26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 3b:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4cb,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious DeepScan:Generic.KillMBR.A Sample eaa840e393c8… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample eaa840e393c8…. Malware family: DeepScan:Generic.KillMBR.A. Threat score 100/100. 19/25 AV engines flagged this file. 5 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/eaa840e393c8f8a3bdcd865ea6eff59f586e14bd9c3518d88098062056964281","keywords":["Malicious","DeepScan:Generic.KillMBR.A","malware analysis","sandbox report","threat intelligence","eaa840e393c8f8a3bdcd865ea6eff59f586e14bd9c3518d88098062056964281"],"about":{"@type":"SoftwareApplication","name":"7aad7c8ad75a96d9dd0f32ae5b51aca7","applicationCategory":["peexe","executable"],"identifier":"eaa840e393c8f8a3bdcd865ea6eff59f586e14bd9c3518d88098062056964281","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"DeepScan:Generic.KillMBR.A","antivirusDetections":{"malicious":19,"total":25},"behavioralIndicators":{"malicious":5,"suspicious":14},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T1454,"7aad7c8ad75a96d9dd0f32ae5b51aca7.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00007312) "7aad7c8ad75a96d9dd0f32ae5b51aca7.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00007312) "7aad7c8ad75a96d9dd0f32ae5b51aca7.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00007312) "7aad7c8ad75a96d9dd0f32ae5b51aca7.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00007312) "7aad7c8ad75a96d9dd0f32ae5b51aca7.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00007312) "7aad7c8ad75a96d9dd0f32ae5b51aca7.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00007312) "7aad7c8ad75a96d9dd0f32ae5b51aca7.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00007312) "7aad7c8ad75a96d9dd0f32ae5b51aca7.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00007312) "7aad7c8ad75a96d9dd0f32ae5b51aca7.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00007312) "7aad7c8ad75a96d9dd0f32ae5b51aca7.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00007312) "7aad7c8ad75a96d9dd0f32ae5b51aca7.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00007312) "7aad7c8ad75a96d9dd0f32ae5b51aca7.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00007312) "7aad7c8ad75a96d9dd0f32ae5b51aca7.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00007312) "7aad7c8ad75a96d9dd0f32ae5b51aca7.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00007312) "7aad7c8ad75a96d9dd0f32ae5b51aca7.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00007312) "7aad7c8ad75a96d9dd0f32ae5b51aca7.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00007312) "7aad7c8ad75a96d9dd0f32ae5b51aca7.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00007312) "7aad7c8ad75a96d9dd0f32ae5b51aca7.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00007312) "7aad7c8ad75a96d9dd0f32ae5b51aca7.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00007312) "7aad7c8ad75a96d9dd0f32ae5b51aca7.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00007312) "7aad7c8ad75a96d9dd0f32ae5b51aca7.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00007312) "7aad7c8ad75a96d9dd0f32ae5b51aca7.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00007312) "7aad7c8ad75a96d9dd0f32ae5b51aca7.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00007312) "7aad7c8ad75a96d9dd0f32ae5b51aca7.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00007312) "7aad7c8ad75a96d9dd0f32ae5b51aca7.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00007312) "7aad7c8ad75a96d9dd0f32ae5b51aca7.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00007312) "7aad7c8ad75a96d9dd0f32ae5b51aca7.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00007312) "7aad7c8ad75a96d9dd0f32ae5b51aca7.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00007312) "7aad7c8ad75a96d9dd0f32ae5b51aca7.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00007312) "7aad7c8ad75a96d9dd0f32ae5b51aca7.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00007312) "7aad7c8ad75a96d9dd0f32ae5b51aca7.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00007312) "7aad7c8ad75a96d9dd0f32ae5b51aca7.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00007312) "7aad7c8ad75a96d9dd0f32ae5b51aca7.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00007312) "7aad7c8ad75a96d9dd0f32ae5b51aca7.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00007312) "7aad7c8ad75a96d9dd0f32ae5b51aca7.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00007312) "7aad7c8ad75a96d9dd0f32ae5b51aca7.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00007312) "7aad7c8ad75a96d9dd0f32ae5b51aca7.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00007312) "7aad7c8ad75a96d9dd0f32ae5b51aca7.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00007312) "7aad7c8ad75a96d9dd0f32ae5b51aca7.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00007312) "7aad7c8ad75a96d9dd0f32ae5b51aca7.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00007312) "7aad7c8ad75a96d9dd0f32ae5b51aca7.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00007312)28:T40e,"7aad7c8ad75a96d9dd0f32ae5b51aca7.exe" loaded module "KERNEL32" at base 74860000 "7aad7c8ad75a96d9dd0f32ae5b51aca7.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 74ce0000 "7aad7c8ad75a96d9dd0f32ae5b51aca7.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 74ce0000 "7aad7c8ad75a96d9dd0f32ae5b51aca7.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 74ce0000 "7aad7c8ad75a96d9dd0f32ae5b51aca7.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 77c00000 "7aad7c8ad75a96d9dd0f32ae5b51aca7.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 74ce0000 "7aad7c8ad75a96d9dd0f32ae5b51aca7.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 74ce0000 "7aad7c8ad75a96d9dd0f32ae5b51aca7.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 74ce0000 "7aad7c8ad75a96d9dd0f32ae5b51aca7.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 740a0000 "7aad7c8ad75a96d9dd0f32ae5b51aca7.exe" loaded module "EXT-MS-WIN-KERNEL32-ERRORHANDLING-L1-1-0.DLL" at base 7486000029:T649,"7aad7c8ad75a96d9dd0f32ae5b51aca7.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "7aad7c8ad75a96d9dd0f32ae5b51aca7.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "7aad7c8ad75a96d9dd0f32ae5b51aca7.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "7aad7c8ad75a96d9dd0f32ae5b51aca7.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TERMINAL SERVER"; Key: ""; Value: "") "7aad7c8ad75a96d9dd0f32ae5b51aca7.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "7aad7c8ad75a96d9dd0f32ae5b51aca7.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "7aad7c8ad75a96d9dd0f32ae5b51aca7.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "7aad7c8ad75a96d9dd0f32ae5b51aca7.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "7aad7c8ad75a96d9dd0f32ae5b51aca7.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "7aad7c8ad75a96d9dd0f32ae5b51aca7.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: ""; Value: "") "7aad7c8ad75a96d9dd0f32ae5b51aca7.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: ""; Value: "")2a:Tbe8,"7aad7c8ad75a96d9dd0f32ae5b51aca7.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "7aad7c8ad75a96d9dd0f32ae5b51aca7.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: "7AAD7C8AD75A96D9DD0F32AE5B51ACA7.EXE"; Value: "") "7aad7c8ad75a96d9dd0f32ae5b51aca7.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "7aad7c8ad75a96d9dd0f32ae5b51aca7.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TERMINAL SERVER"; Key: "TSAPPCOMPAT"; Value: "") "7aad7c8ad75a96d9dd0f32ae5b51aca7.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TERMINAL SERVER"; Key: "TSUSERENABLED"; Value: "") "7aad7c8ad75a96d9dd0f32ae5b51aca7.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "7aad7c8ad75a96d9dd0f32ae5b51aca7.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "7aad7c8ad75a96d9dd0f32ae5b51aca7.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "LOGFLAGS"; Value: "") "7aad7c8ad75a96d9dd0f32ae5b51aca7.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "SHOWDEBUGINFO"; Value: "") "7aad7c8ad75a96d9dd0f32ae5b51aca7.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: "CACHE"; Value: "") "7aad7c8ad75a96d9dd0f32ae5b51aca7.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY"; Value: "") "7aad7c8ad75a96d9dd0f32ae5b51aca7.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK"; Value: "") "7aad7c8ad75a96d9dd0f32ae5b51aca7.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "TYPE"; Value: "") "7aad7c8ad75a96d9dd0f32ae5b51aca7.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "ALTERNATECODEPAGE"; Value: "") "7aad7c8ad75a96d9dd0f32ae5b51aca7.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "7aad7c8ad75a96d9dd0f32ae5b51aca7.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "7aad7c8ad75a96d9dd0f32ae5b51aca7.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SAFEDLLSEARCHMODE"; Value: "") "7aad7c8ad75a96d9dd0f32ae5b51aca7.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "ENABLED"; Value: "") "7aad7c8ad75a96d9dd0f32ae5b51aca7.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: "FIPSALGORITHMPOLICY"; Value: "")2b:T54b,Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00007312.00000000.67151.02910000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00007312.00000000.67151.02910000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00007312.00000000.67151.02910000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00007312.00000000.67151.02910000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00007312.00000000.67151.02910000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00007312.00000000.67151.02910000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00007312.00000000.67151.02910000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00007312.00000000.67151.02910000.00000004.mdmp")2c:T63e,"7aad7c8ad75a96d9dd0f32ae5b51aca7.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001272) "7aad7c8ad75a96d9dd0f32ae5b51aca7.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001272) "7aad7c8ad75a96d9dd0f32ae5b51aca7.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000200000000000000d8ebd775986c22000070fd7f9a5c8f7700e0fd7f684299014470fd7f00000000400000003f0000001e0000000070fd7f5c429901c15c8f77608296771e0000000070fd7f9a5c8f7700e0fd7f8042990157898e77808396771317a075d8ebd775 (UID: 00000000-00001272) "7aad7c8ad75a96d9dd0f32ae5b51aca7.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000195e18a77466d1700fefffffff5f68e77634d8f77e09420008ef1016dbce40100b2f48e77ca340076bc5199010000016d0000016d804d8f772e340076e0000000e000016d00000000285199015c12016dbc52990100000000010000008c51990140f58e77000000000000000078519901 (UID: 00000000-00001272)2d:T407,Found reference to API "GetWindowTextA" (Indicator: "GetWindowText"; Source: "00000000-00001272.00000000.67082.100EB000.00000004.mdmp, 00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp") Found reference to API "GetWindowTextLengthA" (Indicator: "GetWindowText"; Source: "00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp") Found reference to API "GetForegroundWindow" (Indicator: "GetForegroundWindow"; Source: "00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp") Found reference to API "EnumWindows" (Indicator: "EnumWindows"; Source: "00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp") Found reference to API "FindWindowA" (Indicator: "FindWindow"; Source: "00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp")2e:Ta66,Found reference to API "QAssist!CreateProcessNotifyCallback[irql:%d,pid:%d][info]: Create process, pid:%p, srcPid:%p, srcTid:%p, image:%wZ" (Indicator: "CreateProcess"; Source: "00000000-00001272.00000000.67082.100EB000.00000004.mdmp, 00000000-00001272.00000001.69006.00401000.00000004.mdmp") Found reference to API "QAssist!CreateProcessNotifyCallback[irql:%d,pid:%d][info]: Destroy process, pid:%p, srcPid:%p, srcTid:%p" (Indicator: "CreateProcess"; Source: "00000000-00001272.00000000.67082.100EB000.00000004.mdmp, 00000000-00001272.00000001.69006.00401000.00000004.mdmp") Found reference to API "QAssist!CreateProcessNotifyCallback[irql:%d,pid:%d][warning]: Error, can't allocate buffer" (Indicator: "CreateProcess"; Source: "00000000-00001272.00000000.67082.100EB000.00000004.mdmp, 00000000-00001272.00000001.69006.00401000.00000004.mdmp") Found reference to API "QAssist!CreateProcessNotifyCallback[irql:%d,pid:%d][warning]: Error, path normalization failed with code:%08x, path:%wZ" (Indicator: "CreateProcess"; Source: "00000000-00001272.00000000.67082.100EB000.00000004.mdmp, 00000000-00001272.00000001.69006.00401000.00000004.mdmp") Found reference to API "QAssist!CreateProcessNotifyCallback[irql:%d,pid:%d][trace]: Excluded process:%p" (Indicator: "CreateProcess"; Source: "00000000-00001272.00000000.67082.100EB000.00000004.mdmp, 00000000-00001272.00000001.69006.00401000.00000004.mdmp") Found reference to API "QAssist!CreateProcessNotifyCallback[irql:%d,pid:%d][trace]: Protected process:%p" (Indicator: "CreateProcess"; Source: "00000000-00001272.00000000.67082.100EB000.00000004.mdmp, 00000000-00001272.00000001.69006.00401000.00000004.mdmp") Found reference to API "QAssist!CreateProcessNotifyCallback[irql:%d,pid:%d][warning]: Warning, can't add process(pid:%p) to process table" (Indicator: "CreateProcess"; Source: "00000000-00001272.00000000.67082.100EB000.00000004.mdmp, 00000000-00001272.00000001.69006.00401000.00000004.mdmp") Found reference to API "QAssist!CreateProcessNotifyCallback[irql:%d,pid:%d][warning]: Warning, can't remove process(pid:%p) from process table" (Indicator: "CreateProcess"; Source: "00000000-00001272.00000000.67082.100EB000.00000004.mdmp, 00000000-00001272.00000001.69006.00401000.00000004.mdmp") Found reference to API "PsSetCreateProcessNotifyRoutineEx" (Indicator: "CreateProcess"; Source: "00000000-00001272.00000000.67082.100EB000.00000004.mdmp, 00000000-00001272.00000001.69006.00401000.00000004.mdmp") Found reference to API "CreateProcessA" (Indicator: "CreateProcess"; Source: "00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp")2f:Td367,Found reference to API (Indicator: "TerminateThread"; Source: "00000000-00001272.00000000.67082.100EB000.00000004.mdmp, 00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00001272.00000000.67082.100EB000.00000004.mdmp, 00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00001272.00000000.67082.100EB000.00000004.mdmp, 00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp") Found reference to API (Indicator: "ResumeThread"; Source: "00000000-00001272.00000000.67082.100EB000.00000004.mdmp, 00000000-00001272.00000001.69006.00401000.00000004.mdmp") Found reference to API (Indicator: "DispatchMessageA"; Source: "00000000-00001272.00000000.67082.100EB000.00000004.mdmp, 00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp") Found reference to API (Indicator: "TranslateMessage"; Source: "00000000-00001272.00000000.67082.100EB000.00000004.mdmp, 00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp") Found reference to API (Indicator: "GetMessageA"; Source: "00000000-00001272.00000000.67082.100EB000.00000004.mdmp, 00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp") Found reference to API (Indicator: "lstrlenA"; Source: "00000000-00001272.00000000.67082.100EB000.00000004.mdmp, 00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp") Found reference to API (Indicator: "GetWindowTextA"; Source: "00000000-00001272.00000000.67082.100EB000.00000004.mdmp, 00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp") Found reference to API (Indicator: "ZwUnloadDriver"; Source: "00000000-00001272.00000000.67082.100EB000.00000004.mdmp, 00000000-00001272.00000001.69006.00401000.00000004.mdmp") Found reference to API (Indicator: "RtlInitUnicodeString"; Source: "00000000-00001272.00000000.67082.100EB000.00000004.mdmp, 00000000-00001272.00000001.69006.00401000.00000004.mdmp") Found reference to API (Indicator: "CreateEventA"; Source: "00000000-00001272.00000000.67082.100EB000.00000004.mdmp, 00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00001272.00000000.67082.100EB000.00000004.mdmp, 00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00001272.00000000.67082.100EB000.00000004.mdmp, 00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp") Found reference to API (Indicator: "closesocket"; Source: "00000000-00001272.00000000.67082.100EB000.00000004.mdmp, 00000000-00001272.00000001.69006.00401000.00000004.mdmp") Found reference to API (Indicator: "getsockname"; Source: "00000000-00001272.00000000.67082.100EB000.00000004.mdmp, 00000000-00001272.00000001.69006.00401000.00000004.mdmp") Found reference to API (Indicator: "RegOpenKeyExA"; Source: "00000000-00001272.00000000.67082.100EB000.00000004.mdmp, 00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp") Found reference to API (Indicator: "ExAllocatePoolWithTag"; Source: "00000000-00001272.00000000.67082.100EB000.00000004.mdmp, 00000000-00001272.00000001.69006.00401000.00000004.mdmp") Found reference to API (Indicator: "ExFreePoolWithTag"; Source: "00000000-00001272.00000000.67082.100EB000.00000004.mdmp, 00000000-00001272.00000001.69006.00401000.00000004.mdmp") Found reference to API (Indicator: "ZwClose"; Source: "00000000-00001272.00000000.67082.100EB000.00000004.mdmp, 00000000-00001272.00000001.69006.00401000.00000004.mdmp") Found reference to API (Indicator: "ZwOpenKey"; Source: "00000000-00001272.00000000.67082.100EB000.00000004.mdmp, 00000000-00001272.00000001.69006.00401000.00000004.mdmp") Found reference to API (Indicator: "ZwQueryValueKey"; Source: "00000000-00001272.00000000.67082.100EB000.00000004.mdmp, 00000000-00001272.00000001.69006.00401000.00000004.mdmp") Found reference to API (Indicator: "PsGetCurrentProcessId"; Source: "00000000-00001272.00000000.67082.100EB000.00000004.mdmp, 00000000-00001272.00000001.69006.00401000.00000004.mdmp") Found reference to API (Indicator: "IofCompleteRequest"; Source: "00000000-00001272.00000000.67082.100EB000.00000004.mdmp, 00000000-00001272.00000001.69006.00401000.00000004.mdmp") Found reference to API (Indicator: "IoCreateDevice"; Source: "00000000-00001272.00000000.67082.100EB000.00000004.mdmp, 00000000-00001272.00000001.69006.00401000.00000004.mdmp") Found reference to API (Indicator: "IoCreateSymbolicLink"; Source: "00000000-00001272.00000000.67082.100EB000.00000004.mdmp, 00000000-00001272.00000001.69006.00401000.00000004.mdmp") Found reference to API (Indicator: "IoDeleteDevice"; Source: "00000000-00001272.00000000.67082.100EB000.00000004.mdmp, 00000000-00001272.00000001.69006.00401000.00000004.mdmp") Found reference to API (Indicator: "IoDeleteSymbolicLink"; Source: "00000000-00001272.00000000.67082.100EB000.00000004.mdmp, 00000000-00001272.00000001.69006.00401000.00000004.mdmp") Found reference to API (Indicator: "RtlAppendUnicodeStringToString"; Source: "00000000-00001272.00000000.67082.100EB000.00000004.mdmp, 00000000-00001272.00000001.69006.00401000.00000004.mdmp") Found reference to API (Indicator: "ZwOpenSymbolicLinkObject"; Source: "00000000-00001272.00000000.67082.100EB000.00000004.mdmp, 00000000-00001272.00000001.69006.00401000.00000004.mdmp") Found reference to API (Indicator: "ZwQuerySymbolicLinkObject"; Source: "00000000-00001272.00000000.67082.100EB000.00000004.mdmp, 00000000-00001272.00000001.69006.00401000.00000004.mdmp") Found reference to API (Indicator: "RtlPrefixUnicodeString"; Source: "00000000-00001272.00000000.67082.100EB000.00000004.mdmp, 00000000-00001272.00000001.69006.00401000.00000004.mdmp") Found reference to API (Indicator: "ZwQuerySystemInformation"; Source: "00000000-00001272.00000000.67082.100EB000.00000004.mdmp, 00000000-00001272.00000001.69006.00401000.00000004.mdmp") Found reference to API (Indicator: "ZwQueryInformationProcess"; Source: "00000000-00001272.00000000.67082.100EB000.00000004.mdmp, 00000000-00001272.00000001.69006.00401000.00000004.mdmp") Found reference to API (Indicator: "RtlCompareUnicodeString"; Source: "00000000-00001272.00000000.67082.100EB000.00000004.mdmp, 00000000-00001272.00000001.69006.00401000.00000004.mdmp") Found reference to API (Indicator: "RtlEqualUnicodeString"; Source: "00000000-00001272.00000000.67082.100EB000.00000004.mdmp, 00000000-00001272.00000001.69006.00401000.00000004.mdmp") Found reference to API (Indicator: "KeInitializeEvent"; Source: "00000000-00001272.00000000.67082.100EB000.00000004.mdmp, 00000000-00001272.00000001.69006.00401000.00000004.mdmp") Found reference to API (Indicator: "IoGetCurrentProcess"; Source: "00000000-00001272.00000000.67082.100EB000.00000004.mdmp, 00000000-00001272.00000001.69006.00401000.00000004.mdmp") Found reference to API (Indicator: "ObRegisterCallbacks"; Source: "00000000-00001272.00000000.67082.100EB000.00000004.mdmp, 00000000-00001272.00000001.69006.00401000.00000004.mdmp") Found reference to API (Indicator: "ObUnRegisterCallbacks"; Source: "00000000-00001272.00000000.67082.100EB000.00000004.mdmp, 00000000-00001272.00000001.69006.00401000.00000004.mdmp") Found reference to API (Indicator: "ZwOpenProcess"; Source: "00000000-00001272.00000000.67082.100EB000.00000004.mdmp, 00000000-00001272.00000001.69006.00401000.00000004.mdmp") Found reference to API (Indicator: "RtlCopyUnicodeString"; Source: "00000000-00001272.00000000.67082.100EB000.00000004.mdmp, 00000000-00001272.00000001.69006.00401000.00000004.mdmp") Found reference to API (Indicator: "RtlInitializeGenericTableAvl"; Source: "00000000-00001272.00000000.67082.100EB000.00000004.mdmp, 00000000-00001272.00000001.69006.00401000.00000004.mdmp") Found reference to API (Indicator: "RtlInsertElementGenericTableAvl"; Source: "00000000-00001272.00000000.67082.100EB000.00000004.mdmp, 00000000-00001272.00000001.69006.00401000.00000004.mdmp") Found reference to API (Indicator: "RtlDeleteElementGenericTableAvl"; Source: "00000000-00001272.00000000.67082.100EB000.00000004.mdmp, 00000000-00001272.00000001.69006.00401000.00000004.mdmp") Found reference to API (Indicator: "RtlEnumerateGenericTableWithoutSplayingAvl"; Source: "00000000-00001272.00000000.67082.100EB000.00000004.mdmp, 00000000-00001272.00000001.69006.00401000.00000004.mdmp") Found reference to API (Indicator: "RtlLookupElementGenericTableAvl"; Source: "00000000-00001272.00000000.67082.100EB000.00000004.mdmp, 00000000-00001272.00000001.69006.00401000.00000004.mdmp") Found reference to API (Indicator: "CmUnRegisterCallback"; Source: "00000000-00001272.00000000.67082.100EB000.00000004.mdmp, 00000000-00001272.00000001.69006.00401000.00000004.mdmp") Found reference to API (Indicator: "CmRegisterCallbackEx"; Source: "00000000-00001272.00000000.67082.100EB000.00000004.mdmp, 00000000-00001272.00000001.69006.00401000.00000004.mdmp") Found reference to API (Indicator: "CmCallbackGetKeyObjectID"; Source: "00000000-00001272.00000000.67082.100EB000.00000004.mdmp, 00000000-00001272.00000001.69006.00401000.00000004.mdmp") Found reference to API (Indicator: "ZwEnumerateKey"; Source: "00000000-00001272.00000000.67082.100EB000.00000004.mdmp, 00000000-00001272.00000001.69006.00401000.00000004.mdmp") Found reference to API (Indicator: "ZwEnumerateValueKey"; Source: "00000000-00001272.00000000.67082.100EB000.00000004.mdmp, 00000000-00001272.00000001.69006.00401000.00000004.mdmp") Found reference to API (Indicator: "RtlAssert"; Source: "00000000-00001272.00000000.67082.100EB000.00000004.mdmp, 00000000-00001272.00000001.69006.00401000.00000004.mdmp") Found reference to API (Indicator: "ExAllocatePoolWithQuotaTag"; Source: "00000000-00001272.00000000.67082.100EB000.00000004.mdmp, 00000000-00001272.00000001.69006.00401000.00000004.mdmp") Found reference to API (Indicator: "KeBugCheckEx"; Source: "00000000-00001272.00000000.67082.100EB000.00000004.mdmp, 00000000-00001272.00000001.69006.00401000.00000004.mdmp") Found reference to API (Indicator: "RtlUnwind"; Source: "00000000-00001272.00000000.67082.100EB000.00000004.mdmp, 00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000003.76445.0052F000.00000004.mdmp") Found reference to API (Indicator: "KeGetCurrentIrql"; Source: "00000000-00001272.00000000.67082.100EB000.00000004.mdmp, 00000000-00001272.00000001.69006.00401000.00000004.mdmp") Found reference to API (Indicator: "ExAcquireFastMutex"; Source: "00000000-00001272.00000000.67082.100EB000.00000004.mdmp, 00000000-00001272.00000001.69006.00401000.00000004.mdmp") Found reference to API (Indicator: "ExReleaseFastMutex"; Source: "00000000-00001272.00000000.67082.100EB000.00000004.mdmp, 00000000-00001272.00000001.69006.00401000.00000004.mdmp") Found reference to API (Indicator: "RtlGetNtVersionNumbers"; Source: "00000000-00001272.00000000.67082.100EB000.00000004.mdmp, 00000000-00001272.00000001.69006.00401000.00000004.mdmp") Found reference to API (Indicator: "CloseDesktop"; Source: "00000000-00001272.00000000.67082.100EB000.00000004.mdmp, 00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp") Found reference to API (Indicator: "GetThreadDesktop"; Source: "00000000-00001272.00000000.67082.100EB000.00000004.mdmp, 00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00001272.00000000.67082.100EB000.00000004.mdmp, 00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp, 00000000-00001272.00000003.76445.0052F000.00000004.mdmp") Found reference to API (Indicator: "OpenInputDesktop"; Source: "00000000-00001272.00000000.67082.100EB000.00000004.mdmp, 00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp") Found reference to API (Indicator: "OpenDesktopA"; Source: "00000000-00001272.00000000.67082.100EB000.00000004.mdmp, 00000000-00001272.00000001.69006.00401000.00000004.mdmp") Found reference to API (Indicator: "InternetReadFile"; Source: "00000000-00001272.00000000.67082.100EB000.00000004.mdmp, 00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp") Found reference to API (Indicator: "CreateFileA"; Source: "00000000-00001272.00000000.67082.100EB000.00000004.mdmp, 00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp") Found reference to API (Indicator: "InternetOpenUrlA"; Source: "00000000-00001272.00000000.67082.100EB000.00000004.mdmp, 00000000-00001272.00000001.69006.00401000.00000004.mdmp") Found reference to API (Indicator: "InternetCloseHandle"; Source: "00000000-00001272.00000000.67082.100EB000.00000004.mdmp, 00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp") Found reference to API (Indicator: "InternetOpenA"; Source: "00000000-00001272.00000000.67082.100EB000.00000004.mdmp, 00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00001272.00000000.67082.100EB000.00000004.mdmp, 00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp, 00000000-00001272.00000003.76445.0052F000.00000004.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00001272.00000000.67082.100EB000.00000004.mdmp, 00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp, 00000000-00001272.00000003.76445.0052F000.00000004.mdmp") Found reference to API (Indicator: "LookupPrivilegeValueA"; Source: "00000000-00001272.00000000.67082.100EB000.00000004.mdmp, 00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp") Found reference to API (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00001272.00000000.67082.100EB000.00000004.mdmp, 00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp") Found reference to API (Indicator: "OpenProcessToken"; Source: "00000000-00001272.00000000.67082.100EB000.00000004.mdmp, 00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp, 00000000-00001272.00000003.76445.0052F000.00000004.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp, 00000000-00001272.00000003.76445.0052F000.00000004.mdmp") Found reference to API (Indicator: "InterlockedExchange"; Source: "00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSection"; Source: "00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp, 00000000-00001272.00000003.76445.0052F000.00000004.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp") Found reference to API (Indicator: "VirtualFree"; Source: "00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp, 00000000-00001272.00000003.76445.0052F000.00000004.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp, 00000000-00001272.00000003.76445.0052F000.00000004.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp, 00000000-00001272.00000003.76445.0052F000.00000004.mdmp") Found reference to API (Indicator: "VirtualAlloc"; Source: "00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp, 00000000-00001272.00000003.76445.0052F000.00000004.mdmp") Found reference to API (Indicator: "GlobalUnlock"; Source: "00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp") Found reference to API (Indicator: "GlobalFree"; Source: "00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp") Found reference to API (Indicator: "GlobalLock"; Source: "00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp") Found reference to API (Indicator: "GlobalAlloc"; Source: "00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp") Found reference to API (Indicator: "GetLocalTime"; Source: "00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleA"; Source: "00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp, 00000000-00001272.00000003.76445.0052F000.00000004.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp") Found reference to API (Indicator: "LocalSize"; Source: "00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp") Found reference to API (Indicator: "LocalReAlloc"; Source: "00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp") Found reference to API (Indicator: "LocalAlloc"; Source: "00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp") Found reference to API (Indicator: "ResetEvent"; Source: "00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp") Found reference to API (Indicator: "CancelIo"; Source: "00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp, 00000000-00001272.00000003.76445.0052F000.00000004.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp, 00000000-00001272.00000003.76445.0052F000.00000004.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp, 00000000-00001272.00000003.76445.0052F000.00000004.mdmp") Found reference to API (Indicator: "HeapReAlloc"; Source: "00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp, 00000000-00001272.00000003.76445.0052F000.00000004.mdmp") Found reference to API (Indicator: "VirtualProtect"; Source: "00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp, 00000000-00001272.00000003.76445.0052F000.00000004.mdmp") Found reference to API (Indicator: "IsBadReadPtr"; Source: "00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp, 00000000-00001272.00000003.76445.0052F000.00000004.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp, 00000000-00001272.00000003.76445.0052F000.00000004.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp") Found reference to API (Indicator: "GetFileSize"; Source: "00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesA"; Source: "00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp, 00000000-00001272.00000003.76445.0052F000.00000004.mdmp") Found reference to API (Indicator: "SetFilePointer"; Source: "00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp") Found reference to API (Indicator: "IsWow64Process"; Source: "00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp") Found reference to API (Indicator: "DeleteFileA"; Source: "00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp") Found reference to API (Indicator: "lstrcpyA"; Source: "00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp") Found reference to API (Indicator: "CreateProcessA"; Source: "00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp") Found reference to API (Indicator: "lstrcatA"; Source: "00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp") Found reference to API (Indicator: "GetDriveTypeA"; Source: "00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp") Found reference to API (Indicator: "GetDiskFreeSpaceExA"; Source: "00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp") Found reference to API (Indicator: "FindNextFileA"; Source: "00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileA"; Source: "00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp") Found reference to API (Indicator: "RemoveDirectoryA"; Source: "00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp") Found reference to API (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp") Found reference to API (Indicator: "Process32Next"; Source: "00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp") Found reference to API (Indicator: "Process32First"; Source: "00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDirectoryA"; Source: "00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp, 00000000-00001272.00000003.76445.0052F000.00000004.mdmp") Found reference to API (Indicator: "OpenProcess"; Source: "00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp, 00000000-00001272.00000003.76445.0052F000.00000004.mdmp") Found reference to API (Indicator: "GetVersion"; Source: "00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp, 00000000-00001272.00000003.76445.0052F000.00000004.mdmp") Found reference to API (Indicator: "DeviceIoControl"; Source: "00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp") Found reference to API (Indicator: "Beep"; Source: "00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExA"; Source: "00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp, 00000000-00001272.00000003.76445.0052F000.00000004.mdmp") Found reference to API (Indicator: "GetModuleFileNameA"; Source: "00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp, 00000000-00001272.00000003.76445.0052F000.00000004.mdmp") Found reference to API (Indicator: "WinExec"; Source: "00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp") Found reference to API (Indicator: "GetCommandLineA"; Source: "00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp, 00000000-00001272.00000003.76445.0052F000.00000004.mdmp") Found reference to API (Indicator: "FreeConsole"; Source: "00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleProcessList"; Source: "00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp") Found reference to API (Indicator: "AttachConsole"; Source: "00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp") Found reference to API (Indicator: "GetWindowsDirectoryA"; Source: "00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp, 00000000-00001272.00000003.76445.0052F000.00000004.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp, 00000000-00001272.00000003.76445.0052F000.00000004.mdmp") Found reference to API (Indicator: "GlobalSize"; Source: "00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryW"; Source: "00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp") Found reference to API (Indicator: "GlobalMemoryStatusEx"; Source: "00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp") Found reference to API (Indicator: "GetSystemInfo"; Source: "00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp") Found reference to API (Indicator: "ReleaseMutex"; Source: "00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp") Found reference to API (Indicator: "CreateMutexA"; Source: "00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThread"; Source: "00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp") Found reference to API (Indicator: "GetEnvironmentVariableA"; Source: "00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp, 00000000-00001272.00000003.76445.0052F000.00000004.mdmp") Found reference to API (Indicator: "lstrcpyW"; Source: "00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp") Found reference to API (Indicator: "Module32Next"; Source: "00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp") Found reference to API (Indicator: "lstrcmpiA"; Source: "00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp") Found reference to API (Indicator: "Module32First"; Source: "00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp") Found reference to API (Indicator: "CreateRemoteThread"; Source: "00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp") Found reference to API (Indicator: "GetProcessId"; Source: "00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp") Found reference to API (Indicator: "SendMessageA"; Source: "00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp") Found reference to API (Indicator: "IsDialogMessageA"; Source: "00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp") Found reference to API (Indicator: "SetWindowPos"; Source: "00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp") Found reference to API (Indicator: "SetWindowTextA"; Source: "00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp") Found reference to API (Indicator: "SetFocus"; Source: "00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp") Found reference to API (Indicator: "DestroyWindow"; Source: "00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp") Found reference to API (Indicator: "SetClassLongA"; Source: "00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp") Found reference to API (Indicator: "LoadIconA"; Source: "00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp") Found reference to API (Indicator: "SetWindowLongA"; Source: "00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp") Found reference to API (Indicator: "PostQuitMessage"; Source: "00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp") Found reference to API (Indicator: "GetWindowLongA"; Source: "00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp") Found reference to API (Indicator: "ShowWindow"; Source: "00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp") Found reference to API (Indicator: "wsprintfA"; Source: "00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp") Found reference to API (Indicator: "MessageBoxA"; Source: "00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp") Found reference to API (Indicator: "GetForegroundWindow"; Source: "00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp") Found reference to API (Indicator: "GetAsyncKeyState"; Source: "00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp") Found reference to API (Indicator: "GetKeyState"; Source: "00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp") Found reference to API (Indicator: "EnumWindows"; Source: "00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp") Found reference to API (Indicator: "ExitWindowsEx"; Source: "00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp") Found reference to API (Indicator: "GetWindowRect"; Source: "00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp") Found reference to API (Indicator: "MoveWindow"; Source: "00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp") Found reference to API (Indicator: "FindWindowA"; Source: "00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp") Found reference to API (Indicator: "GetSystemMetrics"; Source: "00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp") Found reference to API (Indicator: "GetDC"; Source: "00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp") Found reference to API (Indicator: "LoadCursorA"; Source: "00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp") Found reference to API (Indicator: "DestroyCursor"; Source: "00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp") Found reference to API (Indicator: "ReleaseDC"; Source: "00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp") Found reference to API (Indicator: "SystemParametersInfoA"; Source: "00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp") Found reference to API (Indicator: "MapVirtualKeyA"; Source: "00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp") Found reference to API (Indicator: "CloseClipboard"; Source: "00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp") Found reference to API (Indicator: "SetClipboardData"; Source: "00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp") Found reference to API (Indicator: "EmptyClipboard"; Source: "00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp") Found reference to API (Indicator: "OpenClipboard"; Source: "00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp") Found reference to API (Indicator: "GetClipboardData"; Source: "00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp") Found reference to API (Indicator: "PostMessageA"; Source: "00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp") Found reference to API (Indicator: "SetCapture"; Source: "00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp") Found reference to API (Indicator: "WindowFromPoint"; Source: "00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp") Found reference to API (Indicator: "SetCursorPos"; Source: "00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp") Found reference to API (Indicator: "GetCursorInfo"; Source: "00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp") Found reference to API (Indicator: "GetCursorPos"; Source: "00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp") Found reference to API (Indicator: "SetRect"; Source: "00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp") Found reference to API (Indicator: "GetDesktopWindow"; Source: "00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp") Found reference to API (Indicator: "GetClassNameA"; Source: "00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp") Found reference to API (Indicator: "GetWindow"; Source: "00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp") Found reference to API (Indicator: "GetLastInputInfo"; Source: "00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp") Found reference to API (Indicator: "GetWindowThreadProcessId"; Source: "00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp") Found reference to API (Indicator: "IsWindowVisible"; Source: "00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp") Found reference to API (Indicator: "SetThreadDesktop"; Source: "00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp") Found reference to API (Indicator: "GetUserObjectInformationA"; Source: "00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp") Found reference to API (Indicator: "GetDeviceCaps"; Source: "00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp") Found reference to API (Indicator: "SelectObject"; Source: "00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp") Found reference to API (Indicator: "CreateCompatibleDC"; Source: "00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp") Found reference to API (Indicator: "DeleteObject"; Source: "00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp") Found reference to API (Indicator: "DeleteDC"; Source: "00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp") Found reference to API (Indicator: "BitBlt"; Source: "00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp") Found reference to API (Indicator: "GetDIBits"; Source: "00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp") Found reference to API (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp") Found reference to API (Indicator: "GetUserNameA"; Source: "00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp") Found reference to API (Indicator: "CloseEventLog"; Source: "00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp") Found reference to API (Indicator: "OpenEventLogA"; Source: "00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp") Found reference to API (Indicator: "RegSetValueExA"; Source: "00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp") Found reference to API (Indicator: "RegCreateKeyA"; Source: "00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp") Found reference to API (Indicator: "StartServiceA"; Source: "00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp") Found reference to API (Indicator: "CloseServiceHandle"; Source: "00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp") Found reference to API (Indicator: "OpenServiceA"; Source: "00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp") Found reference to API (Indicator: "OpenSCManagerA"; Source: "00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp") Found reference to API (Indicator: "SetServiceStatus"; Source: "00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp") Found reference to API (Indicator: "DeleteService"; Source: "00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp") Found reference to API (Indicator: "SetSecurityDescriptorDacl"; Source: "00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp") Found reference to API (Indicator: "InitializeSecurityDescriptor"; Source: "00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp") Found reference to API (Indicator: "RegEnumValueA"; Source: "00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp") Found reference to API (Indicator: "RegEnumKeyExA"; Source: "00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExA"; Source: "00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp") Found reference to API (Indicator: "RegDeleteValueA"; Source: "00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp") Found reference to API (Indicator: "RegDeleteKeyA"; Source: "00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp") Found reference to API (Indicator: "RegQueryInfoKeyA"; Source: "00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp") Found reference to API (Indicator: "RegCreateKeyExA"; Source: "00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp") Found reference to API (Indicator: "ChangeServiceConfigA"; Source: "00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp") Found reference to API (Indicator: "ControlService"; Source: "00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp") Found reference to API (Indicator: "QueryServiceStatus"; Source: "00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyA"; Source: "00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp") Found reference to API (Indicator: "SHGetSpecialFolderPathA"; Source: "00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp") Found reference to API (Indicator: "ShellExecuteExA"; Source: "00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp") Found reference to API (Indicator: "CoUninitialize"; Source: "00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp") Found reference to API (Indicator: "CoInitialize"; Source: "00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp") Found reference to API (Indicator: "WSAIoctl"; Source: "00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp") Found reference to API (Indicator: "GetIfTable"; Source: "00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp") Found reference to API (Indicator: "NetUserSetInfo"; Source: "00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp") Found reference to API (Indicator: "NetUserGetLocalGroups"; Source: "00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp") Found reference to API (Indicator: "NetApiBufferFree"; Source: "00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp") Found reference to API (Indicator: "NetUserGetInfo"; Source: "00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp") Found reference to API (Indicator: "NetUserEnum"; Source: "00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp") Found reference to API (Indicator: "NetLocalGroupAddMembers"; Source: "00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp") Found reference to API (Indicator: "NetUserAdd"; Source: "00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp") Found reference to API (Indicator: "NetUserDel"; Source: "00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp") Found reference to API (Indicator: "HttpQueryInfoA"; Source: "00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp") Found reference to API (Indicator: "HttpSendRequestA"; Source: "00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp") Found reference to API (Indicator: "HttpOpenRequestA"; Source: "00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp") Found reference to API (Indicator: "InternetConnectA"; Source: "00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp") Found reference to API (Indicator: "InternetGetConnectedState"; Source: "00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp") Found reference to API (Indicator: "WTSFreeMemory"; Source: "00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp") Found reference to API (Indicator: "WTSQuerySessionInformationA"; Source: "00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp") Found reference to API (Indicator: "WTSLogoffSession"; Source: "00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp") Found reference to API (Indicator: "WTSDisconnectSession"; Source: "00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp") Found reference to API (Indicator: "WTSQuerySessionInformationW"; Source: "00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp") Found reference to API (Indicator: "WTSEnumerateSessionsA"; Source: "00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00001272.00000003.76445.0052F000.00000004.mdmp") Found reference to API (Indicator: "GetStartupInfoA"; Source: "00000000-00001272.00000003.76445.0052F000.00000004.mdmp") Found reference to API (Indicator: "TlsSetValue"; Source: "00000000-00001272.00000003.76445.0052F000.00000004.mdmp") Found reference to API (Indicator: "TlsAlloc"; Source: "00000000-00001272.00000003.76445.0052F000.00000004.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00001272.00000003.76445.0052F000.00000004.mdmp") Found reference to API (Indicator: "TlsGetValue"; Source: "00000000-00001272.00000003.76445.0052F000.00000004.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00001272.00000003.76445.0052F000.00000004.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00001272.00000003.76445.0052F000.00000004.mdmp") Found reference to API (Indicator: "FreeEnvironmentStringsA"; Source: "00000000-00001272.00000003.76445.0052F000.00000004.mdmp") Found reference to API (Indicator: "FreeEnvironmentStringsW"; Source: "00000000-00001272.00000003.76445.0052F000.00000004.mdmp") Found reference to API (Indicator: "GetEnvironmentStrings"; Source: "00000000-00001272.00000003.76445.0052F000.00000004.mdmp") Found reference to API (Indicator: "GetEnvironmentStringsW"; Source: "00000000-00001272.00000003.76445.0052F000.00000004.mdmp") Found reference to API (Indicator: "SetHandleCount"; Source: "00000000-00001272.00000003.76445.0052F000.00000004.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00001272.00000003.76445.0052F000.00000004.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00001272.00000003.76445.0052F000.00000004.mdmp") Found reference to API (Indicator: "HeapDestroy"; Source: "00000000-00001272.00000003.76445.0052F000.00000004.mdmp") Found reference to API (Indicator: "HeapCreate"; Source: "00000000-00001272.00000003.76445.0052F000.00000004.mdmp") Found reference to API (Indicator: "IsBadWritePtr"; Source: "00000000-00001272.00000003.76445.0052F000.00000004.mdmp") Found reference to API (Indicator: "IsBadCodePtr"; Source: "00000000-00001272.00000003.76445.0052F000.00000004.mdmp") Found reference to API (Indicator: "GetCPInfo"; Source: "00000000-00001272.00000003.76445.0052F000.00000004.mdmp") Found reference to API (Indicator: "GetACP"; Source: "00000000-00001272.00000003.76445.0052F000.00000004.mdmp") Found reference to API (Indicator: "GetOEMCP"; Source: "00000000-00001272.00000003.76445.0052F000.00000004.mdmp") Found reference to API (Indicator: "LCMapStringA"; Source: "00000000-00001272.00000003.76445.0052F000.00000004.mdmp") Found reference to API (Indicator: "LCMapStringW"; Source: "00000000-00001272.00000003.76445.0052F000.00000004.mdmp") Found reference to API (Indicator: "GetStringTypeA"; Source: "00000000-00001272.00000003.76445.0052F000.00000004.mdmp") Found reference to API (Indicator: "GetStringTypeW"; Source: "00000000-00001272.00000003.76445.0052F000.00000004.mdmp") Found reference to API (Indicator: "InterlockedDecrement"; Source: "00000000-00001272.00000003.76445.0052F000.00000004.mdmp") Found reference to API (Indicator: "InterlockedIncrement"; Source: "00000000-00001272.00000003.76445.0052F000.00000004.mdmp")30:Ta70,"Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00001272.00000000.67082.001E0000.00000004.mdmp 00000000-00001272.00000001.69006.001E0000.00000004.mdmp 00000000-00001272.00000002.70931.001E0000.00000004.mdmp 00000000-00001272.00000003.76445.001E0000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Services\%S" in Source: 00000000-00001272.00000000.67082.100EB000.00000004.mdmp 00000000-00001272.00000001.69006.00401000.00000004.mdmp "\REGISTRY\MACHINE\SYSTEM\CurrentControlSet" in Source: 00000000-00001272.00000000.67082.100EB000.00000004.mdmp 00000000-00001272.00000001.69006.00401000.00000004.mdmp "\REGISTRY\MACHINE\SYSTEM\ControlSet001\%wZ" in Source: 00000000-00001272.00000000.67082.100EB000.00000004.mdmp 00000000-00001272.00000001.69006.00401000.00000004.mdmp "\REGISTRY\MACHINE\SYSTEM\ControlSet001" in Source: 00000000-00001272.00000000.67082.100EB000.00000004.mdmp 00000000-00001272.00000001.69006.00401000.00000004.mdmp "REGISTRY\MACHINE\SYSTEM\CurrentControlSet" in Source: 00000000-00001272.00000000.67082.100EB000.00000004.mdmp 00000000-00001272.00000001.69006.00401000.00000004.mdmp "REGISTRY\MACHINE\SYSTEM\ControlSet001\%wZ" in Source: 00000000-00001272.00000000.67082.100EB000.00000004.mdmp 00000000-00001272.00000001.69006.00401000.00000004.mdmp "REGISTRY\MACHINE\SYSTEM\ControlSet001" in Source: 00000000-00001272.00000000.67082.100EB000.00000004.mdmp 00000000-00001272.00000001.69006.00401000.00000004.mdmp "SYSTEM\CurrentControlSet\Services\BITS" in Source: 00000000-00001272.00000000.67082.100EB000.00000004.mdmp 00000000-00001272.00000001.69006.00401000.00000004.mdmp "SYSTEM\CurrentControlSet\Services\" in Source: 00000000-00001272.00000000.67082.100EB000.00000004.mdmp 00000000-00001272.00000001.69006.00401000.00000004.mdmp "Software\Microsoft\Windows\DWM" in Source: 00000000-00001272.00000000.67082.100EB000.00000004.mdmp 00000000-00001272.00000001.69006.00401000.00000004.mdmp "SYSTEM\CurrentControlSet\Services\%s" in Source: 00000000-00001272.00000000.67082.100EB000.00000004.mdmp 00000000-00001272.00000001.69006.00401000.00000004.mdmp "SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\%s" in Source: 00000000-00001272.00000000.67082.100EB000.00000004.mdmp 00000000-00001272.00000001.69006.00401000.00000004.mdmp "SYSTEM\CurrentControlSet\Control\Terminal Server" in Source: 00000000-00001272.00000000.67082.100EB000.00000004.mdmp 00000000-00001272.00000001.69006.00401000.00000004.mdmp "HARDWARE\DESCRIPTION\System\CentralProcessor\0" in Source: 00000000-00001272.00000000.67082.100EB000.00000004.mdmp 00000000-00001272.00000001.69006.00401000.00000004.mdmp31:T41a,"7aad7c8ad75a96d9dd0f32ae5b51aca7.exe" trying to access non-existent file "\Device\RasAcd" "7aad7c8ad75a96d9dd0f32ae5b51aca7.exe" trying to access non-existent file "B:" "7aad7c8ad75a96d9dd0f32ae5b51aca7.exe" trying to access non-existent file "D:" "7aad7c8ad75a96d9dd0f32ae5b51aca7.exe" trying to access non-existent file "E:" "7aad7c8ad75a96d9dd0f32ae5b51aca7.exe" trying to access non-existent file "F:" "7aad7c8ad75a96d9dd0f32ae5b51aca7.exe" trying to access non-existent file "G:" "7aad7c8ad75a96d9dd0f32ae5b51aca7.exe" trying to access non-existent file "H:" "7aad7c8ad75a96d9dd0f32ae5b51aca7.exe" trying to access non-existent file "I:" "7aad7c8ad75a96d9dd0f32ae5b51aca7.exe" trying to access non-existent file "J:" "7aad7c8ad75a96d9dd0f32ae5b51aca7.exe" trying to access non-existent file "K:" "7aad7c8ad75a96d9dd0f32ae5b51aca7.exe" trying to access non-existent file "L:" "7aad7c8ad75a96d9dd0f32ae5b51aca7.exe" trying to access non-existent file "M:" "7aad7c8ad75a96d9dd0f32ae5b51aca7.exe" trying to access non-existent file "N:"32:T89b,Found reference to API "InternetOpenA" (Indicator: "InternetOpen"; Source: "00000000-00001272-00000C26-44845798") Found reference to API "InternetConnectA" (Indicator: "InternetConnect"; Source: "00000000-00001272-00000C26-44846378") Found reference to API "HttpOpenRequestA" (Indicator: "HttpOpenRequest"; Source: "00000000-00001272-00000C26-44848059") Found reference to API "HttpSendRequestA" (Indicator: "HttpSendRequest"; Source: "00000000-00001272-00000C26-44848649") Found reference to API "HttpQueryInfoA" (Indicator: "HttpQueryInfo"; Source: "00000000-00001272-00000C26-44849229") Found reference to API "InternetReadFile" (Indicator: "InternetReadFile"; Source: "00000000-00001272-00000C26-44849809") Found reference to API "InternetReadFile" (Indicator: "InternetReadFile"; Source: "00000000-00001272.00000000.67082.100EB000.00000004.mdmp, 00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp") Found reference to API "InternetOpenUrlA" (Indicator: "InternetOpen"; Source: "00000000-00001272.00000000.67082.100EB000.00000004.mdmp, 00000000-00001272.00000001.69006.00401000.00000004.mdmp") Found reference to API "InternetOpenA" (Indicator: "InternetOpen"; Source: "00000000-00001272.00000000.67082.100EB000.00000004.mdmp, 00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp") Found reference to API "HttpQueryInfoA" (Indicator: "HttpQueryInfo"; Source: "00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp") Found reference to API "HttpSendRequestA" (Indicator: "HttpSendRequest"; Source: "00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp") Found reference to API "HttpOpenRequestA" (Indicator: "HttpOpenRequest"; Source: "00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp") Found reference to API "InternetConnectA" (Indicator: "InternetConnect"; Source: "00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp")33:Tefc,Found URL "http://ptlogin2.qun.qq.com%saccept-language:" - Source: "00000000-00001272.00000000.67082.100EB000.00000004.mdmp") Found URL "https://ssl.ptlogin2.qq.com%saccept-language:" - Source: "00000000-00001272.00000000.67082.100EB000.00000004.mdmp") Found URL "https://localhost.ptlogin2.qq.com:4301%saccept-language:" - Source: "00000000-00001272.00000000.67082.100EB000.00000004.mdmp") Found URL "http://qun.qq.com%saccept-language:" - Source: "00000000-00001272.00000000.67082.100EB000.00000004.mdmp") Found URL "https://xui.ptlogin2.qq.com/cgi-bin/xlogin?appid=715030901&daid=73&hide_close_icon=1&pt_no_auth=1&s_url=http%3a%2f%2fqun.qq.com%2fmember.html%23accept-language:" - Source: "00000000-00001272.00000000.67082.100EB000.00000004.mdmp") Found URL "https://www.verisign.com/rpa" - Source: "00000000-00001272.00000000.67082.100EB000.00000004.mdmp") Found URL "http://csc3-2010-crl.verisign.com/csc3-2010.crl0d=0;090*0(https://www.verisign.com/rpa0e0c0$http://ocsp.verisign.com0;/http://csc3-2010-aia.verisign.com/csc3-2010.cer0+" - Source: "00000000-00001272.00000000.67082.100EB000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftcodeverifroot.crl0,n\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00007312.00000000.67151.02910000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"659200659677e5a1ed039366"}]},{"level":"informative","category":"Cryptographic Related","name":"Sample file has high entropy (likely encrypted/compressed content)","description":"Sample file \"sample.bin\" has high entropy 7.290283880215465","origin":"Binary File","mitre_attack_id":"T1027","relevance":1,"id":"binary-71","sources":[{"report_type":"sandbox","report_id":"659200659677e5a1ed039366"},{"report_type":"sandbox","report_id":"659200968ced01c068003062"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Sample file has high entropy (likely encrypted/compressed content)","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"659200659677e5a1ed039366"},{"report_type":"sandbox","report_id":"659200968ced01c068003062"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"\"7aad7c8ad75a96d9dd0f32ae5b51aca7.exe\" called \"RtlGetVersion\" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000018000000aa3d50b5432a1174e8228f00687d4f7588f18f00505911744eddccc1feffffffa4f08f00c244107448f08f000000427540f18f00db441074e0df077508000000000000000000000000000000000000000000000000000000000000000100000000000000ffffffffffffffff3400000000000000d0f08f000000000008000000000000000000000000000000000000000000000000000000b23d50b50000000010f18f006992de74ffffffff34000000d0f08f0008000000000000000000427540f18f002794de74d8f08f000b0000000000000028f18f00 (UID: 00000000-00007312)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"659200659677e5a1ed039366"},{"report_type":"sandbox","report_id":"659200968ced01c068003062"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"7aad7c8ad75a96d9dd0f32ae5b51aca7.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"659200659677e5a1ed039366"},{"report_type":"sandbox","report_id":"659200968ced01c068003062"}]},{"level":"informative","category":"General","name":"An application crash occurred","description":"Report process \"WerFault.exe\" was created by \"7aad7c8ad75a96d9dd0f32ae5b51aca7.exe\"","origin":"Monitored Target","id":"target-2","sources":[{"report_type":"sandbox","report_id":"659200659677e5a1ed039366"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"\"7aad7c8ad75a96d9dd0f32ae5b51aca7.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007312)\n \"7aad7c8ad75a96d9dd0f32ae5b51aca7.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007312)\n \"7aad7c8ad75a96d9dd0f32ae5b51aca7.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007312)\n \"7aad7c8ad75a96d9dd0f32ae5b51aca7.exe\" called \"LoadLibrary\" with a parameter kernel32 (UID: 00000000-00007312)","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"659200659677e5a1ed039366"},{"report_type":"sandbox","report_id":"659200968ced01c068003062"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$27","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"659200659677e5a1ed039366"},{"report_type":"sandbox","report_id":"659200968ced01c068003062"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically determine API calls","description":"Found GetProcAddress() and LoadLibraryA() in an import section (Source: 7aad7c8ad75a96d9dd0f32ae5b51aca7)","origin":"Static Parser","mitre_attack_id":"T1027.007","relevance":1,"id":"static-79","sources":[{"report_type":"sandbox","report_id":"659200659677e5a1ed039366"},{"report_type":"sandbox","report_id":"659200968ced01c068003062"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$28","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"659200659677e5a1ed039366"},{"report_type":"sandbox","report_id":"659200968ced01c068003062"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"7aad7c8ad75a96d9dd0f32ae5b51aca7.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 74800000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"659200659677e5a1ed039366"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"7aad7c8ad75a96d9dd0f32ae5b51aca7.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 762B0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"659200659677e5a1ed039366"},{"report_type":"sandbox","report_id":"659200968ced01c068003062"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"7aad7c8ad75a96d9dd0f32ae5b51aca7\" was detected as \"EP:Microsoft Visual C/C++\" and name: \"Compiler\"\n \"7aad7c8ad75a96d9dd0f32ae5b51aca7\" was detected as \"Microsoft Visual C/C++\" and name: \"Compiler\"\n \"7aad7c8ad75a96d9dd0f32ae5b51aca7\" was detected as \"Microsoft Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"659200659677e5a1ed039366"},{"report_type":"sandbox","report_id":"659200968ced01c068003062"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"7aad7c8ad75a96d9dd0f32ae5b51aca7\" has an writable section named \".data\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"659200659677e5a1ed039366"},{"report_type":"sandbox","report_id":"659200968ced01c068003062"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"\"7aad7c8ad75a96d9dd0f32ae5b51aca7\" file has an entrypoint instructions - \"push\tebp,mov\tebp, esp,push\t-1,push\t0x528400,push\t0x52b564,mov\teax, dword ptr fs:[0],push\teax,mov\tdword ptr fs:[0], esp,sub\tesp, 0x58,push\tebx,push\tesi,push\tedi,mov\tdword ptr [ebp - 0x18], esp,call\tdword ptr [0x401044],xor\tedx, edx,mov\tdl, ah,mov\tdword ptr [0x52f17c], edx,mov\tecx, eax,and\tecx, 0xff,mov\tdword ptr [0x52f178], ecx,shl\tecx, 8,add\tecx, edx,mov\tdword ptr [0x52f174], ecx,shr\teax, 0x10,mov\tdword ptr [0x52f170], eax,push\t1,call\t0x52b4fe,pop\tecx,test\teax, eax,jne\t0x529d4c,\"","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"659200659677e5a1ed039366"},{"report_type":"sandbox","report_id":"659200968ced01c068003062"}]},{"level":"informative","category":"General","name":"PE file has a big raw size section","description":"Raw size of \".data\" is \"0x12ee00\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-125","sources":[{"report_type":"sandbox","report_id":"659200659677e5a1ed039366"},{"report_type":"sandbox","report_id":"659200968ced01c068003062"}]},{"level":"informative","category":"General","name":"PE file has a big virtual size section","description":"Virtual size of \".data\" is \"0x12ed00\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-124","sources":[{"report_type":"sandbox","report_id":"659200659677e5a1ed039366"},{"report_type":"sandbox","report_id":"659200968ced01c068003062"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"7aad7c8ad75a96d9dd0f32ae5b51aca7.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"659200659677e5a1ed039366"},{"report_type":"sandbox","report_id":"659200968ced01c068003062"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"WerFault.exe\" with commandline \"-pss -s 460 -p 7312 -ip 7312\" (UID: 00000000-00006340)\n Spawned process \"WerFault.exe\" with commandline \"-u -p 7312 -s 380\" (UID: 00000000-00002652)\n Spawned process \"WerFault.exe\" with commandline \"-u -p 7312 -s 380\" (UID: 00000000-00002676)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"659200659677e5a1ed039366"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"WerFault.exe\" with commandline \"-pss -s 460 -p 7312 -ip 7312\" (UID: 00000000-00006340)\n Spawned process \"WerFault.exe\" with commandline \"-u -p 7312 -s 380\" (UID: 00000000-00002652)\n Spawned process \"WerFault.exe\" with commandline \"-u -p 7312 -s 380\" (UID: 00000000-00002676)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"659200659677e5a1ed039366"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"7aad7c8ad75a96d9dd0f32ae5b51aca7\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"659200659677e5a1ed039366"},{"report_type":"sandbox","report_id":"659200968ced01c068003062"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$29","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"659200659677e5a1ed039366"},{"report_type":"sandbox","report_id":"659200968ced01c068003062"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"7aad7c8ad75a96d9dd0f32ae5b51aca7.exe\" queries basic process information of the \"C:\\7aad7c8ad75a96d9dd0f32ae5b51aca7.exe\" (UID: 7312)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"659200659677e5a1ed039366"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$2a","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"659200659677e5a1ed039366"},{"report_type":"sandbox","report_id":"659200968ced01c068003062"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"\"7aad7c8ad75a96d9dd0f32ae5b51aca7.exe\" trying to touch file \"\\Device\\HarddiskVolume2\\Windows\\System32\\WOW64LOG.DLL\"\n \"7aad7c8ad75a96d9dd0f32ae5b51aca7.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\apphelp.dll\"\n \"7aad7c8ad75a96d9dd0f32ae5b51aca7.exe\" trying to touch file \"C:\\7aad7c8ad75a96d9dd0f32ae5b51aca7.exe\"\n \"7aad7c8ad75a96d9dd0f32ae5b51aca7.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\ntdll.dll\"\n \"7aad7c8ad75a96d9dd0f32ae5b51aca7.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\kernel32.dll\"\n \"7aad7c8ad75a96d9dd0f32ae5b51aca7.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\KernelBase.dll\"\n \"7aad7c8ad75a96d9dd0f32ae5b51aca7.exe\" trying to touch file \"C:\\Windows\\apppatch\\sysmain.sdb\"\n \"7aad7c8ad75a96d9dd0f32ae5b51aca7.exe\" trying to touch file \"C:\\Windows\\Temp\\VxSSL32.dll\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"659200659677e5a1ed039366"},{"report_type":"sandbox","report_id":"659200968ced01c068003062"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"\"7aad7c8ad75a96d9dd0f32ae5b51aca7.exe\" trying to access non-existent file \"\\Device\\HarddiskVolume2\\Windows\\System32\\WOW64LOG.DLL\"\n \"7aad7c8ad75a96d9dd0f32ae5b51aca7.exe\" trying to access non-existent file \"\\Device\\HarddiskVolume2\\FLTLIB.DLL\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"659200659677e5a1ed039366"},{"report_type":"sandbox","report_id":"659200968ced01c068003062"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"QA.In\"\n Pattern match: \"http://www.w3.org/2001/XMLSchema-instance\"\n Heuristic match: \"Ht@.Ht\"","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"659200659677e5a1ed039366"},{"report_type":"sandbox","report_id":"659200968ced01c068003062"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: bd0bf25947d4a37404f0424edf4db9ad\n Observed JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"659200659677e5a1ed039366"},{"report_type":"sandbox","report_id":"659200968ced01c068003062"}]},{"level":"informative","category":"Network Related","name":"Making HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"659200659677e5a1ed039366"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"7aad7c8ad75a96d9dd0f32ae5b51aca7.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"659200659677e5a1ed039366"},{"report_type":"sandbox","report_id":"659200968ced01c068003062"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to capture screen (API string)","description":"$2b","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"659200659677e5a1ed039366"},{"report_type":"sandbox","report_id":"659200968ced01c068003062"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Imports GetCommandLine API","description":"Observed import api \"GetCommandLineA\" which can \"Retrieves the command-line string for the current process\" [Source: 7aad7c8ad75a96d9dd0f32ae5b51aca7]","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-88","sources":[{"report_type":"sandbox","report_id":"659200659677e5a1ed039366"},{"report_type":"sandbox","report_id":"659200968ced01c068003062"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"7aad7c8ad75a96d9dd0f32ae5b51aca7\" was detected as \"Microsoft visual C++ 5.0\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"659200659677e5a1ed039366"},{"report_type":"sandbox","report_id":"659200968ced01c068003062"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"7aad7c8ad75a96d9dd0f32ae5b51aca7.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"659200659677e5a1ed039366"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries process information","description":"\"7aad7c8ad75a96d9dd0f32ae5b51aca7.exe\" queried SystemProcessInformation at 00000000-00007312-00000C13-37820041 [PID: 7312]\n \"7aad7c8ad75a96d9dd0f32ae5b51aca7.exe\" queried SystemProcessInformation at 00000000-00007312-00000C13-37821360 [PID: 7312]","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"659200659677e5a1ed039366"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":".data with unusual entropies 7.2918862768","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":3,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"659200659677e5a1ed039366"},{"report_type":"sandbox","report_id":"659200968ced01c068003062"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Tries to detect debugger using ProcessDebugPort","description":"\"7aad7c8ad75a96d9dd0f32ae5b51aca7.exe queries ProcessDebugPort (UID: 7312)","origin":"API Call","mitre_attack_id":"T1622","relevance":5,"id":"api-238","sources":[{"report_type":"sandbox","report_id":"659200659677e5a1ed039366"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"60/72 Antivirus vendors marked sample as malicious (83% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"659200659677e5a1ed039366"},{"report_type":"sandbox","report_id":"659200968ced01c068003062"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"7aad7c8ad75a96d9dd0f32ae5b51aca7\" claimed CRC 1293837 while the actual is CRC 1274871","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"659200659677e5a1ed039366"},{"report_type":"sandbox","report_id":"659200968ced01c068003062"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Entrypoint in PE header is within an uncommon section","description":"\"7aad7c8ad75a96d9dd0f32ae5b51aca7\" has an entrypoint in section \".data\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-4","sources":[{"report_type":"sandbox","report_id":"659200659677e5a1ed039366"},{"report_type":"sandbox","report_id":"659200968ced01c068003062"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"VirtualProtect\n GetVersionExA\n GetModuleFileNameA\n LoadLibraryA\n UnhandledExceptionFilter\n GetCommandLineA\n GetProcAddress\n GetModuleHandleA\n WriteFile\n GetStartupInfoA\n TerminateProcess\n VirtualAlloc","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"659200659677e5a1ed039366"},{"report_type":"sandbox","report_id":"659200968ced01c068003062"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"659200659677e5a1ed039366"},{"report_type":"sandbox","report_id":"659200968ced01c068003062"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"60/72 Antivirus vendors marked sample as malicious (83% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"659200659677e5a1ed039366"},{"report_type":"sandbox","report_id":"659200968ced01c068003062"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted Antivirus engine","description":"No specific details available","origin":"External System","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"659200659677e5a1ed039366"},{"report_type":"sandbox","report_id":"659200968ced01c068003062"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Calls an API typically used to find a resource in a module","description":"\"7aad7c8ad75a96d9dd0f32ae5b51aca7.exe\" called \"FindResourceA\" with parameter \"3585\" - (UID: 00000000-00001272)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-140","sources":[{"report_type":"sandbox","report_id":"659200968ced01c068003062"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to create a remote thread (API string)","description":"Found reference to API \"CreateRemoteThread\" (Indicator: \"CreateRemoteThread\"; Source: \"00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-79","sources":[{"report_type":"sandbox","report_id":"659200968ced01c068003062"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"Found reference to API \"WaitForSingleObject\" (Indicator: \"WaitForSingleObject\"; Source: \"00000000-00001272.00000000.67082.100EB000.00000004.mdmp, 00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp\")","origin":"File/Memory","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"659200968ced01c068003062"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to delete all entries from an event log (API string)","description":"Found reference to API \"ClearEventLogA\" (Indicator: \"ClearEventLog\"; Source: \"00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.001","relevance":1,"id":"string-211","sources":[{"report_type":"sandbox","report_id":"659200968ced01c068003062"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to impersonate access tokens (API string)","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00001272.00000000.67082.100EB000.00000004.mdmp, 00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-306","sources":[{"report_type":"sandbox","report_id":"659200968ced01c068003062"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to inject code into another process (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00001272.00000000.67082.100EB000.00000004.mdmp, 00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp\")\n Found reference to API \"VirtualFree\" (Indicator: \"VirtualFree\"; Source: \"00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp, 00000000-00001272.00000003.76445.0052F000.00000004.mdmp\")\n Found reference to API \"VirtualAlloc\" (Indicator: \"VirtualAlloc\"; Source: \"00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp, 00000000-00001272.00000003.76445.0052F000.00000004.mdmp\")\n Found reference to API \"WTSFreeMemory\" (Indicator: \"FreeMemory\"; Source: \"00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"659200968ced01c068003062"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp, 00000000-00001272.00000003.76445.0052F000.00000004.mdmp\")\n Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; Source: \"00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp, 00000000-00001272.00000003.76445.0052F000.00000004.mdmp\")\n Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"659200968ced01c068003062"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to modify registry key/value (API string)","description":"Found reference to API \"RegSetValueExA\" (Indicator: \"RegSetValue\"; Source: \"00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-304","sources":[{"report_type":"sandbox","report_id":"659200968ced01c068003062"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to open a service (API string)","description":"Found reference to API \"OpenService Error!\" (Indicator: \"OpenService\"; Source: \"00000000-00001272.00000000.67082.100EB000.00000004.mdmp, 00000000-00001272.00000001.69006.00401000.00000004.mdmp\")\n Found reference to API \"OpenServiceA\" (Indicator: \"OpenService\"; Source: \"00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":1,"id":"string-544","sources":[{"report_type":"sandbox","report_id":"659200968ced01c068003062"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to perform Base64 encoding/decoding","description":"Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+\"; Source: \"00000000-00001272.00000000.67082.100EB000.00000004.mdmp, 00000000-00001272.00000001.69006.00401000.00000004.mdmp\")\n Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\"; Source: \"00000000-00001272.00000000.67082.100EB000.00000004.mdmp, 00000000-00001272.00000001.69006.00401000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1132","relevance":1,"id":"string-338","sources":[{"report_type":"sandbox","report_id":"659200968ced01c068003062"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to use Cryptographic classes","description":"Found reference to \"CryptCNGInitHMAC\" (Indicator: \"HMAC\"; Source: \"00000000-00001272.00000000.67082.001E0000.00000004.mdmp, 00000000-00001272.00000001.69006.001E0000.00000004.mdmp, 00000000-00001272.00000002.70931.001E0000.00000004.mdmp, 00000000-00001272.00000003.76445.001E0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"659200968ced01c068003062"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains the ability to modify system service (API string)","description":"Found reference to API \"ChangeServiceConfigA\" (Indicator: \"ChangeServiceConfig\"; Source: \"00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp\")\n Found reference to API \"ControlService\" (Indicator: \"ControlService\"; Source: \"00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-192","sources":[{"report_type":"sandbox","report_id":"659200968ced01c068003062"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00001272.00000000.67082.100EB000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00001272.00000001.69006.00401000.00000004.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"659200968ced01c068003062"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Found virtual disk drive like strings","description":"Found string - \\\\.\\PHYSICALDRIVE0; Source: \"00000000-00001272.00000000.67082.100EB000.00000004.mdmp, 00000000-00001272.00000001.69006.00401000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-145","sources":[{"report_type":"sandbox","report_id":"659200968ced01c068003062"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to block user input (API string)","description":"Found reference to API \"BlockInput\" (Indicator: \"BlockInput\"; Source: \"00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-547","sources":[{"report_type":"sandbox","report_id":"659200968ced01c068003062"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to perform Base64 encoding/decoding","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"659200968ced01c068003062"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"7aad7c8ad75a96d9dd0f32ae5b51aca7.exe\" called \"IsWow64Process\" with parameter \"1272\" - (UID: 00000000-00001272)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"659200968ced01c068003062"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"7aad7c8ad75a96d9dd0f32ae5b51aca7.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00001272)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"659200968ced01c068003062"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"$2c","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"659200968ced01c068003062"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to determine if process is running under WOW64 (API string)","description":"Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-450","sources":[{"report_type":"sandbox","report_id":"659200968ced01c068003062"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to find open windows (API string)","description":"Found reference to API \"FindWindowA\" (Indicator: \"FindWindowA\"; Source: \"00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-413","sources":[{"report_type":"sandbox","report_id":"659200968ced01c068003062"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform scheduled transfer (API string)","description":"Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"659200968ced01c068003062"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query volume/memory size (API string)","description":"Found reference to API \"GetDiskFreeSpaceExA\" (Indicator: \"GetDiskFreeSpace\"; Source: \"00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp\")\n Found reference to API \"GlobalMemoryStatusEx\" (Indicator: \"GlobalMemoryStatus\"; Source: \"00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-193","sources":[{"report_type":"sandbox","report_id":"659200968ced01c068003062"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve information about the current system (API string)","description":"Found reference to API \"ZwQuerySystemInformation\" (Indicator: \"QuerySystemInformation\"; Source: \"00000000-00001272.00000000.67082.100EB000.00000004.mdmp, 00000000-00001272.00000001.69006.00401000.00000004.mdmp\")\n Found reference to API \"GetSystemInfo\" (Indicator: \"GetSystemInfo\"; Source: \"00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp\")\n Found reference to API \"GetUserObjectInformationA\" (Indicator: \"GetUserObjectInformation\"; Source: \"00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"659200968ced01c068003062"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine time (API string)","description":"Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"659200968ced01c068003062"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"$2d","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"659200968ced01c068003062"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve path in which Windows is installed (API string)","description":"Found reference to API \"GetWindowsDirectoryA\" (Indicator: \"GetWindowsDirectory\"; Source: \"00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-312","sources":[{"report_type":"sandbox","report_id":"659200968ced01c068003062"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"GetVersion\" (Indicator: \"GetVersion\"; Source: \"00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp, 00000000-00001272.00000003.76445.0052F000.00000004.mdmp\")\n Found reference to API \"GetVersionExA\" (Indicator: \"GetVersionExA\"; Source: \"00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp, 00000000-00001272.00000003.76445.0052F000.00000004.mdmp\")\n Found reference to API \"GetVersionExA\" (Indicator: \"GetVersion\"; Source: \"00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp, 00000000-00001272.00000003.76445.0052F000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"659200968ced01c068003062"}]},{"level":"informative","category":"Environment Awareness","name":"Found registry location string related to processor","description":"Observed string: \"HARDWARE\\DESCRIPTION\\System\\CentralProcessor\\0\" (Indicator: \"hardware\\description\\system\\centralprocessor\") in Source: 00000000-00001272.00000000.67082.100EB000.00000004.mdmp\n 00000000-00001272.00000001.69006.00401000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-351","sources":[{"report_type":"sandbox","report_id":"659200968ced01c068003062"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"7aad7c8ad75a96d9dd0f32ae5b51aca7.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"659200968ced01c068003062"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"154.91.227.10:6099\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"659200968ced01c068003062"}]},{"level":"informative","category":"General","name":"Contains ability to add users to a group (API string)","description":"Found reference to API \"NetLocalGroupAddMembers\" (Indicator: \"NetLocalGroupAdd\"; Source: \"00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1098","relevance":1,"id":"string-215","sources":[{"report_type":"sandbox","report_id":"659200968ced01c068003062"}]},{"level":"informative","category":"General","name":"Contains ability to close a handle to a service (API string)","description":"Found reference to API \"CloseServiceHandle\" (Indicator: \"CloseServiceHandle\"; Source: \"00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-242","sources":[{"report_type":"sandbox","report_id":"659200968ced01c068003062"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"$2e","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"659200968ced01c068003062"}]},{"level":"informative","category":"General","name":"Contains ability to create a new user account (API string)","description":"Found reference to API \"NetLocalGroupAddMembers\" (Indicator: \"NetLocalGroupAddMembers\"; Source: \"00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp\")\n Found reference to API \"NetUserAdd\" (Indicator: \"NetUserAdd\"; Source: \"00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1136.001","relevance":1,"id":"string-214","sources":[{"report_type":"sandbox","report_id":"659200968ced01c068003062"}]},{"level":"informative","category":"General","name":"Contains ability to create/control drivers (API string)","description":"Found reference to API \"IoCreateDevice\" (Indicator: \"IoCreateDevice\"; Source: \"00000000-00001272.00000000.67082.100EB000.00000004.mdmp, 00000000-00001272.00000001.69006.00401000.00000004.mdmp\")\n Found reference to API \"DeviceIoControl\" (Indicator: \"DeviceIoControl\"; Source: \"00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-220","sources":[{"report_type":"sandbox","report_id":"659200968ced01c068003062"}]},{"level":"informative","category":"General","name":"Contains ability to create/load registry keys (API string)","description":"Found reference to API \"RegCreateKeyA\" (Indicator: \"RegCreateKey\"; Source: \"00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp\")\n Found reference to API \"RegCreateKeyExA\" (Indicator: \"RegCreateKey\"; Source: \"00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-307","sources":[{"report_type":"sandbox","report_id":"659200968ced01c068003062"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFileA\" (Indicator: \"CreateFile\"; Source: \"00000000-00001272.00000000.67082.100EB000.00000004.mdmp, 00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"659200968ced01c068003062"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"659200968ced01c068003062"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$2f","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"659200968ced01c068003062"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Found reference to API \"WinExec\" (Indicator: \"WinExec\"; Source: \"00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp\")\n Found reference to API \"ShellExecuteExA\" (Indicator: \"ShellExecute\"; Source: \"00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-240","sources":[{"report_type":"sandbox","report_id":"659200968ced01c068003062"}]},{"level":"informative","category":"General","name":"Contains ability to executes commands or batch file","description":"Found string \"cmd.exe /c RunDll32.exe InetCpl.cpl,ClearMyTracksByProcess 255\" (Indicator: \"cmd.exe /c\"; Source: \"00000000-00001272.00000000.67082.100EB000.00000004.mdmp, 00000000-00001272.00000001.69006.00401000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-174","sources":[{"report_type":"sandbox","report_id":"659200968ced01c068003062"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp, 00000000-00001272.00000003.76445.0052F000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"659200968ced01c068003062"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00001272.00000000.67082.100EB000.00000004.mdmp, 00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp\")\n Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; Source: \"00000000-00001272.00000000.67082.100EB000.00000004.mdmp, 00000000-00001272.00000001.69006.00401000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"659200968ced01c068003062"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/open a process (API string)","description":"Found reference to API \"ZwOpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00001272.00000000.67082.100EB000.00000004.mdmp, 00000000-00001272.00000001.69006.00401000.00000004.mdmp\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcess\"; Source: \"00000000-00001272.00000000.67082.100EB000.00000004.mdmp, 00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp, 00000000-00001272.00000003.76445.0052F000.00000004.mdmp\")\n Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"659200968ced01c068003062"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00001272.00000000.67082.100EB000.00000004.mdmp, 00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp, 00000000-00001272.00000003.76445.0052F000.00000004.mdmp\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"00000000-00001272.00000003.76445.0052F000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"659200968ced01c068003062"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; Source: \"00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp\")\n Found reference to API \"GetWindowThreadProcessId\" (Indicator: \"GetWindowThreadProcessId\"; Source: \"00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-208","sources":[{"report_type":"sandbox","report_id":"659200968ced01c068003062"}]},{"level":"informative","category":"General","name":"Contains ability to start a service (API string)","description":"Found reference to API \"StartServiceA\" (Indicator: \"StartService\"; Source: \"00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-209","sources":[{"report_type":"sandbox","report_id":"659200968ced01c068003062"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$30","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"659200968ced01c068003062"}]},{"level":"informative","category":"General","name":"Contains the ability to enumerate service (API string)","description":"Found reference to API \"QueryServiceStatus Error!\" (Indicator: \"QueryServiceStatus\"; Source: \"00000000-00001272.00000000.67082.100EB000.00000004.mdmp, 00000000-00001272.00000001.69006.00401000.00000004.mdmp\")\n Found reference to API \"OpenSCManager Error!\" (Indicator: \"OpenSCManager\"; Source: \"00000000-00001272.00000000.67082.100EB000.00000004.mdmp, 00000000-00001272.00000001.69006.00401000.00000004.mdmp\")\n Found reference to API \"OpenSCManagerA\" (Indicator: \"OpenSCManager\"; Source: \"00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp\")\n Found reference to API \"QueryServiceStatus\" (Indicator: \"QueryServiceStatus\"; Source: \"00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp\")\n Found reference to API \"EnumServicesStatusA\" (Indicator: \"EnumServicesStatus\"; Source: \"00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1007","relevance":1,"id":"string-191","sources":[{"report_type":"sandbox","report_id":"659200968ced01c068003062"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\Global\\\"C:\\7aad7c8ad75a96d9dd0f32ae5b51aca7.exe\"\"\n \"154.91.227.10:6099:Sainbox\"\n \"Global\\\"C:\\7aad7c8ad75a96d9dd0f32ae5b51aca7.exe\"\"\n \"eed3bd3a-a1ad-4e99-987b-d7cb3fcfa7f0 - S-1-5-21-2092356043-4041700817-663127204-1001\"\n \"\\Sessions\\1\\BaseNamedObjects\\154.91.227.10:6099:Sainbox\"\n \"\\Sessions\\1\\BaseNamedObjects\\eed3bd3a-a1ad-4e99-987b-d7cb3fcfa7f0 - S-1-5-21-2092356043-4041700817-663127204-1001\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"659200968ced01c068003062"}]},{"level":"informative","category":"General","name":"Found user-agent related strings","description":"Found string \"Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1)\" (Indicator: \"mozilla/4.0 (\"; Source: \"00000000-00001272.00000000.67082.100EB000.00000004.mdmp, 00000000-00001272.00000001.69006.00401000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-127","sources":[{"report_type":"sandbox","report_id":"659200968ced01c068003062"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"0d000e00fcd6fc6a@iphlpapi.dll\"\n \"0f00100054d7fc6a@iphlpapi.dll\"\n \"0c000d009cd7fc6a@iphlpapi.dll\"\n \"150016003ccafc6a@ADVAPI32.dll\"\n \"0e000f00eccafc6a@ADVAPI32.dll\"\n \"0e000f0048cbfc6a@ADVAPI32.dll\"\n \"1100120024d3fc6a@ADVAPI32.dll\"\n \"11001200c0d3fc6a@ADVAPI32.dll\"\n \"1200130004d4fc6a@ADVAPI32.dll\"\n \"120013005cd4fc6a@ADVAPI32.dll\"\n \"14001500ecf3fc6a@ADVAPI32.dll\"\n \"1400150004f4fc6a@ADVAPI32.dll\"\n \"140015001cf4fc6a@ADVAPI32.dll\"\n \"1700180034f4fc6a@ADVAPI32.dll\"\n \"0d000e004cf4fc6a@ADVAPI32.dll\"\n \"0d000e0028edfc6a@WININET.dll\"\n \"0d000e0098edfc6a@WININET.dll\"\n \"10001100d0edfc6a@WININET.dll\"\n \"1000110074eefc6a@WININET.dll\"\n \"100011007cf4fc6a@WININET.dll\"\n \"1000110090f4fc6a@WININET.dll\"\n \"14001500a4f4fc6a@WININET.dll\"\n \"14001500bcf4fc6a@WININET.dll\"\n \"12001300d4f4fc6a@WININET.dll\"\n \"12001300e8f4fc6a@WININET.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"659200968ced01c068003062"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"\"7aad7c8ad75a96d9dd0f32ae5b51aca7.exe\" touched \"System Device Enumerator\" (Path: \"HKCU\\CLSID\\{62BE5D10-60EB-11D0-BD3B-00A0C911CE86}\")\n \"7aad7c8ad75a96d9dd0f32ae5b51aca7.exe\" touched \"VFW Capture Class Manager\" (Path: \"HKCU\\CLSID\\{860BB310-5D01-11D0-BD3B-00A0C911CE86}\")","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"659200968ced01c068003062"}]},{"level":"informative","category":"General","name":"References Windows filepaths for DLLs (possible dropped files)","description":"Observed system executable string:\"%WINDIR%\\system32\\odbcint.dll\" [Source: 00000000-00001272-00000C25-44566848]\n Observed system executable string:\"%WINDIR%\\system32\\uxtheme.dll\" [Source: 00000000-00001272-00000C25-45435134]","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"659200968ced01c068003062"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"\"7aad7c8ad75a96d9dd0f32ae5b51aca7.exe\" searching for class \"CTXOPConntion_Class\"","origin":"API Call","mitre_attack_id":"T1010","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"659200968ced01c068003062"}]},{"level":"informative","category":"Installation/Persistence","name":"Connects to LPC ports","description":"\"7aad7c8ad75a96d9dd0f32ae5b51aca7.exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","mitre_attack_id":"T1559","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"659200968ced01c068003062"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp, 00000000-00001272.00000003.76445.0052F000.00000004.mdmp\")\n Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"659200968ced01c068003062"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"7aad7c8ad75a96d9dd0f32ae5b51aca7.exe\" creates a thread in process \"-1\" (Handle: 4294967295)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"659200968ced01c068003062"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to detect virtual environment\n Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: Calls an API typically used to find device information","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"659200968ced01c068003062"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"\"7aad7c8ad75a96d9dd0f32ae5b51aca7.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\counters.dat\"\n \"7aad7c8ad75a96d9dd0f32ae5b51aca7.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\counters.dat\"","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"659200968ced01c068003062"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$31","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"659200968ced01c068003062"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"$32","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"659200968ced01c068003062"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create a HTTP or FTP session (API string)","description":"Found reference to API \"InternetConnectA\" (Indicator: \"InternetConnect\"; Source: \"00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-538","sources":[{"report_type":"sandbox","report_id":"659200968ced01c068003062"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create a new HTTP request (API string)","description":"Found reference to API \"HttpOpenRequestA\" (Indicator: \"HttpOpenRequest\"; Source: \"00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-537","sources":[{"report_type":"sandbox","report_id":"659200968ced01c068003062"}]},{"level":"informative","category":"Network Related","name":"Contains ability to download a file from a URL (API string)","description":"Found reference to API \"InternetReadFile\" (Indicator: \"InternetReadFile\"; Source: \"00000000-00001272.00000000.67082.100EB000.00000004.mdmp, 00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-241","sources":[{"report_type":"sandbox","report_id":"659200968ced01c068003062"}]},{"level":"informative","category":"Network Related","name":"Contains ability to retrieve information about user accounts on a server (API string)","description":"Found reference to API \"NetUserSetInfo\" (Indicator: \"NetUserSetInfo\"; Source: \"00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp\")\n Found reference to API \"NetUserGetLocalGroups\" (Indicator: \"NetUserGetLocalGroups\"; Source: \"00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp\")\n Found reference to API \"NetUserGetInfo\" (Indicator: \"NetUserGetInfo\"; Source: \"00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp\")\n Found reference to API \"NetUserEnum\" (Indicator: \"NetUserEnum\"; Source: \"00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1087.001","relevance":1,"id":"string-112","sources":[{"report_type":"sandbox","report_id":"659200968ced01c068003062"}]},{"level":"informative","category":"Network Related","name":"Contains reference to Windows internet services (API string)","description":"Found reference to API \"InternetOpenUrlA\" (Indicator: \"InternetOpen\"; Source: \"00000000-00001272.00000000.67082.100EB000.00000004.mdmp, 00000000-00001272.00000001.69006.00401000.00000004.mdmp\")\n Found reference to API \"InternetOpenA\" (Indicator: \"InternetOpen\"; Source: \"00000000-00001272.00000000.67082.100EB000.00000004.mdmp, 00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-539","sources":[{"report_type":"sandbox","report_id":"659200968ced01c068003062"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"154.91.227.10\"\n Potential IP \"127.0.0.1\" found in string \"/c ping -n 2 127.0.0.1 > nul && del\"\n \"127.0.0.1\"\n \"192.168.1.101\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"659200968ced01c068003062"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$33","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"659200968ced01c068003062"}]},{"level":"informative","category":"Network Related","name":"Found string related to HTTP headers","description":"Found string \"HTTP/1.1\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00001272.00000000.67082.100EB000.00000004.mdmp, 00000000-00001272.00000001.69006.00401000.00000004.mdmp\")\n Found string \"HTTP/1.0 200 OK\" (Indicator: \"HTTP/1.0\"; Source: \"00000000-00001272.00000000.67082.100EB000.00000004.mdmp, 00000000-00001272.00000001.69006.00401000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-457","sources":[{"report_type":"sandbox","report_id":"659200968ced01c068003062"}]},{"level":"informative","category":"Remote Access Related","name":"Contains ability to retrieve remote session information (API string)","description":"Found reference to API \"WTSQuerySessionInformationA\" (Indicator: \"WTSQuerySessionInformation\"; Source: \"00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp\")\n Found reference to API \"WTSQuerySessionInformationW\" (Indicator: \"WTSQuerySessionInformation\"; Source: \"00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp\")\n Found reference to API \"WTSEnumerateSessionsA\" (Indicator: \"WTSEnumerateSessions\"; Source: \"00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1018","relevance":1,"id":"string-546","sources":[{"report_type":"sandbox","report_id":"659200968ced01c068003062"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"7aad7c8ad75a96d9dd0f32ae5b51aca7.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"000000000010000000000100fffffe7f03000000040000004a020000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"659200968ced01c068003062"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to access clipboard data (API string)","description":"Found reference to API \"OpenClipboard\" (Indicator: \"OpenClipboard\"; Source: \"00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp\")\n Found reference to API \"GetClipboardData\" (Indicator: \"GetClipboardData\"; Source: \"00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1115","relevance":1,"id":"string-188","sources":[{"report_type":"sandbox","report_id":"659200968ced01c068003062"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to determine disk drive type (API string)","description":"Found reference to API \"GetDriveTypeA\" (Indicator: \"GetDriveType\"; Source: \"00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-80","sources":[{"report_type":"sandbox","report_id":"659200968ced01c068003062"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"Found reference to API \"FindNextFileA\" (Indicator: \"FindNextFile\"; Source: \"00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp\")\n Found reference to API \"FindFirstFileA\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"659200968ced01c068003062"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate logon sessions (API string)","description":"Found reference to API \"WTSEnumerateSessionsA\" (Indicator: \"WTSEnumerateSessions\"; Source: \"00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1049","relevance":1,"id":"string-117","sources":[{"report_type":"sandbox","report_id":"659200968ced01c068003062"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$34","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"659200968ced01c068003062"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to query registry keys (API string)","description":"$35","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"659200968ced01c068003062"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"659200968ced01c068003062"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to register/read input devices (API string)","description":"Found reference to API \"keybd_event\" (Indicator: \"keybd_event\"; Source: \"00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp\")\n Found reference to API \"mouse_event\" (Indicator: \"mouse_event\"; Source: \"00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1056","relevance":1,"id":"string-403","sources":[{"report_type":"sandbox","report_id":"659200968ced01c068003062"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp, 00000000-00001272.00000003.76445.0052F000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"659200968ced01c068003062"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp, 00000000-00001272.00000003.76445.0052F000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"659200968ced01c068003062"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve data about the local computer (API string)","description":"Found reference to API \"InterlockedExchange\" (Indicator: \"InterlockedExchange\"; Source: \"00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":3,"id":"string-115","sources":[{"report_type":"sandbox","report_id":"659200968ced01c068003062"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve event logs (API string)","description":"Found reference to API \"OpenEventLogA\" (Indicator: \"OpenEventLog\"; Source: \"00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.001","relevance":1,"id":"string-237","sources":[{"report_type":"sandbox","report_id":"659200968ced01c068003062"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"Found reference to API \"GetFileSize\" (Indicator: \"GetFileSize\"; Source: \"00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp\")\n Found reference to API \"GetFileAttributesA\" (Indicator: \"GetFileAttributes\"; Source: \"00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp\")\n Found reference to API \"GetSystemDirectoryA\" (Indicator: \"GetSystemDirectory\"; Source: \"00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"659200968ced01c068003062"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about pressed keystrokes (API string)","description":"Found reference to API \"GetAsyncKeyState\" (Indicator: \"GetAsyncKeyState\"; Source: \"00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp\")\n Found reference to API \"GetKeyState\" (Indicator: \"GetKeyState\"; Source: \"00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp\")\n Found reference to API \"MapVirtualKeyA\" (Indicator: \"MapVirtualKey\"; Source: \"00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-88","sources":[{"report_type":"sandbox","report_id":"659200968ced01c068003062"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve process ID (API string)","description":"Found reference to API \"PsGetProcessId\" (Indicator: \"GetProcessId\"; Source: \"00000000-00001272.00000000.67082.100EB000.00000004.mdmp, 00000000-00001272.00000001.69006.00401000.00000004.mdmp\")\n Found reference to API \"GetProcessId\" (Indicator: \"GetProcessId\"; Source: \"00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-478","sources":[{"report_type":"sandbox","report_id":"659200968ced01c068003062"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp, 00000000-00001272.00000003.76445.0052F000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"659200968ced01c068003062"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"Found reference to API \"GetEnvironmentVariableA\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp, 00000000-00001272.00000003.76445.0052F000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-107","sources":[{"report_type":"sandbox","report_id":"659200968ced01c068003062"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the local name for a socket (API string)","description":"Found reference to API \"getsockname\" (Indicator: \"getsockname\"; Source: \"00000000-00001272.00000000.67082.100EB000.00000004.mdmp, 00000000-00001272.00000001.69006.00401000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-224","sources":[{"report_type":"sandbox","report_id":"659200968ced01c068003062"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; Source: \"00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-131","sources":[{"report_type":"sandbox","report_id":"659200968ced01c068003062"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"659200968ced01c068003062"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve usernames and/or user information (API string)","description":"$36","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"659200968ced01c068003062"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found strings related to keylogger","description":"Found string \"[BACKSPACE]\" (Indicator: \"[BACKSPACE]\"; Source: \"00000000-00001272.00000000.67082.100EB000.00000004.mdmp, 00000000-00001272.00000001.69006.00401000.00000004.mdmp\")\n Found string \"\" (Indicator: \"\"; Source: \"00000000-00001272.00000000.67082.100EB000.00000004.mdmp, 00000000-00001272.00000001.69006.00401000.00000004.mdmp\")\n Found string \"\" (Indicator: \"\"; Source: \"00000000-00001272.00000000.67082.100EB000.00000004.mdmp, 00000000-00001272.00000001.69006.00401000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-556","sources":[{"report_type":"sandbox","report_id":"659200968ced01c068003062"}]},{"level":"informative","category":"System Destruction","name":"Contains ability to delete a user account from a server (API string)","description":"Found reference to API \"NetUserDel\" (Indicator: \"NetUserDel\"; Source: \"00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1531","relevance":1,"id":"string-216","sources":[{"report_type":"sandbox","report_id":"659200968ced01c068003062"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"$37","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"659200968ced01c068003062"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete device driver (API string)","description":"Found reference to API \"IoDeleteDevice\" (Indicator: \"IoDeleteDevice\"; Source: \"00000000-00001272.00000000.67082.100EB000.00000004.mdmp, 00000000-00001272.00000001.69006.00401000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-463","sources":[{"report_type":"sandbox","report_id":"659200968ced01c068003062"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"DeleteFileA\" (Indicator: \"DeleteFile\"; Source: \"00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp\")\n Found reference to API \"RemoveDirectoryA\" (Indicator: \"RemoveDirectory\"; Source: \"00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"659200968ced01c068003062"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete registry key/value (API string)","description":"Found reference to API \"RegDeleteValueA\" (Indicator: \"RegDeleteValue\"; Source: \"00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp\")\n Found reference to API \"RegDeleteKeyA\" (Indicator: \"RegDeleteKey\"; Source: \"00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp\")\n Found reference to API \"SHDeleteKeyA\" (Indicator: \"SHDeleteKey\"; Source: \"00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-230","sources":[{"report_type":"sandbox","report_id":"659200968ced01c068003062"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"$38","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"659200968ced01c068003062"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify the user configuration/privilege (API string)","description":"Found reference to API \"SystemParametersInfoA\" (Indicator: \"SystemParametersInfo\"; Source: \"00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1098","relevance":1,"id":"string-132","sources":[{"report_type":"sandbox","report_id":"659200968ced01c068003062"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"Found reference to API \"SetSecurityDescriptorDacl\" (Indicator: \"SetSecurityDescriptorDacl\"; Source: \"00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp\")\n Found reference to API \"InitializeSecurityDescriptor\" (Indicator: \"InitializeSecurityDescriptor\"; Source: \"00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"659200968ced01c068003062"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp, 00000000-00001272.00000003.76445.0052F000.00000004.mdmp\")\n Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp, 00000000-00001272.00000003.76445.0052F000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"659200968ced01c068003062"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp, 00000000-00001272.00000003.76445.0052F000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"659200968ced01c068003062"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"7aad7c8ad75a96d9dd0f32ae5b51aca7.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"659200968ced01c068003062"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"7aad7c8ad75a96d9dd0f32ae5b51aca7.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"659200968ced01c068003062"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$39","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"659200968ced01c068003062"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to free the memory used by network management functions (API string)","description":"Found reference to API \"NetApiBufferFree\" (Indicator: \"NetApiBufferFree\"; Source: \"00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-223","sources":[{"report_type":"sandbox","report_id":"659200968ced01c068003062"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to reboot/shutdown the operating system (API string)","description":"Found reference to API \"ExitWindowsEx\" (Indicator: \"ExitWindows\"; Source: \"00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1529","relevance":3,"id":"string-189","sources":[{"report_type":"sandbox","report_id":"659200968ced01c068003062"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"Found reference to API \"ReleaseMutex\" (Indicator: \"ReleaseMutex\"; Source: \"00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp\")\n Found reference to API \"CreateMutexA\" (Indicator: \"CreateMutex\"; Source: \"00000000-00001272.00000001.69006.00401000.00000004.mdmp, 00000000-00001272.00000002.70931.100A9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-354","sources":[{"report_type":"sandbox","report_id":"659200968ced01c068003062"}]},{"level":"suspicious","category":"Network Related","name":"Contains ability to identify remote systems","description":"Found string \"/c ping -n 2 127.0.0.1 > nul && del\" (Indicator: \"/c ping\"; Source: \"00000000-00001272.00000000.67082.100EB000.00000004.mdmp, 00000000-00001272.00000001.69006.00401000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1018","relevance":1,"id":"string-417","sources":[{"report_type":"sandbox","report_id":"659200968ced01c068003062"}]},{"level":"suspicious","category":"Network Related","name":"Spawned process connects to a network","description":"Process \"C:\\7aad7c8ad75a96d9dd0f32ae5b51aca7.exe\" connects to 154.91.227.10 on port 6099 (TCP)","origin":"Monitored Target","mitre_attack_id":"T1071","relevance":5,"id":"target-412","sources":[{"report_type":"sandbox","report_id":"659200968ced01c068003062"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Checks warning level of secure to non-secure traffic redirection","description":"\"7aad7c8ad75a96d9dd0f32ae5b51aca7.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"WARNONHTTPSTOHTTPREDIRECT\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":7,"id":"registry-9","sources":[{"report_type":"sandbox","report_id":"659200968ced01c068003062"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used to enumerate process encountered in a system snapshot","description":"$3a","origin":"API Call","mitre_attack_id":"T1057","relevance":5,"id":"api-104","sources":[{"report_type":"sandbox","report_id":"659200968ced01c068003062"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Found system commands related strings","description":"Found string \"/c ping -n 2 127.0.0.1 > nul && del\" (Indicator: \"ping\"; Source: \"00000000-00001272.00000000.67082.100EB000.00000004.mdmp, 00000000-00001272.00000001.69006.00401000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":3,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"659200968ced01c068003062"}]},{"level":"suspicious","category":"System Destruction","name":"Possibly checks for the presence of an adware detecting tool","description":"\"V3Svc.exe\" (Indicator: \"v3svc.exe\")","origin":"File/Memory","mitre_attack_id":"T1518.001","relevance":3,"id":"string-46","sources":[{"report_type":"sandbox","report_id":"659200968ced01c068003062"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"7aad7c8ad75a96d9dd0f32ae5b51aca7.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYENABLE\"; Value: \"00000000\")\n \"7aad7c8ad75a96d9dd0f32ae5b51aca7.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYSERVER\")\n \"7aad7c8ad75a96d9dd0f32ae5b51aca7.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYOVERRIDE\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"659200968ced01c068003062"}]},{"level":"malicious","category":"Network Related","name":"Uses network protocols on unusual ports","description":"TCP traffic to 154.91.227.10 on port 6099","origin":"Network Traffic","mitre_attack_id":"T1571","relevance":7,"id":"network-7","sources":[{"report_type":"sandbox","report_id":"659200968ced01c068003062"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Tries to access unusual system drive letters","description":"\"7aad7c8ad75a96d9dd0f32ae5b51aca7.exe\" touched \"K:\"\n \"7aad7c8ad75a96d9dd0f32ae5b51aca7.exe\" touched \"L:\"\n \"7aad7c8ad75a96d9dd0f32ae5b51aca7.exe\" touched \"M:\"\n \"7aad7c8ad75a96d9dd0f32ae5b51aca7.exe\" touched \"N:\"\n \"7aad7c8ad75a96d9dd0f32ae5b51aca7.exe\" touched \"O:\"\n \"7aad7c8ad75a96d9dd0f32ae5b51aca7.exe\" touched \"P:\"\n \"7aad7c8ad75a96d9dd0f32ae5b51aca7.exe\" touched \"Q:\"\n \"7aad7c8ad75a96d9dd0f32ae5b51aca7.exe\" touched \"R:\"\n \"7aad7c8ad75a96d9dd0f32ae5b51aca7.exe\" touched \"S:\"\n \"7aad7c8ad75a96d9dd0f32ae5b51aca7.exe\" touched \"T:\"\n \"7aad7c8ad75a96d9dd0f32ae5b51aca7.exe\" touched \"U:\"\n \"7aad7c8ad75a96d9dd0f32ae5b51aca7.exe\" touched \"V:\"\n \"7aad7c8ad75a96d9dd0f32ae5b51aca7.exe\" touched \"W:\"\n \"7aad7c8ad75a96d9dd0f32ae5b51aca7.exe\" touched \"X:\"\n \"7aad7c8ad75a96d9dd0f32ae5b51aca7.exe\" touched \"Y:\"","origin":"API Call","mitre_attack_id":"T1120","relevance":9,"id":"api-31","sources":[{"report_type":"sandbox","report_id":"659200968ced01c068003062"}]}],"incidents":[{"name":"Spyware","details_count":1,"details":[{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"659200659677e5a1ed039366"},{"report_type":"sandbox","report_id":"659200968ced01c068003062"}]},{"name":"Fingerprint","details_count":1,"details":[{"detail":"Queries process information"}],"sources":[{"report_type":"sandbox","report_id":"659200659677e5a1ed039366"},{"report_type":"sandbox","report_id":"659200968ced01c068003062"}]},{"name":"Adware","details_count":1,"details":[{"detail":"Possibly checks for the presence of an adware detecting tool"}],"sources":[{"report_type":"sandbox","report_id":"659200968ced01c068003062"}]},{"name":"Spreading","details_count":1,"details":[{"detail":"Tries to access unusual system drive letters"}],"sources":[{"report_type":"sandbox","report_id":"659200968ced01c068003062"}]}]},"activity":{"stats":{"process_count":4,"spawned_processes_count":4,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":6,"imported_dlls_count":91,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":2,"files_deleted_count":0,"registry_keys_created_count":1,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":1,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":1,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["backdoor","farfli","zegost"],"sample_flags":["Multi-Process","Sample Crashed","Network Traffic"],"sandbox_reports":[{"id":"659200968ced01c068003062","environment_id":110,"environment_description":"Windows 7 32 bit (HWP Support)","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"DeepScan:Generic.KillMBR.A","contacted_countries":["SYC"],"submit_name":"7aad7c8ad75a96d9dd0f32ae5b51aca7","analysis_start_time":"2024-01-01T00:00:23+00:00","indicators_count":{"informative":137,"suspicious":23,"malicious":5},"tags":["Network Traffic"],"is_in_unified_schema":true},{"id":"659200659677e5a1ed039366","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"DeepScan:Generic.KillMBR.A","submit_name":"7aad7c8ad75a96d9dd0f32ae5b51aca7","analysis_start_time":"2023-12-31T23:59:34+00:00","indicators_count":{"informative":34,"suspicious":9,"malicious":3},"tags":["Multi-Process","Sample Crashed"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"154.91.227.10","port":6099,"protocol":"TCP","country":"Seychelles","sources":[{"report_type":"sandbox","report_id":"659200968ced01c068003062"}]}],"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"659200659677e5a1ed039366"}],"processes":[{"pid":7312,"ppid":0,"name":"7aad7c8ad75a96d9dd0f32ae5b51aca7.exe","command_line":"","sha256":"eaa840e393c8f8a3bdcd865ea6eff59f586e14bd9c3518d88098062056964281","normalized_path":"C:\\7aad7c8ad75a96d9dd0f32ae5b51aca7.exe","uid":"00000000-00007312","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="},{"pid":2652,"ppid":7312,"name":"WerFault.exe","command_line":"-u -p 7312 -s 380","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00007312","uid":"00000000-00002652"},{"pid":2676,"ppid":7312,"name":"WerFault.exe","command_line":"-u -p 7312 -s 380","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00007312","uid":"00000000-00002676"},{"pid":6340,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 460 -p 7312 -ip 7312","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00006340","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="}],"all_imported_dlls":["sechost.dll","fltLib.dll","win32u.dll","wow64.dll","KernelBase.dll","rpcrt4.dll","sspicli.dll","cryptbase.dll","ucrtbase.dll","msvcp_win.dll","ole32.dll","ntdll.dll","kernel32.dll","user32.dll","bcryptprimitives.dll","gdi32.dll","gdi32full.dll","oleaut32.dll","wow64win.dll","advapi32.dll","msvcrt.dll","combase.dll","imm32.dll","wow64cpu.dll","apphelp.dll","VxSSL32.dll","ws2_32.dll","cfgmgr32.dll","shlwapi.dll","wtsapi32.dll","mswsock.dll","WSHTCPIP.DLL","wininet.dll","profapi.dll","FWPUCLNT.DLL","rasadhlp.dll","devobj.dll","secur32.dll","shell32.dll","nlaapi.dll","msdmo.dll","IPHLPAPI.DLL","dwmapi.dll","odbc32.dll","dnsapi.dll","msasn1.dll","comctl32.dll","api-ms-win-downlevel-ole32-l1-1-0.dll","version.dll","nsi.dll","winnsi.dll","setupapi.dll","api-ms-win-downlevel-shlwapi-l2-1-0.dll","lpk.dll","usp10.dll","wkscli.dll","normaliz.dll","pnrpnsp.dll","api-ms-win-downlevel-user32-l1-1-0.dll","crypt32.dll","msvfw32.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","clbcatq.dll","ntmarta.dll","winhttp.dll","webio.dll","netapi32.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","iertutil.dll","winrnr.dll","api-ms-win-downlevel-advapi32-l2-1-0.dll","winmm.dll","netutils.dll","userenv.dll","wintrust.dll","avicap32.dll","wship6.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll","devenum.dll","Wldap32.dll","msctf.dll","mfc42.dll","NapiNSP.dll","uxtheme.dll","samcli.dll","api-ms-win-downlevel-version-l1-1-0.dll","odbcint.dll","srvcli.dll","api-ms-win-core-synch-l1-2-0.dll","msvcp60.dll","rpcss.dll"]},"file_activity":{"dropped_files":null,"extracted_files":null,"files_written":[{"path":"\\FileSystem\\Filters\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"659200968ced01c068003062"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\counters.dat","sources":[{"report_type":"sandbox","report_id":"659200968ced01c068003062"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"659200968ced01c068003062"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\\"C:\\7aad7c8ad75a96d9dd0f32ae5b51aca7.exe\"","sources":[{"report_type":"sandbox","report_id":"659200968ced01c068003062"}]},{"name":"154.91.227.10:6099:Sainbox","sources":[{"report_type":"sandbox","report_id":"659200968ced01c068003062"}]},{"name":"Global\\\"C:\\7aad7c8ad75a96d9dd0f32ae5b51aca7.exe\"","sources":[{"report_type":"sandbox","report_id":"659200968ced01c068003062"}]},{"name":"eed3bd3a-a1ad-4e99-987b-d7cb3fcfa7f0 - S-1-5-21-2092356043-4041700817-663127204-1001","sources":[{"report_type":"sandbox","report_id":"659200968ced01c068003062"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\154.91.227.10:6099:Sainbox","sources":[{"report_type":"sandbox","report_id":"659200968ced01c068003062"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\eed3bd3a-a1ad-4e99-987b-d7cb3fcfa7f0 - S-1-5-21-2092356043-4041700817-663127204-1001","sources":[{"report_type":"sandbox","report_id":"659200968ced01c068003062"}]}]}},"report_ids":{"sandbox_job_ids":["659200659677e5a1ed039366","659200968ced01c068003062"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious DeepScan:Generic.KillMBR.A Sample eaa840e393c8… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample eaa840e393c8…. Malware family: DeepScan:Generic.KillMBR.A. Threat score 100/100. 19/25 AV engines flagged this file. 5 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/eaa840e393c8f8a3bdcd865ea6eff59f586e14bd9c3518d88098062056964281"}],["$","meta","4",{"property":"og:title","content":"Malicious DeepScan:Generic.KillMBR.A Sample eaa840e393c8… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample eaa840e393c8…. Malware family: DeepScan:Generic.KillMBR.A. Threat score 100/100. 19/25 AV engines flagged this file. 5 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/eaa840e393c8f8a3bdcd865ea6eff59f586e14bd9c3518d88098062056964281"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious DeepScan:Generic.KillMBR.A Sample eaa840e393c8… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample eaa840e393c8…. Malware family: DeepScan:Generic.KillMBR.A. Threat score 100/100. 19/25 AV engines flagged this file. 5 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L3b","11",{}]]