26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 62:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4c3,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win/malicious_confidence_90% Sample ec75fbd3c2ac… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample ec75fbd3c2ac…. Malware family: Win/malicious_confidence_90%. Threat score 100/100. 3/27 AV engines flagged this file. 12 malicious and 24 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/ec75fbd3c2aced4224014b7c613fc2aa19e11833381d52dee1b95a29690a49bc","keywords":["Malicious","Win/malicious_confidence_90%","malware analysis","sandbox report","threat intelligence","ec75fbd3c2aced4224014b7c613fc2aa19e11833381d52dee1b95a29690a49bc"],"about":{"@type":"SoftwareApplication","name":"LOO.exe","applicationCategory":["peexe","64bits","executable"],"identifier":"ec75fbd3c2aced4224014b7c613fc2aa19e11833381d52dee1b95a29690a49bc","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Win/malicious_confidence_90%","antivirusDetections":{"malicious":3,"total":27},"behavioralIndicators":{"malicious":12,"suspicious":24},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T13a5,Found reference to API "VirtualAllocExNuma" (Indicator: "VirtualAlloc"; File: "ec75fbd3c2aced4224014b7c613fc2aa19e11833381d52dee1b95a29690a49bc.bin") Found reference to API "VirtualAllocExNuma" (Indicator: "VirtualAllocEx"; File: "ec75fbd3c2aced4224014b7c613fc2aa19e11833381d52dee1b95a29690a49bc.bin") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; File: "ec75fbd3c2aced4224014b7c613fc2aa19e11833381d52dee1b95a29690a49bc.bin") Found reference to API "CreateThreadpoolWork" (Indicator: "CreateThread"; File: "ec75fbd3c2aced4224014b7c613fc2aa19e11833381d52dee1b95a29690a49bc.bin") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; File: "ec75fbd3c2aced4224014b7c613fc2aa19e11833381d52dee1b95a29690a49bc.bin") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; File: "ec75fbd3c2aced4224014b7c613fc2aa19e11833381d52dee1b95a29690a49bc.bin") Found reference to API "CreateThreadpoolIo" (Indicator: "CreateThread"; File: "ec75fbd3c2aced4224014b7c613fc2aa19e11833381d52dee1b95a29690a49bc.bin") Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "ec75fbd3c2aced4224014b7c613fc2aa19e11833381d52dee1b95a29690a49bc.bin") Found reference to API "RunPe: NtAllocateVirtualMemory failed" (Indicator: "AllocateVirtualMemory"; File: "ec75fbd3c2aced4224014b7c613fc2aa19e11833381d52dee1b95a29690a49bc.bin") Found reference to API "RunPe: NtWriteVirtualMemory succes" (Indicator: "WriteVirtualMemory"; File: "ec75fbd3c2aced4224014b7c613fc2aa19e11833381d52dee1b95a29690a49bc.bin") Found reference to API "RunPe: NtWriteVirtualMemory succes" (Indicator: "NtWriteVirtualMemory"; File: "ec75fbd3c2aced4224014b7c613fc2aa19e11833381d52dee1b95a29690a49bc.bin") Found reference to API "VirtualAllocE" (Indicator: "VirtualAlloc"; File: "ec75fbd3c2aced4224014b7c613fc2aa19e11833381d52dee1b95a29690a49bc.bin") Found reference to API "_VirtualAlloc" (Indicator: "VirtualAlloc"; File: "ec75fbd3c2aced4224014b7c613fc2aa19e11833381d52dee1b95a29690a49bc.bin") Found reference to API "_VirtualFree" (Indicator: "VirtualFree"; File: "ec75fbd3c2aced4224014b7c613fc2aa19e11833381d52dee1b95a29690a49bc.bin") Found reference to API "&_WriteProcessMemory" (Indicator: "WriteProcessMemory"; File: "ec75fbd3c2aced4224014b7c613fc2aa19e11833381d52dee1b95a29690a49bc.bin") Found reference to API "LCreateThreadLocalContentionCountObject" (Indicator: "CreateThread"; File: "ec75fbd3c2aced4224014b7c613fc2aa19e11833381d52dee1b95a29690a49bc.bin") Found reference to API "CreateThread@" (Indicator: "CreateThread"; File: "ec75fbd3c2aced4224014b7c613fc2aa19e11833381d52dee1b95a29690a49bc.bin") Found reference to API "$2RefreshCurrentProcessorId2ProcessorNumberSpeedCheck*UninlinedThreadStatic8CreateThreadLocalCountObject&AssignWorkItemQueue@" (Indicator: "CreateThread"; File: "ec75fbd3c2aced4224014b7c613fc2aa19e11833381d52dee1b95a29690a49bc.bin") Found reference to API "*UnassignWorkItemQueue$CreateThreadLocals@" (Indicator: "CreateThread"; File: "ec75fbd3c2aced4224014b7c613fc2aa19e11833381d52dee1b95a29690a49bc.bin") Found reference to API ""TransferLocalWorkVGetOrCreateThreadLocalCompletionCountObject&NotifyThreadBlocked*NotifyThreadUnblocked&RequestWorkerThread"CreateTimerQueues" (Indicator: "CreateThread"; File: "ec75fbd3c2aced4224014b7c613fc2aa19e11833381d52dee1b95a29690a49bc.bin") Found reference to API "(FreeNativeOverlapped0GetNativeOverlappedStatefSystem.Threading.IDeferredDisposable.OnFinalReleaseLCreateThreadLocalCompletionCountObject DispatchCallback" (Indicator: "CreateThread"; File: "ec75fbd3c2aced4224014b7c613fc2aa19e11833381d52dee1b95a29690a49bc.bin") Found reference to API "$CreateThreadpoolIo" (Indicator: "CreateThread"; File: "ec75fbd3c2aced4224014b7c613fc2aa19e11833381d52dee1b95a29690a49bc.bin") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; File: "ec75fbd3c2aced4224014b7c613fc2aa19e11833381d52dee1b95a29690a49bc.bin") Found reference to API "e: NtAllocateVirtualMemory failed" (Indicator: "AllocateVirtualMemory"; File: "ec75fbd3c2aced4224014b7c613fc2aa19e11833381d52dee1b95a29690a49bc.bin") Found reference to API "unPe: NtWriteVirtualMemory succes" (Indicator: "WriteVirtualMemory"; File: "ec75fbd3c2aced4224014b7c613fc2aa19e11833381d52dee1b95a29690a49bc.bin") Found reference to API "unPe: NtWriteVirtualMemory succes" (Indicator: "NtWriteVirtualMemory"; File: "ec75fbd3c2aced4224014b7c613fc2aa19e11833381d52dee1b95a29690a49bc.bin") Found reference to API "NtWriteVirtualMemory" (Indicator: "WriteVirtualMemory"; Source: "00000000-00001776.00000000.137145.9B930000.00000004.mdmp, 00000000-00001776.00000000.137145.A0000000.00000004.mdmp") Found reference to API "NtWriteVirtualMemory" (Indicator: "NtWriteVirtualMemory"; Source: "00000000-00001776.00000000.137145.9B930000.00000004.mdmp, 00000000-00001776.00000000.137145.A0000000.00000004.mdmp") Found reference to API "NtAllocateVirtualMemory" (Indicator: "AllocateVirtualMemory"; Source: "00000000-00001776.00000000.137145.A0000000.00000004.mdmp")28:Taec,Found reference to API "SuspendThread" (Indicator: "SuspendThread"; File: "ec75fbd3c2aced4224014b7c613fc2aa19e11833381d52dee1b95a29690a49bc.bin") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; File: "ec75fbd3c2aced4224014b7c613fc2aa19e11833381d52dee1b95a29690a49bc.bin") Found reference to API "SetThreadContext" (Indicator: "SetThreadContext"; File: "ec75fbd3c2aced4224014b7c613fc2aa19e11833381d52dee1b95a29690a49bc.bin") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; File: "ec75fbd3c2aced4224014b7c613fc2aa19e11833381d52dee1b95a29690a49bc.bin") Found reference to API "Wow64GetThreadContext" (Indicator: "GetThreadContext"; File: "ec75fbd3c2aced4224014b7c613fc2aa19e11833381d52dee1b95a29690a49bc.bin") Found reference to API "Wow64SetThreadContext" (Indicator: "SetThreadContext"; File: "ec75fbd3c2aced4224014b7c613fc2aa19e11833381d52dee1b95a29690a49bc.bin") Found reference to API "nPe: ResumeThread don" (Indicator: "ResumeThread"; File: "ec75fbd3c2aced4224014b7c613fc2aa19e11833381d52dee1b95a29690a49bc.bin") Found reference to API "NtResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00001776.00000000.137145.9B930000.00000004.mdmp, 00000000-00001776.00000000.137145.A0000000.00000004.mdmp") Found reference to API "RunPe: ResumeThread done" (Indicator: "ResumeThread"; Source: "00000000-00001776.00000000.137145.E05E5000.00000004.mdmp, 00000000-00001776.00000000.137145.E0699000.00000002.mdmp") Found reference to API "Wow64GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00001776.00000000.137145.E05E5000.00000004.mdmp, 00000000-00001776.00000000.137145.E0699000.00000002.mdmp") Found reference to API ""_GetThreadContext"_SetThreadContext,_Wow64GetThreadContext,_Wow64SetThreadContext" (Indicator: "SetThreadContext"; Source: "00000000-00001776.00000000.137145.E0699000.00000002.mdmp") Found reference to API ""_GetThreadContext"_SetThreadContext,_Wow64GetThreadContext,_Wow64SetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00001776.00000000.137145.E0699000.00000002.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00001776.00000000.137145.E0699000.00000002.mdmp") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00001776.00000000.137145.E0699000.00000002.mdmp") Found reference to API "SetThreadContext" (Indicator: "SetThreadContext"; Source: "00000000-00001776.00000000.137145.E0699000.00000002.mdmp") Found reference to API "Wow64SetThreadContext" (Indicator: "SetThreadContext"; Source: "00000000-00001776.00000000.137145.E0699000.00000002.mdmp") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; Source: "00000000-00001776.00000000.137145.E0699000.00000002.mdmp")29:T126c,Found reference to API "SleepEx" (Indicator: "SleepEx"; File: "ec75fbd3c2aced4224014b7c613fc2aa19e11833381d52dee1b95a29690a49bc.bin") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "ec75fbd3c2aced4224014b7c613fc2aa19e11833381d52dee1b95a29690a49bc.bin") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "ec75fbd3c2aced4224014b7c613fc2aa19e11833381d52dee1b95a29690a49bc.bin") Found reference to API "WaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjects"; File: "ec75fbd3c2aced4224014b7c613fc2aa19e11833381d52dee1b95a29690a49bc.bin") Found reference to API "WaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjectsEx"; File: "ec75fbd3c2aced4224014b7c613fc2aa19e11833381d52dee1b95a29690a49bc.bin") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; File: "ec75fbd3c2aced4224014b7c613fc2aa19e11833381d52dee1b95a29690a49bc.bin") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "ec75fbd3c2aced4224014b7c613fc2aa19e11833381d52dee1b95a29690a49bc.bin") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; File: "ec75fbd3c2aced4224014b7c613fc2aa19e11833381d52dee1b95a29690a49bc.bin") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; File: "ec75fbd3c2aced4224014b7c613fc2aa19e11833381d52dee1b95a29690a49bc.bin") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; File: "ec75fbd3c2aced4224014b7c613fc2aa19e11833381d52dee1b95a29690a49bc.bin") Found reference to API "8GetSystemSupportsLeapSeconds>GetGetSystemTimeAsFileTimeFnPtr" (Indicator: "GetSystemTimeAsFileTime"; File: "ec75fbd3c2aced4224014b7c613fc2aa19e11833381d52dee1b95a29690a49bc.bin") Found reference to API "SetTimerGetGetSystemTimeAsFileTimeFnPtr" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00001776.00000000.137145.E0699000.00000002.mdmp") Found reference to API "SetTimerb__0@" (Indicator: "Aes"; File: "ec75fbd3c2aced4224014b7c613fc2aa19e11833381d52dee1b95a29690a49bc.bin") Found reference to "6b__70_0@" (Indicator: "ECDsa"; File: "ec75fbd3c2aced4224014b7c613fc2aa19e11833381d52dee1b95a29690a49bc.bin") Found reference to "6b__70_1@" (Indicator: "ECDsa"; File: "ec75fbd3c2aced4224014b7c613fc2aa19e11833381d52dee1b95a29690a49bc.bin") Found reference to "Jb__71_0@" (Indicator: "ECDiffieHellman"; File: "ec75fbd3c2aced4224014b7c613fc2aa19e11833381d52dee1b95a29690a49bc.bin") Found reference to "Jb__71_1@" (Indicator: "ECDiffieHellman"; File: "ec75fbd3c2aced4224014b7c613fc2aa19e11833381d52dee1b95a29690a49bc.bin") Found reference to "pCertContext:b__21_0@" (Indicator: "ECDsa"; File: "ec75fbd3c2aced4224014b7c613fc2aa19e11833381d52dee1b95a29690a49bc.bin")2c:T71a,"pzstgq.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE") "pzstgq.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE") "pzstgq.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS DEFENDER") "pzstgq.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS DEFENDER") "pzstgq.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\REMOVALTOOLS\MRT") "pzstgq.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\REMOVALTOOLS\MRT") "pzstgq.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT") "pzstgq.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS DEFENDER\POLICY MANAGER") "pzstgq.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\DIAGNOSTICS") "pzstgq.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON") "pzstgq.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON") "pzstgq.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SYSTEM") "pzstgq.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SYSTEM") "pzstgq.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\SETUP") "pzstgq.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\SETUP") "pzstgq.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS DEFENDER") "pzstgq.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS DEFENDER") "pzstgq.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\") "pzstgq.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT") "pzstgq.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT")2d:T7dc,"g____PInvoke|6_0" (Indicator: "CryptDecrypt"; File: "ec75fbd3c2aced4224014b7c613fc2aa19e11833381d52dee1b95a29690a49bc.bin") Found reference to API "BCryptDecryptRsa" (Indicator: "BCryptDecrypt"; File: "ec75fbd3c2aced4224014b7c613fc2aa19e11833381d52dee1b95a29690a49bc.bin") Found reference to API "BCryptDecryptRsa" (Indicator: "CryptDecrypt"; File: "ec75fbd3c2aced4224014b7c613fc2aa19e11833381d52dee1b95a29690a49bc.bin") Found reference to API "BCryptDecrypt" (Indicator: "BCryptDecrypt"; Source: "00000000-00001776.00000000.137145.E0699000.00000002.mdmp") Found reference to API "BCryptDecrypt" (Indicator: "CryptDecrypt"; Source: "00000000-00001776.00000000.137145.E0699000.00000002.mdmp") Found reference to API "CryptDecrypt" (Indicator: "CryptDecrypt"; Source: "00000000-00001776.00000000.137145.E0699000.00000002.mdmp") Found reference to API "<g____PInvoke|6_0" (Indicator: "CryptDecrypt"; Source: "00000000-00001776.00000000.137145.E0699000.00000002.mdmp") Found reference to API "BCryptDecryptRsa" (Indicator: "BCryptDecrypt"; Source: "00000000-00001776.00000000.137145.E0699000.00000002.mdmp") Found reference to API "BCryptDecryptRsa" (Indicator: "CryptDecrypt"; Source: "00000000-00001776.00000000.137145.E0699000.00000002.mdmp") Found reference to API "NCryptDecrypt" (Indicator: "NCryptDecrypt"; Source: "00000000-00001776.00000000.137145.E0699000.00000002.mdmp") Found reference to API "NCryptDecrypt" (Indicator: "CryptDecrypt"; Source: "00000000-00001776.00000000.137145.E0699000.00000002.mdmp")33:T431,Found string "BCryptEncryptRsa" (Indicator: "EncryptRSA"; File: "ec75fbd3c2aced4224014b7c613fc2aa19e11833381d52dee1b95a29690a49bc.bin") Found string "BCryptDecryptRsa" (Indicator: "DecryptRSA"; File: "ec75fbd3c2aced4224014b7c613fc2aa19e11833381d52dee1b95a29690a49bc.bin") Found string "IDX10693: RSACryptoServiceProvider doesn't support the RSASSA-PSS signature algorithm. The list of supported algorithms is available here: https://aka.ms/IdentityModel/supported-algorithms" (Indicator: "RSACryptoServiceProvider"; Source: "00000000-00001776.00000000.137145.E05E5000.00000004.mdmp, 00000000-00001776.00000000.137145.E0699000.00000002.mdmp") Found string "RSABCrypt0RSACryptoServiceProvider X509Certificates" (Indicator: "RSACryptoServiceProvider"; Source: "00000000-00001776.00000000.137145.E0699000.00000002.mdmp") Found string "BCryptEncryptRsa" (Indicator: "EncryptRSA"; Source: "00000000-00001776.00000000.137145.E0699000.00000002.mdmp") Found string "BCryptDecryptRsa" (Indicator: "DecryptRSA"; Source: "00000000-00001776.00000000.137145.E0699000.00000002.mdmp")34:T7cd,Found reference to API "CryptAcquireCertificatePrivateKey" (Indicator: "CryptAcquireCertificatePrivateKey"; File: "ec75fbd3c2aced4224014b7c613fc2aa19e11833381d52dee1b95a29690a49bc.bin") Found reference to API "CryptCreateHash" (Indicator: "CryptCreateHash"; File: "ec75fbd3c2aced4224014b7c613fc2aa19e11833381d52dee1b95a29690a49bc.bin") Found reference to API "CryptDecrypt" (Indicator: "CryptDecrypt"; File: "ec75fbd3c2aced4224014b7c613fc2aa19e11833381d52dee1b95a29690a49bc.bin") Found reference to API "CryptEncrypt" (Indicator: "CryptEncrypt"; File: "ec75fbd3c2aced4224014b7c613fc2aa19e11833381d52dee1b95a29690a49bc.bin") Found reference to API "CryptExportKey" (Indicator: "CryptExportKey"; File: "ec75fbd3c2aced4224014b7c613fc2aa19e11833381d52dee1b95a29690a49bc.bin") Found reference to API "CryptGenKey" (Indicator: "CryptGenKey"; File: "ec75fbd3c2aced4224014b7c613fc2aa19e11833381d52dee1b95a29690a49bc.bin") Found reference to API "CryptGetUserKey" (Indicator: "CryptGetUserKey"; File: "ec75fbd3c2aced4224014b7c613fc2aa19e11833381d52dee1b95a29690a49bc.bin") Found reference to API "CryptImportKey" (Indicator: "CryptImportKey"; File: "ec75fbd3c2aced4224014b7c613fc2aa19e11833381d52dee1b95a29690a49bc.bin") Found reference to API "CryptAcquireContextW" (Indicator: "CryptAcquireContextW"; File: "ec75fbd3c2aced4224014b7c613fc2aa19e11833381d52dee1b95a29690a49bc.bin") Found reference to API "CryptDestroyHash" (Indicator: "CryptDestroyHash"; File: "ec75fbd3c2aced4224014b7c613fc2aa19e11833381d52dee1b95a29690a49bc.bin") Found reference to API "CryptDestroyKey" (Indicator: "CryptDestroyKey"; File: "ec75fbd3c2aced4224014b7c613fc2aa19e11833381d52dee1b95a29690a49bc.bin") Found reference to API "CryptGetHashParam" (Indicator: "CryptGetHashParam"; File: "ec75fbd3c2aced4224014b7c613fc2aa19e11833381d52dee1b95a29690a49bc.bin") Found reference to API "CryptReleaseContext" (Indicator: "CryptReleaseContext"; File: "ec75fbd3c2aced4224014b7c613fc2aa19e11833381d52dee1b95a29690a49bc.bin")35:Td8e,file/memory contains long string with (Indicator: "private key"; File: "ec75fbd3c2aced4224014b7c613fc2aa19e11833381d52dee1b95a29690a49bc.bin") Found string "IDX12720: Token string does not match the token formats: JWE (header.encryptedKey.iv.ciphertext.tag) or JWS (header.payload.signature" (Indicator: "encryptedkey"; File: "ec75fbd3c2aced4224014b7c613fc2aa19e11833381d52dee1b95a29690a49bc.bin") Found string "Invalid assembly public key" (Indicator: "public key"; File: "ec75fbd3c2aced4224014b7c613fc2aa19e11833381d52dee1b95a29690a49bc.bin") Found string "Key is not a valid private key" (Indicator: "private key"; File: "ec75fbd3c2aced4224014b7c613fc2aa19e11833381d52dee1b95a29690a49bc.bin") Found string "[Private Key" (Indicator: "private key"; File: "ec75fbd3c2aced4224014b7c613fc2aa19e11833381d52dee1b95a29690a49bc.bin") Found string "[Public Key" (Indicator: "public key"; File: "ec75fbd3c2aced4224014b7c613fc2aa19e11833381d52dee1b95a29690a49bc.bin") file/memory contains long string with (Indicator: "encryptedkey"; File: "ec75fbd3c2aced4224014b7c613fc2aa19e11833381d52dee1b95a29690a49bc.bin") Found string "is not a valid private key" (Indicator: "private key"; File: "ec75fbd3c2aced4224014b7c613fc2aa19e11833381d52dee1b95a29690a49bc.bin") Found string "lic or private key" (Indicator: "private key"; File: "ec75fbd3c2aced4224014b7c613fc2aa19e11833381d52dee1b95a29690a49bc.bin") file/memory contains long string with (Indicator: "private key"; Source: "00000000-00001776.00000000.137145.E05E5000.00000004.mdmp, 00000000-00001776.00000000.137145.E0699000.00000002.mdmp") Found string "The token needs to be in JWS or JWE Compact Serialization Format. (JWS): 'EncodedHeader.EndcodedPayload.EncodedSignature'. (JWE): 'EncodedProtectedHeader.EncodedEncryptedKey.EncodedInitializationVector.EncodedCiphertext.EncodedAuthenticationTag'." (Indicator: "encryptedkey"; Source: "00000000-00001776.00000000.137145.E05E5000.00000004.mdmp, 00000000-00001776.00000000.137145.E0699000.00000002.mdmp") Found string "IDX12720: Token string does not match the token formats: JWE (header.encryptedKey.iv.ciphertext.tag) or JWS (header.payload.signature)" (Indicator: "encryptedkey"; Source: "00000000-00001776.00000000.137145.E05E5000.00000004.mdmp, 00000000-00001776.00000000.137145.E0699000.00000002.mdmp") Found string "Invalid assembly public key." (Indicator: "public key"; Source: "00000000-00001776.00000000.137145.E05E5000.00000004.mdmp, 00000000-00001776.00000000.137145.E0699000.00000002.mdmp") Found string "Key is not a valid private key." (Indicator: "private key"; Source: "00000000-00001776.00000000.137145.E05E5000.00000004.mdmp, 00000000-00001776.00000000.137145.E0699000.00000002.mdmp") Found string "Key is not a valid public or private key." (Indicator: "private key"; Source: "00000000-00001776.00000000.137145.E05E5000.00000004.mdmp, 00000000-00001776.00000000.137145.E0699000.00000002.mdmp") Found string "[Private Key]" (Indicator: "private key"; Source: "00000000-00001776.00000000.137145.E05E5000.00000004.mdmp, 00000000-00001776.00000000.137145.E0699000.00000002.mdmp") Found string "[Public Key]" (Indicator: "public key"; Source: "00000000-00001776.00000000.137145.E05E5000.00000004.mdmp, 00000000-00001776.00000000.137145.E0699000.00000002.mdmp") Found string "rawEncryptedKey" (Indicator: "encryptedkey"; Source: "00000000-00001776.00000000.137145.E05E5000.00000004.mdmp, 00000000-00001776.00000000.137145.E0699000.00000002.mdmp")36:T824,The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains ability to perform AES/RC4 encryption (API string) Matched sigs: Contains key cryptographic functions (API string) Matched sigs: Able to import cryptographic keys (seen in ransomware) Matched sigs: Able to utilize the Windows bcrypt cryptographic API Matched sigs: Contains CRYPTO related strings Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Contains reference to cryptographic keys Matched sigs: Contains ability to perform AES decryption (Dotnet String) Matched sigs: Contains ability to decode base64 data Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Contains ability to perform encryption/decryption using RSA algorithm Matched sigs: Contains asymmetric cryptographic functions (API string) Matched sigs: Contains ability to perform decryption (API string) Matched sigs: Calls an API typically used to decrypt a block of data Matched sigs: Calls an API typically used to import asymmetric cryptographic keys into a CSP Matched sigs: Able to decrypt/decode data Matched sigs: Calls an API typically used to encrypt data Matched sigs: Contains ability to perform Base64 encoding/decoding Matched sigs: Able to access crypto-related API (String) Matched sigs: Calls an API typically used to decrypt data Matched sigs: References bcrypt module and functions (used for encryption/decryption) Matched sigs: Calls an API typically used to decrypt the data Matched sigs: Able to perform cryptographic operations Matched sigs: Reads the cryptographic machine GUID Matched sigs: Calls an API typically used to import cryptographic keys into a CSP Matched sigs: Contains XOR operation loops [Stream disassembly] Matched sigs: Calls an API typically used to encrypt a block of data Matched sigs: Contains key cryptographic functions of the CryptoAPI Matched sigs: Contains cryptographic functions of the CryptoAPI Matched sigs: HTTP requests contain Base64 strings37:T1c88,Found XOR loop in file "sample.bin" at offset 2752039; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3364118; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3436811; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3606165; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3697904; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3799496; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3833511; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3850447; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3852284; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3858326; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3870063; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3885502; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3889828; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 402748; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 525878; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 525909; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 613020; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 613033; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 627423; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 686015; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 686724; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 711113; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 737513; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 738378; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 739873; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 740139; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 777401; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 803049; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 803770; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 808113; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 891199; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1010733; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1025146; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1044203; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1150282; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1157575; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1157858; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1157896; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1181690; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1182114; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1182120; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1190981; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1193243; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1213458; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1237931; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1266333; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1269478; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1375430; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1375485; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1381499; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1383192; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1384083; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1741590; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1768097; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1768157; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1786021; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1793780; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1797893; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1850196; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1852404; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1854612; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1856852; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1859092; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1861302; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1864196; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1866420; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1964292; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1994292; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2148253; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2148409; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2148631; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2616836; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3893017; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 130939; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 180036; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1807188; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2637960; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2758208; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3358337; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3406478; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3411527; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3467054; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3513384; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3538986; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3565257; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3568344; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3576802; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3592052; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3592065; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3592138; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3592262; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3709916; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3744692; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3749288; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3753992; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3778380; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3778388; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3793028; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3837916; code bytes = 803038:T51c,Found string "etUserNameExW" (Source: "00000000-00001776.00000000.137145.9B930000.00000004.mdmp") Found string "get_UserName" (Source: "00000000-00001776.00000000.137145.9BB90000.00000040.mdmp, 00000000-00001776.00000000.137145.A0000000.00000004.mdmp") Found string "get_OSVersion" (Source: "00000000-00001776.00000000.137145.9BB90000.00000040.mdmp, 00000000-00001776.00000000.137145.A0000000.00000004.mdmp, 00000000-00001776.00000000.137145.E0699000.00000002.mdmp") Found string "get_Is64BitOperatingSystem" (Source: "00000000-00001776.00000000.137145.9BB90000.00000040.mdmp, 00000000-00001776.00000000.137145.A0000000.00000004.mdmp") Found string "get_MachineName" (Source: "00000000-00001776.00000000.137145.9BB90000.00000040.mdmp, 00000000-00001776.00000000.137145.A0000000.00000004.mdmp") Found string "OSVersion's call to GetVersionEx failed." (Source: "00000000-00001776.00000000.137145.E05E5000.00000004.mdmp, 00000000-00001776.00000000.137145.E0699000.00000002.mdmp") Found string "GetOSVersion&get_SystemDirectory&get_UserInteractive4GetEnvironmentVariableCoreLGetEnvironmentVariableCore_NoArrayPool" (Source: "00000000-00001776.00000000.137145.E0699000.00000002.mdmp") Found string ""get_VersionString$IsOSVersionAtLeast" (Source: "00000000-00001776.00000000.137145.E0699000.00000002.mdmp")39:T40e,Found reference to API ""GetLocaleInfoCore@" (Indicator: "GetLocaleInfo"; File: "ec75fbd3c2aced4224014b7c613fc2aa19e11833381d52dee1b95a29690a49bc.bin"), Found reference to API ":GetLocaleInfoCoreUserOverride@" (Indicator: "GetLocaleInfo"; File: "ec75fbd3c2aced4224014b7c613fc2aa19e11833381d52dee1b95a29690a49bc.bin"), Found reference to API "*GetUserDefaultCulture.GetUserDefaultUICulture0GetUserDefaultLocaleName@" (Indicator: "GetUserDefaultLocaleName"; File: "ec75fbd3c2aced4224014b7c613fc2aa19e11833381d52dee1b95a29690a49bc.bin"), Found reference to API ""GetLocaleInfoCore@" (Indicator: "GetLocaleInfo"; Source: "00000000-00001776.00000000.137145.E0699000.00000002.mdmp") Found reference to API ":GetLocaleInfoCoreUserOverride@" (Indicator: "GetLocaleInfo"; Source: "00000000-00001776.00000000.137145.E0699000.00000002.mdmp") Found reference to API "*GetUserDefaultCulture.GetUserDefaultUICulture0GetUserDefaultLocaleName@" (Indicator: "GetUserDefaultLocaleName"; Source: "00000000-00001776.00000000.137145.E0699000.00000002.mdmp")3a:Tb1a,Found system information discovery API: "GetSystemInfo" in file "ec75fbd3c2aced4224014b7c613fc2aa19e11833381d52dee1b95a29690a49bc.bin" Found system information discovery API: "ExpandEnvironmentStringsW" in file "ec75fbd3c2aced4224014b7c613fc2aa19e11833381d52dee1b95a29690a49bc.bin" Found system information discovery API: "0ExpandEnvironmentStrings" in file "ec75fbd3c2aced4224014b7c613fc2aa19e11833381d52dee1b95a29690a49bc.bin" Found system information discovery API: "$*RtlNtStatusToDosError" in file "ec75fbd3c2aced4224014b7c613fc2aa19e11833381d52dee1b95a29690a49bc.bin" Found system information discovery API: "0NtQuerySystemInformation" in file "ec75fbd3c2aced4224014b7c613fc2aa19e11833381d52dee1b95a29690a49bc.bin" Found system information discovery API: ".GetProcessWindowStation2GetUserObjectInformationW" in file "ec75fbd3c2aced4224014b7c613fc2aa19e11833381d52dee1b95a29690a49bc.bin" Found system information discovery API: "Zg____PInvoke|210_0" in file "ec75fbd3c2aced4224014b7c613fc2aa19e11833381d52dee1b95a29690a49bc.bin" Found system information discovery API: "GetUserObjectInformationW" in file "ec75fbd3c2aced4224014b7c613fc2aa19e11833381d52dee1b95a29690a49bc.bin" Found system information discovery API: "NtQuerySystemInformation" in file "ec75fbd3c2aced4224014b7c613fc2aa19e11833381d52dee1b95a29690a49bc.bin" Found system information discovery API: "RtlNtStatusToDosError" in file "ec75fbd3c2aced4224014b7c613fc2aa19e11833381d52dee1b95a29690a49bc.bin" Found system information discovery API: "0ExpandEnvironmentStrings" in "00000000-00001776.00000000.137145.E0699000.00000002.mdmp" Found system information discovery API: "$*RtlNtStatusToDosError" in "00000000-00001776.00000000.137145.E0699000.00000002.mdmp" Found system information discovery API: "0NtQuerySystemInformation" in "00000000-00001776.00000000.137145.E0699000.00000002.mdmp" Found system information discovery API: ".GetProcessWindowStation2GetUserObjectInformationW" in "00000000-00001776.00000000.137145.E0699000.00000002.mdmp" Found system information discovery API: "Zg____PInvoke|210_0" in "00000000-00001776.00000000.137145.E0699000.00000002.mdmp" Found system information discovery API: "GetUserObjectInformationW" in "00000000-00001776.00000000.137145.E0699000.00000002.mdmp" Found system information discovery API: "NtQuerySystemInformation" in "00000000-00001776.00000000.137145.E0699000.00000002.mdmp" Found system information discovery API: "RtlNtStatusToDosError" in "00000000-00001776.00000000.137145.E0699000.00000002.mdmp" Found system information discovery API: "GetSystemInfo" in "00000000-00001776.00000000.137145.E0699000.00000002.mdmp" Found system information discovery API: "ExpandEnvironmentStringsW" in "00000000-00001776.00000000.137145.E0699000.00000002.mdmp"3b:T113f,"GetGetSystemTimeAsFileTimeFnPtr" (Indicator: "GetSystemTime"; File: "ec75fbd3c2aced4224014b7c613fc2aa19e11833381d52dee1b95a29690a49bc.bin") Found reference to API "GetLocalTimeZone" (Indicator: "GetLocalTime"; File: "ec75fbd3c2aced4224014b7c613fc2aa19e11833381d52dee1b95a29690a49bc.bin") Found reference to API ":GetLocalTimeZoneFromWin32Data" (Indicator: "GetLocalTime"; File: "ec75fbd3c2aced4224014b7c613fc2aa19e11833381d52dee1b95a29690a49bc.bin") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00001776.00000000.137145.E05E5000.00000004.mdmp, 00000000-00001776.00000000.137145.E0699000.00000002.mdmp") Found reference to API "GetSystemTimePreciseAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00001776.00000000.137145.E05E5000.00000004.mdmp, 00000000-00001776.00000000.137145.E0699000.00000002.mdmp") Found reference to API "8GetSystemSupportsLeapSeconds>GetGetSystemTimeAsFileTimeFnPtr" (Indicator: "GetSystemTime"; Source: "00000000-00001776.00000000.137145.E0699000.00000002.mdmp") Found reference to API "GetLocalTimeZone" (Indicator: "GetLocalTime"; Source: "00000000-00001776.00000000.137145.E0699000.00000002.mdmp") Found reference to API ":GetLocalTimeZoneFromWin32Data" (Indicator: "GetLocalTime"; Source: "00000000-00001776.00000000.137145.E0699000.00000002.mdmp") Found reference to API "GetSystemTime" (Indicator: "GetSystemTime"; Source: "00000000-00001776.00000000.137145.E0699000.00000002.mdmp")3e:T57c,Found reference to API "FileTimeToSystemTime" (Indicator: "FileTimeToSystemTime"; File: "ec75fbd3c2aced4224014b7c613fc2aa19e11833381d52dee1b95a29690a49bc.bin") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "ec75fbd3c2aced4224014b7c613fc2aa19e11833381d52dee1b95a29690a49bc.bin") Found reference to API "SystemTimeToFileTime" (Indicator: "SystemTimeToFileTime"; File: "ec75fbd3c2aced4224014b7c613fc2aa19e11833381d52dee1b95a29690a49bc.bin") Found reference to API "8GetSystemSupportsLeapSeconds>GetGetSystemTimeAsFileTimeFnPtr" (Indicator: "GetSystemTimeAsFileTime"; File: "ec75fbd3c2aced4224014b7c613fc2aa19e11833381d52dee1b95a29690a49bc.bin") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00001776.00000000.137145.E05E5000.00000004.mdmp, 00000000-00001776.00000000.137145.E0699000.00000002.mdmp") Found reference to API "8GetSystemSupportsLeapSeconds>GetGetSystemTimeAsFileTimeFnPtr" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00001776.00000000.137145.E0699000.00000002.mdmp") Found reference to API "SystemTimeToFileTime" (Indicator: "SystemTimeToFileTime"; Source: "00000000-00001776.00000000.137145.E0699000.00000002.mdmp") Found reference to API "FileTimeToSystemTime" (Indicator: "FileTimeToSystemTime"; Source: "00000000-00001776.00000000.137145.E0699000.00000002.mdmp")3f:T7d3,Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; File: "ec75fbd3c2aced4224014b7c613fc2aa19e11833381d52dee1b95a29690a49bc.bin") Found reference to API "GetSystemTime" (Indicator: "GetSystemTime"; File: "ec75fbd3c2aced4224014b7c613fc2aa19e11833381d52dee1b95a29690a49bc.bin") Found reference to API "GetSystemTimePreciseAsFileTim" (Indicator: "GetSystemTime"; File: "ec75fbd3c2aced4224014b7c613fc2aa19e11833381d52dee1b95a29690a49bc.bin") Found reference to API "8GetSystemSupportsLeapSeconds>GetGetSystemTimeAsFileTimeFnPtr" (Indicator: "GetSystemTime"; File: "ec75fbd3c2aced4224014b7c613fc2aa19e11833381d52dee1b95a29690a49bc.bin") Found reference to API "GetLocalTimeZone" (Indicator: "GetLocalTime"; File: "ec75fbd3c2aced4224014b7c613fc2aa19e11833381d52dee1b95a29690a49bc.bin") Found reference to API ":GetLocalTimeZoneFromWin32Data" (Indicator: "GetLocalTime"; File: "ec75fbd3c2aced4224014b7c613fc2aa19e11833381d52dee1b95a29690a49bc.bin") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00001776.00000000.137145.E05E5000.00000004.mdmp, 00000000-00001776.00000000.137145.E0699000.00000002.mdmp") Found reference to API "GetSystemTimePreciseAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00001776.00000000.137145.E05E5000.00000004.mdmp, 00000000-00001776.00000000.137145.E0699000.00000002.mdmp") Found reference to API "8GetSystemSupportsLeapSeconds>GetGetSystemTimeAsFileTimeFnPtr" (Indicator: "GetSystemTime"; Source: "00000000-00001776.00000000.137145.E0699000.00000002.mdmp") Found reference to API "GetLocalTimeZone" (Indicator: "GetLocalTime"; Source: "00000000-00001776.00000000.137145.E0699000.00000002.mdmp") Found reference to API ":GetLocalTimeZoneFromWin32Data" (Indicator: "GetLocalTime"; Source: "00000000-00001776.00000000.137145.E0699000.00000002.mdmp") Found reference to API "GetSystemTime" (Indicator: "GetSystemTime"; Source: "00000000-00001776.00000000.137145.E0699000.00000002.mdmp")40:T53a,Found reference to API "GetDynamicTimeZoneInformation" (Indicator: "GetDynamicTimeZoneInformation"; File: "ec75fbd3c2aced4224014b7c613fc2aa19e11833381d52dee1b95a29690a49bc.bin") Found reference to API "GetTimeZoneInformation" (Indicator: "GetTimeZoneInformation"; File: "ec75fbd3c2aced4224014b7c613fc2aa19e11833381d52dee1b95a29690a49bc.bin") Found reference to API ":GetDynamicTimeZoneInformation" (Indicator: "GetDynamicTimeZoneInformation"; File: "ec75fbd3c2aced4224014b7c613fc2aa19e11833381d52dee1b95a29690a49bc.bin") Found reference to API ",GetTimeZoneInformation" (Indicator: "GetTimeZoneInformation"; File: "ec75fbd3c2aced4224014b7c613fc2aa19e11833381d52dee1b95a29690a49bc.bin") Found reference to API ":GetDynamicTimeZoneInformation" (Indicator: "GetDynamicTimeZoneInformation"; Source: "00000000-00001776.00000000.137145.E0699000.00000002.mdmp") Found reference to API ",GetTimeZoneInformation" (Indicator: "GetTimeZoneInformation"; Source: "00000000-00001776.00000000.137145.E0699000.00000002.mdmp") Found reference to API "GetDynamicTimeZoneInformation" (Indicator: "GetDynamicTimeZoneInformation"; Source: "00000000-00001776.00000000.137145.E0699000.00000002.mdmp") Found reference to API "GetTimeZoneInformation" (Indicator: "GetTimeZoneInformation"; Source: "00000000-00001776.00000000.137145.E0699000.00000002.mdmp")41:T4f1,Found reference to API "OSVersion's call to GetVersionEx failed" (Indicator: "GetVersion"; File: "ec75fbd3c2aced4224014b7c613fc2aa19e11833381d52dee1b95a29690a49bc.bin") Found reference to API "RtlGetVersionEx" (Indicator: "GetVersion"; File: "ec75fbd3c2aced4224014b7c613fc2aa19e11833381d52dee1b95a29690a49bc.bin") Found reference to API "@g____PInvoke|22_0" (Indicator: "GetVersion"; File: "ec75fbd3c2aced4224014b7c613fc2aa19e11833381d52dee1b95a29690a49bc.bin") Found reference to API "RtlGetVersion" (Indicator: "GetVersion"; File: "ec75fbd3c2aced4224014b7c613fc2aa19e11833381d52dee1b95a29690a49bc.bin") Found reference to API "OSVersion's call to GetVersionEx failed." (Indicator: "GetVersion"; Source: "00000000-00001776.00000000.137145.E05E5000.00000004.mdmp, 00000000-00001776.00000000.137145.E0699000.00000002.mdmp") Found reference to API "RtlGetVersionEx" (Indicator: "GetVersion"; Source: "00000000-00001776.00000000.137145.E0699000.00000002.mdmp") Found reference to API "@g____PInvoke|22_0" (Indicator: "GetVersion"; Source: "00000000-00001776.00000000.137145.E0699000.00000002.mdmp") Found reference to API "RtlGetVersion" (Indicator: "GetVersion"; Source: "00000000-00001776.00000000.137145.E0699000.00000002.mdmp")42:T7ad,"pzstgq.exe" (Access type: "QUERY"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES"; Key: ""; Value: "") "pzstgq.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "pzstgq.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "REGISTRATIONENABLED"; Value: "") "pzstgq.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "REGISTERADAPTERNAME"; Value: "") "pzstgq.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DOMAIN"; Value: "") "pzstgq.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DHCPDOMAIN"; Value: "") "pzstgq.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "pzstgq.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "pzstgq.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "pzstgq.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "") "pzstgq.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "SEARCHLIST"; Value: "")43:T514,"pzstgq.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET"; Key: ""; Value: "") "pzstgq.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\GOOGLE CHROME"; Key: ""; Value: "") "pzstgq.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\GOOGLE CHROME\SHELL\OPEN\COMMAND"; Key: ""; Value: "") "pzstgq.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\GOOGLE CHROME\SHELL\OPEN\COMMAND"; Key: ""; Value: "") "pzstgq.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\IEXPLORE.EXE"; Key: ""; Value: "") "pzstgq.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\IEXPLORE.EXE\SHELL\OPEN\COMMAND"; Key: ""; Value: "") "pzstgq.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\IEXPLORE.EXE\SHELL\OPEN\COMMAND"; Key: ""; Value: "") "pzstgq.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\MICROSOFT EDGE"; Key: ""; Value: "") "pzstgq.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\MICROSOFT EDGE\SHELL\OPEN\COMMAND"; Key: ""; Value: "") "pzstgq.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\MICROSOFT EDGE\SHELL\OPEN\COMMAND"; Key: ""; Value: "")44:T519,"pzstgq.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\pzstgq.exe" at 00000000-00002296-00000C17-1130613793 "pzstgq.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll" at 00000000-00002296-00000C17-1141323971 "pzstgq.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll" at 00000000-00002296-00000C17-1141335984 "pzstgq.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll" at 00000000-00002296-00000C17-1141347358 "pzstgq.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll" at 00000000-00002296-00000C17-1141394977 "pzstgq.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll" at 00000000-00002296-00000C17-1142421786 "pzstgq.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00002296-00000C17-114313182145:T6c4,"pzstgq.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "pzstgq.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT"; Key: "") "pzstgq.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT"; Key: "") "pzstgq.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\SMARTCARDROOT"; Key: "") "pzstgq.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\FLIGHTROOT"; Key: "") "pzstgq.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "pzstgq.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES"; Key: "22FF89586561FC2D52F77491E9F1EFF1B80BE33E") "pzstgq.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES"; Key: "22FF89586561FC2D52F77491E9F1EFF1B80BE33E") "pzstgq.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\FLIGHTROOT\CERTIFICATES"; Key: "22FF89586561FC2D52F77491E9F1EFF1B80BE33E") "pzstgq.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "22FF89586561FC2D52F77491E9F1EFF1B80BE33E") "pzstgq.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES"; Key: "CABD2A79A1076A31F21D253635CB039D4329A5E8") "pzstgq.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES"; Key: "CABD2A79A1076A31F21D253635CB039D4329A5E8") "pzstgq.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\CABD2A79A1076A31F21D253635CB039D4329A5E8"; Key: "BLOB") "pzstgq.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "PINRULESLASTSYNCTIME") "pzstgq.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "PINRULESENCODEDCTL")46:T31f0,"g____PInvoke|17_0" (Indicator: "QueryInformationFile"; File: "ec75fbd3c2aced4224014b7c613fc2aa19e11833381d52dee1b95a29690a49bc.bin") Found reference to API "NtQueryInformationFile" (Indicator: "QueryInformationFile"; File: "ec75fbd3c2aced4224014b7c613fc2aa19e11833381d52dee1b95a29690a49bc.bin") Found reference to API "GetTempPath" (Indicator: "GetTempPath"; Source: "00000000-00001776.00000000.137145.9BB90000.00000040.mdmp, 00000000-00001776.00000000.137145.A0000000.00000004.mdmp") Found reference to API "GetTempFileName" (Indicator: "GetTempFileName"; Source: "00000000-00001776.00000000.137145.9BB90000.00000040.mdmp, 00000000-00001776.00000000.137145.A0000000.00000004.mdmp") Found reference to API "_GetFileSize" (Indicator: "GetFileSize"; Source: "00000000-00001776.00000000.137145.E0699000.00000002.mdmp") Found reference to API "FreeLibrary4GetFileAttributesExPrivate" (Indicator: "GetFileAttributes"; Source: "00000000-00001776.00000000.137145.E0699000.00000002.mdmp") Found reference to API "8GetFileInformationByHandleEx" (Indicator: "GetFileInformationByHandle"; Source: "00000000-00001776.00000000.137145.E0699000.00000002.mdmp") Found reference to API "&GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; Source: "00000000-00001776.00000000.137145.E0699000.00000002.mdmp") Found reference to API ",NtQueryInformationFile" (Indicator: "QueryInformationFile"; Source: "00000000-00001776.00000000.137145.E0699000.00000002.mdmp") Found reference to API "Rg____PInvoke|17_0" (Indicator: "QueryInformationFile"; Source: "00000000-00001776.00000000.137145.E0699000.00000002.mdmp") Found reference to API "NtQueryInformationFile" (Indicator: "QueryInformationFile"; Source: "00000000-00001776.00000000.137145.E0699000.00000002.mdmp") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; Source: "00000000-00001776.00000000.137145.E0699000.00000002.mdmp") Found reference to API "GetFileAttributesExW" (Indicator: "GetFileAttributes"; Source: "00000000-00001776.00000000.137145.E0699000.00000002.mdmp") Found reference to API "GetFileInformationByHandleEx" (Indicator: "GetFileInformationByHandle"; Source: "00000000-00001776.00000000.137145.E0699000.00000002.mdmp") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; Source: "00000000-00001776.00000000.137145.E0699000.00000002.mdmp")5c:Tab0,Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; File: "ec75fbd3c2aced4224014b7c613fc2aa19e11833381d52dee1b95a29690a49bc.bin") Found reference to API "0NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; File: "ec75fbd3c2aced4224014b7c613fc2aa19e11833381d52dee1b95a29690a49bc.bin") Found reference to API ".GetProcessWindowStation2GetUserObjectInformationW" (Indicator: "GetProcessWindowStation"; File: "ec75fbd3c2aced4224014b7c613fc2aa19e11833381d52dee1b95a29690a49bc.bin") Found reference to API ".GetProcessWindowStation2GetUserObjectInformationW" (Indicator: "GetUserObjectInformation"; File: "ec75fbd3c2aced4224014b7c613fc2aa19e11833381d52dee1b95a29690a49bc.bin") Found reference to API "Zg____PInvoke|210_0" (Indicator: "GetUserObjectInformation"; File: "ec75fbd3c2aced4224014b7c613fc2aa19e11833381d52dee1b95a29690a49bc.bin") Found reference to API "GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; File: "ec75fbd3c2aced4224014b7c613fc2aa19e11833381d52dee1b95a29690a49bc.bin") Found reference to API "GetUserObjectInformationW" (Indicator: "GetUserObjectInformation"; File: "ec75fbd3c2aced4224014b7c613fc2aa19e11833381d52dee1b95a29690a49bc.bin") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; File: "ec75fbd3c2aced4224014b7c613fc2aa19e11833381d52dee1b95a29690a49bc.bin") Found reference to API "0NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00001776.00000000.137145.E0699000.00000002.mdmp") Found reference to API ".GetProcessWindowStation2GetUserObjectInformationW" (Indicator: "GetProcessWindowStation"; Source: "00000000-00001776.00000000.137145.E0699000.00000002.mdmp") Found reference to API ".GetProcessWindowStation2GetUserObjectInformationW" (Indicator: "GetUserObjectInformation"; Source: "00000000-00001776.00000000.137145.E0699000.00000002.mdmp") Found reference to API "Zg____PInvoke|210_0" (Indicator: "GetUserObjectInformation"; Source: "00000000-00001776.00000000.137145.E0699000.00000002.mdmp") Found reference to API "GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; Source: "00000000-00001776.00000000.137145.E0699000.00000002.mdmp") Found reference to API "GetUserObjectInformationW" (Indicator: "GetUserObjectInformation"; Source: "00000000-00001776.00000000.137145.E0699000.00000002.mdmp") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00001776.00000000.137145.E0699000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00001776.00000000.137145.E0699000.00000002.mdmp")5d:Tce8,Found string "PKCS12 (PFX) without a supplied password has exceeded maximum allowed iterations. See https://go.microsoft.com/fwlink/?linkid=2233907 for more information" (Indicator: "password"; File: "ec75fbd3c2aced4224014b7c613fc2aa19e11833381d52dee1b95a29690a49bc.bin") Found string "The KDF for algorithm '{0}' requires a char-based password input" (Indicator: "password"; File: "ec75fbd3c2aced4224014b7c613fc2aa19e11833381d52dee1b95a29690a49bc.bin") Found string "http://schemas.microsoft.com/ws/2012/01/passwordexpirationday" (Indicator: "password"; File: "ec75fbd3c2aced4224014b7c613fc2aa19e11833381d52dee1b95a29690a49bc.bin") Found string "to generate a secret agreement" (Indicator: "secret"; File: "ec75fbd3c2aced4224014b7c613fc2aa19e11833381d52dee1b95a29690a49bc.bin") Found string "lied password. See https://go.microsoft.com/fwlink/?linkid=2233907 for more information" (Indicator: "password"; File: "ec75fbd3c2aced4224014b7c613fc2aa19e11833381d52dee1b95a29690a49bc.bin") Found string "http://schemas.microsoft.com/ws/2012/01/passwordchangeur" (Indicator: "password"; File: "ec75fbd3c2aced4224014b7c613fc2aa19e11833381d52dee1b95a29690a49bc.bin") Found string "//schemas.microsoft.com/ws/2012/01/passwordexpirationtim" (Indicator: "password"; File: "ec75fbd3c2aced4224014b7c613fc2aa19e11833381d52dee1b95a29690a49bc.bin") Found string "PKCS12 (PFX) without a supplied password has exceeded maximum allowed iterations. See https://go.microsoft.com/fwlink/?linkid=2233907 for more information." (Indicator: "password"; Source: "00000000-00001776.00000000.137145.E05E5000.00000004.mdmp, 00000000-00001776.00000000.137145.E0699000.00000002.mdmp") Found string "The KDF for algorithm '{0}' requires a char-based password input." (Indicator: "password"; Source: "00000000-00001776.00000000.137145.E05E5000.00000004.mdmp, 00000000-00001776.00000000.137145.E0699000.00000002.mdmp") Found string "The keys from both parties must be the same size to generate a secret agreement." (Indicator: "secret"; Source: "00000000-00001776.00000000.137145.E05E5000.00000004.mdmp, 00000000-00001776.00000000.137145.E0699000.00000002.mdmp") Found string "There was a problem with the PKCS12 (PFX) without a supplied password. See https://go.microsoft.com/fwlink/?linkid=2233907 for more information." (Indicator: "password"; Source: "00000000-00001776.00000000.137145.E05E5000.00000004.mdmp, 00000000-00001776.00000000.137145.E0699000.00000002.mdmp") Found string "http://schemas.microsoft.com/ws/2012/01/passwordchangeurl" (Indicator: "password"; Source: "00000000-00001776.00000000.137145.E05E5000.00000004.mdmp, 00000000-00001776.00000000.137145.E0699000.00000002.mdmp") Found string "http://schemas.microsoft.com/ws/2012/01/passwordexpirationdays" (Indicator: "password"; Source: "00000000-00001776.00000000.137145.E05E5000.00000004.mdmp, 00000000-00001776.00000000.137145.E0699000.00000002.mdmp") Found string "http://schemas.microsoft.com/ws/2012/01/passwordexpirationtime" (Indicator: "password"; Source: "00000000-00001776.00000000.137145.E05E5000.00000004.mdmp, 00000000-00001776.00000000.137145.E0699000.00000002.mdmp") Found string "password" (Indicator: "password"; Source: "00000000-00001776.00000000.137145.E05E5000.00000004.mdmp, 00000000-00001776.00000000.137145.E0699000.00000002.mdmp")5e:T927,"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-\"; File: \"ec75fbd3c2aced4224014b7c613fc2aa19e11833381d52dee1b95a29690a49bc.bin\")\n Found string \">ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_\"; File: \"ec75fbd3c2aced4224014b7c613fc2aa19e11833381d52dee1b95a29690a49bc.bin\")\n Found string \">ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-\"; Source: \"00000000-00001776.00000000.137145.E0699000.00000002.mdmp\")\n Found string \">ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_\"; Source: \"00000000-00001776.00000000.137145.E0699000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1132","relevance":1,"id":"string-338","sources":[{"report_type":"sandbox","report_id":"69778aaaf1461cfcd7018d08"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"$2b","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"69778aaaf1461cfcd7018d08"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00001776.00000000.137145.9BB90000.00000040.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00001776.00000000.137145.A0000000.00000004.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"69778aaaf1461cfcd7018d08"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"$2c","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"69778aaaf1461cfcd7018d08"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"$2d","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"69778aaaf1461cfcd7018d08"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; File: \"ec75fbd3c2aced4224014b7c613fc2aa19e11833381d52dee1b95a29690a49bc.bin\")\n Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"ec75fbd3c2aced4224014b7c613fc2aa19e11833381d52dee1b95a29690a49bc.bin\")\n Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount\"; File: \"ec75fbd3c2aced4224014b7c613fc2aa19e11833381d52dee1b95a29690a49bc.bin\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"69778aaaf1461cfcd7018d08"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"ec75fbd3c2aced4224014b7c613fc2aa19e11833381d52dee1b95a29690a49bc.bin\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"ec75fbd3c2aced4224014b7c613fc2aa19e11833381d52dee1b95a29690a49bc.bin\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"ec75fbd3c2aced4224014b7c613fc2aa19e11833381d52dee1b95a29690a49bc.bin\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-148","sources":[{"report_type":"sandbox","report_id":"69778aaaf1461cfcd7018d08"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"PE file contains zero-sized sections","description":"Raw size of \"hydrated\" is zero","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-5","sources":[{"report_type":"sandbox","report_id":"69778aaaf1461cfcd7018d08"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to access crypto-related API (String)","description":"Found reference to API \"CryptUnprotectData\" (Indicator: \"CryptUnprotectData\"; Source: \"00000000-00002296-00000C2C-1142682524\")\n Found reference to API \"CryptUnprotectDataW\" (Indicator: \"CryptUnprotectData\"; Source: \"00000000-00002296-00000C2C-1142682564\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-920","sources":[{"report_type":"sandbox","report_id":"69778aaaf1461cfcd7018d08"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to decrypt/decode data","description":"Found reference to API \".DecryptFunctionNotFound\" (Indicator: \".decrypt\"; File: \"ec75fbd3c2aced4224014b7c613fc2aa19e11833381d52dee1b95a29690a49bc.bin\")\n Found reference to API \"CreateDecryptor@\" (Indicator: \"CreateDecryptor\"; File: \"ec75fbd3c2aced4224014b7c613fc2aa19e11833381d52dee1b95a29690a49bc.bin\")\n Found reference to API \"CreateDecryptor\" (Indicator: \"CreateDecryptor\"; Source: \"00000000-00001776.00000000.137145.9BB90000.00000040.mdmp, 00000000-00001776.00000000.137145.A0000000.00000004.mdmp\")\n Found reference to API \".DecryptFunctionNotFound\" (Indicator: \".decrypt\"; Source: \"00000000-00001776.00000000.137145.E0699000.00000002.mdmp\")\n Found reference to API \"CreateDecryptor@\" (Indicator: \"CreateDecryptor\"; Source: \"00000000-00001776.00000000.137145.E0699000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-356","sources":[{"report_type":"sandbox","report_id":"69778aaaf1461cfcd7018d08"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to import cryptographic keys (seen in ransomware)","description":"Found api reference \"BCryptImportKeyPair\" (Indicator: \"BCryptImportKeyPair\"; File: \"ec75fbd3c2aced4224014b7c613fc2aa19e11833381d52dee1b95a29690a49bc.bin\")\n Found api reference \"BCryptImportKey\" (Indicator: \"BCryptImportKey\"; File: \"ec75fbd3c2aced4224014b7c613fc2aa19e11833381d52dee1b95a29690a49bc.bin\")\n Found api reference \"CryptImportKey\" (Indicator: \"CryptImportKey\"; File: \"ec75fbd3c2aced4224014b7c613fc2aa19e11833381d52dee1b95a29690a49bc.bin\")\n Found api reference \"BCryptImportKey\" (Indicator: \"BCryptImportKey\"; Source: \"00000000-00001776.00000000.137145.E0699000.00000002.mdmp\")\n Found api reference \"CryptImportKey\" (Indicator: \"CryptImportKey\"; Source: \"00000000-00001776.00000000.137145.E0699000.00000002.mdmp\")\n Found api reference \"BCryptImportKeyPair\" (Indicator: \"BCryptImportKeyPair\"; Source: \"00000000-00001776.00000000.137145.E0699000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-603","sources":[{"report_type":"sandbox","report_id":"69778aaaf1461cfcd7018d08"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to use Microsoft's Enhanced Cryptographic Provider","description":"$2e","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-602","sources":[{"report_type":"sandbox","report_id":"69778aaaf1461cfcd7018d08"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to utilize the Windows bcrypt cryptographic API","description":"$2f","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-927","sources":[{"report_type":"sandbox","report_id":"69778aaaf1461cfcd7018d08"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"$30","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"69778aaaf1461cfcd7018d08"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to decode base64 data","description":"Found reference to API \"ThrowInvalidBase FromBase64String$TryFromBase64Chars\" (Indicator: \"FromBase64String\"; File: \"ec75fbd3c2aced4224014b7c613fc2aa19e11833381d52dee1b95a29690a49bc.bin\")\n Found reference to API \"FromBase64String\" (Indicator: \"FromBase64String\"; Source: \"00000000-00001776.00000000.137145.9BB90000.00000040.mdmp, 00000000-00001776.00000000.137145.A0000000.00000004.mdmp\")\n Found reference to API \"ThrowInvalidBase FromBase64String$TryFromBase64Chars\" (Indicator: \"FromBase64String\"; Source: \"00000000-00001776.00000000.137145.E0699000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-106","sources":[{"report_type":"sandbox","report_id":"69778aaaf1461cfcd7018d08"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform AES decryption (Dotnet String)","description":"Observed string: \"System.Security.Cryptography.ThrowOnX509ChainBuildInternalErro.ValidKeySize\"EncryptWithAesGcm..DecryptFunctionNotFound\" in Source: ec75fbd3c2aced4224014b7c613fc2aa19e11833381d52dee1b95a29690a49bc.bin, Observed string: \"System.Collections.Generic.IEnumerable.GetEnumerator@.IsAesCbc*IsSupportedRsaKeyWrap6IsSupportedSymmetricKeyWrap.IsSupportedRsaAlgorithm\"IsSupportedRsaPss.DecryptKey\" in Source: ec75fbd3c2aced4224014b7c613fc2aa19e11833381d52dee1b95a29690a49bc.bin","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-445","sources":[{"report_type":"sandbox","report_id":"69778aaaf1461cfcd7018d08"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform AES/RC4 encryption (API string)","description":"$31","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-438","sources":[{"report_type":"sandbox","report_id":"69778aaaf1461cfcd7018d08"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform decryption (API string)","description":"$32","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-212","sources":[{"report_type":"sandbox","report_id":"69778aaaf1461cfcd7018d08"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform encryption/decryption using RSA algorithm","description":"$33","origin":"File/Memory","mitre_attack_id":"T1573.002","relevance":1,"id":"string-352","sources":[{"report_type":"sandbox","report_id":"69778aaaf1461cfcd7018d08"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains key cryptographic functions (API string)","description":"$34","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-195","sources":[{"report_type":"sandbox","report_id":"69778aaaf1461cfcd7018d08"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to cryptographic keys","description":"$35","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-280","sources":[{"report_type":"sandbox","report_id":"69778aaaf1461cfcd7018d08"}]},{"level":"informative","category":"Cryptographic Related","name":"HTTP requests contain Base64 strings","description":"Contains base64 string in header \"Keep\" in header \"GET / HTTP/1.1Host: icanhazip.comConnection: Keep-Alive\"","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-60","sources":[{"report_type":"sandbox","report_id":"69778aaaf1461cfcd7018d08"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to decode base64 data\n Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: HTTP requests contain Base64 strings","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"69778aaaf1461cfcd7018d08"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"$36","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"69778aaaf1461cfcd7018d08"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"69778aaaf1461cfcd7018d08"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$37","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"69778aaaf1461cfcd7018d08"}]},{"level":"informative","category":"Environment Awareness","name":"Able to access user sensitive domain","description":"file/memory contains long string with (Indicator: \"github.com\"; File: \"Chromium_cookies_DESKTOP-FVVF82A_2026-01-26_15.41.18.json\")\n Found string \"https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet{\" (Indicator: \"github.com\"; Source: \"00000000-00001776.00000000.137145.E0699000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1590","relevance":1,"id":"string-761","sources":[{"report_type":"sandbox","report_id":"69778aaaf1461cfcd7018d08"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate system processes using native API","description":"Found reference to API \"0NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; File: \"ec75fbd3c2aced4224014b7c613fc2aa19e11833381d52dee1b95a29690a49bc.bin\")\n Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; File: \"ec75fbd3c2aced4224014b7c613fc2aa19e11833381d52dee1b95a29690a49bc.bin\")\n Found reference to API \"0NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00001776.00000000.137145.E0699000.00000002.mdmp\")\n Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00001776.00000000.137145.E0699000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-907","sources":[{"report_type":"sandbox","report_id":"69778aaaf1461cfcd7018d08"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system information (.NET)","description":"$38","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-937","sources":[{"report_type":"sandbox","report_id":"69778aaaf1461cfcd7018d08"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"Found string \"0NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; File: \"ec75fbd3c2aced4224014b7c613fc2aa19e11833381d52dee1b95a29690a49bc.bin\")\n Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; File: \"ec75fbd3c2aced4224014b7c613fc2aa19e11833381d52dee1b95a29690a49bc.bin\")\n Found string \"0NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00001776.00000000.137145.E0699000.00000002.mdmp\")\n Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00001776.00000000.137145.E0699000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"69778aaaf1461cfcd7018d08"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetLastInputInfo\" (Indicator: \"GetLastInputInfo\"; Source: \"00000000-00001776.00000000.137145.9BB90000.00000040.mdmp, 00000000-00001776.00000000.137145.A0000000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"69778aaaf1461cfcd7018d08"}]},{"level":"informative","category":"Environment Awareness","name":"Able to list processes on remote desktop session host","description":"Found reference to API \"ProcessIdToSessionId\" (Indicator: \"ProcessIdToSessionId\"; Source: \"00000000-00002296-00000C2C-1152602540\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-906","sources":[{"report_type":"sandbox","report_id":"69778aaaf1461cfcd7018d08"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; Source: \"00000000-00002296-00000C2C-1130432741\")\n Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; Source: \"00000000-00002296-00000C2C-1130433361\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"69778aaaf1461cfcd7018d08"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"$39","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"69778aaaf1461cfcd7018d08"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query volume/memory size (API string)","description":"Found reference to API \"GlobalMemoryStatusEx\" (Indicator: \"GlobalMemoryStatus\"; File: \"ec75fbd3c2aced4224014b7c613fc2aa19e11833381d52dee1b95a29690a49bc.bin\")\n Found reference to API \"GlobalMemoryStatusEx\" (Indicator: \"GlobalMemoryStatusEx\"; File: \"ec75fbd3c2aced4224014b7c613fc2aa19e11833381d52dee1b95a29690a49bc.bin\")\n Found reference to API \"GlobalMemoryStatusEx\" (Indicator: \"GlobalMemoryStatus\"; Source: \"00000000-00001776.00000000.137145.E0699000.00000002.mdmp\")\n Found reference to API \"GlobalMemoryStatusEx\" (Indicator: \"GlobalMemoryStatusEx\"; Source: \"00000000-00001776.00000000.137145.E0699000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-193","sources":[{"report_type":"sandbox","report_id":"69778aaaf1461cfcd7018d08"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve geographical location information","description":"Found reference to API \"GetAddrInfoW\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00002296-00000C2C-1146437423\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-739","sources":[{"report_type":"sandbox","report_id":"69778aaaf1461cfcd7018d08"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"$3a","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"69778aaaf1461cfcd7018d08"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve system language (API string)","description":"Found reference to API \"GetKeyboardLayout\" (Indicator: \"GetKeyboardLayout\"; Source: \"00000000-00001776.00000000.137145.9BB90000.00000040.mdmp, 00000000-00001776.00000000.137145.A0000000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"69778aaaf1461cfcd7018d08"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"pzstgq.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00002296)\n \"pzstgq.exe\" called \"GetWriteWatch\" with parameters (UID: 00000000-00002296)","origin":"API Call","mitre_attack_id":"T1497","relevance":3,"id":"api-296","sources":[{"report_type":"sandbox","report_id":"69778aaaf1461cfcd7018d08"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\" HTTP/1.1 200 OK\nDate: Mon\n 26 Jan 2026 15:40:27 GMT\nContent-Type: text/plain\nContent-Length: 14\nConnection: keep-alive\nCF-RAY: 9c411bde98c92c39-SJC\nAccess-Control-Allow-Origin: *\nAccess-Control-Allow-Methods: GET\nSet-Cookie: __cf_bm=aB8NHW5AWB.cb5WkVOiT1Ht8Zs15SFe0fYJFwjZY.rA-1769442027-1.0.1.1-w_wRBhiHvW6O9HgWgaelyrOY9Ouz12DRLQFi1xXG00_5lxEs.2mB6Z9pjx6Ev6PVwAS5LFCPDUv6e44jwBU8x1YyEOia52CIndhlyH2F.UE; path=/; expires=Mon\n 26-Jan-26 16:10:27 GMT; domain=.icanhazip.com; HttpOnly\nServer: cloudflare\nalt-svc: h3=\":443\"; ma=86400 with response body ==>36342E3132342E31322E3136320A.......","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"69778aaaf1461cfcd7018d08"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$4d","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"69778aaaf1461cfcd7018d08"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"jsc.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\36eaccfde177c2e7b93b8dbdde4e012a\\mscorlib.ni.dll\" at 70760000\n \"pzstgq.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\fe2524177eb3088c77be666722039f52\\mscorlib.ni.dll\" at C15E0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-3","sources":[{"report_type":"sandbox","report_id":"69778aaaf1461cfcd7018d08"}]},{"level":"informative","category":"General","name":"Loads the AMSI (Antimalware Scan Interface) DLL","description":"\"jsc.exe\" loaded module \"%WINDIR%\\SysWOW64\\amsi.dll\" at 6EBB0000\n \"pzstgq.exe\" loaded module \"%WINDIR%\\System32\\amsi.dll\" at DD5C0000","origin":"Loaded Module","mitre_attack_id":"T1562.001","id":"module-8","sources":[{"report_type":"sandbox","report_id":"69778aaaf1461cfcd7018d08"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"g____PInvoke|22_0\" (Indicator: \"RtlGetVersion\"; File: \"ec75fbd3c2aced4224014b7c613fc2aa19e11833381d52dee1b95a29690a49bc.bin\")\n Found reference to API \"RtlGetVersion\" (Indicator: \"RtlGetVersion\"; File: \"ec75fbd3c2aced4224014b7c613fc2aa19e11833381d52dee1b95a29690a49bc.bin\")\n Found reference to API \"RtlGetVersionEx\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00001776.00000000.137145.E0699000.00000002.mdmp\")\n Found reference to API \"@g____PInvoke|22_0\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00001776.00000000.137145.E0699000.00000002.mdmp\")\n Found reference to API \"RtlGetVersion\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00001776.00000000.137145.E0699000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"69778aaaf1461cfcd7018d08"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"$56","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"69778aaaf1461cfcd7018d08"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve information about pressed keystrokes (API string)","description":"Found reference to API \"GetKeyState\" (Indicator: \"GetKeyState\"; Source: \"00000000-00001776.00000000.137145.9BB90000.00000040.mdmp, 00000000-00001776.00000000.137145.A0000000.00000004.mdmp\")\n Found reference to API \"GetKeyboardState\" (Indicator: \"GetKeyboardState\"; Source: \"00000000-00001776.00000000.137145.9BB90000.00000040.mdmp, 00000000-00001776.00000000.137145.A0000000.00000004.mdmp\")\n Found reference to API \"MapVirtualKey\" (Indicator: \"MapVirtualKey\"; Source: \"00000000-00001776.00000000.137145.9BB90000.00000040.mdmp, 00000000-00001776.00000000.137145.A0000000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-88","sources":[{"report_type":"sandbox","report_id":"69778aaaf1461cfcd7018d08"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve running process details (.NET)","description":"Found string \"get_ProcessName\" (Source: \"00000000-00001776.00000000.137145.9BB90000.00000040.mdmp, 00000000-00001776.00000000.137145.A0000000.00000004.mdmp\")\n Found string \"GetProcessById\" (Source: \"00000000-00001776.00000000.137145.9BB90000.00000040.mdmp, 00000000-00001776.00000000.137145.A0000000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-931","sources":[{"report_type":"sandbox","report_id":"69778aaaf1461cfcd7018d08"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$57","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"69778aaaf1461cfcd7018d08"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"