24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 34:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4ad,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Jalapeno.Generic Sample f556c0986ef6… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample f556c0986ef6…. Malware family: Jalapeno.Generic. Threat score 100/100. 17/26 AV engines flagged this file. 6 malicious and 6 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2","keywords":["Malicious","Jalapeno.Generic","malware analysis","sandbox report","threat intelligence","f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2"],"about":{"@type":"SoftwareApplication","name":"bounty-57790487195655566","applicationCategory":["peexe","64bits","assembly","executable"],"identifier":"f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Jalapeno.Generic","antivirusDetections":{"malicious":17,"total":26},"behavioralIndicators":{"malicious":6,"suspicious":6},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T4d8,The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Contains CRYPTO related strings Matched sigs: Calls an API typically used to decrypt a block of data Matched sigs: Calls an API typically used to encrypt data Matched sigs: Contains ability to perform symmetric decryption (Dotnet) Matched sigs: Contains ability to perform symmetric encryption (Dotnet) Matched sigs: Calls an API typically used to import cryptographic keys into a CSP Matched sigs: Calls an API typically used to encrypt a block of data Matched sigs: Calls an API typically used to decrypt data Matched sigs: Reads the cryptographic machine GUID Matched sigs: HTTP requests contain Base64 strings Matched sigs: Contains ability to decode string content at runtime (Dotnet) Matched sigs: Contains ability to perform crypto operations Matched sigs: Contains ability to perform CryptoStream operations (Dotnet) Matched sigs: Contains ability to perform symmetric crypto operations Matched sigs: Dotnet file contains encryption/decryption functions Matched sigs: Sample file has high entropy (likely encrypted/compressed content)26:T12ce,"f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000018000000000000003578a042074c00000800000000000000ffffffffffffffff3400000000000000a4299779fd7f000018e7cfeba8000000db04688bfd7f000000000000fd7f00002a965988fd7f0000000000000000000009000000000000000000000000000000000000000000000000000000000000000100000000000000ffffffffffffffff340000000000000080e7cfeba80000000800000000000000000000000000000000000000000000008566a142074c0000c3f0668bfd7f000000008189fd7f0000a713678bfd7f0000d8e7cfeb (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000000040000000000000000000f5a0890200000b8e688bfd7f00000000f5a0890200000200000089020000380000000000000040000000000000003003f5a089020000f8d7cfeba80000000100000000000000030000000000000001000000000000001600000000000000a00eeda08902000000000000000000000000eda08902000000a0afeba8000000000000000000000062000000010000000000000000000000800000000000000004000000000000000000000000000000c849e7a08902000004000000000000003800000000000000f098ca89fd7f00003800000000000000380000000000000070d9cfeba8000000c00caa72fd7f000000000000 (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f000002000000000000000000000000000000d0b03180fd7f00000700000000000000000000000000000001000000000000004064f5a089020000000000000000000050f16cbb890200004c98ca89fd7f0000c0156dbb89020000b3cea072fd7f0000f0f56cbb89020000004f3180fd7f0000d0b03180fd7f000000000000000000000000000000000000f0f56cbb890200004064f5a089020000602d6dbb89020000c8d9cfeba80000004c98ca89fd7f00000100000000000000c8d9cfeba8000000602d6dbb89020000f0f56cbb89020000010000000000000002bca072fd7f000070f46cbb8902000090336bbb89020000feffffff040000007df03080fd7f0000002a6dbb (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f000002000000000000000700000000000000000000000000000001000000000000004064f5a089020000000000000000000050f16cbb890200004c98ca89fd7f0000c0106dbb89020000b3cea072fd7f000020f96cbb89020000384f3180fd7f0000d0b03180fd7f00000000000000000000000000000000000020f96cbb890200004064f5a089020000602d6dbb89020000c0d9cfeba80000004c98ca89fd7f00000100000000000000c0d9cfeba8000000602d6dbb8902000020f96cbb89020000010000000000000002bca072fd7f0000000000000000000090336bbb8902000070f46cbb04000000feffffffffffffff4064f5a0890200007df03080fd7f000000000000 (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006356)27:T19b7,"f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MPCLIENT.DLL (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MsMpLics.dll (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00006356)28:T6990,"f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "GetProcAddress" with a parameter RegisterShimImplCallback (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "GetProcAddress" with a parameter RegisterShimImplCleanupCallback (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "GetProcAddress" with a parameter SetShellShimInstance (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "GetProcAddress" with a parameter OnShimDllMainCalled (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "GetProcAddress" with a parameter _CorExeMain_RetAddr (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "GetProcAddress" with a parameter _CorExeMain (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "GetProcAddress" with a parameter UrlIsW (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "GetProcAddress" with a parameter AppPolicyGetClrCompat (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "GetProcAddress" with a parameter GetCurrentPackageInfo (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "GetProcAddress" with a parameter GetCurrentPackagePath (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "GetProcAddress" with a parameter SetRuntimeInfo (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "GetProcAddress" with a parameter QuirkIsEnabled3 (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "GetProcAddress" with a parameter QuirkGetData2 (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "GetProcAddress" with a parameter CreateConfigStream (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "GetProcAddress" with a parameter CreateConfigStream_RetAddr (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "GetProcAddress" with a parameter GetNumaHighestNodeNumber (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "GetProcAddress" with a parameter RtlVirtualUnwind (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "GetProcAddress" with a parameter GetSystemWindowsDirectoryW (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "GetProcAddress" with a parameter AddAccessAllowedAce (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "GetProcAddress" with a parameter RoInitialize (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "GetProcAddress" with a parameter AddSIDToBoundaryDescriptor (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "GetProcAddress" with a parameter CreateBoundaryDescriptorW (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "GetProcAddress" with a parameter CreatePrivateNamespaceW (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "GetProcAddress" with a parameter OpenPrivateNamespaceW (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "GetProcAddress" with a parameter DeleteBoundaryDescriptor (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "GetProcAddress" with a parameter WerRegisterRuntimeExceptionModule (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "GetProcAddress" with a parameter RaiseException (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "GetProcAddress" with a parameter GetProcessMemoryInfo (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "GetProcAddress" with a parameter RoUninitialize (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "GetProcAddress" with a parameter CoGetContextToken (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "GetProcAddress" with a parameter GetEnabledXStateFeatures (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "GetProcAddress" with a parameter sxsJitStartup (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "GetProcAddress" with a parameter jitStartup (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "GetProcAddress" with a parameter getJit (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "GetProcAddress" with a parameter GetCurrentProcessId (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "GetProcAddress" with a parameter GetCurrentProcessIdW (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "GetProcAddress" with a parameter OpenProcess (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "GetProcAddress" with a parameter VirtualProtect (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "GetProcAddress" with a parameter GetUserPreferredUILanguages (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "GetProcAddress" with a parameter BCryptGetFipsAlgorithmMode (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "GetProcAddress" with a parameter RegOpenKeyEx (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "GetProcAddress" with a parameter GetFullPathName (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "GetProcAddress" with a parameter GetFullPathNameW (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "GetProcAddress" with a parameter SetThreadErrorMode (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "GetProcAddress" with a parameter GetFileAttributesEx (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "GetProcAddress" with a parameter CreateFile (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "GetProcAddress" with a parameter GetFileSize (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "GetProcAddress" with a parameter ReadProcessMemory (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "GetProcAddress" with a parameter WldpIsDynamicCodePolicyEnabled (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "GetProcAddress" with a parameter AmsiInitialize (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeExW (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "GetProcAddress" with a parameter GetFileVersionInfoExW (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "GetProcAddress" with a parameter AmsiScanBuffer (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "GetProcAddress" with a parameter MpManagerOpen (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "GetProcAddress" with a parameter MpHandleClose (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "GetProcAddress" with a parameter MpFreeMemory (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "GetProcAddress" with a parameter MpScanStart (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "GetProcAddress" with a parameter MpMemoryScanStart (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "GetProcAddress" with a parameter MpScanResult (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "GetProcAddress" with a parameter MpThreatOpen (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "GetProcAddress" with a parameter MpThreatEnumerate (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "GetProcAddress" with a parameter MpConfigOpen (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "GetProcAddress" with a parameter MpConfigGetValue (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "GetProcAddress" with a parameter MpConfigGetValueAlloc (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "GetProcAddress" with a parameter MpConfigClose (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "GetProcAddress" with a parameter MpFastMemoryScanOpen (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "GetProcAddress" with a parameter MpFastMemoryScan (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "GetProcAddress" with a parameter MpTelemetryInitialize (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "GetProcAddress" with a parameter MpTelemetryUninitialize (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "GetProcAddress" with a parameter MpTelemetryAddToAverageDWORD (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "GetProcAddress" with a parameter MpAmsiScan (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "GetProcAddress" with a parameter MpAmsiCloseSession (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "GetProcAddress" with a parameter MpConfigRegisterForNotifications (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "GetProcAddress" with a parameter MpConfigUnregisterNotifications (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "GetProcAddress" with a parameter MpClientUtilExportFunctions (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "GetProcAddress" with a parameter MpManagerVersionQuery (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "GetProcAddress" with a parameter EventWrite (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "GetProcAddress" with a parameter IsWow64Process (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "GetProcAddress" with a parameter RegisterGPNotification (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "GetProcAddress" with a parameter EventWriteTransfer (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "GetProcAddress" with a parameter UnregisterGPNotification (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap_RetAddr (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "GetProcAddress" with a parameter CreateProcess (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "GetProcAddress" with a parameter CreateProcessW (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "GetProcAddress" with a parameter Wow64GetThreadContext (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "GetProcAddress" with a parameter VirtualAllocEx (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "GetProcAddress" with a parameter WriteProcessMemory (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "GetProcAddress" with a parameter Wow64SetThreadContext (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "GetProcAddress" with a parameter ResumeThread (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "GetProcAddress" with a parameter CoWaitForMultipleHandles (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "GetProcAddress" with a parameter CreateActCtxW (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "GetProcAddress" with a parameter AddRefActCtx (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "GetProcAddress" with a parameter ReleaseActCtx (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "GetProcAddress" with a parameter ActivateActCtx (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "GetProcAddress" with a parameter DeactivateActCtx (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "GetProcAddress" with a parameter GetCurrentActCtx (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "GetProcAddress" with a parameter QueryActCtxW (UID: 00000000-00006356)29:T1b18,"f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" loaded module "KERNEL32" at base 7ffd89f50000 "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 7ffd88770000 "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 7ffd88770000 "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 7ffd88770000 "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 7ffd897e0000 "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ffd88770000 "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ffd88770000 "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ffd88770000 "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ffd68ed0000 "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" loaded module "ADVAPI32.DLL" at base 7ffd89530000 "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSCOREEI.DLL" at base 7ffd68d70000 "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" loaded module "SHLWAPI.DLL" at base 7ffd8a170000 "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 7ffd879d0000 "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" loaded module "VERSION.DLL" at base 7ffd7f0e0000 "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLR.DLL" at base 7ffd598d0000 "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" loaded module "USER32.DLL" at base 7ffd89090000 "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 7ffd88770000 "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSCOREE.DLL" at base 0 "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" loaded module "MSCOREE.DLL" at base 7ffd74970000 "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" loaded module "NTDLL" at base 7ffd8b660000 "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 7ffd89220000 "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" loaded module "PSAPI.DLL" at base 7ffd88ee0000 "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" loaded module "RPCRT4.DLL" at base 7ffd88ef0000 "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" loaded module "KERNEL32.DLL" at base 7ffd89f50000 "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MSCORLIB\FE2524177EB3088C77BE666722039F52\MSCORLIB.NI.DLL" at base 7ffd582d0000 "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\OLE32.DLL" at base 0 "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" loaded module "OLE32.DLL" at base 7ffd895e0000 "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7ffd85ff0000 "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 0 "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 7ffd89220000 "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 7ffd88770000 "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLRJIT.DLL" at base 7ffd58180000 "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM\E43DD9C73AB5615E461BF5109C3FACD6\SYSTEM.NI.DLL" at base 7ffd57510000 "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CORE\0D59B0E237D7519417DE10CD84BDA4E7\SYSTEM.CORE.NI.DLL" at base 7ffd56a90000 "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\BCRYPT.DLL" at base 0 "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" loaded module "BCRYPT.DLL" at base 7ffd874b0000 "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" loaded module "WLDP.DLL" at base 7ffd869e0000 "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" loaded module "AMSI.DLL" at base 7ffd80320000 "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 7ffd7f0e0000 "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\MPOAV.DLL" at base 7ffd80300000 "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" loaded module "%WINDIR%\SYSTEM32\4IJGLVDQ.DLL" at base 7ffd72ab0000 "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\MPCLIENT.DLL" at base 7ffd729d0000 "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" loaded module "%WINDIR%\SYSTEM32\KERNEL32.DLL" at base 7ffd89f50000 "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" loaded module "USERENV.DLL" at base 7ffd878b0000 "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 7ffd89530000 "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 7ffd86df0000 "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 7ffd886f0000 "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" loaded module "NTDLL.DLL" at base 7ffd8b6600002a:Ta26,Observed system executable string:"1,"fusion","GAC",01,"WinRT","NotApp",13,"System Version=4.0.0.0 Culture=neutral PublicKeyToken=b77a5c561934e089","C:\WINDOWS\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll",03,"System.Core Version=4.0.0.0 Culture=neutral PublicKeyToken=b77a5c561934e089","C:\WINDOWS\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll",0" [Source: f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe.log] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" [Source: 00000000-00006356-00000C2A-556411039] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll" [Source: 00000000-00006356-00000C2A-556749033] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" [Source: 00000000-00006356-00000C2A-556870349] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00006356-00000C2A-556961664] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll" [Source: 00000000-00006356-00000C2A-557254089] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" [Source: 00000000-00006356-00000C2A-557297301] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" [Source: 00000000-00006356-00000C2A-557416687] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll" [Source: 00000000-00006356-00000C2A-557663836] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll" [Source: 00000000-00006356-00000C2A-557724882] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll" [Source: 00000000-00006356-00000C2A-557874856] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" [Source: 00000000-00006356-00000C2A-557909375] Observed system executable string:"%WINDIR%\system32\version.dll" [Source: 00000000-00006356-00000C2A-558578111] Observed system executable string:"%WINDIR%\system32\kernel32.dll" [Source: 00000000-00006356-00000C2A-559212475] Observed system executable string:"%WINDIR%\system32\advapi32.dll" [Source: 00000000-00006356-00000C2A-559345443]2b:T9df,"f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\RPC"; Key: ""; Value: "") "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: ""; Value: "") "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\SETUP"; Key: ""; Value: "") "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\F556C0986EF6736F7C54AA22DE4B166A09C0A6BC541242A126041DA20848C2B2.EXE"; Key: ""; Value: "") "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS NT\RPC"; Key: ""; Value: "") "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: ""; Value: "")2c:Teaf,"f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\RPC"; Key: "MAXRPCSIZE"; Value: "") "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: "COMPUTERNAME"; Value: "") "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\SETUP"; Key: "OOBEINPROGRESS"; Value: "") "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\SETUP"; Key: "SYSTEMSETUPINPROGRESS"; Value: "") "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\RPC"; Key: "IDLETIMERWINDOW"; Value: "") "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "LOGFLAGS"; Value: "") "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "SHOWDEBUGINFO"; Value: "") "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: "CACHE"; Value: "") "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: "PREFEREXTERNALMANIFEST"; Value: "") "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SAFEDLLSEARCHMODE"; Value: "") "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "ENABLED"; Value: "") "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: "FIPSALGORITHMPOLICY"; Value: "") "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "MDMENABLED"; Value: "") "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORUSESYSTEMHEAP"; Value: "")2d:T584,"f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" trying to touch file "C:\Windows\System32\mscoree.dll" "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" trying to touch file "C:\Windows\System32\apphelp.dll" "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" trying to touch file "C:\f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" trying to touch file "C:\Windows\System32\ntdll.dll" "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" trying to touch file "C:\Windows\System32\kernel32.dll" "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" trying to touch file "C:\Windows\System32\KernelBase.dll" "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" trying to touch file "C:\Windows\apppatch\sysmain.sdb" "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" trying to touch file "C:\FLTLIB.DLL" "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" trying to touch file "C:\Windows\System32\fltLib.dll" "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" trying to touch file "C:\windows\temp\VxOle64.dll" "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" trying to touch file "C:\Windows\System32\imm32.dll"2e:Te02,"f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" trying to access non-existent file "C:\FLTLIB.DLL" "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" trying to access non-existent file "C:\CRYPTSP.DLL" "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\CLR.DLL" "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\VCRUNTIME140_CLR0400.DLL" "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\VCRUNTIME140_CLR0400.dll" "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\UCRTBASE_CLR0400.DLL" "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ucrtbase_clr0400.dll" "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSCOREE.DLL" "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\OLE32.DLL" "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\API-MS-WIN-CORE-WINRT-L1-1-0.DLL" "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\BCRYPT.DLL" "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" trying to access non-existent file "C:\ProgramData\Microsoft\Windows Defender\Platform\4.12.17007.18022-0\SLC.DLL" "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" trying to access non-existent file "C:\ProgramData\Microsoft\Windows Defender\platform\4.12.17007.18022-0\SLC.dll" "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" trying to access non-existent file "C:\ProgramData\Microsoft\Windows Defender\Platform\4.12.17007.18022-0\SPPC.DLL" "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" trying to access non-existent file "C:\ProgramData\Microsoft\Windows Defender\platform\4.12.17007.18022-0\sppc.dll" "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" trying to access non-existent file "C:\CRYPTBASE.DLL" "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" trying to access non-existent file "C:\CRYPTBASE.dll"2f:T78f,"f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" trying to access non-existent file "C:\Windows\System32\MSCOREE.DLL.LOCAL" "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" trying to access non-existent file "C:\WINDOWS\SYSTEM32\MSCOREE.DLL.local" "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" trying to access non-existent file "C:\F556C0986EF6736F7C54AA22DE4B166A09C0A6BC541242A126041DA20848C2B2.EXE.CONFIG" "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\FUSION.LOCALGAC" "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\fusion.localgac" "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\F556C0986EF6736F7C54AA22DE4B166A09C0A6BC541242A126041DA20848C2B2.EXE.LOG" "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" trying to access non-existent file "C:\f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe.config" "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_64\QNHH87" "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" trying to access non-existent file "C:\F556C0986EF6736F7C54AA22DE4B166A09C0A6BC541242A126041DA20848C2B2.INI" "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" trying to access non-existent file "C:\f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.INI" "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" trying to access non-existent file "C:\Windows\assembly\GAC\PUBLISHERPOLICY.TME"30:Tb94,"f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework64\\* (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "FindNextFileW" with parameter SharedReg12.dll (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "FindNextFileW" with parameter v2.0.50727 (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "FindNextFileW" with parameter v3.0 (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "FindNextFileW" with parameter v3.5 (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "FindNextFileW" with parameter v4.0.30319 (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\* (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "FindNextFileW" with parameter fe2524177eb3088c77be666722039f52 (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\QNHh87\* (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\* (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "FindNextFileW" with parameter e43dd9c73ab5615e461bf5109c3facd6 (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\* (UID: 00000000-00006356) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" called "FindNextFileW" with parameter 0d59b0e237d7519417de10cd84bda4e7 (UID: 00000000-00006356)31:T21de,Executable loaded in memory "MZ@ !L!This program cannot be run in DOS mode. $PELVKe!0<@Z `@ `TZWT`1 H.text: < `.reloc`>@B.rsrcT@@@ZHt2't00m( +6(%&,E-&(+5(X (( -E(+*0 ( (%&( (}( %&( %&( %&}( %& (,(%&( %&~ ~ $(((~ (%&,(,E-&s z0(( %&4(X( 8(()%&<(@(( D(,2E {(%&H(,s z+$ {(%&L(,s zP(T( {X(X\((%&`(,Es z,& {(%&d(,s zh(X( %& l(X( %& p( { t(x(( -E|(+ (,GE ( { ( ( (( %& (,s z { ( (,Es z (X (X( %& (8 (X( %& (X( (X( ( 9E (Y (X((%&!! (!i( {X!!i( ("",Es z (X (X (Y (##:E(! %& { (X ((%& ($$,s z (X( %&%%,E (X( %& (&&,5 {(%& ('',Es z+1 {(%& (((,Es z {( %& ()),Es zE& {(" %&(# **~'++,E*o$ (, (,+,*AW]E0 (% *0 (& *0G~~( ,,(%&(*%&( %&o' %&s( ~+*0~ +*0 *0 () *0 s(* %&t*0~ +*0K~-Cr[p (+ %&(, %&io- %& (. %&o/ %&aj($%&*0 (& *0 ~( %&*0 ~(0 *0 ~(1 %&*0 ~(2 %&*0 ~ _-'E-&~ X8|~@_-/E~ _b ~X` X+A~ ?_b ~Xb` ~Xb` ~X` X/E*~( *0\~-TE-&rmp (+ %&(, %&io- (. %&o/ %&aj($%&*0 (& *0 ~ _-'E-&~ X8|~@_-/E~ _b ~X` X+A~ ?_b ~Xb` ~Xb` ~X` X/~3 *(4 ~o- %&(5 %&*0I~&"~&# !s6 "s6 #s& *0 (& *06 o7 %& ,o8 2E-!&o9 %& *0 o7 %& rpo: %&/rpo: /E-"&~%hXo; %&n.o; %&N3E~%6o9 %& (< %& (= %&(> &**0#~%(? aj(%%& (@ *0(#%& &aj(%%& *0/ u ~& + oA %&& X 2oA %&f_9E-%&sB ((%&oC &oD ((%&oC %&&+ ,E+Xi2E,E(. %&("%&oE ~"-DE~ 3E~"oF %&ioG +~"~ oG ~"joH oI %& oJ oK %&& oK %&((%& oJ %&((%& oL %&i+7 oC %&& oM %&~"oN XXjoF %&2 oF jYioC %&& oF %&jYioO %&~"ioN ~"joH ~"_9E~#-FE~! 3!E~#oF %&iZoG +~#~!oG ~#joH sP ((%&oC %&1~#oN /E~#, oQ %&*oF oL %&Y((%&ioC %&&* * **** * *lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSetPADPADP\ m|C84jF.Yf"B,&<ŝ66x'"UeƱMM@2Ks""ZrGZ}afсl H=f1TG ,9&_bKhPD^ܩ˜ǤGC%8T(D-5(k9o:ivVKe[2RSDSeBF&l<>C:\Users\Administrator\Documents\CryptoObfuscator_Output\QUICK.pdbBSJBv4.0.30319ld#~#Strings"#GUID"p#Blob '#USW 3>(,>Q! tz 5 J5W_s;s s " 8"FS]Sdkttttttt,tCt^n$C$Q$Yr/6=FRZkpw~y y-.yPyryy%&y&'y'(y')y'*>y'+`y(,[`, yO q =_ +Mo3h#;#]3h#;111111;IIII[` ``^ ` ` ` #` .` 9` ?`H$P M% M)'V-'d. 'h.' n.' s.'d/'< }/'C /'< }/T(d/h(/(0(1(2()3)< }5*d50*m5+< }6p+d6+96+}7,8,9-;L0k}=P0k}=T0=\0>d0?l0k}?p0k}? ,Np < < < < * L n * L :\~$Fh& K[[;;'dIA\dQdIYdq1VV VV)VV9Vi&qV!VVadyi d)&i1"61ddd6FAKYdaCWiPkaqjwtq $d!(&0-056@M:Z?j$}$6EPXai ).S.[.c.;.3.K.C.U.+.j.b.s.k..{.@I`+#+g @AssemblyInfoAttributeAc7cd631edb7b18788f3b95e7ec3178e35SettingsQUICK.Propertiesc0a4f3ebc61f5bd03e84aa00e7e8c23a2cfa2930dba404860fa2ad53eea0140731c9e6a658373ee48edc3e86090f9bb5872cf9afe20756b982514087418b00c7cb56c220e9071a8d6ed4b7d2067b4ec73061fc19d43f709a18f6253edab83bf9ef20a3c222b30520180237af9e3046a14c1bc7ec6d79033ad1dddfbaa8244d5f99058acac7818d896e5b62da9f8be1e51fec2298fc80d1a61613d13198a7f033abacd5fb38ca6af9db3cd97091e0873cfbc59c4760dcc79332c91947e2a0955345a4891f06e6c09a88c5668819f509b003ef518ec08bccfc932cc5ccec6b965d208f5a7dcb1dc7c35a4a17f019c8261102b092cf7d3629fc3369ffe8703540d45eb8503bcc040c89c40b7fadb936d1409e0047ac5cf3088cfc1ffe22880c098c8683a6d0d71a55b0c0c4a444e7408e3b203e5b69a8fe311ccaeca25d423fcf212898d963d28dac995662c9c8e8c6cc534b3148dfd7db47d04825ac1f6e34ea48ae1b3be5858ddb39b9fc09cd1db14cb39c62bfa98f80ae6b0e6454bc61c029b0719720156924f5da12b9adedc6a7e1f9b2649f3835348ea90d1e5e97ccc882b614909724473468421f4d3060dcc2317aec0e56f57f99818d04145e76010c130a08acf0710a6ce084018fd6dc2ff9c3e5c5276d332abb2986622a15adc0089cd0986a5b9c7f1391ae90195c28e0e071c1df721489eed844973927b4299e7b48cc650fe530c9458b358d4edb79a463be8bc7b8086a08f7a6b20d6c9de3e43cc48e0c09af1efb32321687b2d4a056abe838cbc80900d23e9d60a443aaa055f4f64404fc0ced63d1d9a13aaa6a286ae583c46f9bc776c8887f4fd767e1f5f6631bbf8f6aec7be2af6c20e77529790f1c70e2ec4242cae0f725b4b2bdc7592c874b75a2e668fc9eac3b52e413c7cf73c48b79e2a51fd1ca0da4f3cbc26d0610373a70a6260c5b9c49c5c0f9ca2e647ad33b0a606f6b2409cde08ba88a0c5a6d4346fa60ad558b7ebcdfcc28a8ecc32777e4f1396f8b3a7818c1724ff66b89e50ef9befc84a205f6fd7FASTpathcmddatacompatiblece37854b5e86670fd6f982549c8681bb4c1a93d7a36040992d183264d909291641c8b763ca52b55c457d8b11abb4100a8adcad36e1114b46cce270266e9544ae4a34c48ee6e7f754c1a9e6b237b125f724bda.ctorstrccceaea80e34696f81bf61212a5d57e21c9b5bfd150fbfbadf3611308b1aa97e42get_ResourceManagerget_Cultureset_CulturevaluedefaultInstance.cctorget_Defaultc4272a2601ea55286c8e5665d5011851bc81c4cb59d12808c5ba39e86061732a2bc03479ce6bf0a13b30c4a890e641e5ed5c2a45d8b4026555b96eb504ed7fa27fe8c26ef70a17c1e545619376c500db5b20fc8a5ae663eae430820525bdca9a3b1aa9cc9e7df8605ba9d042692bbd677b25d45ca41eba23d5694766a093e4394e77fce5c996611aa19b583197ea1ff5b951ae2e7c7875f189f48a2d05f7381441eda93115cacc3871b7b6874a76b11fec969f28feec7f30a1d815ba429ce6c8f1fa63084aafcd96e635df72e58ba1f749e07a3ed0966c0666c3dc76608af8ee1c6ceb7e66e493c83e193df54f413785edb6a883b8fb746cb6f3a1e8ad0e204ee600dc84aef3d385c7a4a50bd456b77aafa565e083e3829e1c4cd2854b74f8896cacea65efe73fede9cac7185b9b646dc15c3d1b8180e23ba50c921d71ca649486e0e57db884e4fb9c57c5ecc189cbe787259811e123fd2ccca8dcad06e192aab3c97d6b8e5d6ac02ffa9bc3133ba3d7582740d2b8f837be4fdf334cc9c792605cd7e899d89713ab18c18d7cc29c1bfc23b9d7489c8606a86e668bd74c2e0f3706da782ab9afb5fd5fe5b8a4d6c6041d6904fe3f1b75c7430d49e30a227ccfaa30adb4e72c5695a25384d95c0807c9752ef2738908b9a1b2bb9d0571dd8cecb6d1847cc7310c2ca2037a96119c5f15c2c7af60100ac3ac8ae8cf89e62c066b4c0248e1898484373731c8a811717b071fc864824826eee18b260f29341c14bca82c4ca6cfb6f81983f5a68aa5a009e11853c8b73f2fcd0cf1ffa12a9a09751f7e5e2c16747a96329eadc7334d04a616cb5542c5b1f4fa7f07dfc5cc011ca94227a86b8c91afb3d4c0d6bad2a83f73f33b097ef1c9bfc76201eb96de22664403e60a21b29c9d3bf9d43aba43cf12409db60f45b302c70854e8d5973ecdf43fccbff0707f781cd695fbd877cf6f60d22d8356b0ce3614cede84010b8eef6a6ffd8d19be56f88ebc61d31018043cc281b1f351b8c1568f85c606c6eb5e891f2c7171bec551c1a90c3c426b0e7dd0e9a677687f7ca59a8f7f1dc2854ead0e9d20ff2c54a433dfc806e67c25ce1afd3dabe9fc44dc0ba8ec162b80cffd59e74166e553c5e1f5d6ea1de29d1cbb5611ce6c5b409147dd2433544b0735CreateProcessGetThreadContextWow64GetThreadContextSetThreadContextWow64SetThreadContextReadProcessMemoryWriteProcessMemoryUnmapViewOfSectionVirtualAllocExResumeThreadCultureDefaultFormatGetTypeFromHandleSizeOfToUInt32IsNullOrEmptyConcatZeroToInt32get_SizeToInt16BlockCopyGetBytesGetProcessByIdKillget_AssemblySynchronizedFromBase64Stringget_UTF8GetStringGetExecutingAssemblyGetManifestResourceStreamToInt64ToSingleToDoubleEmptyget_UnicodeInternget_FullNameIndexOfSubstringget_CharsParseReverseEnterExitReadByteReadset_IVset_Keyget_Lengthset_Capacityset_PositionCreateDecryptorget_InputBlockSizeget_OutputBlockSizeget_PositionTransformBlockWriteTransformFinalBlockToArray6+^gXD(U{Fz\V4 Q QQ q}}u u E )Q@3System.Resources.Tools.StronglyTypedResourceBuilder4.0.0.0 YKMicrosoft.VisualStudio.Editors.SettingsDesigner.SettingsSingleFileGenerator11.0.0.0 TWrapNonExceptionThrows = QUICKCopyright © 2024 )$823681d6-046e-4f8c-bc9b-dfcd8019dc8f1.0.0.0M.NETFramework,Version=v4.5.1TFrameworkDisplayName.NET Framework 4.5.15-E E } }Q11u } u U *uuqm ui Y"3D9B94A98B-76A8-4810-B1A0-4BE7C4F9C98DA2#UVVJQ0slUVVJQ0skPublicKeyToken=publickeytoken=|ZZ Z_CorDllMainmscoree.dll% @P:0HX4VS_VERSION_INFO?DVarFileInfo$Translation\StringFileInfo8000004b0Comments"CompanyName4FileDescriptionQUICK0FileVersion1.0.0.04 InternalNameQUICK.dllHLegalCopyrightCopyright 2024*LegalTrademarks< OriginalFilenameQUICK.dll,ProductNameQUICK4ProductVersion1.0.0.08Assembly Version1.0.0.0"32:T490,"f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" wrote 00000FB8 bytes to a remote process "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe" (Handle: 936) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" wrote 00000008 bytes to a remote process "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe" (Handle: 936) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" wrote 00000004 bytes to a remote process "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe" (Handle: 936) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" wrote 00000200 bytes to a remote process "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe" (Handle: 936) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" wrote 0003B800 bytes to a remote process "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe" (Handle: 936) "f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe" wrote 00000600 bytes to a remote process "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe" (Handle: 936)33:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAcAAAAAAAAAAAAAAAAAAAAHiIiIiIiIiIiIiIiIiIiIAI//////////////////+ICP//////////////////gAj/d3d3d3d3d3d3d3d3j4AI/3d3d3d3d3d3d2d3d4+ACP92Zmd2ZmZmZ2ZmZ3ePgAj/dmZmdmd2ZmZmZmdnj4AI/3iIiHiIiIiIiIiIiI+ACP94/4iIiIiIiIiIiIiPgAj/eIiIiIiIiIiIiIiIj4AI/3d3eIh3d3d3d3d3eI+ACP93d3d3h3d3d3d3d3iPgAj/d3d3d3eId3d3d3d3j4AI/3d3d3d3d4iId3d3d4+ACP92Z3d3d3d4iIiId3ePgAj/dmZnd3d3d4iIiIiIj4AI/3ZmZmd3d3d4iIiIiI+ACP92ZmZmd3d3d4iIiIiPgAj/d3d3d3d3d3d3d3d3j4AI//////////////////+ACP//////////////////gAiIiIiIiIiIiIiIiIiIiIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD///////////////8AAAAAAAAAAIAAAACAAAABgAAAAYAAAAGAAAABgAAAAYAAAAGAAAABgAAAAYAAAAGAAAABgAAAAYAAAAGAAAABgAAAAYAAAAGAAAABgAAAAYAAAAGAAAABgAAAAf///////////////////////////////w==1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1791848344396,"unified_at":"2026-10-12T23:39:04.396Z","metadata":{"hashes":{"sha256":"f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2","sha1":"fd317cbddb724d10efe5546558e438ae6421c923","md5":"c798afaf71a6fc10eeb72dca089ea147","sha512":"aadca4a7d694c762ad0222e980c15f720a8898b29ace03bdb60d055e08899260835d5f82e1757fb3370fc4cb8261bc8fecb7f1ed1f23b59f9579e5e0c697fb71","ssdeep":"24576:IUaIsWV6SfOdhSocYGK4Okw2outKwbWJDHvTRsGGHkHY+Wyp:IUa7olfk5VGK4Lo1ztsGGwY+WE","ssdeep_chunks":["24576:IUaIsWV","24576:UaIsWV6","24576:aIsWV6S","24576:IsWV6Sf","24576:sWV6SfO","24576:WV6SfOd","24576:V6SfOdh","24576:6SfOdhS","24576:SfOdhSo","24576:fOdhSoc","24576:OdhSocY","24576:dhSocYG","24576:hSocYGK","24576:SocYGK4","24576:ocYGK4O","24576:cYGK4Ok","24576:YGK4Okw","24576:GK4Okw2","24576:K4Okw2o","24576:4Okw2ou","24576:Okw2out","24576:kw2outK","24576:w2outKw","24576:2outKwb","24576:outKwbW","24576:utKwbWJ","24576:tKwbWJD","24576:KwbWJDH","24576:wbWJDHv","24576:bWJDHvT","24576:WJDHvTR","24576:JDHvTRs","24576:DHvTRsG","24576:HvTRsGG","24576:vTRsGGH","24576:TRsGGHk","24576:RsGGHkH","24576:sGGHkHY","24576:GGHkHY+","24576:GHkHY+W","24576:HkHY+Wy","24576:kHY+Wyp","49152:IUaIsWV","49152:UaIsWV6","49152:aIsWV6S","49152:IsWV6Sf","49152:sWV6SfO","49152:WV6SfOd","49152:V6SfOdh","49152:6SfOdhS","49152:SfOdhSo","49152:fOdhSoc","49152:OdhSocY","49152:dhSocYG","49152:hSocYGK","49152:SocYGK4","49152:ocYGK4O","49152:cYGK4Ok","49152:YGK4Okw","49152:GK4Okw2","49152:K4Okw2o","49152:4Okw2ou","49152:Okw2out","49152:kw2outK","49152:w2outKw","49152:2outKwb","49152:outKwbW","49152:utKwbWJ","49152:tKwbWJD","49152:KwbWJDH","49152:wbWJDHv","49152:bWJDHvT","49152:WJDHvTR","49152:JDHvTRs","49152:DHvTRsG","49152:HvTRsGG","49152:vTRsGGH","49152:TRsGGHk","49152:RsGGHkH","49152:sGGHkHY","49152:GGHkHY+","49152:GHkHY+W","49152:HkHY+Wy","49152:kHY+Wyp","24576:IUa7olf","24576:Ua7olfk","24576:a7olfk5","24576:7olfk5V","24576:olfk5VG","24576:lfk5VGK","24576:fk5VGK4","24576:k5VGK4L","24576:5VGK4Lo","24576:VGK4Lo1","24576:GK4Lo1z","24576:K4Lo1zt","24576:4Lo1zts","24576:Lo1ztsG","24576:o1ztsGG","24576:1ztsGGw","24576:ztsGGwY","24576:tsGGwY+","24576:sGGwY+W","24576:GGwY+WE"]},"file_info":{"file_name":"bounty-57790487195655566","file_type":["peexe","64bits","assembly","executable"],"file_type_id":"64-bit .NET exe","file_size":1091584,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1706540592000,"last_seen":1749637587000,"last_multi_scan":1749637587000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":null},"stats":{"av":{"malicious_count":17,"suspicious_count":0,"total_engines":26},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":37},"sandbox_signatures":{"informative_count":91,"suspicious_count":6,"malicious_count":6,"total":103},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win.Generic","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"RiskWare[Obfuscator]/MSIL.Reactor.a","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"HEUR/AGEN.1326423","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Jalapeno.4230","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cylance":{"name":"Cylance","success":true,"verdict":"malicious","threat_name":"Malware_-10","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Jalapeno.4230 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"malicious","threat_name":"Trojan.Win64.Gen.bot!i","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"Trojan/MSIL.Agent.fz","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 0059b9101 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win64.Agensla.kopucr","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W64/ABRisk.FGYO-5166","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win64.MSIL_Heur.A","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"TrojanPSW.MSIL.Agensla","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware_42.3","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Agensla.Win32.30113","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Jalapeno.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Command and Scripting Interpreter","attack_id":"T1059","attack_id_wiki":"https://attack.mitre.org/techniques/T1059","sources":[{"report_type":"sandbox","report_id":"684959d3d620fb02a50cd4d9"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads the .NET runtime environment"},{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Fails to load modules at runtime"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"}],"sources":[{"report_type":"sandbox","report_id":"684959d3d620fb02a50cd4d9"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Calls an API typically used to load a resource in memory"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Found Native API in Dotnet file"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Calls an API typically used to find a resource in a module"}],"sources":[{"report_type":"sandbox","report_id":"684959d3d620fb02a50cd4d9"}]},{"tactic":"Execution","technique":"PowerShell","attack_id":"T1059.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/001","sources":[{"report_type":"sandbox","report_id":"684959d3d620fb02a50cd4d9"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"684959d3d620fb02a50cd4d9"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"684959d3d620fb02a50cd4d9"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"malicious","value":"Writes data to a remote process"},{"type":"malicious","value":"Creates a process in suspended mode (likely for process injection)"}],"sources":[{"report_type":"sandbox","report_id":"684959d3d620fb02a50cd4d9"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"malicious","value":"Script loads executable in memory (Antimalware Scan Interface)"}],"sources":[{"report_type":"sandbox","report_id":"684959d3d620fb02a50cd4d9"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Contains ability to perform CryptoStream operations (Dotnet)"},{"type":"informative","value":"Contains ability to load manifest resource from assembly (Dotnet)"},{"type":"informative","value":"Sample file has high entropy (likely encrypted/compressed content)"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Dotnet file contains encryption/decryption functions"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"suspicious","value":"Timestamp in PE header is very old or in the future"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Contains ability to perform symmetric encryption (Dotnet)"},{"type":"informative","value":"Contains ability to perform crypto operations"}],"sources":[{"report_type":"sandbox","report_id":"684959d3d620fb02a50cd4d9"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Contains ability to perform symmetric decryption (Dotnet)"},{"type":"informative","value":"Contains ability to decode string content at runtime (Dotnet)"},{"type":"informative","value":"Contains ability to load content into memory (Dotnet)"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"684959d3d620fb02a50cd4d9"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"},{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"684959d3d620fb02a50cd4d9"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"},{"type":"informative","value":"Dotnet file contains function to dynamically call methods at runtime"}],"sources":[{"report_type":"sandbox","report_id":"684959d3d620fb02a50cd4d9"}]},{"tactic":"Defense Evasion","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"suspicious","value":"Section contains high entropy"}],"sources":[{"report_type":"sandbox","report_id":"684959d3d620fb02a50cd4d9"}]},{"tactic":"Defense Evasion","technique":"Encrypted/Encoded File","attack_id":"T1027.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/013","identifiers":[{"type":"suspicious","value":"YARA signature match – Anomalous PE file structure"}],"sources":[{"report_type":"sandbox","report_id":"684959d3d620fb02a50cd4d9"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"}],"sources":[{"report_type":"sandbox","report_id":"684959d3d620fb02a50cd4d9"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"suspicious","value":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)"},{"type":"informative","value":"Calls GetProcAddress on AmsiScanBuffer function (may used to bypass AMSI)"},{"type":"informative","value":"Loads the AMSI (Antimalware Scan Interface) DLL"}],"sources":[{"report_type":"sandbox","report_id":"684959d3d620fb02a50cd4d9"}]},{"tactic":"Defense Evasion","technique":"Reflective Code Loading","attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Loads the CLR Loader DLL"},{"type":"informative","value":"Dotnet code contains potential unpacker"}],"sources":[{"report_type":"sandbox","report_id":"684959d3d620fb02a50cd4d9"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Drops files inside appdata directory"}],"sources":[{"report_type":"sandbox","report_id":"684959d3d620fb02a50cd4d9"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"684959d3d620fb02a50cd4d9"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Calls an API typically used for searching a directory for files"},{"type":"informative","value":"Touches files"}],"sources":[{"report_type":"sandbox","report_id":"684959d3d620fb02a50cd4d9"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"}],"sources":[{"report_type":"sandbox","report_id":"684959d3d620fb02a50cd4d9"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Reads information about supported languages"}],"sources":[{"report_type":"sandbox","report_id":"684959d3d620fb02a50cd4d9"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"}],"sources":[{"report_type":"sandbox","report_id":"684959d3d620fb02a50cd4d9"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Detected Suricata Alert - External IP Lookup"},{"type":"malicious","value":"Found a reference to an external IP address lookup service"},{"type":"malicious","value":"Tries to identify its external IP address"}],"sources":[{"report_type":"sandbox","report_id":"684959d3d620fb02a50cd4d9"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve account information for specified SID"}],"sources":[{"report_type":"sandbox","report_id":"684959d3d620fb02a50cd4d9"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"684959d3d620fb02a50cd4d9"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"684959d3d620fb02a50cd4d9"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Writes log files"}],"sources":[{"report_type":"sandbox","report_id":"684959d3d620fb02a50cd4d9"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Contacts server"},{"type":"informative","value":"Contacts domains"},{"type":"informative","value":"Found potential URL in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"684959d3d620fb02a50cd4d9"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"},{"type":"informative","value":"Communicates with HTTP webserver (GET/POST requests)"},{"type":"informative","value":"GETs files from a webserver"},{"type":"informative","value":"GETs files from a webserver (HTTPS)"}],"sources":[{"report_type":"sandbox","report_id":"684959d3d620fb02a50cd4d9"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","sources":[{"report_type":"sandbox","report_id":"684959d3d620fb02a50cd4d9"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"HTTP requests contain Base64 strings"}],"sources":[{"report_type":"sandbox","report_id":"684959d3d620fb02a50cd4d9"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"684959d3d620fb02a50cd4d9"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Dropped files"}],"sources":[{"report_type":"sandbox","report_id":"684959d3d620fb02a50cd4d9"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Contains ability to perform symmetric crypto operations"}],"sources":[{"report_type":"sandbox","report_id":"684959d3d620fb02a50cd4d9"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"suspicious","value":"Opens a handle to the specified local process"},{"type":"informative","value":"Able to retrieve/open a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"684959d3d620fb02a50cd4d9"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","sources":[{"report_type":"sandbox","report_id":"684959d3d620fb02a50cd4d9"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to find a resource in a module","description":"\"f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe\" called \"FindResourceW\" with parameter \"7\" - (UID: 00000000-00006356)\n \"f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe\" called \"FindResourceW\" with parameter \"63\" - (UID: 00000000-00006356)\n \"f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe\" called \"FindResourceW\" with parameter \"64\" - (UID: 00000000-00006356)\n \"f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe\" called \"FindResourceW\" with parameter \"8\" - (UID: 00000000-00006356)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-140","sources":[{"report_type":"sandbox","report_id":"684959d3d620fb02a50cd4d9"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to load a resource in memory","description":"\"f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe\" called \"LoadResource with parameter {'hModule': '2790134579201', 'hResInfo': '2790134580448'}\" (UID: 00000000-00006356)\n \"f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe\" called \"LoadResource with parameter {'hModule': '2790134579201', 'hResInfo': '2790134580480'}\" (UID: 00000000-00006356)\n \"f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe\" called \"LoadResource with parameter {'hModule': '2790134579201', 'hResInfo': '2790134580496'}\" (UID: 00000000-00006356)\n \"f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe\" called \"LoadResource with parameter {'hModule': '2790134579201', 'hResInfo': '2790134580464'}\" (UID: 00000000-00006356)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"684959d3d620fb02a50cd4d9"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load content into memory (Dotnet)","description":"Observed namespace \"System.IO.MemoryStream\" and TypeReference \".ctor\" in \"f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2\"\n Observed namespace \"System.IO.MemoryStream\" and TypeReference \"ToArray\" in \"f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2\"\n Observed namespace \"System.Runtime.InteropServices.Marshal\" and TypeReference \"GetHINSTANCE\" in \"f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2\"\n Observed namespace \"System.Runtime.InteropServices.Marshal\" and TypeReference \"WriteInt32\" in \"f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2\"","origin":"Static Parser","mitre_attack_id":"T1140","relevance":1,"id":"static-107","sources":[{"report_type":"sandbox","report_id":"684959d3d620fb02a50cd4d9"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load manifest resource from assembly (Dotnet)","description":"Observed namespace \"System.Reflection.Assembly\" and TypeReference \"GetManifestResourceStream\" in \"f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-173","sources":[{"report_type":"sandbox","report_id":"684959d3d620fb02a50cd4d9"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"Found reference to \"System.Security.Cryptography.CryptoConfig\" (Indicator: \"CryptoConfig\"; File: \"f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2\")\n Found reference to \"HashAlgorithm\" (Indicator: \"HashAlgorithm\"; Source: \"00000000-00006356-00000BC0-557284394\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"684959d3d620fb02a50cd4d9"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Dotnet code contains potential unpacker","description":"Observed function \"System.Reflection.Load\" in \"f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2\"","origin":"Static Parser","mitre_attack_id":"T1620","relevance":1,"id":"static-115","sources":[{"report_type":"sandbox","report_id":"684959d3d620fb02a50cd4d9"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Dotnet file contains encryption/decryption functions","description":"Observed namespace \"System.Security.Cryptography\" and MemberReference \"CreateDecryptor\" in \"f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-134","sources":[{"report_type":"sandbox","report_id":"684959d3d620fb02a50cd4d9"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Dotnet file contains function to dynamically call methods at runtime","description":"Observed namespace \"System\" and MemberReference \"GetMethod\" in \"f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":1,"id":"static-135","sources":[{"report_type":"sandbox","report_id":"684959d3d620fb02a50cd4d9"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to decode string content at runtime (Dotnet)","description":"Observed function \"FromBase64String\" in \"f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2\"\n Observed function \"ToBase64String\" in \"f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2\"","origin":"Static Parser","mitre_attack_id":"T1140","relevance":1,"id":"static-106","sources":[{"report_type":"sandbox","report_id":"684959d3d620fb02a50cd4d9"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform CryptoStream operations (Dotnet)","description":"Observed namespace \"System.Security.Cryptography.CryptoStream\" and TypeReference \"FlushFinalBlock\" in \"f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-166","sources":[{"report_type":"sandbox","report_id":"684959d3d620fb02a50cd4d9"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform crypto operations","description":"Observed namespace \"System.Security.Cryptography\" in [Source: \"f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2\"]","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-118","sources":[{"report_type":"sandbox","report_id":"684959d3d620fb02a50cd4d9"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform symmetric crypto operations","description":"Observed namespace \"System.Security.Cryptography.AesCryptoServiceProvider\" and TypeReference \".ctor\" in \"f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2\"\n Observed namespace \"System.Security.Cryptography.RijndaelManaged\" and TypeReference \".ctor\" in \"f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2\"","origin":"Static Parser","mitre_attack_id":"T1573.001","relevance":1,"id":"static-140","sources":[{"report_type":"sandbox","report_id":"684959d3d620fb02a50cd4d9"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform symmetric decryption (Dotnet)","description":"Observed namespace \"System.Security.Cryptography.SymmetricAlgorithm\" and TypeReference \"CreateDecryptor\" in \"f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2\"","origin":"Static Parser","mitre_attack_id":"T1140","relevance":1,"id":"static-168","sources":[{"report_type":"sandbox","report_id":"684959d3d620fb02a50cd4d9"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform symmetric encryption (Dotnet)","description":"Observed namespace \"System.Security.Cryptography.SymmetricAlgorithm\" and TypeReference \"CreateEncryptor\" in \"f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-165","sources":[{"report_type":"sandbox","report_id":"684959d3d620fb02a50cd4d9"}]},{"level":"informative","category":"Cryptographic Related","name":"HTTP requests contain Base64 strings","description":"Contains base64 string in header \"Keep\" in header \"GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive\"","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-60","sources":[{"report_type":"sandbox","report_id":"684959d3d620fb02a50cd4d9"}]},{"level":"informative","category":"Cryptographic Related","name":"Sample file has high entropy (likely encrypted/compressed content)","description":"Sample file \"sample.bin\" has high entropy 7.902808363819258","origin":"Binary File","mitre_attack_id":"T1027","relevance":1,"id":"binary-71","sources":[{"report_type":"sandbox","report_id":"684959d3d620fb02a50cd4d9"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: HTTP requests contain Base64 strings","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"684959d3d620fb02a50cd4d9"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"$25","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"684959d3d620fb02a50cd4d9"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00006356)","origin":"API Call","mitre_attack_id":"T1497","relevance":3,"id":"api-296","sources":[{"report_type":"sandbox","report_id":"684959d3d620fb02a50cd4d9"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00006356)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"684959d3d620fb02a50cd4d9"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00006356)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"684959d3d620fb02a50cd4d9"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe\" called \"IsWow64Process\" with parameter \"6356\" - (UID: 00000000-00006356)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"684959d3d620fb02a50cd4d9"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00006356)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"684959d3d620fb02a50cd4d9"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$26","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"684959d3d620fb02a50cd4d9"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"\"f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe\" called \"GetVersionExA\" with parameter 940000000600000002000000f0230000020000000000360065006600360037003300360066003700630035003400610061003200320064006500340062003100360036006100300039006300300061003600620063003500340031003200340032006100310032003600300034003100640061003200300038003400380063003200620032002e00650078006500000050dddca0 (UID: 00000000-00006356)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"684959d3d620fb02a50cd4d9"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve account information for specified SID","description":"\"f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe\" called \"LookupAccountSidW\" with param Name SYSTEM (UID: 00000000-00006356)","origin":"API Call","mitre_attack_id":"T1033","relevance":3,"id":"api-148","sources":[{"report_type":"sandbox","report_id":"684959d3d620fb02a50cd4d9"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"684959d3d620fb02a50cd4d9"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"\"f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe\" queries volume information of \"C:\\f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe\" at 00000000-00006356-00000C17-557289091","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"684959d3d620fb02a50cd4d9"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"684959d3d620fb02a50cd4d9"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"684959d3d620fb02a50cd4d9"}]},{"level":"informative","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"ET HUNTING GET Request to ip-api Without User-Agent (Common with Stealers)\" (SID: 2062720, Rev: 1, Severity: 3) categorized as \"Misc activity\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-0","sources":[{"report_type":"sandbox","report_id":"684959d3d620fb02a50cd4d9"}]},{"level":"informative","category":"External Systems","name":"Detected Suricata Alert - External IP Lookup","description":"Detected alert \"ET INFO External IP Lookup ip-api.com\" (SID: 2022082, Rev: 6, Severity: 2) categorized as \"Device Retrieving External IP Address Detected\"","origin":"Suricata Alerts","mitre_attack_id":"T1016","relevance":3,"id":"suricata-4","sources":[{"report_type":"sandbox","report_id":"684959d3d620fb02a50cd4d9"}]},{"level":"informative","category":"General","name":"Calls GetProcAddress on AmsiScanBuffer function (may used to bypass AMSI)","description":"\"f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe\" called \"GetProcAddress\" with a parameter \"AmsiScanBuffer\" (UID: 00000000-00006356)","origin":"API Call","mitre_attack_id":"T1562.001","relevance":1,"id":"api-179","sources":[{"report_type":"sandbox","report_id":"684959d3d620fb02a50cd4d9"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"\"f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe\" called \"CreateProcessW\" with parameter \"\"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\aspnet_compiler.exe\"\" - (UID: 00000000-00006356)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"684959d3d620fb02a50cd4d9"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$27","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"684959d3d620fb02a50cd4d9"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$28","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"684959d3d620fb02a50cd4d9"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"ip-api.com\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"684959d3d620fb02a50cd4d9"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"208.95.112.1:80\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"684959d3d620fb02a50cd4d9"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\BaseNamedObjects\\CLR_PerfMon_WrapMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\SM0:6356:304:WilStaging_02\"\n \"SM0:6356:304:WilStaging_02\"","origin":"Created Mutant","mitre_attack_id":"T1480","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"684959d3d620fb02a50cd4d9"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"\"f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe\" failed to load missing module \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\mscoree.dll\" - [base:0; Status:ffffffffc0000135]\n \"f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe\" failed to load missing module \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\ole32.dll\" - [base:0; Status:ffffffffc0000135]\n \"f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe\" failed to load missing module \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\api-ms-win-core-winrt-l1-1-0.dll\" - [base:0; Status:ffffffffc0000135]\n \"f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe\" failed to load missing module \"%WINDIR%\\Microsoft.Net\\assembly\\GAC_64\\mscorlib\\v4.0_4.0.0.0__b77a5c561934e089\\bcrypt.dll\" - [base:0; Status:ffffffffc0000135]","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"684959d3d620fb02a50cd4d9"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2\" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA\n IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_NO_SEH\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"684959d3d620fb02a50cd4d9"}]},{"level":"informative","category":"General","name":"Found Native API in Dotnet file","description":"Observed unmanaged function \"VirtualProtect\" in \"f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2\"\n Observed unmanaged function \"WriteProcessMemory\" in \"f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2\"\n Observed unmanaged function \"ReadProcessMemory\" in \"f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2\"\n Observed unmanaged function \"OpenProcess\" in \"f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2\"\n Observed unmanaged function \"CloseHandle\" in \"f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2\"","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-101","sources":[{"report_type":"sandbox","report_id":"684959d3d620fb02a50cd4d9"}]},{"level":"informative","category":"General","name":"GETs files from a webserver","description":"\"GET /line/?fields=hosting HTTP/1.1\nHost: ip-api.com\nConnection: Keep-Alive\" Response ==> HTTP/1.1 200 OK\nDate: Wed\n 11 Jun 2025 10:27:04 GMT\nContent-Type: text/plain; charset=utf-8\nContent-Length: 6\nAccess-Control-Allow-Origin: *\nX-Ttl: 60\nX-Rl: 44 with response body ==>36363A36313A36633A37333A36353A3061.......","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"684959d3d620fb02a50cd4d9"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$29","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"684959d3d620fb02a50cd4d9"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\fe2524177eb3088c77be666722039f52\\mscorlib.ni.dll\" at 582D0000\n \"aspnet_compiler.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\36eaccfde177c2e7b93b8dbdde4e012a\\mscorlib.ni.dll\" at 70600000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-3","sources":[{"report_type":"sandbox","report_id":"684959d3d620fb02a50cd4d9"}]},{"level":"informative","category":"General","name":"Loads the AMSI (Antimalware Scan Interface) DLL","description":"\"f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe\" loaded module \"%WINDIR%\\System32\\amsi.dll\" at 80320000","origin":"Loaded Module","mitre_attack_id":"T1562.001","id":"module-8","sources":[{"report_type":"sandbox","report_id":"684959d3d620fb02a50cd4d9"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 886F0000\n \"f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 874B0000\n \"aspnet_compiler.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 77330000\n \"aspnet_compiler.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 732D0000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"684959d3d620fb02a50cd4d9"}]},{"level":"informative","category":"General","name":"Loads the CLR Loader DLL","description":"\"f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll\" at 598D0000\n \"aspnet_compiler.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 728B0000","origin":"Loaded Module","mitre_attack_id":"T1620","id":"module-7","sources":[{"report_type":"sandbox","report_id":"684959d3d620fb02a50cd4d9"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 88EF0000\n \"aspnet_compiler.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 74720000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"684959d3d620fb02a50cd4d9"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"19001a000000000040c78e88fd7f0000@ntdll.dll\"\n \"220023000000000018c78e88fd7f0000@ntdll.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"684959d3d620fb02a50cd4d9"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2\" was detected as \".NET Reactor\" and name: \"Protector\"\n \"f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2\" was detected as \".NET\" and name: \"Library\"\n \"f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2\" was detected as \"Microsoft Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"684959d3d620fb02a50cd4d9"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"\"f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe\" touched \"Windows Defender IOfficeAntiVirus implementation\" (Path: \"HKLM\\SOFTWARE\\CLASSES\\CLSID\\{2781761E-28E0-4109-99FE-B9D127C57AFE}\\INPROCSERVER32\")","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"684959d3d620fb02a50cd4d9"}]},{"level":"informative","category":"General","name":"PE file contains COM data directory","description":"\"f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2\" has COM data directory \"IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR\"","origin":"Static Parser","relevance":1,"id":"static-144","sources":[{"report_type":"sandbox","report_id":"684959d3d620fb02a50cd4d9"}]},{"level":"informative","category":"General","name":"PE file contains Debug data directory","description":"\"f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"","origin":"Static Parser","id":"static-146","sources":[{"report_type":"sandbox","report_id":"684959d3d620fb02a50cd4d9"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"684959d3d620fb02a50cd4d9"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2\" has an writable section named \".sdata\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"684959d3d620fb02a50cd4d9"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"\"f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2\" file has an entrypoint instructions - \"pop\tr10,nop\t,add\tbyte ptr [rbx], al,add\tbyte ptr [rax], al,add\tbyte ptr [rax + rax], al,add\tbyte ptr [rax], al,\"","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"684959d3d620fb02a50cd4d9"}]},{"level":"informative","category":"General","name":"PE file has a big raw size section","description":"Raw size of \".text\" is \"0x101200\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-125","sources":[{"report_type":"sandbox","report_id":"684959d3d620fb02a50cd4d9"}]},{"level":"informative","category":"General","name":"PE file has a big virtual size section","description":"Virtual size of \".text\" is \"0x1011b4\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-124","sources":[{"report_type":"sandbox","report_id":"684959d3d620fb02a50cd4d9"}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"Observed system executable string:\"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\aspnet_compiler.exe\" [Source: 00000000-00006356-00000BC0-559483586]\n Observed system executable string:\"\"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\aspnet_compiler.exe\"\" [Source: 00000000-00006356-00000C46-10160369736]","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"684959d3d620fb02a50cd4d9"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"aspnet_compiler.exe\" (UID: 00000000-00003908) was launched with new environment variables: \"USERDNSDOMAIN=\"thq5XtQ0j8Ok9Bj\"\"\n Process \"aspnet_compiler.exe\" (UID: 00000000-00003908) was launched with modified environment variables: \"NUMBER_OF_PROCESSORS\"","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"684959d3d620fb02a50cd4d9"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"ip-api.com\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"684959d3d620fb02a50cd4d9"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"684959d3d620fb02a50cd4d9"}]},{"level":"informative","category":"General","name":"References Windows file paths for DLLs (possible dropped files)","description":"$2a","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"684959d3d620fb02a50cd4d9"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"aspnet_compiler.exe\" (UID: 00000000-00003908)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"684959d3d620fb02a50cd4d9"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"aspnet_compiler.exe\" (UID: 00000000-00003908)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"684959d3d620fb02a50cd4d9"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"684959d3d620fb02a50cd4d9"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"\"f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe.log\" has type \"CSV ASCII text\"- Location: [%LOCALAPPDATA%\\Microsoft\\CLR_v4.0\\UsageLogs\\f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe.log]- [targetUID: 00000000-00006356]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"684959d3d620fb02a50cd4d9"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$2b","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"684959d3d620fb02a50cd4d9"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe\" queries basic process information of the \"C:\\f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe\" (UID: 6356)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"684959d3d620fb02a50cd4d9"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$2c","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"684959d3d620fb02a50cd4d9"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe\" reads file \"c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\config\\machine.config\"\n \"f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe\" reads file \"c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\mscorlib\\fe2524177eb3088c77be666722039f52\\mscorlib.ni.dll.aux\"\n \"f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe\" reads file \"c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system\\e43dd9c73ab5615e461bf5109c3facd6\\system.ni.dll.aux\"\n \"f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe\" reads file \"c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.core\\0d59b0e237d7519417de10cd84bda4e7\\system.core.ni.dll.aux\"\n \"f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe\" reads file \"c:\\f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"684959d3d620fb02a50cd4d9"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Found a reference to an external IP address lookup service\n Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques\n Matched sigs: Tries to identify its external IP address","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"684959d3d620fb02a50cd4d9"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$2d","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"684959d3d620fb02a50cd4d9"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$2e","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"684959d3d620fb02a50cd4d9"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$2f","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"684959d3d620fb02a50cd4d9"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\microsoft\\clr_v4.0\\usagelogs\\f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe.log\"\n \"f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe\" writes file \"%localappdata%\\microsoft\\clr_v4.0\\usagelogs\\f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe.log\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"684959d3d620fb02a50cd4d9"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes log files","description":"\"f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe\" writes a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\CLR_v4.0\\UsageLogs\\f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe.log\"\n \"f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe\" writes a file \"%LOCALAPPDATA%\\Microsoft\\CLR_v4.0\\UsageLogs\\f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe.log\"","origin":"API Call","mitre_attack_id":"T1074.001","relevance":1,"id":"api-159","sources":[{"report_type":"sandbox","report_id":"684959d3d620fb02a50cd4d9"}]},{"level":"informative","category":"Network Related","name":"Communicates with HTTP webserver (GET/POST requests)","description":"Found http requests in header \"GET /line/?fields=hosting\"","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-62","sources":[{"report_type":"sandbox","report_id":"684959d3d620fb02a50cd4d9"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"1.0.0.0\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"684959d3d620fb02a50cd4d9"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \")!.pl\"\n Heuristic match: \"#t.lt\"\n Heuristic match: \"f7.cn\"\n Heuristic match: \"c1.zm\"\n Heuristic match: \"o{.ch\"\n Heuristic match: \"ip-api.com\"","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"684959d3d620fb02a50cd4d9"}]},{"level":"informative","category":"Network Related","name":"GETs files from a webserver (HTTPS)","description":"GET /line/?fields=hosting HTTP/1.1\nHost: ip-api.com\nConnection: Keep-Alive\n","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":3,"id":"network-72","sources":[{"report_type":"sandbox","report_id":"684959d3d620fb02a50cd4d9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$30","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"684959d3d620fb02a50cd4d9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"684959d3d620fb02a50cd4d9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"09000000001000000000010000000000fffffeffff7f0000ff0000000000000008000000d8210000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"684959d3d620fb02a50cd4d9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"Found string \"System.Security.Cryptography.CryptoConfig\" (Indicator: \"System.Security.Cryptography\"; File: \"f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"684959d3d620fb02a50cd4d9"}]},{"level":"informative","category":"System Security","name":"Able to retrieve/open a process (API string)","description":"Found string \"OpenProcessToken\" (Indicator: \"OpenProcess\"; Source: \"00000000-00006356-00000C2B-556507781\")\n Found string \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00006356-00000C2B-557827639\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-729","sources":[{"report_type":"sandbox","report_id":"684959d3d620fb02a50cd4d9"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"\"f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\USERSETTINGS\\S-1-5-21-735145574-3570218355-1207367261-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME2\\WINDOWS\\MICROSOFT.NET\\FRAMEWORK\\V4.0.30319\\ASPNET_COMPILER.EXE\"; Value: \"\")","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"684959d3d620fb02a50cd4d9"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"Dropped file: \"f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe.log\" - Location: [%LOCALAPPDATA%\\Microsoft\\CLR_v4.0\\UsageLogs\\f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe.log]- [targetUID: 00000000-00006356]","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"684959d3d620fb02a50cd4d9"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2\" was detected as \"Microsoft visual C++ vx.x DLL\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"684959d3d620fb02a50cd4d9"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"684959d3d620fb02a50cd4d9"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"\"f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe\" is allocating memory with PAGE_GUARD access rights (Handle: FFFFFFFFFFFFFFFF); (PID: 6356)","origin":"API Call","mitre_attack_id":"T1562.001","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"684959d3d620fb02a50cd4d9"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Section contains high entropy","description":"\"f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2\" has section name .text with entropy \"7.946281481929567\"","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"684959d3d620fb02a50cd4d9"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 208.95.112.1 on port 80 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"684959d3d620fb02a50cd4d9"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match – Anomalous PE file structure","description":"YARA signature for invalid number of Rva and Size of PE file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1027.013","relevance":1,"id":"yara-153","sources":[{"report_type":"sandbox","report_id":"684959d3d620fb02a50cd4d9"}]},{"level":"suspicious","category":"System Security","name":"Opens a handle to the specified local process","description":"\"f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe\" opens a process \"C:\\f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe\" (UID: 00000000-00006356)","origin":"API Call","mitre_attack_id":"T1489","relevance":1,"id":"api-284","sources":[{"report_type":"sandbox","report_id":"684959d3d620fb02a50cd4d9"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Timestamp in PE header is very old or in the future","description":"\"f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2\" claims program is from Sun Jun 20 23:50:42 2066","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-3","sources":[{"report_type":"sandbox","report_id":"684959d3d620fb02a50cd4d9"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Creates a process in suspended mode (likely for process injection)","description":"\"f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe\" called \"CreateProcessW\" with parameter \"\"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\aspnet_compiler.exe\"\" - (UID: 00000000-00006356)","origin":"API Call","mitre_attack_id":"T1055","relevance":10,"id":"api-129","sources":[{"report_type":"sandbox","report_id":"684959d3d620fb02a50cd4d9"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Script loads executable in memory (Antimalware Scan Interface)","description":"$31","origin":"Windows Antimalware Scan Interface","mitre_attack_id":"T1055.001","relevance":10,"id":"amsi-3","sources":[{"report_type":"sandbox","report_id":"684959d3d620fb02a50cd4d9"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"684959d3d620fb02a50cd4d9"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"$32","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"684959d3d620fb02a50cd4d9"}]},{"level":"malicious","category":"Network Related","name":"Found a reference to an external IP address lookup service","description":"\"ip-api.com\" (Indicator: \"ip-api.com\"; File: \"PCAP\")\n \"GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive\" (Indicator: \"ip-api.com\"; File: \"PCAP\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":6,"id":"string-56","sources":[{"report_type":"sandbox","report_id":"684959d3d620fb02a50cd4d9"}]},{"level":"malicious","category":"Network Related","name":"Tries to identify its external IP address","description":"\"ip-api.com\"","origin":"Network Traffic","mitre_attack_id":"T1016","relevance":6,"id":"network-24","sources":[{"report_type":"sandbox","report_id":"684959d3d620fb02a50cd4d9"}]}],"incidents":[{"name":"Persistence","details_count":1,"details":[{"detail":"Writes data to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"684959d3d620fb02a50cd4d9"}]},{"name":"Fingerprint","details_count":2,"details":[{"detail":"Queries process information"},{"detail":"Tries to identify its external IP address"}],"sources":[{"report_type":"sandbox","report_id":"684959d3d620fb02a50cd4d9"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 1 domain and 1 host"}],"sources":[{"report_type":"sandbox","report_id":"684959d3d620fb02a50cd4d9"}]}]},"activity":{"stats":{"process_count":2,"spawned_processes_count":2,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":3,"imported_dlls_count":93,"dropped_files_count":0,"extracted_files_count":1,"files_written_count":1,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":1,"dns_resolutions_count":1,"contacted_urls_count":1,"http_requests_count":1},"behavior_tags":null,"sample_flags":["Network Traffic","Extracted Files","TOR analysis"],"sandbox_reports":[{"id":"684959d3d620fb02a50cd4d9","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"contacted_countries":["ZZZ"],"submit_name":"f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2","analysis_start_time":"2025-06-11T10:26:28+00:00","indicators_count":{"informative":91,"suspicious":23,"malicious":6},"tags":["Network Traffic","Extracted Files","TOR analysis"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"208.95.112.1","port":80,"protocol":"TCP","country":"Reserved","sources":[{"report_type":"sandbox","report_id":"684959d3d620fb02a50cd4d9"}]}],"dns_resolutions":[{"domain":"ip-api.com","address":"208.95.112.1","ttl":60,"country":"Reserved","registrar_name":"Internet Domain Service BS Corp.","registrar_organization":"Whois Privacy Corp.","registrar_name_servers":"b.ip-api.com","registrar_creation_date":"2012-04-24T13:42:54+00:00","sources":[{"report_type":"sandbox","report_id":"684959d3d620fb02a50cd4d9"}]}],"http_requests":[{"host":"ip-api.com","host_ip":"208.95.112.1:80","url":"/line/?fields=hosting","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /line/?fields=hosting HTTP/1.1\nHost: ip-api.com\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"684959d3d620fb02a50cd4d9"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"684959d3d620fb02a50cd4d9"}],"processes":[{"pid":6356,"ppid":0,"name":"f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe","command_line":"","sha256":"f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2","normalized_path":"C:\\f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe","uid":"00000000-00006356","icon":"$33"},{"pid":3908,"ppid":6356,"name":"aspnet_compiler.exe","command_line":"","sha256":"d7409d01e21b22084f3c166022c69ad46ddd7aaaff8eed6eb540961d3a196aea","normalized_path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\aspnet_compiler.exe","parent_uid":"00000000-00006356","uid":"00000000-00003908"}],"all_imported_dlls":["cryptsp.dll","wldp.dll","wow64win.dll","powrprof.dll","rtutils.dll","dnsapi.dll","kernel.appcore.dll","ole32.dll","4IjGlvDQ.dll","cfgmgr32.dll","winhttp.dll","vaultcli.dll","mscoree.dll","oleaut32.dll","wintrust.dll","profapi.dll","sspicli.dll","shell32.dll","wbemprox.dll","advapi32.dll","version.dll","vcruntime140_clr0400.dll","mscorlib.ni.dll","slc.dll","winnsi.dll","rasadhlp.dll","win32u.dll","clrjit.dll","bcryptprimitives.dll","imm32.dll","amsi.dll","windows.storage.dll","WMINet_Utils.dll","fastprox.dll","msvcrt.dll","System.Xml.ni.dll","System.Management.dll","IPHLPAPI.DLL","System.Drawing.dll","psapi.dll","sppc.dll","gpapi.dll","rsaenh.dll","WinTypes.dll","userenv.dll","wow64.dll","wmiutils.dll","dwmapi.dll","Accessibility.dll","ntdll.dll","KernelBase.dll","gdi32.dll","shlwapi.dll","ucrtbase_clr0400.dll","System.Core.ni.dll","MpClient.dll","dhcpcsvc.dll","apphelp.dll","ws2_32.dll","rpcrt4.dll","System.ni.dll","cryptbase.dll","wow64cpu.dll","wbemsvc.dll","FWPUCLNT.DLL","user32.dll","uxtheme.dll","crypt32.dll","msasn1.dll","clbcatq.dll","mswsock.dll","nsi.dll","kernel32.dll","bcrypt.dll","System.Windows.Forms.dll","SHCore.dll","wbemcomn.dll","dhcpcsvc6.dll","comctl32.dll","msvcp_win.dll","sechost.dll","MpOAV.dll","System.Configuration.ni.dll","rasman.dll","System.Security.dll","gdi32full.dll","rasapi32.dll","VxSSL64.dll","ucrtbase.dll","mscoreei.dll","clr.dll","fltLib.dll","combase.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe.log","sha256":"2b8893b9391fc78639976ed48fbd7302a1d6a8f28d69b55a200a52ba2f8a9cf5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"684959d3d620fb02a50cd4d9"}]}],"files_written":[{"path":"%LOCALAPPDATA%\\Microsoft\\CLR_v4.0\\UsageLogs\\f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2.exe.log","sources":[{"report_type":"sandbox","report_id":"684959d3d620fb02a50cd4d9"}]}],"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\BaseNamedObjects\\CLR_PerfMon_WrapMutex","sources":[{"report_type":"sandbox","report_id":"684959d3d620fb02a50cd4d9"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6356:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"684959d3d620fb02a50cd4d9"}]},{"name":"SM0:6356:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"684959d3d620fb02a50cd4d9"}]}]}},"report_ids":{"sandbox_job_ids":["684959d3d620fb02a50cd4d9"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Jalapeno.Generic Sample f556c0986ef6… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample f556c0986ef6…. Malware family: Jalapeno.Generic. Threat score 100/100. 17/26 AV engines flagged this file. 6 malicious and 6 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2"}],["$","meta","4",{"property":"og:title","content":"Malicious Jalapeno.Generic Sample f556c0986ef6… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample f556c0986ef6…. Malware family: Jalapeno.Generic. Threat score 100/100. 17/26 AV engines flagged this file. 6 malicious and 6 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/f556c0986ef6736f7c54aa22de4b166a09c0a6bc541242a126041da20848c2b2"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Jalapeno.Generic Sample f556c0986ef6… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample f556c0986ef6…. Malware family: Jalapeno.Generic. Threat score 100/100. 17/26 AV engines flagged this file. 6 malicious and 6 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L34","11",{}]]