","value":"Contains ability to unmaps a view of a section from the process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"}],"sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"suspicious","value":"Tries to sleep for a long time (more than two minutes)"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"},{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"}],"sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"tactic":"Defense Evasion","technique":"Reflective Code Loading","attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Loads the CLR Loader DLL"}],"sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"suspicious","value":"Modifies proxy settings"},{"type":"informative","value":"Contains ability to close the handle to a registry key (API string)"},{"type":"informative","value":"Contains ability to create/open registry keys (API string)"},{"type":"informative","value":"Contains ability to delete registry value (API string)"}],"sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Contains ability to delete files (API string)"},{"type":"suspicious","value":"Opens file with deletion access rights"},{"type":"suspicious","value":"Marks file for deletion"}],"sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to show a graphical window (API string)"},{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Possibly use system binaries"},{"type":"informative","value":"Drops files inside appdata directory"}],"sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"suspicious","value":"PE file has unusual entropy sections"},{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"suspicious","value":"Dotnet file contains pe file in dotnet resource"},{"type":"informative","value":"Dotnet file resource with suspicious entropy"},{"type":"informative","value":"YARA signature match - RC4 Encryption"},{"type":"informative","value":"YARA signature match - AES Encryption"}],"sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"tactic":"Credential Access","technique":"Credential API Hooking","attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","identifiers":[{"type":"suspicious","value":"Installs hooks/patches the running process"},{"type":"informative","value":"Contains ability to hook/unhook windows functions (API string)"}],"sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"suspicious","value":"Calls an API typically used for keylogging"},{"type":"informative","value":"Contains ability to retrieve information about pressed keystrokes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"tactic":"Credential Access","technique":"Credentials from Web Browsers","attack_id":"T1555.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1555/003","identifiers":[{"type":"informative","value":"References Firefox browser credentials files"}],"sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Calls an API's typically used for searching a directory for a files"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Contains ability to verify if file exist on disk (API string)"},{"type":"suspicious","value":"Reads configuration files (.ini files)"}],"sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Contains ability to retrieve environment variable settings"},{"type":"informative","value":"Calls an API typically used to determine whether a process running under Wow64"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Contains ability to query volume/memory size (API string)"},{"type":"informative","value":"Contains ability to determine disk drive type (API string)"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Calls an API typically used to retrieve SID domain name"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Contains ability to find logical drives of the machine (API string)"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Contains ability to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains ability to retrieve the NetBIOS name of the local computer (API string)"},{"type":"suspicious","value":"Calls an API typically used to retrieve information about the current system"}],"sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"malicious","value":"Spawns a lot of processes"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Contains ability to enumerate processes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve local language"},{"type":"informative","value":"Contains ability to query system locale (API string)"}],"sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"suspicious","value":"Read windows product name from registry"},{"type":"suspicious","value":"Checks warning level of secure to non-secure traffic redirection"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Reads Windows Trust Settings"},{"type":"informative","value":"Queries TCP/IP interface details"},{"type":"informative","value":"Contains ability to read registry keys (API string)"},{"type":"informative","value":"Found registry key string for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"suspicious","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"},{"type":"informative","value":"Calls an API typically used to get active windows title"},{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"}],"sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"malicious","value":"Tries to identify its external IP address"},{"type":"malicious","value":"Found a reference to an external IP address lookup service"}],"sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine time (API string)"},{"type":"informative","value":"Contains ability to retrieve machine timezone (API string)"}],"sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Contains ability to retrieve information about user logon sessions (API string)"},{"type":"informative","value":"Contains ability to retrieve usernames (API string)"}],"sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"tactic":"Discovery","technique":"Remote System Discovery","attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","identifiers":[{"type":"informative","value":"Contains ability to enumerate system network resources (API string)"}],"sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Contains the ability to enumerate system service (API string)"}],"sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Contains ability to move file or directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Calls an API typically used to create a directory"},{"type":"informative","value":"Writes log files"}],"sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Contains ability to capture screen (API string)"},{"type":"informative","value":"Calls an API possibly used to take screenshots"}],"sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"tactic":"Collection","technique":"Archive Collected Data","attack_id":"T1560","attack_id_wiki":"https://attack.mitre.org/techniques/T1560","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"tactic":"Collection","technique":"Clipboard Data","attack_id":"T1115","attack_id_wiki":"https://attack.mitre.org/techniques/T1115","identifiers":[{"type":"informative","value":"Contains ability to access clipboard data (API string)"}],"sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"suspicious","value":"Drops script files inside temp directory"},{"type":"informative","value":"Calls an API typically used to retrieve the URL data"},{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Drops executable files"},{"type":"informative","value":"Contains ability to copy files"},{"type":"informative","value":"Contains ability to download a file from a URL (API string)"}],"sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"malicious","value":"Uses network protocols on unusual ports"}],"sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"},{"type":"suspicious","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Contacts server"},{"type":"informative","value":"Contacts domains"},{"type":"informative","value":"Found potential URL in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Communicates with HTTP webserver (GET/POST requests)"},{"type":"informative","value":"GETs files from a webserver"},{"type":"informative","value":"Contains reference to Windows HTTP services (API string)"}],"sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Making HTTPS connections using secure TLS/SSL version"}],"sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"informative","value":"Contains ability to communicate with C2 using Sockets (API string)"}],"sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"tactic":"Command and Control","technique":"Mail Protocols","attack_id":"T1071.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/003","identifiers":[{"type":"informative","value":"Found mail related domain names"}],"sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"},{"type":"informative","value":"Contains ability to close a handle to a service (API string)"}],"sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains reference to cryptographic keys"}],"sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to reboot/shutdown the operating system (API string)"}],"sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Calls an API typically used to load a resource in memory","description":"\"oos.exe\" called \"LoadResource\" (UID: 00000000-00003236)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"Observed string: \"MsgWaitForMultipleObjectsEx\" (Indicator: \"WaitForMultipleObjects\") in Source: 00000000-00003880-00000C1E-21180196","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to free a loaded DLL module (API string)","description":"Observed string: \"FreeLibraryWhenCallbackReturns\" (Indicator: \"FreeLibrary\") in Source: 00000000-00003880-00000C1E-10302934\n Observed string: \"FreeLibrary\" (Indicator: \"FreeLibrary\") in Source: 00000000-00003880-00000C1E-28782920\n Observed string: \"FreeLibraryWhenCallbackReturns\" (Indicator: \"FreeLibrary\") in Source: 00000000-00001544.00000000.70129.00400000.00000040.mdmp\n 00000000-00001544.00000001.72051.00400000.00000040.mdmp\n 00000000-00001544.00000002.73969.00400000.00000040.mdmp\n Observed string: \"FreeLibrary\" (Indicator: \"FreeLibrary\") in Source: 00000000-00001544.00000000.70129.00400000.00000040.mdmp\n 00000000-00001544.00000001.72051.00400000.00000040.mdmp\n 00000000-00001544.00000002.73969.00400000.00000040.mdmp","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to impersonate access tokens (API string)","description":"Observed string: \"OpenProcessToken\" (Indicator: \"OpenProcessToken\") in Source: 00000000-00003880-00000C1E-19056254\n Observed string: \"OpenThreadToken\" (Indicator: \"OpenThreadToken\") in Source: 00000000-00003880-00000C1E-19613813\n Observed string: \"OpenProcessTokenW\" (Indicator: \"OpenProcessToken\") in Source: 00000000-00003880-00000C1E-20932651\n Observed string: \"OpenProcessToken\" (Indicator: \"OpenProcessToken\") in Source: 00000000-00001544.00000000.70129.00400000.00000040.mdmp\n 00000000-00001544.00000001.72051.00400000.00000040.mdmp\n 00000000-00001544.00000002.73969.00400000.00000040.mdmp","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-306","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to modify process memory (API string)","description":"Observed string: \"VirtualAllocEx\" (Indicator: \"VirtualAlloc\") in Source: 00000000-00003880-00000C1E-14558812\n Observed string: \"VirtualFree\" (Indicator: \"VirtualFree\") in Source: 00000000-00001544.00000000.70129.00400000.00000040.mdmp\n 00000000-00001544.00000001.72051.00400000.00000040.mdmp\n 00000000-00001544.00000002.73969.00400000.00000040.mdmp\n Observed string: \"VirtualAlloc\" (Indicator: \"VirtualAlloc\") in Source: 00000000-00001544.00000000.70129.00400000.00000040.mdmp\n 00000000-00001544.00000001.72051.00400000.00000040.mdmp\n 00000000-00001544.00000002.73969.00400000.00000040.mdmp\n Observed string: \"VirtualAllocEx\" (Indicator: \"VirtualAlloc\") in Source: 00000000-00001544.00000000.70129.00400000.00000040.mdmp\n 00000000-00001544.00000001.72051.00400000.00000040.mdmp\n 00000000-00001544.00000002.73969.00400000.00000040.mdmp","origin":"File/Memory","mitre_attack_id":"T1055.003","relevance":1,"id":"string-309","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to pass information to a window procedure (API string)","description":"Observed string: \"CallWindowProc\" (Indicator: \"CallWindowProc\") in Source: 00000000-00003880-00000C1E-21123033\n Observed string: \"CallWindowProcW\" (Indicator: \"CallWindowProc\") in Source: 00000000-00003880-00000C1E-21123718","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to unmaps a view of a section from the process (API string)","description":"Observed string: \"ZwUnmapViewOfSection\" [Source: 00000000-00003880-00000C1E-14582741]\n Observed string: \"NtUnmapViewOfSection\" [Source: 00000000-00001544.00000000.70129.00400000.00000040.mdmp\n 00000000-00001544.00000001.72051.00400000.00000040.mdmp\n 00000000-00001544.00000002.73969.00400000.00000040.mdmp]","origin":"File/Memory","mitre_attack_id":"T1055.013","relevance":1,"id":"string-90","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to write data into process memory (API string)","description":"Observed string: \"WriteProcessMemory\" [Source: 00000000-00003880-00000C1E-14563402]\n Observed string: \"WriteProcessMemory\" [Source: 00000000-00001544.00000000.70129.00400000.00000040.mdmp\n 00000000-00001544.00000001.72051.00400000.00000040.mdmp\n 00000000-00001544.00000002.73969.00400000.00000040.mdmp]","origin":"File/Memory","mitre_attack_id":"T1055.012","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains the ability to modify system service (API string)","description":"Observed string: \"ChangeServiceConfigW\" [Source: 00000000-00001544.00000000.70129.00400000.00000040.mdmp\n 00000000-00001544.00000001.72051.00400000.00000040.mdmp\n 00000000-00001544.00000002.73969.00400000.00000040.mdmp]","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-192","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Dotnet file resource with suspicious entropy","description":"e96aed97b899d7cfc37b229f045f6b87623f9abd97b15256fa6322685cb2c5f0.bin has big resource with name: \"o3\" size: \"13952\" and abnormal entropy:\"7.37370943403\"\n e96aed97b899d7cfc37b229f045f6b87623f9abd97b15256fa6322685cb2c5f0.bin has big resource with name: \"o2\" size: \"13952\" and abnormal entropy:\"6.1789964674\"\n oos.exe has big resource with name: \"o3\" size: \"13952\" and abnormal entropy:\"7.37370943403\"\n oos.exe has big resource with name: \"o2\" size: \"13952\" and abnormal entropy:\"6.1789964674\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-129","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to cryptographic keys","description":"$27","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-280","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API possibly used to retrieve a handle to the foreground window","description":"\".exe\" called \"GetForegroundWindow\" (UID: 00000000-00004056)\n \"WScript.exe\" called \"GetForegroundWindow\" (UID: 00000000-00003596)\n \"oos.exe\" called \"GetForegroundWindow\" (UID: 00000000-00001544)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-142","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine whether a process running under Wow64","description":"\".exe\" called \"IsWow64Process\" with parameter \"3880\" - (UID: 00000000-00003880)\n \".exe\" called \"IsWow64Process\" with parameter \"4056\" - (UID: 00000000-00004056)\n \".exe\" called \"IsWow64Process\" (UID: 00000000-00004056)\n \"WScript.exe\" called \"IsWow64Process\" with parameter \"3596\" - (UID: 00000000-00003596)\n \"WScript.exe\" called \"IsWow64Process\" (UID: 00000000-00003596)\n \"cmd.exe\" called \"IsWow64Process\" with parameter \"3292\" - (UID: 00000000-00003292)\n \"oos.exe\" called \"IsWow64Process\" (UID: 00000000-00003236)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get active windows title","description":"\"oos.exe\" called \"GetWindowTextW\" (UID: 00000000-00001544)\n \"oos.exe\" called \"GetWindowTextW\" with parameter \"Program Manager\" - (UID: 00000000-00001544)\n \"oos.exe\" called \"GetWindowTextW\" with parameter \"Task Switching\" - (UID: 00000000-00001544)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-151","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\".exe\" called \"RtlGetNtProductType\" (UID: 00000000-00003880)\n \".exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00003880)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$28","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve SID domain name","description":"\".exe\" called \"LookupAccountSidW\" (UID: 00000000-00003880)\n \"WScript.exe\" called \"LookupAccountSidW\" (UID: 00000000-00003596)\n \"oos.exe\" called \"LookupAccountSidW\" (UID: 00000000-00003236)\n \"oos.exe\" called \"LookupAccountSidW\" (UID: 00000000-00001544)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-148","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\".exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00003880)\n \"WScript.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00003596)\n \"WScript.exe\" called \"GetLocaleInfoA\" with parameter \"1033\" - (UID: 00000000-00003596)\n \"cmd.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00003292)\n \"oos.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00003236)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform scheduled transfer (API string)","description":"$29","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query system locale (API string)","description":"$2a","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query volume/memory size (API string)","description":"Observed string: \"GlobalMemoryStatusEx\" [Source: 00000000-00001544.00000000.70129.00400000.00000040.mdmp\n 00000000-00001544.00000001.72051.00400000.00000040.mdmp\n 00000000-00001544.00000002.73969.00400000.00000040.mdmp]","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-193","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"$2b","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve environment variable settings","description":"Observed string: \"Set fso = CreateObject(\"Scripting.FileSystemObject\")\" (Indicator: \"set \") in Source: 00000000-00001544.00000000.70129.00400000.00000040.mdmp\n 00000000-00001544.00000001.72051.00400000.00000040.mdmp\n 00000000-00001544.00000002.73969.00400000.00000040.mdmp","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-326","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Observed string: \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\") in Source: 00000000-00001544.00000000.70129.00400000.00000040.mdmp\n 00000000-00001544.00000001.72051.00400000.00000040.mdmp\n 00000000-00001544.00000002.73969.00400000.00000040.mdmp","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine time (API string)","description":"$2c","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine timezone (API string)","description":"Observed string: \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\") in Source: 00000000-00001544.00000000.70129.00400000.00000040.mdmp\n 00000000-00001544.00000001.72051.00400000.00000040.mdmp\n 00000000-00001544.00000002.73969.00400000.00000040.mdmp","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-248","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"Observed api:\"GetWindowText\"[Source: 00000000-00001544.00000000.70129.00400000.00000040.mdmp\n 00000000-00001544.00000001.72051.00400000.00000040.mdmp\n 00000000-00001544.00000002.73969.00400000.00000040.mdmp]\n Observed api:\"GetForegroundWindow\"[Source: 00000000-00001544.00000000.70129.00400000.00000040.mdmp\n 00000000-00001544.00000001.72051.00400000.00000040.mdmp\n 00000000-00001544.00000002.73969.00400000.00000040.mdmp]\n Observed api:\"EnumWindows\"[Source: 00000000-00001544.00000000.70129.00400000.00000040.mdmp\n 00000000-00001544.00000001.72051.00400000.00000040.mdmp\n 00000000-00001544.00000002.73969.00400000.00000040.mdmp]","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to verify if file exist on disk (API string)","description":"Observed string: \"PathFileExistsW\" [Source: 00000000-00001544.00000000.70129.00400000.00000040.mdmp\n 00000000-00001544.00000001.72051.00400000.00000040.mdmp\n 00000000-00001544.00000002.73969.00400000.00000040.mdmp]\n Observed string: \"PathFileExistsA\" [Source: 00000000-00001544.00000000.70129.00400000.00000040.mdmp\n 00000000-00001544.00000001.72051.00400000.00000040.mdmp\n 00000000-00001544.00000002.73969.00400000.00000040.mdmp]","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-140","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"level":"informative","category":"Environment Awareness","name":"Queries TCP/IP interface details","description":"$2d","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-130","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"\".exe\" queries volume information of \"C:\\e96aed97b899d7cfc37b229f045f6b87623f9abd97b15256fa6322685cb2c5f0.exe\" at 00000000-00003880-0000010C-1180637\n \"oos.exe\" queries volume information of \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\oos.exe\" at 00000000-00003236-0000010C-915270","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"WScript.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"oos.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\".exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"WScript.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"oos.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\".exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\WSCRIPT.EXE\")\n \".exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\WSCRIPT.EXE\")\n \"WScript.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\CMD.EXE\")\n \"WScript.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\CMD.EXE\")","origin":"Registry Access","mitre_attack_id":"T1518","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"$2e","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"\".exe\" called \"CreateProcessA\" with parameter \"C:\\e96aed97b899d7cfc37b229f045f6b87623f9abd97b15256fa6322685cb2c5f0.exe\" - (UID: 00000000-00003880)\n \".exe\" called \"CreateProcessW\" with parameter \"\"%WINDIR%\\System32\\WScript.exe\" \"%TEMP%\\install.vbs\"\" - (UID: 00000000-00004056)\n \"WScript.exe\" called \"CreateProcessW\" with parameter \"\"%WINDIR%\\System32\\cmd.exe\" /c \"%APPDATA%\\oos.exe\"\" - (UID: 00000000-00003596)\n \"oos.exe\" called \"CreateProcessA\" with parameter \"%APPDATA%\\oos.exe\" - (UID: 00000000-00003236)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$2f","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function address","description":"$30","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"geoplugin.net\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"109.206.243.117:3542\"\n \"178.237.33.50:80\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"kCkguPX.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"level":"informative","category":"General","name":"Contains ability to close a handle to a service (API string)","description":"Observed string: \"CloseServiceHandle\" (Indicator: \"CloseServiceHandle\") in Source: 00000000-00001544.00000000.70129.00400000.00000040.mdmp\n 00000000-00001544.00000001.72051.00400000.00000040.mdmp\n 00000000-00001544.00000002.73969.00400000.00000040.mdmp","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-242","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"level":"informative","category":"General","name":"Contains ability to close the handle to a registry key (API string)","description":"Observed string: \"RegCloseKey\" (Indicator: \"RegCloseKey\") in Source: 00000000-00003880-00000C1E-11144454\n Observed string: \"RegCloseKey\" (Indicator: \"RegCloseKey\") in Source: 00000000-00001544.00000000.70129.00400000.00000040.mdmp\n 00000000-00001544.00000001.72051.00400000.00000040.mdmp\n 00000000-00001544.00000002.73969.00400000.00000040.mdmp","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"Observed string: \"CreateProcessA\" (Indicator: \"CreateProcess\") in Source: 00000000-00003880-00000C1E-27982035\n Observed string: \"CreateProcessA\" (Indicator: \"CreateProcess\") in Source: 00000000-00001544.00000000.70129.00400000.00000040.mdmp\n 00000000-00001544.00000001.72051.00400000.00000040.mdmp\n 00000000-00001544.00000002.73969.00400000.00000040.mdmp\n Observed string: \"CreateProcessW\" (Indicator: \"CreateProcess\") in Source: 00000000-00001544.00000000.70129.00400000.00000040.mdmp\n 00000000-00001544.00000001.72051.00400000.00000040.mdmp\n 00000000-00001544.00000002.73969.00400000.00000040.mdmp","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"level":"informative","category":"General","name":"Contains ability to create files (API string)","description":"Observed string: \"CreateFile\" (Indicator: \"CreateFile\") in Source: 00000000-00003880-00000C1E-20943909\n Observed string: \"CreateFileW\" (Indicator: \"CreateFile\") in Source: 00000000-00003880-00000C1E-20944234\n Observed string: \"CreateFileW\" (Indicator: \"CreateFile\") in Source: 00000000-00001544.00000000.70129.00400000.00000040.mdmp\n 00000000-00001544.00000001.72051.00400000.00000040.mdmp\n 00000000-00001544.00000002.73969.00400000.00000040.mdmp","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"level":"informative","category":"General","name":"Contains ability to create/open registry keys (API string)","description":"Observed string: \"RegCreateKeyExW\" (Indicator: \"RegCreateKey\") in Source: 00000000-00003880-00000C1E-11145153\n Observed string: \"RegCreateKeyExA\" (Indicator: \"RegCreateKey\") in Source: 00000000-00001544-00000C1E-45194363\n Observed string: \"RegCreateKeyW\" (Indicator: \"RegCreateKey\") in Source: 00000000-00001544.00000000.70129.00400000.00000040.mdmp\n 00000000-00001544.00000001.72051.00400000.00000040.mdmp\n 00000000-00001544.00000002.73969.00400000.00000040.mdmp\n Observed string: \"RegCreateKeyExW\" (Indicator: \"RegCreateKey\") in Source: 00000000-00001544.00000000.70129.00400000.00000040.mdmp\n 00000000-00001544.00000001.72051.00400000.00000040.mdmp\n 00000000-00001544.00000002.73969.00400000.00000040.mdmp\n Observed string: \"RegCreateKeyA\" (Indicator: \"RegCreateKey\") in Source: 00000000-00001544.00000000.70129.00400000.00000040.mdmp\n 00000000-00001544.00000001.72051.00400000.00000040.mdmp\n 00000000-00001544.00000002.73969.00400000.00000040.mdmp","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-307","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Observed string: \"EnableShellExecuteHooks\" (Indicator: \"ShellExecute\") in Source: 00000000-00004056-00000BC0-15398925\n Observed string: \"ShellExecuteExW\" (Indicator: \"ShellExecute\") in Source: 00000000-00003596-00000C1E-17572406\n Observed string: \"ShellExecuteW\" (Indicator: \"ShellExecute\") in Source: 00000000-00001544.00000000.70129.00400000.00000040.mdmp\n 00000000-00001544.00000001.72051.00400000.00000040.mdmp\n 00000000-00001544.00000002.73969.00400000.00000040.mdmp\n Observed string: \"ShellExecuteExA\" (Indicator: \"ShellExecute\") in Source: 00000000-00001544.00000000.70129.00400000.00000040.mdmp\n 00000000-00001544.00000001.72051.00400000.00000040.mdmp\n 00000000-00001544.00000002.73969.00400000.00000040.mdmp","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-240","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"level":"informative","category":"General","name":"Contains ability to modify process thread functionality (API string)","description":"$31","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"level":"informative","category":"General","name":"Contains ability to move file or directory (API string)","description":"Observed string: \"MoveFileW\" (Indicator: \"MoveFile\") in Source: 00000000-00001544.00000000.70129.00400000.00000040.mdmp\n 00000000-00001544.00000001.72051.00400000.00000040.mdmp\n 00000000-00001544.00000002.73969.00400000.00000040.mdmp\n Observed string: \"MoveFileExW\" (Indicator: \"MoveFile\") in Source: 00000000-00001544.00000000.70129.00400000.00000040.mdmp\n 00000000-00001544.00000001.72051.00400000.00000040.mdmp\n 00000000-00001544.00000002.73969.00400000.00000040.mdmp","origin":"File/Memory","mitre_attack_id":"T1570","relevance":1,"id":"string-322","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Observed string: \"GetCommandLineA\" (Indicator: \"GetCommandLine\") in Source: 00000000-00001544.00000000.70129.00400000.00000040.mdmp\n 00000000-00001544.00000001.72051.00400000.00000040.mdmp\n 00000000-00001544.00000002.73969.00400000.00000040.mdmp\n Observed string: \"GetCommandLineW\" (Indicator: \"GetCommandLine\") in Source: 00000000-00001544.00000000.70129.00400000.00000040.mdmp\n 00000000-00001544.00000001.72051.00400000.00000040.mdmp\n 00000000-00001544.00000002.73969.00400000.00000040.mdmp","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/open a process (API string)","description":"$32","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Observed string: \"GetLastError\" (Indicator: \"GetLastError\") in Source: 00000000-00001544.00000000.70129.00400000.00000040.mdmp\n 00000000-00001544.00000001.72051.00400000.00000040.mdmp\n 00000000-00001544.00000002.73969.00400000.00000040.mdmp\n Observed string: \"SetLastError\" (Indicator: \"SetLastError\") in Source: 00000000-00001544.00000000.70129.00400000.00000040.mdmp\n 00000000-00001544.00000001.72051.00400000.00000040.mdmp\n 00000000-00001544.00000002.73969.00400000.00000040.mdmp","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Observed string: \"GetWindowThreadProcessId\" (Indicator: \"GetWindowThreadProcessId\") in Source: 00000000-00001544.00000000.70129.00400000.00000040.mdmp\n 00000000-00001544.00000001.72051.00400000.00000040.mdmp\n 00000000-00001544.00000002.73969.00400000.00000040.mdmp\n Observed string: \"ShowWindow\" (Indicator: \"ShowWindow\") in Source: 00000000-00001544.00000000.70129.00400000.00000040.mdmp\n 00000000-00001544.00000001.72051.00400000.00000040.mdmp\n 00000000-00001544.00000002.73969.00400000.00000040.mdmp","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-208","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"level":"informative","category":"General","name":"Contains ability to start a service (API string)","description":"Observed string: \"StartServiceW\" (Indicator: \"StartService\") in Source: 00000000-00001544.00000000.70129.00400000.00000040.mdmp\n 00000000-00001544.00000001.72051.00400000.00000040.mdmp\n 00000000-00001544.00000002.73969.00400000.00000040.mdmp","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-209","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"level":"informative","category":"General","name":"Contains the ability to enumerate system service (API string)","description":"$33","origin":"File/Memory","mitre_attack_id":"T1007","relevance":1,"id":"string-191","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\"\n \"Local\\ZonesLockedCacheCounterMutex\"\n \"Local\\ZonesCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Remcos-MMP2I7\"\n \"Remcos-MMP2I7\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"$34","origin":"API Call","mitre_attack_id":"T1574.002","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"level":"informative","category":"General","name":"Found Windows API related strings","description":"$35","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"level":"informative","category":"General","name":"Found a reference to a known community page","description":"\"okie:hapubws@youtube.com/\" (Indicator: \"youtube\")\n \"ookie:hapubws@linkedin.com/\" (Indicator: \"linkedin.com\")\n \"ads.linkedin.com\" (Indicator: \"linkedin.com\")\n \"www.linkedin.com\" (Indicator: \"linkedin.com\")\n \"craigslist.org\" (Indicator: \"craigslist.org\")\n \"facebook.com\" (Indicator: \"facebook.com\")\n \"badoo.com\" (Indicator: \"badoo.com\")\n \"twitter.com\" (Indicator: \"twitter\")\n \"youtube.com\" (Indicator: \"youtube\")\n \"linkedin.com\" (Indicator: \"linkedin.com\")","origin":"File/Memory","relevance":7,"id":"string-10","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"level":"informative","category":"General","name":"GETs files from a webserver","description":"\"GET /json.gp HTTP/1.1\nHost: geoplugin.net\nCache-Control: no-cache\"","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$36","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\".exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\36eaccfde177c2e7b93b8dbdde4e012a\\mscorlib.ni.dll\" at 67E20000\n \"oos.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\36eaccfde177c2e7b93b8dbdde4e012a\\mscorlib.ni.dll\" at 67670000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-3","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"level":"informative","category":"General","name":"Loads the CLR Loader DLL","description":"\".exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 68A80000\n \".exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 69230000\n \"oos.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 69230000\n \"oos.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 68A80000","origin":"Loaded Module","mitre_attack_id":"T1620","id":"module-7","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\".exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 76460000\n \"WScript.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 76460000\n \"cmd.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 76460000\n \"oos.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 76460000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"150016002c7a3d6d@ADVAPI32.dll\"\n \"0e000f00a47a3d6d@ADVAPI32.dll\"\n \"0e000f00d87a3d6d@ADVAPI32.dll\"\n \"11001200387f3d6d@ADVAPI32.dll\"\n \"11001200a47f3d6d@ADVAPI32.dll\"\n \"12001300b87f3d6d@ADVAPI32.dll\"\n \"12001300e07f3d6d@ADVAPI32.dll\"\n \"1400150094933d6d@ADVAPI32.dll\"\n \"0d000e002016396d@ADVAPI32.dll\"\n \"13001400702c326d@ADVAPI32.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$37","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"level":"informative","category":"General","name":"PE file contains COM data directory","description":"\"e96aed97b899d7cfc37b229f045f6b87623f9abd97b15256fa6322685cb2c5f0.bin\" has COM data directory \"IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR\"\n \"oos.exe\" has COM data directory \"IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR\"","origin":"Static Parser","relevance":1,"id":"static-144","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"level":"informative","category":"General","name":"PE file contains Debug data directory","description":"\"e96aed97b899d7cfc37b229f045f6b87623f9abd97b15256fa6322685cb2c5f0.bin\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"\n \"oos.exe\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"","origin":"Static Parser","id":"static-146","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"e96aed97b899d7cfc37b229f045f6b87623f9abd97b15256fa6322685cb2c5f0.bin\" has an executable section named \".text\"\n \"oos.exe\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"$38","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"level":"informative","category":"General","name":"Possibly use system binaries","description":"Observed system executable string:\"%WINDIR%\\System32\\WScript.exe\" [Source: 00000000-00004056-00000C39-28079515002]\n Observed system executable string:\"\"%WINDIR%\\System32\\WScript.exe\" \"%TEMP%\\install.vbs\"\" [Source: 00000000-00004056-00000C39-28079515002]\n Observed system executable string:\"%WINDIR%\\System32\\cmd.exe\" [Source: 00000000-00003596-00000C39-18446744051197126640]\n Observed system executable string:\"\"%WINDIR%\\System32\\cmd.exe\" /c \"%APPDATA%\\oos.exe\"\" [Source: 00000000-00003596-00000C39-18446744051197126640]","origin":"File/Memory","mitre_attack_id":"T1036","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"oos.exe\" (UID: 00000000-00003236) was launched with new environment variables: \"PROMPT=\"$P$G\"\"","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"geoplugin.net\"\n \"xpremcuz300622.ddns.net\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"level":"informative","category":"General","name":"Reads Windows Trust Settings","description":"\"WScript.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-20","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"$39","origin":"Registry Access","mitre_attack_id":"T1012","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"level":"informative","category":"General","name":"Runs shell commands","description":"\"/c \"%APPDATA%\\\\oos.exe\"\" on 2023-4-4.22:55:38.217","origin":"Monitored Target","mitre_attack_id":"T1059.003","relevance":5,"id":"target-3","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \".exe\" (UID: 00000000-00004056)\n Spawned process \"WScript.exe\" with commandline \"\"%TEMP%\\\\install.vbs\"\" (UID: 00000000-00003596)\n Spawned process \"cmd.exe\" with commandline \"/c \"%APPDATA%\\\\oos.exe\"\" (UID: 00000000-00003292)\n Spawned process \"oos.exe\" (UID: 00000000-00003236)\n Spawned process \"oos.exe\" (UID: 00000000-00002460)\n Spawned process \"oos.exe\" (UID: 00000000-00001544)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \".exe\" (UID: 00000000-00004056)\n Spawned process \"WScript.exe\" with commandline \"\"%TEMP%\\\\install.vbs\"\" (UID: 00000000-00003596)\n Spawned process \"cmd.exe\" with commandline \"/c \"%APPDATA%\\\\oos.exe\"\" (UID: 00000000-00003292)\n Spawned process \"oos.exe\" (UID: 00000000-00003236)\n Spawned process \"oos.exe\" (UID: 00000000-00002460)\n Spawned process \"oos.exe\" (UID: 00000000-00001544)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"level":"informative","category":"Installation/Persistence","name":"Connects to LPC ports","description":"\".exe\" connecting to \"\\ThemeApiPort\"\n \"oos.exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","mitre_attack_id":"T1559","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Observed string: \"LoadLibrary\" (Indicator: \"LoadLibrary\") in Source: 00000000-00003880-00000C1E-10743283\n Observed string: \"LoadLibraryW\" (Indicator: \"LoadLibrary\") in Source: 00000000-00003880-00000C1E-10743453\n Observed string: \"LoadLibraryExW\" (Indicator: \"LoadLibrary\") in Source: 00000000-00003880-00000C1E-20114883\n Observed string: \"LoadLibraryEx\" (Indicator: \"LoadLibrary\") in Source: 00000000-00003880-00000C1E-21467191\n Observed string: \"LoadLibraryA\" (Indicator: \"LoadLibrary\") in Source: 00000000-00003880-00000C1E-27844479\n Observed string: \"LoadLibraryA\" (Indicator: \"LoadLibrary\") in Source: 00000000-00001544.00000000.70129.00400000.00000040.mdmp\n 00000000-00001544.00000001.72051.00400000.00000040.mdmp\n 00000000-00001544.00000002.73969.00400000.00000040.mdmp\n Observed string: \"LoadLibraryExW\" (Indicator: \"LoadLibrary\") in Source: 00000000-00001544.00000000.70129.00400000.00000040.mdmp\n 00000000-00001544.00000001.72051.00400000.00000040.mdmp\n 00000000-00001544.00000002.73969.00400000.00000040.mdmp","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"\"oos.exe\" has type \"PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows\"- Location: [%APPDATA%\\oos.exe]- [targetUID: 00000000-00003292]\n \"install.vbs\" has type \"data\"- Location: [%TEMP%\\install.vbs]- [targetUID: 00000000-00004056]\n \"json_1_.json\" has type \"JSON data\"- [targetUID: N/A]\n \"logs.dat\" has type \"data\"- Location: [%ALLUSERSPROFILE%\\remcos\\logs.dat]- [targetUID: 00000000-00001544]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"level":"informative","category":"Installation/Persistence","name":"Drops executable files","description":"\"oos.exe\" has type \"PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows\"- Location: [%APPDATA%\\oos.exe]- [targetUID: 00000000-00003292]","origin":"Binary File","mitre_attack_id":"T1105","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"level":"informative","category":"Installation/Persistence","name":"References user shell folders registry key string","description":"Found string \"Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\" (Indicator: \"currentversion\\explorer\\user shell folders\"; in Source: \"00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1547.001","relevance":1,"id":"string-410","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"$3a","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$3b","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$3c","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes log files","description":"\"oos.exe\" writes a file \"C:\\ProgramData\\remcos\\logs.dat\"\n \"oos.exe\" writes a file \"%ALLUSERSPROFILE%\\remcos\\logs.dat\"","origin":"API Call","mitre_attack_id":"T1074.001","relevance":1,"id":"api-159","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to retrieve the URL data","description":"\"oos.exe\" called \"InternetReadFile\" with parameter 65535 (UID: 00000000-00001544)","origin":"API Call","mitre_attack_id":"T1105","relevance":3,"id":"api-118","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"level":"informative","category":"Network Related","name":"Communicates with HTTP webserver (GET/POST requests)","description":"Found http requests in header \"GET /json.gp\"","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-62","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with C2 using Sockets (API string)","description":"Observed string: \"WSASend\" (Indicator: \"WSASend\") in Source: 00000000-00001544-00000C1E-46627237\n Observed string: \"WSARecv\" (Indicator: \"WSARecv\") in Source: 00000000-00001544-00000C1E-46629542","origin":"File/Memory","mitre_attack_id":"T1095","relevance":1,"id":"string-228","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"level":"informative","category":"Network Related","name":"Contains ability to copy files","description":"Observed string: \"Copy\" (Indicator: \"copy\") in Source: 00000000-00001544.00000000.70129.00252000.00000020.mdmp\n 00000000-00001544.00000001.72051.00252000.00000020.mdmp\n 00000000-00001544.00000002.73969.00252000.00000020.mdmp\n Observed string: \"Copy\" (Indicator: \"copy\") in Source: 00000000-00002460.00000000.70120.00252000.00000020.mdmp\n 00000000-00002460.00000000.70124.00252000.00000020.mdmp\n Observed string: \"Copy\" (Indicator: \"copy\") in Source: 00000000-00003236.00000000.68539.00210000.00000004.mdmp\n 00000000-00003236.00000000.68539.00252000.00000020.mdmp\n 00000000-00003236.00000000.68539.01B70000.00000004.mdmp\n 00000000-00003236.00000001.69833.00210000.00000004.mdmp\n 00000000-00003236.00000001.69833.00240000.00000004.mdmp\n 00000000-00003236.00000001.69833.00252000.00000020.mdmp\n 00000000-00003236.00000001.69833.01910000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-329","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create/connect to a named pipe (API string)","description":"Observed string: \"CreatePipe\" (Indicator: \"CreatePipe\") in Source: 00000000-00001544.00000000.70129.00400000.00000040.mdmp\n 00000000-00001544.00000001.72051.00400000.00000040.mdmp\n 00000000-00001544.00000002.73969.00400000.00000040.mdmp\n Observed string: \"PeekNamedPipe\" (Indicator: \"PeekNamedPipe\") in Source: 00000000-00001544.00000000.70129.00400000.00000040.mdmp\n 00000000-00001544.00000001.72051.00400000.00000040.mdmp\n 00000000-00001544.00000002.73969.00400000.00000040.mdmp","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-210","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"level":"informative","category":"Network Related","name":"Contains ability to download a file from a URL (API string)","description":"Observed string: \"URLDownloadToFileW\" (Indicator: \"URLDownloadToFile\") in Source: 00000000-00001544.00000000.70129.00400000.00000040.mdmp\n 00000000-00001544.00000001.72051.00400000.00000040.mdmp\n 00000000-00001544.00000002.73969.00400000.00000040.mdmp","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-241","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"level":"informative","category":"Network Related","name":"Contains reference to Windows HTTP services (API string)","description":"Observed string: \"WinHttpCreateProxyResolver\" (Indicator: \"WinHttpCreateProxyResolver\") in Source: 00000000-00001544-00000C1E-45412691","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-323","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"level":"informative","category":"Network Related","name":"Found email domains (string)","description":"Observed string: \"www.gmx.net\" (Indicator: \".gmx.\") in Source: 00000000-00001544.00000000.70129.0061C000.00000004.mdmp\n 00000000-00001544.00000001.72051.0065F000.00000004.mdmp\n 00000000-00001544.00000002.73969.0065F000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1585.002","relevance":1,"id":"string-235","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"level":"informative","category":"Network Related","name":"Found mail related domain names","description":"Observed email domain:\"ten.sdapop.evres\" [Source: 00000000-00001544.00000000.70129.0061C000.00000004.mdmp\n 00000000-00001544.00000001.72051.0063C000.00000004.mdmp\n 00000000-00001544.00000002.73969.0063C000.00000004.mdmp]\n Observed email domain:\"www.gmx.net\" [Source: 00000000-00001544.00000000.70129.0061C000.00000004.mdmp\n 00000000-00001544.00000001.72051.0065F000.00000004.mdmp\n 00000000-00001544.00000002.73969.0065F000.00000004.mdmp]","origin":"File/Memory","mitre_attack_id":"T1071.003","relevance":1,"id":"string-169","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$3d","origin":"File/Memory","mitre_attack_id":"T1071","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"level":"informative","category":"Network Related","name":"Making HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x00000303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - AES Encryption","description":"YARA signature for AES encryption matched on process \"00000000-00001544\"\n YARA signature for AES encryption matched on process \"00000000-00004056\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-103","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - RC4 Encryption","description":"YARA signature for RC4 encryption matched on process \"00000000-00003880\"\n YARA signature for RC4 encryption matched on process \"00000000-00001544\"\n YARA signature for RC4 encryption matched on process \"00000000-00004056\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-104","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"level":"informative","category":"Ransomware/Banking","name":"Contains ability to update the user profile (API string)","description":"Observed string: \"SystemParametersInfo\" [Source: 00000000-00003880-00000C1E-11039553]\n Observed string: \"SystemParametersInfoW\" [Source: 00000000-00003880-00000C1E-11040236]\n Observed string: \"SystemParametersInfoW\" [Source: 00000000-00001544.00000000.70129.00400000.00000040.mdmp\n 00000000-00001544.00000001.72051.00400000.00000040.mdmp\n 00000000-00001544.00000002.73969.00400000.00000040.mdmp]","origin":"File/Memory","mitre_attack_id":"T1098","relevance":1,"id":"string-132","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API possibly used to take screenshots","description":"\".exe\" called \"CreateCompatibleBitmap\" (UID: 00000000-00003880)\n \"oos.exe\" called \"CreateCompatibleBitmap\" (UID: 00000000-00003236)","origin":"API Call","mitre_attack_id":"T1113","relevance":3,"id":"api-105","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\".exe\" called \"CreateToolhelp32Snapshot\" (UID: 00000000-00003880)\n \"WScript.exe\" called \"CreateToolhelp32Snapshot\" (UID: 00000000-00003596)\n \"cmd.exe\" called \"CreateToolhelp32Snapshot\" (UID: 00000000-00003292)\n \"oos.exe\" called \"CreateToolhelp32Snapshot\" (UID: 00000000-00003236)\n \"oos.exe\" called \"CreateToolhelp32Snapshot\" (UID: 00000000-00001544)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API's typically used for searching a directory for a files","description":"$3e","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to access clipboard data (API string)","description":"Observed string: \"GetClipboardData\" [Source: 00000000-00001544.00000000.70129.00400000.00000040.mdmp\n 00000000-00001544.00000001.72051.00400000.00000040.mdmp\n 00000000-00001544.00000002.73969.00400000.00000040.mdmp]\n Observed string: \"OpenClipboard\" [Source: 00000000-00001544.00000000.70129.00400000.00000040.mdmp\n 00000000-00001544.00000001.72051.00400000.00000040.mdmp\n 00000000-00001544.00000002.73969.00400000.00000040.mdmp]","origin":"File/Memory","mitre_attack_id":"T1115","relevance":1,"id":"string-188","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to capture screen (API string)","description":"Observed string: \"GetDC\" [Source: 00000000-00003880-00000C1E-21311626]\n Observed string: \"CreateDCA\" [Source: 00000000-00001544.00000000.70129.00400000.00000040.mdmp\n 00000000-00001544.00000001.72051.00400000.00000040.mdmp\n 00000000-00001544.00000002.73969.00400000.00000040.mdmp]\n Observed string: \"GetDIBits\" [Source: 00000000-00001544.00000000.70129.00400000.00000040.mdmp\n 00000000-00001544.00000001.72051.00400000.00000040.mdmp\n 00000000-00001544.00000002.73969.00400000.00000040.mdmp]\n Observed string: \"CreateCompatibleDC\" [Source: 00000000-00001544.00000000.70129.00400000.00000040.mdmp\n 00000000-00001544.00000001.72051.00400000.00000040.mdmp\n 00000000-00001544.00000002.73969.00400000.00000040.mdmp]\n Observed string: \"CreateCompatibleBitmap\" [Source: 00000000-00001544.00000000.70129.00400000.00000040.mdmp\n 00000000-00001544.00000001.72051.00400000.00000040.mdmp\n 00000000-00001544.00000002.73969.00400000.00000040.mdmp]","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to determine disk drive type (API string)","description":"Observed string: \"GetDriveTypeA\" [Source: 00000000-00001544.00000000.70129.00400000.00000040.mdmp\n 00000000-00001544.00000001.72051.00400000.00000040.mdmp\n 00000000-00001544.00000002.73969.00400000.00000040.mdmp]","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-80","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"Observed string: \"FindFirstFileW\" [Source: 00000000-00001544.00000000.70129.00400000.00000040.mdmp\n 00000000-00001544.00000001.72051.00400000.00000040.mdmp\n 00000000-00001544.00000002.73969.00400000.00000040.mdmp]\n Observed string: \"FindNextFileW\" [Source: 00000000-00001544.00000000.70129.00400000.00000040.mdmp\n 00000000-00001544.00000001.72051.00400000.00000040.mdmp\n 00000000-00001544.00000002.73969.00400000.00000040.mdmp]\n Observed string: \"FindFirstFileA\" [Source: 00000000-00001544.00000000.70129.00400000.00000040.mdmp\n 00000000-00001544.00000001.72051.00400000.00000040.mdmp\n 00000000-00001544.00000002.73969.00400000.00000040.mdmp]\n Observed string: \"FindNextFileA\" [Source: 00000000-00001544.00000000.70129.00400000.00000040.mdmp\n 00000000-00001544.00000001.72051.00400000.00000040.mdmp\n 00000000-00001544.00000002.73969.00400000.00000040.mdmp]","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate processes (API string)","description":"Observed string: \"EnumProcesses\" [Source: 00000000-00003236-00000C1E-26934189]\n Observed string: \"EnumProcessesW\" [Source: 00000000-00003236-00000C1E-26934882]\n Observed string: \"CreateToolhelp32Snapshot\" [Source: 00000000-00001544.00000000.70129.00400000.00000040.mdmp\n 00000000-00001544.00000001.72051.00400000.00000040.mdmp\n 00000000-00001544.00000002.73969.00400000.00000040.mdmp]\n Observed string: \"Process32NextW\" [Source: 00000000-00001544.00000000.70129.00400000.00000040.mdmp\n 00000000-00001544.00000001.72051.00400000.00000040.mdmp\n 00000000-00001544.00000002.73969.00400000.00000040.mdmp]\n Observed string: \"Process32FirstW\" [Source: 00000000-00001544.00000000.70129.00400000.00000040.mdmp\n 00000000-00001544.00000001.72051.00400000.00000040.mdmp\n 00000000-00001544.00000002.73969.00400000.00000040.mdmp]","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate system network resources (API string)","description":"Observed string: \"GetAdaptersAddresses\" (Indicator: \"GetAdaptersAddresses\") in Source: 00000000-00001544-00000C1E-45738372","origin":"File/Memory","mitre_attack_id":"T1018","relevance":1,"id":"string-313","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to find logical drives of the machine (API string)","description":"Observed string: \"GetLogicalDriveStringsA\" [Source: 00000000-00001544.00000000.70129.00400000.00000040.mdmp\n 00000000-00001544.00000001.72051.00400000.00000040.mdmp\n 00000000-00001544.00000002.73969.00400000.00000040.mdmp]","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-84","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read registry keys (API string)","description":"$3f","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Observed string: \"GetProcAddress\" (Indicator: \"GetProcAddress\") in Source: 00000000-00003880-00000C1E-20114571\n Observed string: \"GetProcAddress\" (Indicator: \"GetProcAddress\") in Source: 00000000-00001544.00000000.70129.00400000.00000040.mdmp\n 00000000-00001544.00000001.72051.00400000.00000040.mdmp\n 00000000-00001544.00000002.73969.00400000.00000040.mdmp","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"$40","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about pressed keystrokes (API string)","description":"Observed string: \"GetKeyboardState\" [Source: 00000000-00001544.00000000.70129.00400000.00000040.mdmp\n 00000000-00001544.00000001.72051.00400000.00000040.mdmp\n 00000000-00001544.00000002.73969.00400000.00000040.mdmp]\n Observed string: \"GetKeyState\" [Source: 00000000-00001544.00000000.70129.00400000.00000040.mdmp\n 00000000-00001544.00000001.72051.00400000.00000040.mdmp\n 00000000-00001544.00000002.73969.00400000.00000040.mdmp]","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-88","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about the current system (API string)","description":"Observed string: \"NtQuerySystemInformation\" [Source: 00000000-00003880-00000C1E-20941306]\n Observed string: \"GetSystemMetrics\" [Source: 00000000-00003880-00000C1E-21303320]\n Observed string: \"ExpandEnvironmentStringsA\" [Source: 00000000-00001544.00000000.70129.00400000.00000040.mdmp\n 00000000-00001544.00000001.72051.00400000.00000040.mdmp\n 00000000-00001544.00000002.73969.00400000.00000040.mdmp]\n Observed string: \"GetNativeSystemInfo\" [Source: 00000000-00001544.00000000.70129.00400000.00000040.mdmp\n 00000000-00001544.00000001.72051.00400000.00000040.mdmp\n 00000000-00001544.00000002.73969.00400000.00000040.mdmp]\n Observed string: \"GetSystemMetrics\" [Source: 00000000-00001544.00000000.70129.00400000.00000040.mdmp\n 00000000-00001544.00000001.72051.00400000.00000040.mdmp\n 00000000-00001544.00000002.73969.00400000.00000040.mdmp]","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about user logon sessions (API string)","description":"Observed string: \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\") in Source: 00000000-00003880-00000C1E-28320447\n Observed string: \"IsUserAnAdmin\" (Indicator: \"IsUserAnAdmin\") in Source: 00000000-00001544.00000000.70129.00400000.00000040.mdmp\n 00000000-00001544.00000001.72051.00400000.00000040.mdmp\n 00000000-00001544.00000002.73969.00400000.00000040.mdmp","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-217","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the NetBIOS name of the local computer (API string)","description":"Observed string: \"GetComputerNameExW\" [Source: 00000000-00001544.00000000.70129.00400000.00000040.mdmp\n 00000000-00001544.00000001.72051.00400000.00000040.mdmp\n 00000000-00001544.00000002.73969.00400000.00000040.mdmp]","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-122","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Observed string: \"GetModuleFileName\" [Source: 00000000-00001544.00000000.70129.00400000.00000040.mdmp\n 00000000-00001544.00000001.72051.00400000.00000040.mdmp\n 00000000-00001544.00000002.73969.00400000.00000040.mdmp]","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"Observed string: \"GetEnvironmentVariableW\" [Source: 00000000-00003880-00000C1E-20068177]\n Observed string: \"GetEnvironmentVariable\" [Source: 00000000-00003880-00000C1E-20726092]","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-107","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"Observed string: \"GetSystemMetrics\" [Source: 00000000-00003880-00000C1E-21303320]\n Observed string: \"GetSystemMetrics\" [Source: 00000000-00001544.00000000.70129.00400000.00000040.mdmp\n 00000000-00001544.00000001.72051.00400000.00000040.mdmp\n 00000000-00001544.00000002.73969.00400000.00000040.mdmp]","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-131","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Observed string: \"GetTickCount64\" (Indicator: \"GetTickCount\") in Source: 00000000-00003880-00000C1E-10303556\n Observed string: \"GetTickCount64\" (Indicator: \"GetTickCount\") in Source: 00000000-00001544.00000000.70129.00400000.00000040.mdmp\n 00000000-00001544.00000001.72051.00400000.00000040.mdmp\n 00000000-00001544.00000002.73969.00400000.00000040.mdmp\n Observed string: \"GetTickCount\" (Indicator: \"GetTickCount\") in Source: 00000000-00001544.00000000.70129.00400000.00000040.mdmp\n 00000000-00001544.00000001.72051.00400000.00000040.mdmp\n 00000000-00001544.00000002.73969.00400000.00000040.mdmp","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve usernames (API string)","description":"Observed string: \"GetUserNameExW\" [Source: 00000000-00003880-00000C1E-28411351]\n Observed string: \"GetUserNameExA\" [Source: 00000000-00001544-00000C1E-28390804]\n Observed string: \"GetUserNameW\" [Source: 00000000-00001544.00000000.70129.00400000.00000040.mdmp\n 00000000-00001544.00000001.72051.00400000.00000040.mdmp\n 00000000-00001544.00000002.73969.00400000.00000040.mdmp]","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieves the class object from a DLL object handler (API string)","description":"Observed string: \"DllGetClassObject\" [Source: 00000000-00003880-00000C1E-11277360]","origin":"File/Memory","relevance":1,"id":"string-82","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found registry key string for installed applications","description":"\"Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\" (Indicator: \"microsoft\\windows\\currentversion\\uninstall\") in Source: 00000000-00001544.00000000.70129.00400000.00000040.mdmp\n 00000000-00001544.00000001.72051.00400000.00000040.mdmp\n 00000000-00001544.00000002.73969.00400000.00000040.mdmp","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-96","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"References Firefox browser credentials files","description":"Found string \"\\key3.db\" (Indicator: \"key3.db\"; in Source: \"00000000-00001544.00000000.70129.00400000.00000040.mdmp, 00000000-00001544.00000001.72051.00400000.00000040.mdmp, 00000000-00001544.00000002.73969.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1555.003","relevance":1,"id":"string-405","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files (API string)","description":"Observed string: \"DeleteFileA\" (Indicator: \"DeleteFileA\") in Source: 00000000-00001544.00000000.70129.00400000.00000040.mdmp\n 00000000-00001544.00000001.72051.00400000.00000040.mdmp\n 00000000-00001544.00000002.73969.00400000.00000040.mdmp\n Observed string: \"DeleteFileW\" (Indicator: \"DeleteFileW\") in Source: 00000000-00001544.00000000.70129.00400000.00000040.mdmp\n 00000000-00001544.00000001.72051.00400000.00000040.mdmp\n 00000000-00001544.00000002.73969.00400000.00000040.mdmp","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete registry value (API string)","description":"Observed string: \"RegDeleteValueW\" (Indicator: \"RegDeleteValue\") in Source: 00000000-00001544-00000C1E-28681382\n Observed string: \"RegDeleteValueW\" (Indicator: \"RegDeleteValue\") in Source: 00000000-00001544.00000000.70129.00400000.00000040.mdmp\n 00000000-00001544.00000001.72051.00400000.00000040.mdmp\n 00000000-00001544.00000002.73969.00400000.00000040.mdmp","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-230","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"level":"informative","category":"System Security","name":"Contains ability to hook/unhook windows functions (API string)","description":"Observed string: \"UnhookWindowsHookEx\" [Source: 00000000-00001544.00000000.70129.00400000.00000040.mdmp\n 00000000-00001544.00000001.72051.00400000.00000040.mdmp\n 00000000-00001544.00000002.73969.00400000.00000040.mdmp]\n Observed string: \"SetWindowsHookExA\" [Source: 00000000-00001544.00000000.70129.00400000.00000040.mdmp\n 00000000-00001544.00000001.72051.00400000.00000040.mdmp\n 00000000-00001544.00000002.73969.00400000.00000040.mdmp]\n Observed string: \"CallNextHookEx\" [Source: 00000000-00001544.00000000.70129.00400000.00000040.mdmp\n 00000000-00001544.00000001.72051.00400000.00000040.mdmp\n 00000000-00001544.00000002.73969.00400000.00000040.mdmp]","origin":"File/Memory","mitre_attack_id":"T1056.004","relevance":1,"id":"string-91","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"Observed string: \"LookupPrivilegeValue\" [Source: 00000000-00003236-00000C1E-26907711]\n Observed string: \"LookupPrivilegeValueW\" [Source: 00000000-00003236-00000C1E-26908407]\n Observed string: \"AdjustTokenPrivileges\" [Source: 00000000-00003236-00000C1E-26912065]\n Observed string: \"AdjustTokenPrivilegesW\" [Source: 00000000-00003236-00000C1E-26912746]\n Observed string: \"SeShutdownPrivilege\" [Source: 00000000-00001544.00000000.70129.00400000.00000040.mdmp\n 00000000-00001544.00000001.72051.00400000.00000040.mdmp\n 00000000-00001544.00000002.73969.00400000.00000040.mdmp]\n Observed string: \"LookupPrivilegeValueA\" [Source: 00000000-00001544.00000000.70129.00400000.00000040.mdmp\n 00000000-00001544.00000001.72051.00400000.00000040.mdmp\n 00000000-00001544.00000002.73969.00400000.00000040.mdmp]\n Observed string: \"AdjustTokenPrivileges\" [Source: 00000000-00001544.00000000.70129.00400000.00000040.mdmp\n 00000000-00001544.00000001.72051.00400000.00000040.mdmp\n 00000000-00001544.00000002.73969.00400000.00000040.mdmp]","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Observed string: \"TerminateProcess\" (Indicator: \"TerminateProcess\") in Source: 00000000-00003236-00000C1E-26939408\n Observed string: \"TerminateProcessW\" (Indicator: \"TerminateProcess\") in Source: 00000000-00003236-00000C1E-26940102\n Observed string: \"CorExitProcess\" (Indicator: \"ExitProcess\") in Source: 00000000-00001544.00000000.70129.00400000.00000040.mdmp\n 00000000-00001544.00000001.72051.00400000.00000040.mdmp\n 00000000-00001544.00000002.73969.00400000.00000040.mdmp\n Observed string: \"TerminateProcess\" (Indicator: \"TerminateProcess\") in Source: 00000000-00001544.00000000.70129.00400000.00000040.mdmp\n 00000000-00001544.00000001.72051.00400000.00000040.mdmp\n 00000000-00001544.00000002.73969.00400000.00000040.mdmp\n Observed string: \"ExitProcess\" (Indicator: \"ExitProcess\") in Source: 00000000-00001544.00000000.70129.00400000.00000040.mdmp\n 00000000-00001544.00000001.72051.00400000.00000040.mdmp\n 00000000-00001544.00000002.73969.00400000.00000040.mdmp","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"level":"informative","category":"System Security","name":"Contains reference to Hijacked CLSID(s)","description":"Observed string: \"CLSID\\{1299CF18-C4F5-4B6A-BB0F-2299F0398E27}\" (Indicator: \"{1299CF18-C4F5-4B6A-BB0F-2299F0398E27}\") in Source: 00000000-00001544.00000000.70129.0061C000.00000004.mdmp\n 00000000-00001544.00000001.72051.0065F000.00000004.mdmp\n 00000000-00001544.00000002.73969.0065F000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1546.015","relevance":1,"id":"string-342","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"oos.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\".exe\" opened \"\\Device\\KsecDD\"\n \"oos.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to reboot/shutdown the operating system (API string)","description":"Observed string: \"ExitWindowsEx\" [Source: 00000000-00001544.00000000.70129.00400000.00000040.mdmp\n 00000000-00001544.00000001.72051.00400000.00000040.mdmp\n 00000000-00001544.00000002.73969.00400000.00000040.mdmp]","origin":"File/Memory","mitre_attack_id":"T1529","relevance":3,"id":"string-189","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"Observed string: \"CreateMutexA\" (Indicator: \"CreateMutex\") in Source: 00000000-00001544.00000000.70129.00400000.00000040.mdmp\n 00000000-00001544.00000001.72051.00400000.00000040.mdmp\n 00000000-00001544.00000002.73969.00400000.00000040.mdmp\n Observed string: \"OpenMutexA\" (Indicator: \"OpenMutex\") in Source: 00000000-00001544.00000000.70129.00400000.00000040.mdmp\n 00000000-00001544.00000001.72051.00400000.00000040.mdmp\n 00000000-00001544.00000002.73969.00400000.00000040.mdmp","origin":"File/Memory","relevance":1,"id":"string-354","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"Dropped file: \"oos.exe\" - Location: [%APPDATA%\\oos.exe]- [targetUID: 00000000-00003292]","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"e96aed97b899d7cfc37b229f045f6b87623f9abd97b15256fa6322685cb2c5f0.bin\" was detected as \"Microsoft visual C# v7.0 / Basic .NET\"\n \"oos.exe\" was detected as \"Microsoft visual C# v7.0 / Basic .NET\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":".text\n .rsrc\n .reloc\n .text\n .rsrc\n .reloc with unusual entropies 7.92435498532\n 7.67761262176\n 0.101910425663\n 7.92435498532\n 7.67761262176\n 0.101910425663","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":3,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"level":"suspicious","category":"Environment Awareness","name":"Tries to sleep for a long time (more than two minutes)","description":"\".exe\" sleeping for \"1566804069\" milliseconds\n \"oos.exe\" sleeping for \"1566804069\" milliseconds","origin":"API Call","mitre_attack_id":"T1497.003","relevance":10,"id":"api-24","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"level":"suspicious","category":"External Systems","name":"Found an IP/URL artifact that was identified as malicious by at least three reputation engines","description":"14/90 reputation engines marked \"http://xpremcuz300622.ddns.net\" as malicious (15% detection rate)","origin":"External System","relevance":10,"id":"avtest-6","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"31/69 Antivirus vendors marked sample as malicious (44% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"level":"suspicious","category":"General","name":"Reads configuration files (.ini files)","description":"\".exe\" reads file \"C:\\Users\\%OSUSER%\\Favorites\\desktop.ini\"\n \".exe\" reads file \"C:\\Users\\%OSUSER%\\Downloads\\desktop.ini\"\n \".exe\" reads file \"C:\\Users\\%OSUSER%\\Links\\desktop.ini\"\n \".exe\" reads file \"C:\\Users\\%OSUSER%\\Desktop\\desktop.ini\"\n \".exe\" reads file \"C:\\Users\\%OSUSER%\\Searches\\desktop.ini\"\n \".exe\" reads file \"C:\\Users\\%OSUSER%\\Videos\\desktop.ini\"\n \".exe\" reads file \"C:\\Users\\%OSUSER%\\Pictures\\desktop.ini\"","origin":"API Call","mitre_attack_id":"T1083","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"level":"suspicious","category":"General","name":"The analysis extracted a file that was identified as malicious","description":"31/69 Antivirus vendors marked dropped file \"oos.exe\" as malicious (classified as \"Gen:Variant.Lazy\" with 44% detection rate)","origin":"Binary File","mitre_attack_id":"T1204.002","relevance":10,"id":"binary-11","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Modifies auto-execute functionality by setting/creating a value in the registry","description":"\".exe\" (Access type: \"CREATE\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\\\")\n \".exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\"; Key: \"KKL\"; Value: \"\"%APPDATA%\\oos.exe\"\")\n \".exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\\\")\n \".exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\"; Key: \"KKL\"; Value: \"\"%APPDATA%\\oos.exe\"\")\n \"oos.exe\" (Access type: \"CREATE\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\\\")\n \"oos.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\"; Key: \"KKL\"; Value: \"\"%APPDATA%\\oos.exe\"\")\n \"oos.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\\\")\n \"oos.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\"; Key: \"KKL\"; Value: \"\"%APPDATA%\\oos.exe\"\")","origin":"Registry Access","mitre_attack_id":"T1547.001","relevance":8,"id":"registry-0","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"4.0.0.0\"\n \"16.0.0.0\"\n \"9.0.0.0\"\n \"0.0.0.0\"\n Potential IP \"1.0.0.0\" found in string \"Microsoft.Windows.IsolationAutomation,processorArchitecture=\"x86\",publicKeyToken=\"6595b64144ccf1df\",type=\"win32\",version=\"1.0.0.0\"C:\\Windows\\WinSxS\\manifests\\x86_microsoft.windows.isolationautomation_6595b64144ccf1df_1.0.0.0_none_35d357a66c38ade4.manifest\"\n Potential IP \"1.0.0.0\" found in string \"Windows.WinINET,processorArchitecture=\"x86\",publicKeyToken=\"6595b64144ccf1df\",type=\"win32\",version=\"1.0.0.0\"C:\\Windows\\system32\\WININET.dll\"\n Potential IP \"5.1.0.0\" found in string \"Microsoft.Windows.Shell.shell32,processorArchitecture=\"*\",type=\"win32\",version=\"5.1.0.0\"C:\\Windows\\WindowsShell.Manifest\"\n Potential IP \"67.218.111.202\" found in string \"plugin_request\":\"67.218.111.202\"\n\", \"192.168.243.177\", Potential IP \"67.218.111.202\" found in string \"\"geoplugin_request\":\"67.218.111.202\"\n\"","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 178.237.33.50 on port 80 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Checks warning level of secure to non-secure traffic redirection","description":"\"oos.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"WARNONHTTPSTOHTTPREDIRECT\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":7,"id":"registry-9","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used for keylogging","description":"\"oos.exe\" called \"GetKeyState\"","origin":"API Call","mitre_attack_id":"T1056.001","relevance":10,"id":"api-40","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\".exe\" called \"GetNativeSystemInfo\" (UID: 00000000-00003880)\n \".exe\" called \"GetNativeSystemInfo\" (UID: 00000000-00004056)\n \"WScript.exe\" called \"GetNativeSystemInfo\" (UID: 00000000-00003596)\n \"oos.exe\" called \"GetNativeSystemInfo\" (UID: 00000000-00003236)","origin":"API Call","mitre_attack_id":"T1082","relevance":5,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Found an instant messenger related domain","description":"\"hotwire.com\" (Indicator: \"wire.com\")\n \"blackberry.com\" (Indicator: \"blackberry.com\")","origin":"File/Memory","relevance":10,"id":"string-61","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Read windows product name from registry","description":"\".exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\"; Key: \"PRODUCTNAME\")\n \"oos.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\"; Key: \"PRODUCTNAME\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-105","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"WScript.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\install.vbs\" for deletion","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"WScript.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\install.vbs\" with delete access","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"$41","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Detected known bank URL artifact","description":"\"www.credit-agricole.fr\" (Source: 00000000-00001544.00000000.70129.0061C000.00000004.mdmp, 00000000-00001544.00000001.72051.0065F000.00000004.mdmp, 00000000-00001544.00000002.73969.0065F000.00000004.mdmp, Indicator: \"credit-agricole.fr\")\n \"capitalone.com\" (Source: 00000000-00001544.00000000.70129.0061C000.00000004.mdmp, 00000000-00001544.00000001.72051.0065F000.00000004.mdmp, 00000000-00001544.00000002.73969.0065F000.00000004.mdmp, Indicator: \"capitalone.com\")","origin":"File/Memory","relevance":10,"id":"string-23","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Dotnet file contains pe file in dotnet resource","description":"e96aed97b899d7cfc37b229f045f6b87623f9abd97b15256fa6322685cb2c5f0.bin has PE file in resource with name: \"o1\" and filetype: \"PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows\"\n oos.exe has PE file in resource with name: \"o1\" and filetype: \"PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-109","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Drops script files inside temp directory","description":"Dropped file: \"install.vbs\" - Location: [%TEMP%\\install.vbs]- [targetUID: 00000000-00004056]","origin":"Binary File","mitre_attack_id":"T1105","relevance":5,"id":"binary-35","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"Found string \"GetPixel\" (Source: e96aed97b899d7cfc37b229f045f6b87623f9abd97b15256fa6322685cb2c5f0.bin, API is part of module: GDI32.DLL)\n Found string \"SetPixel\" (Source: e96aed97b899d7cfc37b229f045f6b87623f9abd97b15256fa6322685cb2c5f0.bin, API is part of module: GDI32.DLL)\n Found string \"Sleep\" (Source: e96aed97b899d7cfc37b229f045f6b87623f9abd97b15256fa6322685cb2c5f0.bin, API is part of module: KERNELBASE.DLL)","origin":"File/Memory","mitre_attack_id":"T1106","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"\".exe\" wrote bytes \"f597f4c6\" to virtual address \"0x6923F798\" (part of module \"CLR.DLL\")\n \".exe\" wrote bytes \"db4d577300000000\" to virtual address \"0x012D2000\" (part of module \"E96AED97B899D7CFC37B229F045F6B87623F9ABD97B15256FA6322685CB2C5F0.EXE\")\n \"oos.exe\" wrote bytes \"01a89494\" to virtual address \"0x68A8F798\" (part of module \"CLR.DLL\")\n \"oos.exe\" wrote bytes \"db4d486d00000000\" to virtual address \"0x00252000\" (part of module \"OOS.EXE\")","origin":"Hook Detection","mitre_attack_id":"T1056.004","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"WScript.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"oos.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":5,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Creates a process in suspended mode (likely for process injection)","description":"\".exe\" called \"CreateProcessA\" with parameter \"C:\\e96aed97b899d7cfc37b229f045f6b87623f9abd97b15256fa6322685cb2c5f0.exe\" - (UID: 00000000-00003880)\n \"oos.exe\" called \"CreateProcessA\" with parameter \"%APPDATA%\\oos.exe\" - (UID: 00000000-00003236)","origin":"API Call","mitre_attack_id":"T1055.012","relevance":10,"id":"api-129","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Writes PE header to memory","description":"\".exe wrote PE header bytes (\"MZ\") to a remote process \"C:\\e96aed97b899d7cfc37b229f045f6b87623f9abd97b15256fa6322685cb2c5f0.exe\", which might be an injection preparation attempt ..., \"oos.exe wrote PE header bytes (\"MZ\") to a remote process \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\oos.exe\"\n which might be an injection preparation attempt ...","origin":"API Call","mitre_attack_id":"T1055.002","relevance":7,"id":"api-83","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"31/69 Antivirus vendors marked sample as malicious (44% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted Antivirus engine","description":"No specific details available","origin":"External System","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"level":"malicious","category":"General","name":"The analysis spawned a process that was identified as malicious","description":"31/69 Antivirus vendors marked spawned process \".exe\" (PID: 4056) as malicious (classified as \"Gen:Variant.Lazy\" with 44% detection rate)\n 31/69 Antivirus vendors marked spawned process \"oos.exe\" (PID: 3236) as malicious (classified as \"Gen:Variant.Lazy\" with 44% detection rate)\n 31/69 Antivirus vendors marked spawned process \"oos.exe\" (PID: 2460) as malicious (classified as \"Gen:Variant.Lazy\" with 44% detection rate)\n 31/69 Antivirus vendors marked spawned process \"oos.exe\" (PID: 1544) as malicious (classified as \"Gen:Variant.Lazy\" with 44% detection rate)","origin":"Monitored Target","mitre_attack_id":"T1204.002","relevance":10,"id":"target-58","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"level":"malicious","category":"Installation/Persistence","name":"Allocates virtual memory in a remote process","description":"\"oos.exe\" allocated memory in \"%APPDATA%\\oos.exe\"","origin":"API Call","mitre_attack_id":"T1055.012","relevance":7,"id":"api-20","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"$42","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"level":"malicious","category":"Network Related","name":"Found a reference to an external IP address lookup service","description":"$43","origin":"File/Memory","mitre_attack_id":"T1016","relevance":6,"id":"string-56","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"level":"malicious","category":"Network Related","name":"Tries to identify its external IP address","description":"\"geoplugin.net\"","origin":"Network Traffic","mitre_attack_id":"T1016","relevance":6,"id":"network-24","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"level":"malicious","category":"Network Related","name":"Uses network protocols on unusual ports","description":"TCP traffic to 109.206.243.117 on port 3542","origin":"Network Traffic","mitre_attack_id":"T1571","relevance":7,"id":"network-7","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"Spawned process \".exe\" (UID: 00000000-00003880)\n Spawned process \".exe\" (UID: 00000000-00004056)\n Spawned process \"WScript.exe\" with commandline \"\"%TEMP%\\\\install.vbs\"\" (UID: 00000000-00003596)\n Spawned process \"cmd.exe\" with commandline \"/c \"%APPDATA%\\\\oos.exe\"\" (UID: 00000000-00003292)\n Spawned process \"oos.exe\" (UID: 00000000-00003236)\n Spawned process \"oos.exe\" (UID: 00000000-00002460)\n Spawned process \"oos.exe\" (UID: 00000000-00001544)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]}],"incidents":[{"name":"Spyware","details_count":1,"details":[{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"name":"Persistence","details_count":3,"details":[{"detail":"Modifies auto-execute functionality by setting/creating a value in the registry"},{"detail":"Spawns a lot of processes"},{"detail":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"name":"Fingerprint","details_count":6,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Queries process information"},{"detail":"Tries to identify its external IP address"},{"detail":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)"},{"detail":"Queries sensitive IE security settings"},{"detail":"Queries the display settings of system associated file extensions"}],"sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"name":"Evasive","details_count":3,"details":[{"detail":"Tries to sleep for a long time (more than two minutes)"},{"detail":"Marks file for deletion"},{"detail":"Input file contains API references not part of its Import Address Table (IAT)"}],"sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 2 domains and 2 hosts"}],"sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]}]},"activity":{"stats":{"process_count":7,"spawned_processes_count":7,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":6,"imported_dlls_count":115,"dropped_files_count":0,"extracted_files_count":4,"files_written_count":14,"files_deleted_count":0,"registry_keys_created_count":8,"registry_keys_modified_count":0,"registry_keys_deleted_count":2,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":10,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":2,"dns_resolutions_count":2,"contacted_urls_count":1,"http_requests_count":1},"behavior_tags":["commodity","credentialharvesting","criminal","remcos"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"642caa07f8493c6aaa00d6b9","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Gen:Variant.Lazy","contacted_countries":["DEU","NLD"],"submit_name":"e96aed97b899d7cfc37b229f045f6b87623f9abd97b15256fa6322685cb2c5f0.exe","analysis_start_time":"2023-04-04T22:51:52+00:00","indicators_count":{"informative":137,"suspicious":45,"malicious":13},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"109.206.243.117","port":3542,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"address":"178.237.33.50","port":80,"protocol":"TCP","country":"Netherlands","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]}],"dns_resolutions":[{"domain":"geoplugin.net","address":"178.237.33.50","ttl":1916,"country":"Netherlands","registrar_name":"OVH, SAS","registrar_name_servers":"DNS200.ANYCAST.ME","registrar_creation_date":"2006-11-06T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"domain":"xpremcuz300622.ddns.net","address":"109.206.243.117","ttl":60,"country":"Germany","registrar_name":"TLDS LLC. d/b/a SRSPlus","registrar_organization":"No-IP.com","registrar_name_servers":"NF1.NO-IP.COM","registrar_creation_date":"2001-06-28T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]}],"http_requests":[{"host":"geoplugin.net","host_ip":"178.237.33.50:80","url":"/json.gp","method":"GET","header":"GET /json.gp HTTP/1.1\nHost: geoplugin.net\nCache-Control: no-cache","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}],"processes":[{"pid":3880,"ppid":0,"name":"e96aed97b899d7cfc37b229f045f6b87623f9abd97b15256fa6322685cb2c5f0.exe","command_line":"","sha256":"e96aed97b899d7cfc37b229f045f6b87623f9abd97b15256fa6322685cb2c5f0","normalized_path":"C:\\e96aed97b899d7cfc37b229f045f6b87623f9abd97b15256fa6322685cb2c5f0.exe","uid":"00000000-00003880","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABYUlEQVR4XtWWPYoCQRCFjTbREQw9h4lgYGQm+IcbGHiBTfYKBuIh9AAmJiroLbyDZzAy0a3Bdss3XV09jvbggwLbrn7f6xpkLBQ+QeXB4EKF3weRgecWAgNEIUMY6H5/iSv4FAhWHY3DB+AjN3Cqzfb8/hASHKeAhT6phYa+YCz09ZINjMZ833wudToxkH4ZmUKYg42fyT3AfHm0wnkAyce251Sx21VhuLZB0AP3VaEBwl23J+E5qc9LtgAL9likfp+g3kpjir2V4Xe8jvp9a7+X0FQLwB+V1u8lHsBlhkFzCdD8nb4+AMmYUEW9XsJMuj0PkCmEZiIFWK1PDwE0H6ekgxKc3x7Xkpdbtdr9IP9HhBAJJu1xhK5WK2GM5rtdEo59zwe4CY2l0qaCvqmFhhIY4V/tdna4TVKAl95aE4YICidJAbDvbTLA2fzwD6/XwwUg8bEHvb1R6e99kRv8GV0BYYkRsvxv9t0AAAAASUVORK5CYII="},{"pid":4056,"ppid":3880,"name":"e96aed97b899d7cfc37b229f045f6b87623f9abd97b15256fa6322685cb2c5f0.exe","command_line":"","sha256":"e96aed97b899d7cfc37b229f045f6b87623f9abd97b15256fa6322685cb2c5f0","normalized_path":"C:\\e96aed97b899d7cfc37b229f045f6b87623f9abd97b15256fa6322685cb2c5f0.exe","parent_uid":"00000000-00003880","uid":"00000000-00004056"},{"pid":3596,"ppid":4056,"name":"WScript.exe","command_line":"\"%TEMP%\\install.vbs\"","sha256":"2160ba6829909eeb1d272ac4a5f43588750c0b4743477bf2b46952033b5d4b3b","normalized_path":"%WINDIR%\\System32\\WScript.exe","parent_uid":"00000000-00004056","uid":"00000000-00003596"},{"pid":3292,"ppid":3596,"name":"cmd.exe","command_line":"/c \"%APPDATA%\\oos.exe\"","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00000000-00003596","uid":"00000000-00003292"},{"pid":3236,"ppid":3292,"name":"oos.exe","command_line":"","sha256":"e96aed97b899d7cfc37b229f045f6b87623f9abd97b15256fa6322685cb2c5f0","normalized_path":"%APPDATA%\\oos.exe","parent_uid":"00000000-00003292","uid":"00000000-00003236"},{"pid":2460,"ppid":3236,"name":"oos.exe","command_line":"","sha256":"e96aed97b899d7cfc37b229f045f6b87623f9abd97b15256fa6322685cb2c5f0","normalized_path":"%APPDATA%\\oos.exe","parent_uid":"00000000-00003236","uid":"00000000-00002460"},{"pid":1544,"ppid":3236,"name":"oos.exe","command_line":"","sha256":"e96aed97b899d7cfc37b229f045f6b87623f9abd97b15256fa6322685cb2c5f0","normalized_path":"%APPDATA%\\oos.exe","parent_uid":"00000000-00003236","uid":"00000000-00001544"}],"all_imported_dlls":["PresentationCore.ni.dll","GdiPlus.dll","msctf.dll","profapi.dll","normaliz.dll","ucrtbase_clr0400.dll","winmm.dll","api-ms-win-downlevel-advapi32-l2-1-0.dll","ieframe.dll","wshqos.dll","uxtheme.dll","scrobj.dll","netprofm.dll","secur32.dll","wintrust.dll","wshext.dll","WSHTCPIP.DLL","kernel32.dll","psapi.dll","System.Xaml.ni.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","sxs.dll","wship6.dll","winnsi.dll","dhcpcsvc.dll","usp10.dll","oleaut32.dll","imm32.dll","comctl32.dll","apphelp.dll","ntdll.dll","npmproxy.dll","dhcpcsvc6.dll","msvcp140_clr0400.dll","System.Windows.Forms.ni.dll","userenv.dll","devobj.dll","api-ms-win-downlevel-shell32-l1-1-0.dll","IPHLPAPI.DLL","clr.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll","sspicli.dll","mscoree.dll","sechost.dll","mscorlib.ni.dll","System.ni.dll","wpfgfx_v0400.dll","System.Xml.ni.dll","api-ms-win-downlevel-user32-l1-1-0.dll","vcruntime140_clr0400.dll","api-ms-win-downlevel-shlwapi-l2-1-0.dll","gdi32.dll","DWrite.dll","WindowsCodecs.dll","nlssorting.dll","msasn1.dll","mlang.dll","KernelBase.dll","rsaenh.dll","api-ms-win-downlevel-ole32-l1-1-0.dll","rpcss.dll","urlmon.dll","ntmarta.dll","Wldap32.dll","shdocvw.dll","winhttp.dll","clrjit.dll","msvcrt.dll","mscoreei.dll","mscorrc.dll","crypt32.dll","msisip.dll","wininet.dll","mswsock.dll","nsi.dll","PresentationNative_v0400.dll","bcrypt.dll","fltLib.dll","nlaapi.dll","rpcrt4.dll","api-ms-win-downlevel-version-l1-1-0.dll","ole32.dll","scrrun.dll","dwmapi.dll","version.dll","System.Core.ni.dll","rasadhlp.dll","WindowsBase.ni.dll","cryptsp.dll","user32.dll","clbcatq.dll","cryptbase.dll","mpr.dll","winbrand.dll","FWPUCLNT.DLL","lpk.dll","ws2_32.dll","api-ms-win-core-xstate-l2-1-0.dll","System.Configuration.ni.dll","webio.dll","Microsoft.VisualBasic.ni.dll","iertutil.dll","api-ms-win-core-synch-l1-2-0.dll","shlwapi.dll","PresentationFramework.ni.dll","shell32.dll","System.Drawing.ni.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","propsys.dll","vbscript.dll","setupapi.dll","cfgmgr32.dll","dnsapi.dll","RpcRtRemote.dll","advapi32.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"oos.exe","sha256":"e96aed97b899d7cfc37b229f045f6b87623f9abd97b15256fa6322685cb2c5f0","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"name":"install.vbs","sha256":"ad1b7523ad4d7c526ae9bdae3838668aebfe7aa947fc84bee4d91bf27c42e252","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"name":"logs.dat","sha256":"0063aaf3500ad339742c413ebcd665c5964f9c3662ef11c0ca16979e0fdbd61e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"name":"json_1_.json","sha256":"c05e770683842b7ea118997ba87448b96a5fc794fea09f8aa6392b77f0b771e8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]}],"files_written":[{"path":"\\FileSystem\\Filters\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{E29AC6C2-7037-11DE-816D-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{FC9EBB92-F38F-4C0F-9BB2-4E5E64704E72}","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\counters.dat","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\37NU00GP\\json[1].json","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"path":"%ALLUSERSPROFILE%\\remcos","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"path":"%ALLUSERSPROFILE%\\remcos\\logs.dat","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\GDIPLUS\\","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\\\","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\{0C70BB6D-CFA8-4734-A158-28619E142726}\\","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\AC-1F-6B-0D-DB-84\\","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\{0C70BB6D-CFA8-4734-A158-28619E142726}\\AC-1F-6B-0D-DB-84\\","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]}],"keys_modified":null,"keys_deleted":[{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\{0C70BB6D-CFA8-4734-A158-28619E142726}\\WPADDETECTEDURL\\WPADDETECTEDURL","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\AC-1F-6B-0D-DB-84\\WPADDETECTEDURL\\WPADDETECTEDURL","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]}]},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Remcos-MMP2I7","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"name":"Remcos-MMP2I7","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"642caa07f8493c6aaa00d6b9"}]}]}},"report_ids":{"sandbox_job_ids":["642caa07f8493c6aaa00d6b9"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Win/malicious_confidence_70% Sample e96aed97b899… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample e96aed97b899…. Malware family: Win/malicious_confidence_70%. Threat score 100/100. 2/28 AV engines flagged this file. 11 malicious and 23 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/e96aed97b899d7cfc37b229f045f6b87623f9abd97b15256fa6322685cb2c5f0"}],["$","meta","4",{"property":"og:title","content":"Malicious Win/malicious_confidence_70% Sample e96aed97b899… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample e96aed97b899…. Malware family: Win/malicious_confidence_70%. Threat score 100/100. 2/28 AV engines flagged this file. 11 malicious and 23 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/e96aed97b899d7cfc37b229f045f6b87623f9abd97b15256fa6322685cb2c5f0"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Win/malicious_confidence_70% Sample e96aed97b899… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample e96aed97b899…. Malware family: Win/malicious_confidence_70%. Threat score 100/100. 2/28 AV engines flagged this file. 11 malicious and 23 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L44","11",{}]]