24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 48:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T495,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.MagicRAT Sample f6827dc5af66… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample f6827dc5af66…. Malware family: Trojan.MagicRAT. Threat score 100/100. 15/26 AV engines flagged this file. 12 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/f6827dc5af661fbb4bf64bc625c78283ef836c6985bb2bfb836bd0c8d5397332","keywords":["Malicious","Trojan.MagicRAT","malware analysis","sandbox report","threat intelligence","f6827dc5af661fbb4bf64bc625c78283ef836c6985bb2bfb836bd0c8d5397332"],"about":{"@type":"SoftwareApplication","name":"tmpzkizu8h_","applicationCategory":["peexe","64bits","executable"],"identifier":"f6827dc5af661fbb4bf64bc625c78283ef836c6985bb2bfb836bd0c8d5397332","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.MagicRAT","antivirusDetections":{"malicious":15,"total":26},"behavioralIndicators":{"malicious":12,"suspicious":17},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T4e1,Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "file") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "file") Found reference to API "RegisterWaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "file") Found reference to API "SleepEx" (Indicator: "SleepEx"; File: "file") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "file") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; File: "file") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; File: "file") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; File: "file") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; File: "file") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "file") Found reference to API "MsgWaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjects"; File: "file") Found reference to API "MsgWaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjectsEx"; File: "file") Found reference to API "SetTimer" (Indicator: "SetTimer"; File: "file")26:T5da,Found string - \\.\pipe\qt-%lX-%X; Source: "file") Found string - .\\.\A:\; Source: "file") Found string - \\.\NUL; Source: "file") Found string - \\.\pipe\qt-ACC-B1CEF811; Source: "00000000-00002764-00000C55-1480890027") Found string - \\.\pipe\qt-ACC-746B003B; Source: "00000000-00002764-00000C55-1480890888") Found string - \\.\pipe\qt-ACC-43595CE6; Source: "00000000-00002764-00000C55-1480891954") Found string - \\.\pipe\qt-ACC-36F393E8; Source: "00000000-00002764-00000C55-1481478706") Found string - \\.\pipe\qt-ACC-AFD5EFC6; Source: "00000000-00002764-00000C55-1481480022") Found string - \\.\pipe\qt-ACC-B5197C96; Source: "00000000-00002764-00000C55-1481481417") Found string - \\.\pipe\qt-ACC-183E5002; Source: "00000000-00002764-00000C55-1483787104") Found string - \\.\pipe\qt-ACC-BA596EAC; Source: "00000000-00002764-00000C55-1483788583") Found string - \\.\pipe\qt-ACC-4E168657; Source: "00000000-00002764-00000C55-1483790443") Found string - \\.\pipe\qt-ACC-B09E4C7C; Source: "00000000-00002764-00000C55-1485494553") Found string - \\.\pipe\qt-ACC-21322A46; Source: "00000000-00002764-00000C55-1485496299") Found string - \\.\pipe\qt-ACC-1D9F31E7; Source: "00000000-00002764-00000C55-1485498015") Found string - \\.\pipe\qt-ACC-DDC5A242; Source: "00000000-00002764-00000C55-1486590866") Found string - \\.\pipe\qt-ACC-31898D8F; Source: "00000000-00002764-00000C55-1486592568") Found string - \\.\pipe\qt-ACC-84A48AB7; Source: "00000000-00002764-00000C55-1486594397")27:T2c3c,"file.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002764) "file.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002764) "file.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002764) "cmd.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002628) "cmd.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002628) "bcdedit.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004004) "cmd.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004324) "cmd.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004324) "schtasks.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004452) "schtasks.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000003c000000000020c25dfbfe0700003000000000000000b8023c000000000048dda47700000000000000000000000030000000000000000b00d20003010000c0823c0000000000d0ab1e0000000000e000a07700000000b10400b5000000000000000000000000b10400b5000000000000a077000000000200000252004e0045004c00330032002e0064006c006c000000630075007200c803b17700000000000000000000000010010000000000000000770000000000000100000000000000010000000000008803770000000000d8dda4770000000000007700 (UID: 00000000-00004452) "cmd.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003788) "cmd.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003788) "schtasks.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003496) "schtasks.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003496) "schtasks.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000000000000000000023000000000020c25dfbfe0700003000000000000000b80223000000000048dda47700000000000000000000000030000000000000000a00d600d40400007081230000000000c0c81c0000000000e000a07700000000a90400ad000000000000000000000000a90400ad000000000000a077000000000200000252004e0045004c00330032002e0064006c006c000000630075007200c803b17700000000000000000000000010010000000000000000140000000000000100000000000000010000000000008803140000000000d8dda4770000000000001400 (UID: 00000000-00003496) "cmd.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003948) "bcdedit.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000fa00a20200007080300000000000070000000000000000f65200000000000000000000000000853f76f2fe0700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000000000000000002ffefe07000000f6520000000000000000000000000028f6520000000000000000000000000093e0a5dccc4f0000000000000000000008827cfefe0700000000000000000000e005010000000000000000000000000000000000000000000000000000000000b4be83fefe070000405984fe (UID: 00000000-00004384) "bcdedit.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004384)28:T797,"file.exe" (Access type: "QUERY"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES"; Key: ""; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E390372A-3FAB-417F-940E-F2CD5C8F68CB}"; Key: "ENABLEDHCP"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E390372A-3FAB-417F-940E-F2CD5C8F68CB}"; Key: "REGISTRATIONENABLED"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E390372A-3FAB-417F-940E-F2CD5C8F68CB}"; Key: "REGISTERADAPTERNAME"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E390372A-3FAB-417F-940E-F2CD5C8F68CB}"; Key: "DOMAIN"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E390372A-3FAB-417F-940E-F2CD5C8F68CB}"; Key: "DHCPDOMAIN"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{846EE342-7039-11DE-9D20-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{846EE342-7039-11DE-9D20-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{846EE342-7039-11DE-9D20-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{846EE342-7039-11DE-9D20-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{846EE342-7039-11DE-9D20-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "")29:T652,"file.exe" called "NtCreateNamedPipeFile" with parameter "pipe\qt-ACC-B1CEF811" - (UID: 00000000-00002764) "file.exe" called "NtCreateNamedPipeFile" with parameter "pipe\qt-ACC-746B003B" - (UID: 00000000-00002764) "file.exe" called "NtCreateNamedPipeFile" with parameter "pipe\qt-ACC-43595CE6" - (UID: 00000000-00002764) "file.exe" called "NtCreateNamedPipeFile" with parameter "pipe\qt-ACC-36F393E8" - (UID: 00000000-00002764) "file.exe" called "NtCreateNamedPipeFile" with parameter "pipe\qt-ACC-AFD5EFC6" - (UID: 00000000-00002764) "file.exe" called "NtCreateNamedPipeFile" with parameter "pipe\qt-ACC-B5197C96" - (UID: 00000000-00002764) "file.exe" called "NtCreateNamedPipeFile" with parameter "pipe\qt-ACC-183E5002" - (UID: 00000000-00002764) "file.exe" called "NtCreateNamedPipeFile" with parameter "pipe\qt-ACC-BA596EAC" - (UID: 00000000-00002764) "file.exe" called "NtCreateNamedPipeFile" with parameter "pipe\qt-ACC-4E168657" - (UID: 00000000-00002764) "file.exe" called "NtCreateNamedPipeFile" with parameter "pipe\qt-ACC-B09E4C7C" - (UID: 00000000-00002764) "file.exe" called "NtCreateNamedPipeFile" with parameter "pipe\qt-ACC-21322A46" - (UID: 00000000-00002764) "file.exe" called "NtCreateNamedPipeFile" with parameter "pipe\qt-ACC-1D9F31E7" - (UID: 00000000-00002764) "file.exe" called "NtCreateNamedPipeFile" with parameter "pipe\qt-ACC-DDC5A242" - (UID: 00000000-00002764) "file.exe" called "NtCreateNamedPipeFile" with parameter "pipe\qt-ACC-31898D8F" - (UID: 00000000-00002764) "file.exe" called "NtCreateNamedPipeFile" with parameter "pipe\qt-ACC-84A48AB7" - (UID: 00000000-00002764)2a:T1a51,"file.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002764) "file.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002764) "file.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002764) "file.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002764) "file.exe" called "LoadLibrary" with a parameter C:\file.exe (UID: 00000000-00002764) "file.exe" called "LoadLibrary" with a parameter psapi (UID: 00000000-00002764) "file.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00002764) "file.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-SDDL-L1-1-0.dll (UID: 00000000-00002764) "file.exe" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00002764) "file.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\winhttp.dll (UID: 00000000-00002764) "file.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00002764) "file.exe" called "LoadLibrary" with a parameter IPHLPAPI.DLL (UID: 00000000-00002764) "file.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00002764) "file.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00002764) "file.exe" called "LoadLibrary" with a parameter winhttp.dll (UID: 00000000-00002764) "file.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00002764) "file.exe" called "LoadLibrary" with a parameter SspiCli.dll (UID: 00000000-00002764) "file.exe" called "LoadLibrary" with a parameter RPCRT4.dll (UID: 00000000-00002764) "file.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00002764) "file.exe" called "LoadLibrary" with a parameter NSI.dll (UID: 00000000-00002764) "file.exe" called "LoadLibrary" with a parameter CFGMGR32.dll (UID: 00000000-00002764) "file.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\Advapi32.dll (UID: 00000000-00002764) "file.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00002764) "file.exe" called "LoadLibrary" with a parameter API-MS-WIN-Service-Management-L1-1-0.dll (UID: 00000000-00002764) "file.exe" called "LoadLibrary" with a parameter API-MS-WIN-Service-Management-L2-1-0.dll (UID: 00000000-00002764) "file.exe" called "LoadLibrary" with a parameter API-MS-WIN-Service-winsvc-L1-1-0.dll (UID: 00000000-00002764) "file.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\shell32.dll (UID: 00000000-00002764) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002628) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002628) "cmd.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002628) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002628) "bcdedit.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\bcdedit.exe (UID: 00000000-00004004) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004324) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004324) "cmd.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004324) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004324) "schtasks.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004452) "schtasks.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004452) "schtasks.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004452) "schtasks.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004452) "schtasks.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00004452) "schtasks.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00004452) "schtasks.exe" called "LoadLibrary" with a parameter SspiCli.dll (UID: 00000000-00004452) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003788) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003788) "cmd.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003788) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003788) "schtasks.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003496) "schtasks.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003496) "schtasks.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003496) "schtasks.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003496) "schtasks.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\schtasks.exe (UID: 00000000-00003496) "schtasks.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00003496) "schtasks.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00003496) "bcdedit.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00004384) "bcdedit.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\IMM32.DLL (UID: 00000000-00004384) "bcdedit.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004384) "bcdedit.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004384) "bcdedit.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004384) "bcdedit.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004384) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004484) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004484) "cmd.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004484) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004484) "schtasks.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00004948) "schtasks.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00004948) "schtasks.exe" called "LoadLibrary" with a parameter SspiCli.dll (UID: 00000000-00004948)2b:Tb938,"file.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00002764) "file.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00002764) "file.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00002764) "file.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00002764) "file.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00002764) "file.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00002764) "file.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00002764) "file.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00002764) "file.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00002764) "file.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00002764) "file.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00002764) "file.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00002764) "file.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00002764) "file.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00002764) "file.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00002764) "file.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00002764) "file.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00002764) "file.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00002764) "file.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00002764) "file.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00002764) "file.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00002764) "file.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00002764) "file.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00002764) "file.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00002764) "file.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00002764) "file.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00002764) "file.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00002764) "file.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00002764) "file.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00002764) "file.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00002764) "file.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00002764) "file.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00002764) "file.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00002764) "file.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00002764) "file.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00002764) "file.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00002764) "file.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00002764) "file.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00002764) "file.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00002764) "file.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00002764) "file.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00002764) "file.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00002764) "file.exe" called "GetProcAddress" with a parameter GetModuleFileNameExW (UID: 00000000-00002764) "file.exe" called "GetProcAddress" with a parameter _localtime64_s (UID: 00000000-00002764) "file.exe" called "GetProcAddress" with a parameter ThemeInitApiHook (UID: 00000000-00002764) "file.exe" called "GetProcAddress" with a parameter IsProcessDPIAware (UID: 00000000-00002764) "file.exe" called "GetProcAddress" with a parameter ConvertStringSecurityDescriptorToSecurityDescriptorW (UID: 00000000-00002764) "file.exe" called "GetProcAddress" with a parameter WinHttpOpen (UID: 00000000-00002764) "file.exe" called "GetProcAddress" with a parameter WinHttpCloseHandle (UID: 00000000-00002764) "file.exe" called "GetProcAddress" with a parameter WinHttpGetProxyForUrl (UID: 00000000-00002764) "file.exe" called "GetProcAddress" with a parameter WinHttpGetDefaultProxyConfiguration (UID: 00000000-00002764) "file.exe" called "GetProcAddress" with a parameter WinHttpGetIEProxyConfigForCurrentUser (UID: 00000000-00002764) "file.exe" called "GetProcAddress" with a parameter StrRChrA (UID: 00000000-00002764) "file.exe" called "GetProcAddress" with a parameter GetAdaptersAddresses (UID: 00000000-00002764) "file.exe" called "GetProcAddress" with a parameter GetBestInterfaceEx (UID: 00000000-00002764) "file.exe" called "GetProcAddress" with a parameter SHGetValueA (UID: 00000000-00002764) "file.exe" called "GetProcAddress" with a parameter RtlConvertSidToUnicodeString (UID: 00000000-00002764) "file.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00002764) "file.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00002764) "file.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00002764) "file.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00002764) "file.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00002764) "file.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00002764) "file.exe" called "GetProcAddress" with a parameter GetProductInfo (UID: 00000000-00002764) "file.exe" called "GetProcAddress" with a parameter InitSecurityInterfaceW (UID: 00000000-00002764) "file.exe" called "GetProcAddress" with a parameter InitSecurityInterfaceA (UID: 00000000-00002764) "file.exe" called "GetProcAddress" with a parameter RpcStringBindingComposeW (UID: 00000000-00002764) "file.exe" called "GetProcAddress" with a parameter RpcBindingFromStringBindingW (UID: 00000000-00002764) "file.exe" called "GetProcAddress" with a parameter RpcBindingSetAuthInfoExW (UID: 00000000-00002764) "file.exe" called "GetProcAddress" with a parameter RpcBindingSetOption (UID: 00000000-00002764) "file.exe" called "GetProcAddress" with a parameter RpcStringFreeW (UID: 00000000-00002764) "file.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00002764) "file.exe" called "GetProcAddress" with a parameter RegDeleteTreeA (UID: 00000000-00002764) "file.exe" called "GetProcAddress" with a parameter RegDeleteTreeW (UID: 00000000-00002764) "file.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00002764) "file.exe" called "GetProcAddress" with a parameter StringFromIID (UID: 00000000-00002764) "file.exe" called "GetProcAddress" with a parameter NsiAllocateAndGetTable (UID: 00000000-00002764) "file.exe" called "GetProcAddress" with a parameter CM_Open_Class_Key_ExW (UID: 00000000-00002764) "file.exe" called "GetProcAddress" with a parameter ConvertInterfaceGuidToLuid (UID: 00000000-00002764) "file.exe" called "GetProcAddress" with a parameter GetIfEntry2 (UID: 00000000-00002764) "file.exe" called "GetProcAddress" with a parameter GetIpForwardTable2 (UID: 00000000-00002764) "file.exe" called "GetProcAddress" with a parameter GetIpNetEntry2 (UID: 00000000-00002764) "file.exe" called "GetProcAddress" with a parameter FreeMibTable (UID: 00000000-00002764) "file.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00002764) "file.exe" called "GetProcAddress" with a parameter NsiFreeTable (UID: 00000000-00002764) "file.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00002764) "file.exe" called "GetProcAddress" with a parameter RpcBindingFree (UID: 00000000-00002764) "file.exe" called "GetProcAddress" with a parameter GetUserNameW (UID: 00000000-00002764) "file.exe" called "GetProcAddress" with a parameter LookupAccountNameW (UID: 00000000-00002764) "file.exe" called "GetProcAddress" with a parameter GetUserNameExW (UID: 00000000-00002764) "file.exe" called "GetProcAddress" with a parameter LookupAccountNameLocalW (UID: 00000000-00002764) "file.exe" called "GetProcAddress" with a parameter RpcAsyncInitializeHandle (UID: 00000000-00002764) "file.exe" called "GetProcAddress" with a parameter OpenSCManagerW (UID: 00000000-00002764) "file.exe" called "GetProcAddress" with a parameter OpenServiceW (UID: 00000000-00002764) "file.exe" called "GetProcAddress" with a parameter CloseServiceHandle (UID: 00000000-00002764) "file.exe" called "GetProcAddress" with a parameter NotifyServiceStatusChangeW (UID: 00000000-00002764) "file.exe" called "GetProcAddress" with a parameter QueryServiceStatus (UID: 00000000-00002764) "file.exe" called "GetProcAddress" with a parameter Ndr64AsyncClientCall (UID: 00000000-00002764) "file.exe" called "GetProcAddress" with a parameter RpcAsyncCompleteCall (UID: 00000000-00002764) "file.exe" called "GetProcAddress" with a parameter SHGetKnownFolderPath (UID: 00000000-00002764) "cmd.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00002628) "cmd.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00002628) "cmd.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00002628) "cmd.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00002628) "cmd.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00002628) "cmd.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00002628) "cmd.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00002628) "cmd.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00002628) "cmd.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00002628) "cmd.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00002628) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00002628) "cmd.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00002628) "cmd.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00002628) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00002628) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00002628) "cmd.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00002628) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00002628) "cmd.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00002628) "cmd.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00002628) "cmd.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00002628) "cmd.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00002628) "cmd.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00002628) "cmd.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00002628) "cmd.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00002628) "cmd.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00002628) "cmd.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00002628) "cmd.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00002628) "cmd.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00002628) "cmd.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00002628) "cmd.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00002628) "cmd.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00002628) "cmd.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00002628) "cmd.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00002628) "cmd.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00002628) "cmd.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00002628) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00002628) "cmd.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00002628) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00002628) "cmd.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00002628) "cmd.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00002628) "cmd.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00002628) "cmd.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00002628) "bcdedit.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004004) "bcdedit.exe" called "GetProcAddress" with a parameter SetThreadUILanguage (UID: 00000000-00004004) "bcdedit.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00004004) "cmd.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004324) "cmd.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00004324) "cmd.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00004324) "cmd.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00004324) "cmd.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00004324) "cmd.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00004324) "cmd.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00004324) "cmd.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00004324) "cmd.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00004324) "cmd.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00004324) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00004324) "cmd.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00004324) "cmd.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00004324) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00004324) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00004324) "cmd.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00004324) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00004324) "cmd.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00004324) "cmd.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00004324) "cmd.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00004324) "cmd.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00004324) "cmd.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00004324) "cmd.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00004324) "cmd.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00004324) "cmd.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00004324) "cmd.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00004324) "cmd.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00004324) "cmd.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00004324) "cmd.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00004324) "cmd.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00004324) "cmd.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00004324) "cmd.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00004324) "cmd.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00004324) "cmd.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00004324) "cmd.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00004324) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00004324) "cmd.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00004324) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00004324) "cmd.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00004324) "cmd.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00004324) "cmd.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00004324) "cmd.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00004324) "schtasks.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00004452) "schtasks.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00004452) "schtasks.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00004452) "schtasks.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004452) "schtasks.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00004452) "schtasks.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00004452) "schtasks.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00004452) "schtasks.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00004452) "schtasks.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00004452) "schtasks.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00004452) "schtasks.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00004452) "schtasks.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00004452) "schtasks.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00004452) "schtasks.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00004452) "schtasks.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00004452) "schtasks.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00004452) "schtasks.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00004452) "schtasks.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00004452) "schtasks.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00004452) "schtasks.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00004452) "schtasks.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00004452) "schtasks.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00004452) "schtasks.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00004452) "schtasks.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00004452) "schtasks.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00004452) "schtasks.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00004452) "schtasks.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00004452) "schtasks.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00004452) "schtasks.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00004452) "schtasks.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00004452) "schtasks.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00004452) "schtasks.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00004452) "schtasks.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00004452) "schtasks.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00004452) "schtasks.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00004452) "schtasks.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00004452) "schtasks.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00004452) "schtasks.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00004452) "schtasks.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00004452) "schtasks.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00004452) "schtasks.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00004452) "schtasks.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00004452) "schtasks.exe" called "GetProcAddress" with a parameter ThemeInitApiHook (UID: 00000000-00004452) "schtasks.exe" called "GetProcAddress" with a parameter IsProcessDPIAware (UID: 00000000-00004452) "schtasks.exe" called "GetProcAddress" with a parameter LookupAccountSidLocalW (UID: 00000000-00004452) "schtasks.exe" called "GetProcAddress" with a parameter GetUserNameExW (UID: 00000000-00004452) "cmd.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00003788) "cmd.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00003788) "cmd.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00003788) "cmd.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003788) "cmd.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00003788) "cmd.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00003788) "cmd.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00003788) "cmd.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00003788) "cmd.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00003788) "cmd.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00003788) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00003788) "cmd.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00003788) "cmd.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00003788) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00003788) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00003788) "cmd.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00003788) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00003788) "cmd.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00003788) "cmd.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00003788) "cmd.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00003788) "cmd.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00003788) "cmd.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00003788) "cmd.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00003788) "cmd.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00003788) "cmd.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00003788) "cmd.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00003788) "cmd.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00003788) "cmd.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00003788) "cmd.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00003788) "cmd.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00003788) "cmd.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00003788) "cmd.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00003788) "cmd.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00003788) "cmd.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00003788) "cmd.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00003788) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00003788) "cmd.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00003788) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00003788) "cmd.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00003788) "cmd.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00003788) "cmd.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00003788) "cmd.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00003788) "schtasks.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003496) "schtasks.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00003496) "schtasks.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00003496) "schtasks.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00003496) "schtasks.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00003496) "schtasks.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00003496) "schtasks.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00003496) "schtasks.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00003496) "schtasks.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00003496) "schtasks.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00003496) "schtasks.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00003496) "schtasks.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00003496) "schtasks.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00003496) "schtasks.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00003496) "schtasks.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00003496) "schtasks.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00003496) "schtasks.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00003496) "schtasks.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00003496) "schtasks.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00003496) "schtasks.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00003496) "schtasks.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00003496) "schtasks.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00003496) "schtasks.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00003496) "schtasks.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00003496) "schtasks.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00003496) "schtasks.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00003496) "schtasks.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00003496) "schtasks.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00003496) "schtasks.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00003496) "schtasks.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00003496) "schtasks.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00003496) "schtasks.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00003496) "schtasks.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00003496) "schtasks.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00003496) "schtasks.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00003496) "schtasks.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00003496) "schtasks.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00003496) "schtasks.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00003496) "schtasks.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00003496) "schtasks.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00003496) "schtasks.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00003496) "schtasks.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00003496) "schtasks.exe" called "GetProcAddress" with a parameter ThemeInitApiHook (UID: 00000000-00003496) "schtasks.exe" called "GetProcAddress" with a parameter IsProcessDPIAware (UID: 00000000-00003496) "schtasks.exe" called "GetProcAddress" with a parameter LookupAccountSidLocalW (UID: 00000000-00003496) "cmd.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003948) "cmd.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00003948) "bcdedit.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004384) "bcdedit.exe" called "GetProcAddress" with a parameter GetCharABCWidthsI (UID: 00000000-00004384) "bcdedit.exe" called "GetProcAddress" with a parameter ImmWINNLSEnableIME (UID: 00000000-00004384) "bcdedit.exe" called "GetProcAddress" with a parameter ImmWINNLSGetEnableStatus (UID: 00000000-00004384) "bcdedit.exe" called "GetProcAddress" with a parameter ImmSendIMEMessageExW (UID: 00000000-00004384) "bcdedit.exe" called "GetProcAddress" with a parameter ImmSendIMEMessageExA (UID: 00000000-00004384) "bcdedit.exe" called "GetProcAddress" with a parameter ImmIMPGetIMEW (UID: 00000000-00004384) "bcdedit.exe" called "GetProcAddress" with a parameter ImmIMPGetIMEA (UID: 00000000-00004384) "bcdedit.exe" called "GetProcAddress" with a parameter ImmIMPQueryIMEW (UID: 00000000-00004384) "bcdedit.exe" called "GetProcAddress" with a parameter ImmIMPQueryIMEA (UID: 00000000-00004384) "bcdedit.exe" called "GetProcAddress" with a parameter ImmIMPSetIMEW (UID: 00000000-00004384) "bcdedit.exe" called "GetProcAddress" with a parameter ImmIMPSetIMEA (UID: 00000000-00004384) "bcdedit.exe" called "GetProcAddress" with a parameter ImmAssociateContext (UID: 00000000-00004384) "bcdedit.exe" called "GetProcAddress" with a parameter ImmEscapeA (UID: 00000000-00004384) "bcdedit.exe" called "GetProcAddress" with a parameter ImmEscapeW (UID: 00000000-00004384) "bcdedit.exe" called "GetProcAddress" with a parameter ImmGetCompositionStringA (UID: 00000000-00004384) "bcdedit.exe" called "GetProcAddress" with a parameter ImmGetCompositionStringW (UID: 00000000-00004384) "bcdedit.exe" called "GetProcAddress" with a parameter ImmGetCompositionWindow (UID: 00000000-00004384) "bcdedit.exe" called "GetProcAddress" with a parameter ImmGetContext (UID: 00000000-00004384) "bcdedit.exe" called "GetProcAddress" with a parameter ImmGetDefaultIMEWnd (UID: 00000000-00004384) "bcdedit.exe" called "GetProcAddress" with a parameter ImmIsIME (UID: 00000000-00004384) "bcdedit.exe" called "GetProcAddress" with a parameter ImmReleaseContext (UID: 00000000-00004384) "bcdedit.exe" called "GetProcAddress" with a parameter ImmRegisterClient (UID: 00000000-00004384) "bcdedit.exe" called "GetProcAddress" with a parameter ImmGetCompositionFontW (UID: 00000000-00004384) "bcdedit.exe" called "GetProcAddress" with a parameter ImmGetCompositionFontA (UID: 00000000-00004384) "bcdedit.exe" called "GetProcAddress" with a parameter ImmSetCompositionFontW (UID: 00000000-00004384) "bcdedit.exe" called "GetProcAddress" with a parameter ImmSetCompositionFontA (UID: 00000000-00004384) "bcdedit.exe" called "GetProcAddress" with a parameter ImmSetCompositionWindow (UID: 00000000-00004384) "bcdedit.exe" called "GetProcAddress" with a parameter ImmNotifyIME (UID: 00000000-00004384) "bcdedit.exe" called "GetProcAddress" with a parameter ImmLockIMC (UID: 00000000-00004384) "bcdedit.exe" called "GetProcAddress" with a parameter ImmUnlockIMC (UID: 00000000-00004384) "bcdedit.exe" called "GetProcAddress" with a parameter ImmLoadIME (UID: 00000000-00004384) "bcdedit.exe" called "GetProcAddress" with a parameter ImmSetOpenStatus (UID: 00000000-00004384) "bcdedit.exe" called "GetProcAddress" with a parameter ImmFreeLayout (UID: 00000000-00004384) "bcdedit.exe" called "GetProcAddress" with a parameter ImmActivateLayout (UID: 00000000-00004384) "bcdedit.exe" called "GetProcAddress" with a parameter ImmGetCandidateWindow (UID: 00000000-00004384) "bcdedit.exe" called "GetProcAddress" with a parameter ImmSetCandidateWindow (UID: 00000000-00004384) "bcdedit.exe" called "GetProcAddress" with a parameter ImmConfigureIMEW (UID: 00000000-00004384) "bcdedit.exe" called "GetProcAddress" with a parameter ImmGetConversionStatus (UID: 00000000-00004384) "bcdedit.exe" called "GetProcAddress" with a parameter ImmSetConversionStatus (UID: 00000000-00004384) "bcdedit.exe" called "GetProcAddress" with a parameter ImmSetStatusWindowPos (UID: 00000000-00004384) "bcdedit.exe" called "GetProcAddress" with a parameter ImmGetImeInfoEx (UID: 00000000-00004384) "bcdedit.exe" called "GetProcAddress" with a parameter ImmLockImeDpi (UID: 00000000-00004384) "bcdedit.exe" called "GetProcAddress" with a parameter ImmUnlockImeDpi (UID: 00000000-00004384) "bcdedit.exe" called "GetProcAddress" with a parameter ImmGetOpenStatus (UID: 00000000-00004384) "bcdedit.exe" called "GetProcAddress" with a parameter ImmSetActiveContext (UID: 00000000-00004384) "bcdedit.exe" called "GetProcAddress" with a parameter ImmTranslateMessage (UID: 00000000-00004384) "bcdedit.exe" called "GetProcAddress" with a parameter ImmLoadLayout (UID: 00000000-00004384) "bcdedit.exe" called "GetProcAddress" with a parameter ImmProcessKey (UID: 00000000-00004384) "bcdedit.exe" called "GetProcAddress" with a parameter ImmPutImeMenuItemsIntoMappedFile (UID: 00000000-00004384) "bcdedit.exe" called "GetProcAddress" with a parameter ImmGetProperty (UID: 00000000-00004384) "bcdedit.exe" called "GetProcAddress" with a parameter ImmSetCompositionStringA (UID: 00000000-00004384) "bcdedit.exe" called "GetProcAddress" with a parameter ImmSetCompositionStringW (UID: 00000000-00004384) "bcdedit.exe" called "GetProcAddress" with a parameter ImmEnumInputContext (UID: 00000000-00004384) "bcdedit.exe" called "GetProcAddress" with a parameter ImmSystemHandler (UID: 00000000-00004384) "bcdedit.exe" called "GetProcAddress" with a parameter CtfImmTIMActivate (UID: 00000000-00004384) "bcdedit.exe" called "GetProcAddress" with a parameter CtfImmRestoreToolbarWnd (UID: 00000000-00004384) "bcdedit.exe" called "GetProcAddress" with a parameter CtfImmHideToolbarWnd (UID: 00000000-00004384) "bcdedit.exe" called "GetProcAddress" with a parameter CtfImmDispatchDefImeMessage (UID: 00000000-00004384) "bcdedit.exe" called "GetProcAddress" with a parameter CtfImmNotify (UID: 00000000-00004384) "bcdedit.exe" called "GetProcAddress" with a parameter CtfImmSetDefaultRemoteKeyboardLayout (UID: 00000000-00004384) "bcdedit.exe" called "GetProcAddress" with a parameter CtfImmGetCompatibleKeyboardLayout (UID: 00000000-00004384) "bcdedit.exe" called "GetProcAddress" with a parameter LpkTabbedTextOut (UID: 00000000-00004384) "bcdedit.exe" called "GetProcAddress" with a parameter LpkPSMTextOut (UID: 00000000-00004384) "bcdedit.exe" called "GetProcAddress" with a parameter LpkDrawTextEx (UID: 00000000-00004384) "bcdedit.exe" called "GetProcAddress" with a parameter LpkEditControl (UID: 00000000-00004384) "bcdedit.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00004384) "bcdedit.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00004384) "bcdedit.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00004384) "bcdedit.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00004384) "bcdedit.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00004384) "bcdedit.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00004384) "bcdedit.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00004384) "bcdedit.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00004384) "bcdedit.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00004384) "bcdedit.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00004384) "bcdedit.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00004384) "bcdedit.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00004384) "bcdedit.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00004384) "bcdedit.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00004384) "bcdedit.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00004384) "bcdedit.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00004384) "bcdedit.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00004384) "bcdedit.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00004384) "bcdedit.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00004384) "bcdedit.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00004384) "bcdedit.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00004384) "bcdedit.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00004384) "bcdedit.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00004384) "bcdedit.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00004384) "bcdedit.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00004384) "bcdedit.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00004384) "bcdedit.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00004384) "bcdedit.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00004384) "bcdedit.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00004384) "bcdedit.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00004384) "bcdedit.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00004384) "bcdedit.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00004384) "bcdedit.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00004384) "bcdedit.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00004384) "bcdedit.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00004384) "bcdedit.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00004384) "bcdedit.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00004384) "bcdedit.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00004384) "bcdedit.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00004384) "bcdedit.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00004384) "bcdedit.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00004384) "cmd.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00004484) "cmd.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00004484) "cmd.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00004484) "cmd.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004484) "cmd.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00004484) "cmd.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00004484) "cmd.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00004484) "cmd.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00004484) "cmd.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00004484) "cmd.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00004484) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00004484) "cmd.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00004484) "cmd.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00004484) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00004484) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00004484) "cmd.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00004484) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00004484) "cmd.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00004484) "cmd.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00004484) "cmd.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00004484) "cmd.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00004484) "cmd.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00004484) "cmd.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00004484) "cmd.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00004484) "cmd.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00004484) "cmd.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00004484) "cmd.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00004484) "cmd.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00004484) "cmd.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00004484) "cmd.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00004484) "cmd.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00004484) "cmd.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00004484) "cmd.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00004484) "cmd.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00004484) "cmd.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00004484) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00004484) "cmd.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00004484) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00004484) "cmd.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00004484) "cmd.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00004484) "cmd.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00004484) "cmd.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00004484) "schtasks.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004948) "schtasks.exe" called "GetProcAddress" with a parameter ThemeInitApiHook (UID: 00000000-00004948) "schtasks.exe" called "GetProcAddress" with a parameter IsProcessDPIAware (UID: 00000000-00004948) "schtasks.exe" called "GetProcAddress" with a parameter LookupAccountSidLocalW (UID: 00000000-00004948) "schtasks.exe" called "GetProcAddress" with a parameter GetUserNameExW (UID: 00000000-00004948) "schtasks.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00004948)2c:T7170,Found reference to API (Indicator: "RegCreateKeyExW"; File: "file") Found reference to API (Indicator: "RegCloseKey"; File: "file") Found reference to API (Indicator: "LookupAccountSidW"; File: "file") Found reference to API (Indicator: "CopySid"; File: "file") Found reference to API (Indicator: "AccessCheck"; File: "file") Found reference to API (Indicator: "RegDeleteKeyW"; File: "file") Found reference to API (Indicator: "RegQueryValueExW"; File: "file") Found reference to API (Indicator: "GetNamedSecurityInfoW"; File: "file") Found reference to API (Indicator: "RegFlushKey"; File: "file") Found reference to API (Indicator: "OpenProcessToken"; File: "file") Found reference to API (Indicator: "DuplicateToken"; File: "file") Found reference to API (Indicator: "RegOpenKeyExW"; File: "file") Found reference to API (Indicator: "GetTokenInformation"; File: "file") Found reference to API (Indicator: "RegQueryInfoKeyW"; File: "file") Found reference to API (Indicator: "RegEnumKeyExW"; File: "file") Found reference to API (Indicator: "GetLengthSid"; File: "file") Found reference to API (Indicator: "MapGenericMask"; File: "file") Found reference to API (Indicator: "RegDeleteValueW"; File: "file") Found reference to API (Indicator: "RegSetValueExW"; File: "file") Found reference to API (Indicator: "FreeSid"; File: "file") Found reference to API (Indicator: "RegEnumValueW"; File: "file") Found reference to API (Indicator: "AllocateAndInitializeSid"; File: "file") Found reference to API (Indicator: "RegNotifyChangeKeyValue"; File: "file") Found reference to API (Indicator: "CertFreeCertificateContext"; File: "file") Found reference to API (Indicator: "CertFreeCertificateChain"; File: "file") Found reference to API (Indicator: "CertCreateCertificateContext"; File: "file") Found reference to API (Indicator: "CertGetCertificateChain"; File: "file") Found reference to API (Indicator: "CreateFontIndirectW"; File: "file") Found reference to API (Indicator: "GetDeviceCaps"; File: "file") Found reference to API (Indicator: "DeleteDC"; File: "file") Found reference to API (Indicator: "GetObjectW"; File: "file") Found reference to API (Indicator: "BitBlt"; File: "file") Found reference to API (Indicator: "GetStockObject"; File: "file") Found reference to API (Indicator: "GetDIBits"; File: "file") Found reference to API (Indicator: "CreateCompatibleDC"; File: "file") Found reference to API (Indicator: "SelectObject"; File: "file") Found reference to API (Indicator: "DeleteObject"; File: "file") Found reference to API (Indicator: "CreateCompatibleBitmap"; File: "file") Found reference to API (Indicator: "GetNetworkParams"; File: "file") Found reference to API (Indicator: "GetAdaptersAddresses"; File: "file") Found reference to API (Indicator: "GetStdHandle"; File: "file") Found reference to API (Indicator: "GetDriveTypeW"; File: "file") Found reference to API (Indicator: "CancelIoEx"; File: "file") Found reference to API (Indicator: "ReleaseMutex"; File: "file") Found reference to API (Indicator: "FileTimeToSystemTime"; File: "file") Found reference to API (Indicator: "SetEvent"; File: "file") Found reference to API (Indicator: "GetHandleInformation"; File: "file") Found reference to API (Indicator: "GetFileAttributesW"; File: "file") Found reference to API (Indicator: "lstrcmpW"; File: "file") Found reference to API (Indicator: "GetLocalTime"; File: "file") Found reference to API (Indicator: "GetProcessId"; File: "file") Found reference to API (Indicator: "DeleteCriticalSection"; File: "file") Found reference to API (Indicator: "GetCurrentProcess"; File: "file") Found reference to API (Indicator: "OpenFileMappingW"; File: "file") Found reference to API (Indicator: "UnhandledExceptionFilter"; File: "file") Found reference to API (Indicator: "SetErrorMode"; File: "file") Found reference to API (Indicator: "GetLogicalDrives"; File: "file") Found reference to API (Indicator: "FreeEnvironmentStringsW"; File: "file") Found reference to API (Indicator: "GetThreadContext"; File: "file") Found reference to API (Indicator: "GetLocaleInfoW"; File: "file") Found reference to API (Indicator: "IsDBCSLeadByteEx"; File: "file") Found reference to API (Indicator: "CheckRemoteDebuggerPresent"; File: "file") Found reference to API (Indicator: "WideCharToMultiByte"; File: "file") Found reference to API (Indicator: "GetTempPathW"; File: "file") Found reference to API (Indicator: "GetUserPreferredUILanguages"; File: "file") Found reference to API (Indicator: "WaitForSingleObject"; File: "file") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; File: "file") Found reference to API (Indicator: "AddVectoredExceptionHandler"; File: "file") Found reference to API (Indicator: "GetExitCodeProcess"; File: "file") Found reference to API (Indicator: "LocalFree"; File: "file") Found reference to API (Indicator: "FormatMessageW"; File: "file") Found reference to API (Indicator: "ConnectNamedPipe"; File: "file") Found reference to API (Indicator: "GetTimeZoneInformation"; File: "file") Found reference to API (Indicator: "OutputDebugStringW"; File: "file") Found reference to API (Indicator: "FindClose"; File: "file") Found reference to API (Indicator: "TlsGetValue"; File: "file") Found reference to API (Indicator: "FindNextChangeNotification"; File: "file") Found reference to API (Indicator: "GetFullPathNameW"; File: "file") Found reference to API (Indicator: "OutputDebugStringA"; File: "file") Found reference to API (Indicator: "SetLastError"; File: "file") Found reference to API (Indicator: "RaiseFailFastException"; File: "file") Found reference to API (Indicator: "GetSystemTime"; File: "file") Found reference to API (Indicator: "DeviceIoControl"; File: "file") Found reference to API (Indicator: "InitializeCriticalSection"; File: "file") Found reference to API (Indicator: "CopyFileW"; File: "file") Found reference to API (Indicator: "GetUserDefaultLangID"; File: "file") Found reference to API (Indicator: "GetModuleFileNameW"; File: "file") Found reference to API (Indicator: "TryEnterCriticalSection"; File: "file") Found reference to API (Indicator: "IsDebuggerPresent"; File: "file") Found reference to API (Indicator: "ExitProcess"; File: "file") Found reference to API (Indicator: "RemoveVectoredExceptionHandler"; File: "file") Found reference to API (Indicator: "RtlAddFunctionTable"; File: "file") Found reference to API (Indicator: "RaiseException"; File: "file") Found reference to API (Indicator: "SetThreadPriority"; File: "file") Found reference to API (Indicator: "RtlVirtualUnwind"; File: "file") Found reference to API (Indicator: "GetVolumeInformationW"; File: "file") Found reference to API (Indicator: "MultiByteToWideChar"; File: "file") Found reference to API (Indicator: "SetFilePointerEx"; File: "file") Found reference to API (Indicator: "SetProcessAffinityMask"; File: "file") Found reference to API (Indicator: "MoveFileW"; File: "file") Found reference to API (Indicator: "GetVolumePathNamesForVolumeNameW"; File: "file") Found reference to API (Indicator: "RegisterWaitForSingleObject"; File: "file") Found reference to API (Indicator: "CreateSemaphoreA"; File: "file") Found reference to API (Indicator: "CreateThread"; File: "file") Found reference to API (Indicator: "MoveFileExW"; File: "file") Found reference to API (Indicator: "GetSystemDirectoryW"; File: "file") Found reference to API (Indicator: "CreateSemaphoreW"; File: "file") Found reference to API (Indicator: "CreateMutexW"; File: "file") Found reference to API (Indicator: "GetFileInformationByHandle"; File: "file") Found reference to API (Indicator: "SetHandleInformation"; File: "file") Found reference to API (Indicator: "SetThreadContext"; File: "file") Found reference to API (Indicator: "TerminateProcess"; File: "file") Found reference to API (Indicator: "FindCloseChangeNotification"; File: "file") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; File: "file") Found reference to API (Indicator: "GetModuleHandleExW"; File: "file") Found reference to API (Indicator: "SetCurrentDirectoryW"; File: "file") Found reference to API (Indicator: "GlobalAlloc"; File: "file") Found reference to API (Indicator: "SetEndOfFile"; File: "file") Found reference to API (Indicator: "GetCurrentThreadId"; File: "file") Found reference to API (Indicator: "SleepEx"; File: "file") Found reference to API (Indicator: "EnterCriticalSection"; File: "file") Found reference to API (Indicator: "PeekNamedPipe"; File: "file") Found reference to API (Indicator: "TerminateThread"; File: "file") Found reference to API (Indicator: "LoadLibraryW"; File: "file") Found reference to API (Indicator: "FreeLibrary"; File: "file") Found reference to API (Indicator: "QueryPerformanceCounter"; File: "file") Found reference to API (Indicator: "GetTickCount"; File: "file") Found reference to API (Indicator: "TlsAlloc"; File: "file") Found reference to API (Indicator: "VirtualProtect"; File: "file") Found reference to API (Indicator: "FlushFileBuffers"; File: "file") Found reference to API (Indicator: "LoadLibraryA"; File: "file") Found reference to API (Indicator: "GlobalSize"; File: "file") Found reference to API (Indicator: "GetStartupInfoA"; File: "file") Found reference to API (Indicator: "TzSpecificLocalTimeToSystemTime"; File: "file") Found reference to API (Indicator: "GetFileSize"; File: "file") Found reference to API (Indicator: "OpenProcess"; File: "file") Found reference to API (Indicator: "GetGeoInfoW"; File: "file") Found reference to API (Indicator: "GetDateFormatW"; File: "file") Found reference to API (Indicator: "GetStartupInfoW"; File: "file") Found reference to API (Indicator: "CreateDirectoryW"; File: "file") Found reference to API (Indicator: "DeleteFileW"; File: "file") Found reference to API (Indicator: "GetProcAddress"; File: "file") Found reference to API (Indicator: "GetSystemInfo"; File: "file") Found reference to API (Indicator: "CreateFileMappingW"; File: "file") Found reference to API (Indicator: "GetTimeFormatW"; File: "file") Found reference to API (Indicator: "RemoveDirectoryW"; File: "file") Found reference to API (Indicator: "ExpandEnvironmentStringsW"; File: "file") Found reference to API (Indicator: "ResumeThread"; File: "file") Found reference to API (Indicator: "FindNextFileW"; File: "file") Found reference to API (Indicator: "WTSGetActiveConsoleSessionId"; File: "file") Found reference to API (Indicator: "RtlLookupFunctionEntry"; File: "file") Found reference to API (Indicator: "ResetEvent"; File: "file") Found reference to API (Indicator: "FindFirstFileW"; File: "file") Found reference to API (Indicator: "DuplicateHandle"; File: "file") Found reference to API (Indicator: "FindFirstFileExW"; File: "file") Found reference to API (Indicator: "GetUserDefaultLCID"; File: "file") Found reference to API (Indicator: "GetFileInformationByHandleEx"; File: "file") Found reference to API (Indicator: "GetProcessAffinityMask"; File: "file") Found reference to API (Indicator: "CreateEventW"; File: "file") Found reference to API (Indicator: "CreateFileW"; File: "file") Found reference to API (Indicator: "GetConsoleWindow"; File: "file") Found reference to API (Indicator: "CreateEventA"; File: "file") Found reference to API (Indicator: "GetFileType"; File: "file") Found reference to API (Indicator: "TlsSetValue"; File: "file") Found reference to API (Indicator: "CreateFileA"; File: "file") Found reference to API (Indicator: "GetCurrencyFormatW"; File: "file") Found reference to API (Indicator: "LeaveCriticalSection"; File: "file") Found reference to API (Indicator: "GetNativeSystemInfo"; File: "file") Found reference to API (Indicator: "GetLastError"; File: "file") Found reference to API (Indicator: "SystemTimeToFileTime"; File: "file") Found reference to API (Indicator: "LCMapStringW"; File: "file") Found reference to API (Indicator: "CreateNamedPipeW"; File: "file") Found reference to API (Indicator: "GlobalFree"; File: "file") Found reference to API (Indicator: "GetThreadPriority"; File: "file") Found reference to API (Indicator: "UnregisterWaitEx"; File: "file") Found reference to API (Indicator: "CompareStringW"; File: "file") Found reference to API (Indicator: "GetEnvironmentStringsW"; File: "file") Found reference to API (Indicator: "GlobalUnlock"; File: "file") Found reference to API (Indicator: "GetUserGeoID"; File: "file") Found reference to API (Indicator: "FindFirstChangeNotificationW"; File: "file") Found reference to API (Indicator: "VirtualFree"; File: "file") Found reference to API (Indicator: "WaitForSingleObjectEx"; File: "file") Found reference to API (Indicator: "SwitchToThread"; File: "file") Found reference to API (Indicator: "GetCurrentDirectoryW"; File: "file") Found reference to API (Indicator: "CompareStringEx"; File: "file") Found reference to API (Indicator: "SetFileTime"; File: "file") Found reference to API (Indicator: "GetCommandLineW"; File: "file") Found reference to API (Indicator: "GetCurrentThread"; File: "file") Found reference to API (Indicator: "GetTickCount64"; File: "file") Found reference to API (Indicator: "SuspendThread"; File: "file") Found reference to API (Indicator: "QueryPerformanceFrequency"; File: "file") Found reference to API (Indicator: "ReleaseSemaphore"; File: "file") Found reference to API (Indicator: "MapViewOfFile"; File: "file") Found reference to API (Indicator: "TlsFree"; File: "file") Found reference to API (Indicator: "SetFilePointer"; File: "file") Found reference to API (Indicator: "ReadFile"; File: "file") Found reference to API (Indicator: "WriteFileEx"; File: "file") Found reference to API (Indicator: "RtlCaptureContext"; File: "file") Found reference to API (Indicator: "CloseHandle"; File: "file") Found reference to API (Indicator: "GlobalLock"; File: "file") Found reference to API (Indicator: "GetModuleHandleW"; File: "file") Found reference to API (Indicator: "GetFileAttributesExW"; File: "file") Found reference to API (Indicator: "GetLongPathNameW"; File: "file") Found reference to API (Indicator: "UnmapViewOfFile"; File: "file") Found reference to API (Indicator: "WriteFile"; File: "file") Found reference to API (Indicator: "VirtualQuery"; File: "file") Found reference to API (Indicator: "CreateProcessW"; File: "file") Found reference to API (Indicator: "WaitForMultipleObjects"; File: "file") Found reference to API (Indicator: "Sleep"; File: "file") Found reference to API (Indicator: "ReadFileEx"; File: "file") Found reference to API (Indicator: "VirtualAlloc"; File: "file") Found reference to API (Indicator: "GetCurrentProcessId"; File: "file") Found reference to API (Indicator: "NetShareEnum"; File: "file") Found reference to API (Indicator: "NetApiBufferFree"; File: "file") Found reference to API (Indicator: "SafeArrayPutElement"; File: "file") Found reference to API (Indicator: "SysAllocString"; File: "file") Found reference to API (Indicator: "SHBrowseForFolderW"; File: "file") Found reference to API (Indicator: "ShellExecuteW"; File: "file") Found reference to API (Indicator: "SHGetPathFromIDListW"; File: "file") Found reference to API (Indicator: "SHGetFileInfoW"; File: "file") Found reference to API (Indicator: "SHGetKnownFolderPath"; File: "file") Found reference to API (Indicator: "Shell_NotifyIconW"; File: "file") Found reference to API (Indicator: "SHGetMalloc"; File: "file") Found reference to API (Indicator: "CommandLineToArgvW"; File: "file") Found reference to API (Indicator: "GetForegroundWindow"; File: "file") Found reference to API (Indicator: "SetWindowRgn"; File: "file") Found reference to API (Indicator: "DestroyMenu"; File: "file") Found reference to API (Indicator: "SetWindowPos"; File: "file") Found reference to API (Indicator: "IsWindow"; File: "file") Found reference to API (Indicator: "WindowFromPoint"; File: "file") Found reference to API (Indicator: "SetMenuItemInfoW"; File: "file") Found reference to API (Indicator: "DispatchMessageW"; File: "file") Found reference to API (Indicator: "DestroyCursor"; File: "file") Found reference to API (Indicator: "GetCursorPos"; File: "file") Found reference to API (Indicator: "GetMenu"; File: "file") Found reference to API (Indicator: "TranslateMessage"; File: "file") Found reference to API (Indicator: "UnregisterClassW"; File: "file") Found reference to API (Indicator: "ToAscii"; File: "file") Found reference to API (Indicator: "SetCaretPos"; File: "file") Found reference to API (Indicator: "CallNextHookEx"; File: "file") Found reference to API (Indicator: "MsgWaitForMultipleObjectsEx"; File: "file") Found reference to API (Indicator: "LoadImageW"; File: "file") Found reference to API (Indicator: "TrackPopupMenu"; File: "file") Found reference to API (Indicator: "GetWindowTextW"; File: "file") Found reference to API (Indicator: "DestroyWindow"; File: "file") Found reference to API (Indicator: "GetParent"; File: "file") Found reference to API (Indicator: "GetCursorInfo"; File: "file") Found reference to API (Indicator: "EnumWindows"; File: "file") Found reference to API (Indicator: "CreateCaret"; File: "file") Found reference to API (Indicator: "ShowWindow"; File: "file") Found reference to API (Indicator: "PeekMessageW"; File: "file") Found reference to API (Indicator: "SetWindowPlacement"; File: "file") Found reference to API (Indicator: "LoadIconW"; File: "file") Found reference to API (Indicator: "SetParent"; File: "file") Found reference to API (Indicator: "IsWindowEnabled"; File: "file") Found reference to API (Indicator: "GetWindow"; File: "file") Found reference to API (Indicator: "DestroyCaret"; File: "file") Found reference to API (Indicator: "CreateCursor"; File: "file") Found reference to API (Indicator: "CharNextExA"; File: "file") Found reference to API (Indicator: "GetIconInfo"; File: "file") Found reference to API (Indicator: "RegisterClassW"; File: "file") Found reference to API (Indicator: "IsZoomed"; File: "file") Found reference to API (Indicator: "GetWindowPlacement"; File: "file") Found reference to API (Indicator: "GetKeyboardLayoutList"; File: "file") Found reference to API (Indicator: "DrawMenuBar"; File: "file") Found reference to API (Indicator: "IsIconic"; File: "file") Found reference to API (Indicator: "TrackPopupMenuEx"; File: "file") Found reference to API (Indicator: "CreateMenu"; File: "file") Found reference to API (Indicator: "GetKeyboardLayout"; File: "file") Found reference to API (Indicator: "GetSysColorBrush"; File: "file") Found reference to API (Indicator: "CreateWindowExW"; File: "file") Found reference to API (Indicator: "IsChild"; File: "file") Found reference to API (Indicator: "SetFocus"; File: "file") Found reference to API (Indicator: "BeginPaint"; File: "file") Found reference to API (Indicator: "DefWindowProcW"; File: "file") Found reference to API (Indicator: "KillTimer"; File: "file") Found reference to API (Indicator: "GetSystemMetrics"; File: "file") Found reference to API (Indicator: "EnableMenuItem"; File: "file") Found reference to API (Indicator: "GetWindowRect"; File: "file") Found reference to API (Indicator: "SetCapture"; File: "file") Found reference to API (Indicator: "ReleaseCapture"; File: "file") Found reference to API (Indicator: "CreatePopupMenu"; File: "file") Found reference to API (Indicator: "ShowCaret"; File: "file") Found reference to API (Indicator: "DrawIconEx"; File: "file") Found reference to API (Indicator: "SetWindowTextW"; File: "file") Found reference to API (Indicator: "SetTimer"; File: "file") Found reference to API (Indicator: "ClientToScreen"; File: "file") Found reference to API (Indicator: "GetKeyboardState"; File: "file") Found reference to API (Indicator: "AttachThreadInput"; File: "file") Found reference to API (Indicator: "GetDesktopWindow"; File: "file") Found reference to API (Indicator: "LoadCursorW"; File: "file") Found reference to API (Indicator: "GetSystemMenu"; File: "file") Found reference to API (Indicator: "GetDC"; File: "file") Found reference to API (Indicator: "InsertMenuW"; File: "file") Found reference to API (Indicator: "SetForegroundWindow"; File: "file") Found reference to API (Indicator: "GetMenuItemInfoW"; File: "file") Found reference to API (Indicator: "GetAsyncKeyState"; File: "file") Found reference to API (Indicator: "GetCaretBlinkTime"; File: "file") Found reference to API (Indicator: "ReleaseDC"; File: "file") Found reference to API (Indicator: "ModifyMenuW"; File: "file") Found reference to API (Indicator: "HideCaret"; File: "file") Found reference to API (Indicator: "CreateIconIndirect"; File: "file") Found reference to API (Indicator: "GetCapture"; File: "file") Found reference to API (Indicator: "ScreenToClient"; File: "file") Found reference to API (Indicator: "FindWindowA"; File: "file") Found reference to API (Indicator: "MessageBeep"; File: "file") Found reference to API (Indicator: "RemoveMenu"; File: "file") Found reference to API (Indicator: "GetWindowThreadProcessId"; File: "file") Found reference to API (Indicator: "MessageBoxW"; File: "file") Found reference to API (Indicator: "SetMenu"; File: "file") Found reference to API (Indicator: "MoveWindow"; File: "file") Found reference to API (Indicator: "AppendMenuW"; File: "file") Found reference to API (Indicator: "AdjustWindowRectEx"; File: "file") Found reference to API (Indicator: "GetSysColor"; File: "file") Found reference to API (Indicator: "GetKeyState"; File: "file") Found reference to API (Indicator: "UpdateLayeredWindow"; File: "file") Found reference to API (Indicator: "DestroyIcon"; File: "file") Found reference to API (Indicator: "IsWindowVisible"; File: "file") Found reference to API (Indicator: "SetCursorPos"; File: "file") Found reference to API (Indicator: "SystemParametersInfoW"; File: "file") Found reference to API (Indicator: "InvalidateRect"; File: "file") Found reference to API (Indicator: "GetClientRect"; File: "file") Found reference to API (Indicator: "GetCursor"; File: "file") Found reference to API (Indicator: "GetFocus"; File: "file") Found reference to API (Indicator: "UnhookWindowsHookEx"; File: "file") Found reference to API (Indicator: "SetCursor"; File: "file") Found reference to API (Indicator: "VerQueryValueW"; File: "file") Found reference to API (Indicator: "GetFileVersionInfoW"; File: "file") Found reference to API (Indicator: "GetFileVersionInfoSizeW"; File: "file") Found reference to API (Indicator: "timeSetEvent"; File: "file") Found reference to API (Indicator: "htonl"; File: "file") Found reference to API (Indicator: "WSAStartup"; File: "file") Found reference to API (Indicator: "getsockname"; File: "file") Found reference to API (Indicator: "htons"; File: "file") Found reference to API (Indicator: "getpeername"; File: "file") Found reference to API (Indicator: "WSAGetLastError"; File: "file") Found reference to API (Indicator: "gethostname"; File: "file") Found reference to API (Indicator: "getsockopt"; File: "file") Found reference to API (Indicator: "ntohl"; File: "file") Found reference to API (Indicator: "WSASend"; File: "file") Found reference to API (Indicator: "__WSAFDIsSet"; File: "file") Found reference to API (Indicator: "WSACleanup"; File: "file") Found reference to API (Indicator: "WSAAsyncSelect"; File: "file") Found reference to API (Indicator: "closesocket"; File: "file") Found reference to API (Indicator: "WSAIoctl"; File: "file") Found reference to API (Indicator: "WTSQuerySessionInformationW"; File: "file") Found reference to API (Indicator: "WTSFreeMemory"; File: "file") Found reference to API (Indicator: "CoInitializeEx"; File: "file") Found reference to API (Indicator: "OleUninitialize"; File: "file") Found reference to API (Indicator: "CoUninitialize"; File: "file") Found reference to API (Indicator: "CoInitialize"; File: "file") Found reference to API (Indicator: "CoCreateGuid"; File: "file") Found reference to API (Indicator: "CoCreateInstance"; File: "file") Found reference to API (Indicator: "CoTaskMemFree"; File: "file") Found reference to API (Indicator: "StringFromGUID2"; File: "file") Found reference to API (Indicator: "OleInitialize"; File: "file") Found reference to API (Indicator: "AccessCheck"; Source: "00000000-00002764.00000001.159193.01663000.00000004.mdmp") Found reference to API (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00002764.00000001.159193.01663000.00000004.mdmp") Found reference to API (Indicator: "CopySid"; Source: "00000000-00002764.00000001.159193.01663000.00000004.mdmp") Found reference to API (Indicator: "DuplicateToken"; Source: "00000000-00002764.00000001.159193.01663000.00000004.mdmp") Found reference to API (Indicator: "FreeSid"; Source: "00000000-00002764.00000001.159193.01663000.00000004.mdmp") Found reference to API (Indicator: "GetLengthSid"; Source: "00000000-00002764.00000001.159193.01663000.00000004.mdmp") Found reference to API (Indicator: "GetNamedSecurityInfoW"; Source: "00000000-00002764.00000001.159193.01663000.00000004.mdmp") Found reference to API (Indicator: "GetTokenInformation"; Source: "00000000-00002764.00000001.159193.01663000.00000004.mdmp") Found reference to API (Indicator: "LookupAccountSidW"; Source: "00000000-00002764.00000001.159193.01663000.00000004.mdmp") Found reference to API (Indicator: "MapGenericMask"; Source: "00000000-00002764.00000001.159193.01663000.00000004.mdmp") Found reference to API (Indicator: "OpenProcessToken"; Source: "00000000-00002764.00000001.159193.01663000.00000004.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00002764.00000001.159193.01663000.00000004.mdmp") Found reference to API (Indicator: "RegCreateKeyExW"; Source: "00000000-00002764.00000001.159193.01663000.00000004.mdmp") Found reference to API (Indicator: "RegDeleteKeyW"; Source: "00000000-00002764.00000001.159193.01663000.00000004.mdmp") Found reference to API (Indicator: "RegDeleteValueW"; Source: "00000000-00002764.00000001.159193.01663000.00000004.mdmp") Found reference to API (Indicator: "RegEnumKeyExW"; Source: "00000000-00002764.00000001.159193.01663000.00000004.mdmp") Found reference to API (Indicator: "RegEnumValueW"; Source: "00000000-00002764.00000001.159193.01663000.00000004.mdmp") Found reference to API (Indicator: "RegFlushKey"; Source: "00000000-00002764.00000001.159193.01663000.00000004.mdmp") Found reference to API (Indicator: "RegNotifyChangeKeyValue"; Source: "00000000-00002764.00000001.159193.01663000.00000004.mdmp") Found reference to API (Indicator: "RegOpenKeyExW"; Source: "00000000-00002764.00000001.159193.01663000.00000004.mdmp") Found reference to API (Indicator: "RegQueryInfoKeyW"; Source: "00000000-00002764.00000001.159193.01663000.00000004.mdmp") Found reference to API (Indicator: "RegQueryValueExW"; Source: "00000000-00002764.00000001.159193.01663000.00000004.mdmp") Found reference to API (Indicator: "RegSetValueExW"; Source: "00000000-00002764.00000001.159193.01663000.00000004.mdmp") Found reference to API (Indicator: "CertCreateCertificateContext"; Source: "00000000-00002764.00000001.159193.01663000.00000004.mdmp") Found reference to API (Indicator: "CertFreeCertificateChain"; Source: "00000000-00002764.00000001.159193.01663000.00000004.mdmp") Found reference to API (Indicator: "CertFreeCertificateContext"; Source: "00000000-00002764.00000001.159193.01663000.00000004.mdmp") Found reference to API (Indicator: "CertGetCertificateChain"; Source: "00000000-00002764.00000001.159193.01663000.00000004.mdmp") Found reference to API (Indicator: "BitBlt"; Source: "00000000-00002764.00000001.159193.01663000.00000004.mdmp") Found reference to API (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00002764.00000001.159193.01663000.00000004.mdmp") Found reference to API (Indicator: "CreateCompatibleDC"; Source: "00000000-00002764.00000001.159193.01663000.00000004.mdmp") Found reference to API (Indicator: "CreateFontIndirectW"; Source: "00000000-00002764.00000001.159193.01663000.00000004.mdmp") Found reference to API (Indicator: "DeleteDC"; Source: "00000000-00002764.00000001.159193.01663000.00000004.mdmp") Found reference to API (Indicator: "DeleteObject"; Source: "00000000-00002764.00000001.159193.01663000.00000004.mdmp") Found reference to API (Indicator: "GetDIBits"; Source: "00000000-00002764.00000001.159193.01663000.00000004.mdmp") Found reference to API (Indicator: "GetDeviceCaps"; Source: "00000000-00002764.00000001.159193.01663000.00000004.mdmp") Found reference to API (Indicator: "GetObjectW"; Source: "00000000-00002764.00000001.159193.01663000.00000004.mdmp") Found reference to API (Indicator: "GetStockObject"; Source: "00000000-00002764.00000001.159193.01663000.00000004.mdmp")2d:T4f3,Found string "cmd.exe /c schtasks /create /tn "OneDrive AutoRemove" /tr "%WINDIR%\System32\cmd.exe /c del /f /q C:/file.exe" /sc daily /st 10" (Indicator: "\system32\cmd.exe /c "; Source: "00000000-00002764-00000C44-3173099506793") Found string "cmd.exe /c schtasks /create /tn "OneDrive AutoRemove" /tr "%WINDIR%\System32\cmd.exe /c del /f /q C:/file.exe" /sc daily /st 10" (Indicator: "cmd.exe /c"; Source: "00000000-00002764-00000C44-3173099506793") Found string "/c schtasks /create /tn "OneDrive AutoRemove" /tr "%WINDIR%\System32\cmd.exe /c del /f /q C:/file.exe" /sc daily /st 10:30:30 /ru SYSTEM" (Indicator: "\system32\cmd.exe /c "; File: "cmd.exe") Found string "/c schtasks /create /tn "OneDrive AutoRemove" /tr "%WINDIR%\System32\cmd.exe /c del /f /q C:/file.exe" /sc daily /st 10:30:30 /ru SYSTEM" (Indicator: "cmd.exe /c"; File: "cmd.exe") Found string "schtasks /create /tn "OneDrive AutoRemove" /tr "%WINDIR%\System32\cmd.exe /c del /f /q C:/file.exe" /sc daily /st 10:30:30 /ru SYSTEM" (Indicator: "\system32\cmd.exe /c "; File: "schtasks.exe") Found string "schtasks /create /tn "OneDrive AutoRemove" /tr "%WINDIR%\System32\cmd.exe /c del /f /q C:/file.exe" /sc daily /st 10:30:30 /ru SYSTEM" (Indicator: "cmd.exe /c"; File: "schtasks.exe")2e:T71d,"file" contains export function called "FT_Activate_Size" at ordinal 1 "file" contains export function called "FT_Add_Default_Modules" at ordinal 2 "file" contains export function called "FT_Add_Module" at ordinal 3 "file" contains export function called "FT_Angle_Diff" at ordinal 4 "file" contains export function called "FT_Atan2" at ordinal 5 "file" contains export function called "FT_Attach_File" at ordinal 6 "file" contains export function called "FT_Attach_Stream" at ordinal 7 "file" contains export function called "FT_Bitmap_Convert" at ordinal 8 "file" contains export function called "FT_Bitmap_Copy" at ordinal 9 "file" contains export function called "FT_Bitmap_Done" at ordinal 10 "file" contains export function called "FT_Bitmap_Embolden" at ordinal 11 "file" contains export function called "FT_Bitmap_Init" at ordinal 12 "file" contains export function called "FT_Bitmap_New" at ordinal 13 "file" contains export function called "FT_CeilFix" at ordinal 14 "file" contains export function called "FT_Cos" at ordinal 15 "file" contains export function called "FT_DivFix" at ordinal 16 "file" contains export function called "FT_Done_Face" at ordinal 17 "file" contains export function called "FT_Done_FreeType" at ordinal 18 "file" contains export function called "FT_Done_Library" at ordinal 19 "file" contains export function called "FT_Done_Size" at ordinal 20 "file" contains export function called "FT_Face_GetCharVariantIndex" at ordinal 21 "file" contains export function called "FT_Face_GetCharVariantIsDefault" at ordinal 22 "file" contains export function called "FT_Face_GetCharsOfVariant" at ordinal 23 "file" contains export function called "FT_Face_GetVariantSelectors" at ordinal 24 "file" contains export function called "FT_Face_GetVariantsOfChar" at ordinal 252f:T1447,"file.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7fef9080000 "file.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "file.exe" loaded module "KERNEL32" at base 778e0000 "file.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "file.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7fef26f0000 "file.exe" loaded module "PSAPI" at base 77bd0000 "file.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7fefbca0000 "file.exe" loaded module "DHCPCSVC6.DLL" at base 7fefb060000 "file.exe" loaded module "IPHLPAPI.DLL" at base 7fefb1e0000 "file.exe" loaded module "RPCRT4.DLL" at base 7fefe090000 "file.exe" loaded module "DHCPCSVC.DLL" at base 7fefb040000 "file.exe" loaded module "KERNEL32.DLL" at base 778e0000 "file.exe" loaded module "%WINDIR%\SYSTEM32\NLAAPI.DLL" at base 7fefb450000 "file.exe" loaded module "%WINDIR%\SYSTEM32\NAPINSP.DLL" at base 7fefada0000 "file.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 7fefdb80000 "file.exe" loaded module "%WINDIR%\SYSTEM32\PNRPNSP.DLL" at base 7fefad80000 "file.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 7fefce80000 "file.exe" loaded module "DNSAPI.DLL" at base 7fefcd00000 "file.exe" loaded module "%WINDIR%\SYSTEM32\WINRNR.DLL" at base 7fefad70000 "file.exe" loaded module "WS2_32.DLL" at base 7fefe1c0000 "file.exe" loaded module "%WINDIR%\SYSTEM32\WINHTTP.DLL" at base 7fef9dc0000 "file.exe" loaded module "SHLWAPI.DLL" at base 7fefdce0000 "file.exe" loaded module "NTDLL.DLL" at base 77a00000 "file.exe" loaded module "ADVAPI32.DLL" at base 7fefe210000 "file.exe" loaded module "WINHTTP.DLL" at base 7fef9dc0000 "file.exe" loaded module "SSPICLI.DLL" at base 7fefd4c0000 "file.exe" loaded module "CRYPTSP.DLL" at base 7fefcee0000 "file.exe" loaded module "CREDSSP.DLL" at base 7fefcae0000 "file.exe" loaded module "OLE32.DLL" at base 7feffab0000 "file.exe" loaded module "CRYPTBASE.DLL" at base 7fefd550000 "file.exe" loaded module "NSI.DLL" at base 7fefdab0000 "file.exe" loaded module "CFGMGR32.DLL" at base 7fefd740000 "file.exe" loaded module "OLEAUT32.DLL" at base 7fefe890000 "file.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 7fefe210000 "file.exe" loaded module "API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL" at base 7fefdb80000 "file.exe" loaded module "API-MS-WIN-SERVICE-MANAGEMENT-L1-1-0.DLL" at base 7fefdb80000 "file.exe" loaded module "API-MS-WIN-SERVICE-MANAGEMENT-L2-1-0.DLL" at base 7fefdb80000 "file.exe" loaded module "API-MS-WIN-SERVICE-WINSVC-L1-1-0.DLL" at base 7fefdb80000 "file.exe" loaded module "%WINDIR%\SYSTEM32\WSHTCPIP.DLL" at base 7fefc8a0000 "file.exe" loaded module "%WINDIR%\SYSTEM32\WSHIP6.DLL" at base 7fefce70000 "file.exe" loaded module "RASADHLP.DLL" at base 7fefa750000 "file.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 7fefd4f0000 "file.exe" loaded module "USER32.DLL" at base 777e0000 "file.exe" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 7fefed20000 "file.exe" loaded module "PROFAPI.DLL" at base 7fefd6f0000 "cmd.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7fef9080000 "cmd.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "cmd.exe" loaded module "KERNEL32" at base 778e0000 "cmd.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "cmd.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 7fefd4f0000 "schtasks.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7fef9080000 "schtasks.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "schtasks.exe" loaded module "KERNEL32" at base 778e0000 "schtasks.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "schtasks.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7fefbca0000 "schtasks.exe" loaded module "RPCRT4.DLL" at base 7fefe090000 "schtasks.exe" loaded module "API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL" at base 7fefdb80000 "schtasks.exe" loaded module "ADVAPI32.DLL" at base 7fefe210000 "schtasks.exe" loaded module "CLBCATQ.DLL" at base 7fefdba0000 "schtasks.exe" loaded module "%WINDIR%\SYSTEM32\TASKSCHD.DLL" at base 7fefb4e0000 "schtasks.exe" loaded module "SSPICLI.DLL" at base 7fefd4c0000 "schtasks.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 7fefdb80000 "schtasks.exe" loaded module "XMLLITE.DLL" at base 7fefb7d0000 "schtasks.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7fef26f0000 "schtasks.exe" loaded module "KERNEL32.DLL" at base 778e0000 "schtasks.exe" loaded module "API-MS-WIN-SERVICE-MANAGEMENT-L1-1-0.DLL" at base 7fefdb80000 "schtasks.exe" loaded module "API-MS-WIN-SERVICE-WINSVC-L1-1-0.DLL" at base 7fefdb80000 "schtasks.exe" loaded module "CRYPTBASE.DLL" at base 7fefd550000 "bcdedit.exe" loaded module "GDI32.DLL" at base 7fefe2f0000 "bcdedit.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 7fefdb50000 "bcdedit.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7fef9080000 "bcdedit.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "bcdedit.exe" loaded module "KERNEL32" at base 778e0000 "bcdedit.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 030:T4c3,"0d000e00fe07000040087af2fe070000@IPHLPAPI.DLL" "0f001000fe070000a0087af2fe070000@IPHLPAPI.DLL" "0c000d00fe070000f0087af2fe070000@IPHLPAPI.DLL" "14001500fe07000040097af2fe070000@IPHLPAPI.DLL" "0c000d00fe070000c0097af2fe070000@IPHLPAPI.DLL" "15001600fe070000b8fa79f2fe070000@ADVAPI32.dll" "0e000f00fe07000070fb79f2fe070000@ADVAPI32.dll" "0e000f00fe070000d0fb79f2fe070000@ADVAPI32.dll" "11001200fe07000040047af2fe070000@ADVAPI32.dll" "11001200fe070000d8047af2fe070000@ADVAPI32.dll" "12001300fe07000020057af2fe070000@ADVAPI32.dll" "12001300fe07000080057af2fe070000@ADVAPI32.dll" "14001500fe070000c02e7af2fe070000@ADVAPI32.dll" "14001500fe070000d82e7af2fe070000@ADVAPI32.dll" "14001500fe070000f02e7af2fe070000@ADVAPI32.dll" "17001800fe070000082f7af2fe070000@ADVAPI32.dll" "0d000e00fe070000202f7af2fe070000@ADVAPI32.dll" "11001200fe070000302f7af2fe070000@ADVAPI32.dll" "11001200fe070000482f7af2fe070000@ADVAPI32.dll" "0f001000fe07000050297af2fe070000@NETAPI32.dll" "0d000e00fe070000d8057af2fe070000@SHELL32.dll" "0d000e00fe07000060067af2fe070000@SHELL32.dll" "10001100fe07000068307af2fe070000@CRYPT32.dll" "12001300fe07000090307af2fe070000@CRYPT32.dll" "0f001000fe070000a8307af2fe070000@ADVAPI32.dll"31:T469,Spawned process "cmd.exe" with commandline "/c bcdedit" (UID: 00000000-00002628) Spawned process "bcdedit.exe" (UID: 00000000-00004004) Spawned process "cmd.exe" with commandline "/c schtasks /create /tn "OneDrive AutoRemove" /tr "%WINDIR%\\Sys ..." (UID: 00000000-00004324), Spawned process "schtasks.exe" with commandline "schtasks /create /tn "OneDrive AutoRemove" /tr "%WINDIR%\\Syste ..." (UID: 00000000-00004452) Spawned process "cmd.exe" with commandline "/c schtasks /delete /f /tn "Microsoft\\Windows\\light Service Ma ..." (UID: 00000000-00003788), Spawned process "schtasks.exe" with commandline "schtasks /delete /f /tn "Microsoft\\Windows\\light Service Mana ..." (UID: 00000000-00003496) Spawned process "cmd.exe" with commandline "/c bcdedit" (UID: 00000000-00003948) Spawned process "bcdedit.exe" (UID: 00000000-00004384) Spawned process "cmd.exe" with commandline "/c schtasks /create /tn "Microsoft\\Windows\\light Service Manag ..." (UID: 00000000-00004484), Spawned process "schtasks.exe" with commandline "schtasks /create /tn "Microsoft\\Windows\\light Service Manager ..." (UID: 00000000-00004948)32:T469,Spawned process "cmd.exe" with commandline "/c bcdedit" (UID: 00000000-00002628) Spawned process "bcdedit.exe" (UID: 00000000-00004004) Spawned process "cmd.exe" with commandline "/c schtasks /create /tn "OneDrive AutoRemove" /tr "%WINDIR%\\Sys ..." (UID: 00000000-00004324), Spawned process "schtasks.exe" with commandline "schtasks /create /tn "OneDrive AutoRemove" /tr "%WINDIR%\\Syste ..." (UID: 00000000-00004452) Spawned process "cmd.exe" with commandline "/c schtasks /delete /f /tn "Microsoft\\Windows\\light Service Ma ..." (UID: 00000000-00003788), Spawned process "schtasks.exe" with commandline "schtasks /delete /f /tn "Microsoft\\Windows\\light Service Mana ..." (UID: 00000000-00003496) Spawned process "cmd.exe" with commandline "/c bcdedit" (UID: 00000000-00003948) Spawned process "bcdedit.exe" (UID: 00000000-00004384) Spawned process "cmd.exe" with commandline "/c schtasks /create /tn "Microsoft\\Windows\\light Service Manag ..." (UID: 00000000-00004484), Spawned process "schtasks.exe" with commandline "schtasks /create /tn "Microsoft\\Windows\\light Service Manager ..." (UID: 00000000-00004948)33:T5b6,"file.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: ""; Value: "") "file.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS NT\DNSCLIENT"; Key: ""; Value: "") "file.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SQMCLIENT\WINDOWS"; Key: ""; Value: "") "file.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\PARAMETERS"; Key: ""; Value: "") "file.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: ""; Value: "") "file.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: ""; Value: "") "file.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS"; Key: ""; Value: "") "file.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS\TCPIP"; Key: ""; Value: "") "file.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS"; Key: ""; Value: "") "file.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "file.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TERMINAL SERVER"; Key: ""; Value: "") "file.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "")34:T9c8,"file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "HOSTNAME"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SQMCLIENT\WINDOWS"; Key: "CEIPENABLE"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\PARAMETERS"; Key: "TRANSPORTS"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS\TCPIP"; Key: "WINSOCK 2.0 PROVIDER ID"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "MINSOCKADDRLENGTH"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "MAXSOCKADDRLENGTH"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "USEDELAYEDACCEPTANCE"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "HELPERDLLNAME"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS"; Key: "DISABLEUSERMODECALLBACKFILTER"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "CWDILLEGALINDLLSEARCH"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TERMINAL SERVER"; Key: "TSAPPCOMPAT"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TERMINAL SERVER"; Key: "TSUSERENABLED"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "COMPATDLL"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "00060101.00060101"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "")35:T5b4,"file.exe" trying to touch file "C:\Windows\SYSTEM32\sechost.dll" "file.exe" trying to touch file "C:\dwmapi.dll" "file.exe" trying to touch file "C:\Windows\system32\dwmapi.dll" "file.exe" trying to touch file "C:\IPHLPAPI.DLL" "file.exe" trying to touch file "C:\Windows\system32\IPHLPAPI.DLL" "file.exe" trying to touch file "C:\WINNSI.DLL" "file.exe" trying to touch file "C:\Windows\system32\WINNSI.DLL" "file.exe" trying to touch file "C:\NETAPI32.dll" "file.exe" trying to touch file "C:\Windows\system32\NETAPI32.dll" "file.exe" trying to touch file "C:\netutils.dll" "file.exe" trying to touch file "C:\Windows\system32\netutils.dll" "file.exe" trying to touch file "C:\srvcli.dll" "file.exe" trying to touch file "C:\Windows\system32\srvcli.dll" "file.exe" trying to touch file "C:\wkscli.dll" "file.exe" trying to touch file "C:\Windows\system32\wkscli.dll" "file.exe" trying to touch file "C:\UxTheme.dll" "file.exe" trying to touch file "C:\Windows\system32\UxTheme.dll" "file.exe" trying to touch file "C:\VERSION.dll" "file.exe" trying to touch file "C:\Windows\system32\VERSION.dll" "file.exe" trying to touch file "C:\WINMM.dll" "file.exe" trying to touch file "C:\Windows\system32\WINMM.dll" "file.exe" trying to touch file "C:\WTSAPI32.dll" "file.exe" trying to touch file "C:\Windows\system32\WTSAPI32.dll" "file.exe" trying to touch file "C:\Windows\Temp\VxSSL64.dll" "file.exe" trying to touch file "C:\FLTLIB.DLL"36:T58f,"file.exe" trying to access non-existent file "C:\dwmapi.dll" "file.exe" trying to access non-existent file "C:\IPHLPAPI.DLL" "file.exe" trying to access non-existent file "C:\WINNSI.DLL" "file.exe" trying to access non-existent file "C:\NETAPI32.dll" "file.exe" trying to access non-existent file "C:\netutils.dll" "file.exe" trying to access non-existent file "C:\srvcli.dll" "file.exe" trying to access non-existent file "C:\wkscli.dll" "file.exe" trying to access non-existent file "C:\UxTheme.dll" "file.exe" trying to access non-existent file "C:\VERSION.dll" "file.exe" trying to access non-existent file "C:\WINMM.dll" "file.exe" trying to access non-existent file "C:\WTSAPI32.dll" "file.exe" trying to access non-existent file "C:\FLTLIB.DLL" "file.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-fibers-l1-1-1.DLL" "file.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-localization-l1-2-1.DLL" "file.exe" trying to access non-existent file "C:\DNSAPI.dll" "file.exe" trying to access non-existent file "C:\webio.dll" "file.exe" trying to access non-existent file "C:\SspiCli.dll" "file.exe" trying to access non-existent file "C:\cryptsp.dll" "file.exe" trying to access non-existent file "C:\credssp.dll" "file.exe" trying to access non-existent file "C:\CRYPTBASE.dll" "file.exe" trying to access non-existent file "C:\rasadhlp.dll"37:T4d5,Potential IP "64.188.27.73" found in string "http://64.188.27.73/adm_bord/login_new_check.php" "2.5.4.3" "2.5.4.4" "2.5.4.5" "2.5.4.6" "2.5.4.7" "2.5.4.8" "2.5.4.9" "2.5.4.10" "2.5.4.11" "2.5.4.12" "2.5.4.13" "2.5.4.14" "2.5.4.15" "2.5.4.16" "2.5.4.17" "2.5.4.18" "2.5.4.19" "2.5.4.20" "2.5.4.21" "2.5.4.22" "2.5.4.23" "2.5.4.24" "2.5.4.25" "2.5.4.26" "2.5.4.27" "2.5.4.28" "2.5.4.29" "2.5.4.30" "2.5.4.31" "2.5.4.32" "2.5.4.33" "2.5.4.34" "2.5.4.35" "2.5.4.36" "2.5.4.37" "2.5.4.38" "2.5.4.39" "2.5.4.40" "2.5.4.42" "2.5.4.43" "2.5.29.19" "2.5.29.10" "2.5.29.21" "2.5.29.37" "2.5.29.7" "2.5.29.8" "2.5.29.17" "2.5.29.18" "2.5.29.1" "2.5.29.35" "2.5.29.14" "2.5.29.15" "2.5.29.2" "2.5.29.4" "2.5.29.31" "2.5.29.46" "2.5.29.32" "2.5.29.20" "2.5.29.27" "2.5.29.28" "2.5.29.30" "2.5.29.33" "2.5.29.36" "2.5.29.5" "2.5.29.54" "2.5.29.3" Potential IP "172.16.3.81" found in string "http://172.16.3.81/proxy.php" "64.188.27.73" Potential IP "64.188.27.73" found in string "://64.188.27.73" "172.16.3.81" Potential IP "64.188.27.73" found in string "http-connection:http://64.188.27.73:80" Potential IP "172.16.3.81" found in string "http-connection:http://172.16.3.81:80"38:T65f,Heuristic match: "dsrc\hb-ot-layout.cc" Heuristic match: "src\hb-common.cc" Heuristic match: "src\hb-buffer.cc" Heuristic match: "src\hb-shape-plan.cc" Heuristic match: "src\hb-ot-shape-complex-indic.cc" Heuristic match: "src\hb-ot-shape-complex-arabic.cc" Pattern match: "http://www.w3.org/xml/1998/namespace" Heuristic match: "a..\3rdparty\double-conversion\double-conversion.cc" Heuristic match: "..\3rdparty\double-conversion\bignum-dtoa.cc" Heuristic match: "..\3rdparty\double-conversion\bignum.cc" Heuristic match: "..\3rdparty\double-conversion\strtod.cc" Heuristic match: "..\3rdparty\double-conversion\fixed-dtoa.cc" Heuristic match: "..\3rdparty\double-conversion\fast-dtoa.cc" Heuristic match: "..\3rdparty\double-conversion\cached-powers.cc" Pattern match: "yyyyd.m.yydd/mm/yyyyd" Pattern match: "yyyy.yy/mm/dddddd" Heuristic match: "ttesa.ki" Pattern match: "qt-project.org/styles/commonstyle/images/cleartext-32.png" Pattern match: "qt-project.org/styles/commonstyle/images/" Pattern match: "qt-project.org/styles/commonstyle/images/cleartext-16.png" Pattern match: "qt.io/licensing" Heuristic match: "qt.io" Pattern match: "qt-project.org/windows/cursors/images/" Pattern match: "qt-project.org/windows/openglblacklists/default.json" Heuristic match: "gendoraduragonkgp126.com" Pattern match: "http://64.188.27.73/adm_bord/login_new_check.php" Pattern match: "http://gendoraduragonkgp126.com/board/index.php" Pattern match: "http://172.16.3.81/proxy.php" Pattern match: "http://gendoraduragonkgp126.com:80" Pattern match: "http://64.188.27.73:80" Pattern match: "http://172.16.3.81:80"39:T1074,Found URL "http://64.188.27.73/adm_bord/login_new_check.php" - Source: "00000000-00002764.00000000.157268.01800000.00000004.mdmp") Found URL "http://64.188.27.73/adm_bord/login_new_check.php" - Source: "00000000-00002764.00000000.157268.019A0000.00000004.mdmp") Found URL "http://gendoraduragonkgp126.com/board/index.phpwssolrosolhttp://172.16.3.81/proxy.php/adm_bord/login_new_check.php" - Source: "00000000-00002764.00000000.157268.019A0000.00000004.mdmp") Found URL "http://64.188.27.73/adm_bord/login_new_check.php" - Source: "00000000-00002764.00000001.159193.01800000.00000004.mdmp") Found URL "http://64.188.27.73/adm_bord/login_new_check.php" - Source: "00000000-00002764.00000001.159193.019A0000.00000004.mdmp") Found URL "http://gendoraduragonkgp126.com/board/index.phpwssolrosolhttp://172.16.3.81/proxy.phphttp://172.16.3.81/proxy.phpgendoraduragonkgp126.cominvalid" - Source: "00000000-00002764.00000001.159193.019A0000.00000004.mdmp") Found URL "http://gendoraduragonkgp126.com:80<:j+=&o+==r+=:i+csisolatw=7n+=8c+=7l+=4c+=:@+org.qt-project.qt.qbearerenginefactoryinterface=;n+qnetworkconfiguration<.o+=4[+<8@+=7m+=:c+=6n+=7b+=7c+=:c+==n+<=i+mozilla/5.0" - Source: "00000000-00002764.00000001.159193.019A0000.00000004.mdmp") Found URL "http://64.188.27.73/adm_bord/login_new_check.php" - Source: "00000000-00002764.00000001.159193.019B0000.00000004.mdmp") Found URL "http://gendoraduragonkgp126.com/board/index.phpapplication/x-www-form-urlencodedugu1lthost" - Source: "00000000-00002764.00000001.159193.019B0000.00000004.mdmp") Found URL "http://64.188.27.73:80://6application/x-www-form-urlencodedqsharedpointer77b6433ba960d7e9c1eac7ca6cc8f59d284054be908f27b2c2dc1c977c46a24bqbytearrayds$vicator*qbytearrayqhostinfoqhostinfohttp-connection:http://172.16.3.81:80://1application/x-www-form-urlencoded76d10832ac9fdfd90d732869a3ffebd7230180376bfde4c7fc93c51e5b6bf55156k*_q_networksessionenticator*qabstractsocket::socketerror_q_networksessionliciesnerrorcator*licies_q_networksessionenticator*sionerroricator*nerrorsionerrorearray>cator*cator*icator*cator*nerrorsionerrornerrorcator*sionerrorsionerrornerrorcator*cator*nerrorsionerrorcator*cator*nerrorsionerrorsionerrornerrorcator*cator*5wk*d63e=/l+0ff1=&e+<8e+55e+by" - Source: "00000000-00002764.00000001.159193.019B0000.00000004.mdmp") Found URL "http://64.188.27.73/adm_bord/login_new_check.php" - Source: "00000000-00002764.00000002.161113.01800000.00000004.mdmp") Found URL "http://64.188.27.73/adm_bord/login_new_check.php" - Source: "00000000-00002764.00000002.161113.019A0000.00000004.mdmp") Found URL "http://gendoraduragonkgp126.com/board/index.phpwssolrosolhttp://172.16.3.81/proxy.phphttp://172.16.3.81/proxy.phpgendoraduragonkgp126.com/adm_bord/login_new_check.php" - Source: "00000000-00002764.00000002.161113.019A0000.00000004.mdmp") Found URL "http://gendoraduragonkgp126.com:80<:j+=&o+==r+=:i+csisolatw=7n+=8c+=7l+=4c+=:@+org.qt-project.qt.qbearerenginefactoryinterface=;n+qnetworkconfiguration<.o+=4[+<8@+=7m+=:c+=6n+=7b+=7c+=:c+==n+<=i+mozilla/5.0" - Source: "00000000-00002764.00000002.161113.019A0000.00000004.mdmp") Found URL "http://64.188.27.73/adm_bord/login_new_check.php" - Source: "00000000-00002764.00000002.161113.019B0000.00000004.mdmp") Found URL "http://gendoraduragonkgp126.com/board/index.phpapplication/x-www-form-urlencodedugu1lthost" - Source: "00000000-00002764.00000002.161113.019B0000.00000004.mdmp") Found URL "http://64.188.27.73:80://6application/x-www-form-urlencodedqsharedpointer77b6433ba960d7e9c1eac7ca6cc8f59d284054be908f27b2c2dc1c977c46a24bqbytearrayds$vicator*qbytearrayqhostinfoqhostinfohttp-connection:http://172.16.3.81:80://1application/x-www-form-urlencoded76d10832ac9fdfd90d732869a3ffebd7230180376bfde4c7fc93c51e5b6bf55156k*_q_networksessionenticator*qabstractsocket::socketerror_q_networksessionliciesnerrorcator*licies_q_networksessionenticator*sionerroricator*nerrorsionerrorearray>cator*cator*icator*cator*nerrorsionerrornerrorcator*sionerrorsionerrornerrorcator*cator*nerrorsionerrorcator*cator*nerrorsionerrorsionerrornerrorcator*cator*5wk*d63e=/l+0ff1=&e+<8e+55e+by" - Source: "00000000-00002764.00000002.161113.019B0000.00000004.mdmp")3a:T4e0,Found reference to API "CreateDCW" (Indicator: "CreateDC"; File: "file") Found reference to API "BitBlt" (Indicator: "BitBlt"; File: "file") Found reference to API "GetDIBits" (Indicator: "GetDIBits"; File: "file") Found reference to API "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; File: "file") Found reference to API "CreateCompatibleBitmap" (Indicator: "CreateCompatibleBitmap"; File: "file") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; File: "file") Found reference to API "GetDC" (Indicator: "GetDC"; File: "file") Found reference to API "BitBlt" (Indicator: "BitBlt"; Source: "00000000-00002764.00000001.159193.01663000.00000004.mdmp") Found reference to API "CreateCompatibleBitmap" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00002764.00000001.159193.01663000.00000004.mdmp") Found reference to API "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; Source: "00000000-00002764.00000001.159193.01663000.00000004.mdmp") Found reference to API "CreateDCW" (Indicator: "CreateDC"; Source: "00000000-00002764.00000001.159193.01663000.00000004.mdmp") Found reference to API "GetDIBits" (Indicator: "GetDIBits"; Source: "00000000-00002764.00000001.159193.01663000.00000004.mdmp")3b:T550,Found reference to API "RegQueryValueExW" (Indicator: "RegQueryValue"; File: "file") Found reference to API "RegOpenKeyExW" (Indicator: "RegOpenKey"; File: "file") Found reference to API "RegQueryInfoKeyW" (Indicator: "RegQueryInfoKey"; File: "file") Found reference to API "RegEnumKeyExW" (Indicator: "RegEnumKey"; File: "file") Found reference to API "RegEnumValueW" (Indicator: "RegEnumValue"; File: "file") Found reference to API "RegNotifyChangeKeyValue" (Indicator: "RegNotifyChangeKeyValue"; File: "file") Found reference to API "RegEnumKeyExW" (Indicator: "RegEnumKey"; Source: "00000000-00002764.00000001.159193.01663000.00000004.mdmp") Found reference to API "RegEnumValueW" (Indicator: "RegEnumValue"; Source: "00000000-00002764.00000001.159193.01663000.00000004.mdmp") Found reference to API "RegNotifyChangeKeyValue" (Indicator: "RegNotifyChangeKeyValue"; Source: "00000000-00002764.00000001.159193.01663000.00000004.mdmp") Found reference to API "RegOpenKeyExW" (Indicator: "RegOpenKey"; Source: "00000000-00002764.00000001.159193.01663000.00000004.mdmp") Found reference to API "RegQueryInfoKeyW" (Indicator: "RegQueryInfoKey"; Source: "00000000-00002764.00000001.159193.01663000.00000004.mdmp") Found reference to API "RegQueryValueExW" (Indicator: "RegQueryValue"; Source: "00000000-00002764.00000001.159193.01663000.00000004.mdmp")3c:T417,Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; File: "file") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; File: "file") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; File: "file") Found reference to API "GetFileInformationByHandle" (Indicator: "GetFileInformationByHandle"; File: "file") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; File: "file") Found reference to API "GetFileInformationByHandleEx" (Indicator: "GetFileInformationByHandle"; File: "file") Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; File: "file") Found reference to API "GetFileAttributesExW" (Indicator: "GetFileAttributes"; File: "file") Found reference to API "GetFileVersionInfoW" (Indicator: "GetFileVersionInfo"; File: "file") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfo"; File: "file") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfoSize"; File: "file")3d:T4f5,Observed string: "cmd.exe /c schtasks /create /tn "OneDrive AutoRemove" /tr "%WINDIR%\System32\cmd.exe /c del /f /q C:/file.exe" /sc daily /st 10" (Indicator: "cmd.exe /c del") in Source: 00000000-00002764-00000C44-3173099506793 Observed string: "cmd.exe /c schtasks /create /tn "OneDrive AutoRemove" /tr "%WINDIR%\System32\cmd.exe /c del /f /q C:/file.exe" /sc daily /st 10" (Indicator: "/c del ") in Source: 00000000-00002764-00000C44-3173099506793 Observed string: "/c schtasks /create /tn "OneDrive AutoRemove" /tr "%WINDIR%\System32\cmd.exe /c del /f /q C:/file.exe" /sc daily /st 10:30:30 /ru SYSTEM" (Indicator: "cmd.exe /c del") in Source: cmd.exe Observed string: "/c schtasks /create /tn "OneDrive AutoRemove" /tr "%WINDIR%\System32\cmd.exe /c del /f /q C:/file.exe" /sc daily /st 10:30:30 /ru SYSTEM" (Indicator: "/c del ") in Source: cmd.exe Observed string: "schtasks /create /tn "OneDrive AutoRemove" /tr "%WINDIR%\System32\cmd.exe /c del /f /q C:/file.exe" /sc daily /st 10:30:30 /ru SYSTEM" (Indicator: "cmd.exe /c del") in Source: schtasks.exe Observed string: "schtasks /create /tn "OneDrive AutoRemove" /tr "%WINDIR%\System32\cmd.exe /c del /f /q C:/file.exe" /sc daily /st 10:30:30 /ru SYSTEM" (Indicator: "/c del ") in Source: schtasks.exe3e:T7e0,Found reference to API "CopySid" (Indicator: "CopySid"; File: "file") Found reference to API "AccessCheck" (Indicator: "AccessCheck"; File: "file") Found reference to API "DuplicateToken" (Indicator: "DuplicateToken"; File: "file") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "file") Found reference to API "GetLengthSid" (Indicator: "GetLengthSid"; File: "file") Found reference to API "MapGenericMask" (Indicator: "MapGenericMask"; File: "file") Found reference to API "FreeSid" (Indicator: "FreeSid"; File: "file") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; File: "file") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; File: "file") Found reference to API "AccessCheck" (Indicator: "AccessCheck"; Source: "00000000-00002764.00000001.159193.01663000.00000004.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00002764.00000001.159193.01663000.00000004.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; Source: "00000000-00002764.00000001.159193.01663000.00000004.mdmp") Found reference to API "CopySid" (Indicator: "CopySid"; Source: "00000000-00002764.00000001.159193.01663000.00000004.mdmp") Found reference to API "DuplicateToken" (Indicator: "DuplicateToken"; Source: "00000000-00002764.00000001.159193.01663000.00000004.mdmp") Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "00000000-00002764.00000001.159193.01663000.00000004.mdmp") Found reference to API "GetLengthSid" (Indicator: "GetLengthSid"; Source: "00000000-00002764.00000001.159193.01663000.00000004.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00002764.00000001.159193.01663000.00000004.mdmp") Found reference to API "MapGenericMask" (Indicator: "MapGenericMask"; Source: "00000000-00002764.00000001.159193.01663000.00000004.mdmp")3f:T4ef,Observed import api "AccessCheck" which can "Determines whether a security descriptor grants a specified set of access rights to the client identified by an access token" [Source: file] Observed import api "AllocateAndInitializeSid" which can "Allocates and initializes a security identifier (SID) with up to eight subauthorities" [Source: file] Observed import api "CopySid" which can "Copies a security identifier (SID) to a buffer" [Source: file] Observed import api "DuplicateToken" which can "Creates a new access token that duplicates one already in existence" [Source: file] Observed import api "FreeSid" which can "Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: file] Observed import api "GetLengthSid" which can "Returns the length in bytes of a valid security identifier (SID)" [Source: file] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: file] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: file] Observed import api "MapGenericMask" which can "Maps the generic access rights in an access mask to specific and standard access rights" [Source: file]40:Tbb1,"file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "HOSTNAME"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\PARAMETERS"; Key: "TRANSPORTS"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS\TCPIP"; Key: "WINSOCK 2.0 PROVIDER ID"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "MINSOCKADDRLENGTH"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "MAXSOCKADDRLENGTH"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "USEDELAYEDACCEPTANCE"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "HELPERDLLNAME"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CRYPT32"; Key: "DEBUGHEAPFLAGS"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LANMANWORKSTATION\PARAMETERS"; Key: "RPCCACHETIMEOUT"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E390372A-3FAB-417F-940E-F2CD5C8F68CB}"; Key: "ENABLEDHCP"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E390372A-3FAB-417F-940E-F2CD5C8F68CB}"; Key: "REGISTRATIONENABLED"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E390372A-3FAB-417F-940E-F2CD5C8F68CB}"; Key: "REGISTERADAPTERNAME"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E390372A-3FAB-417F-940E-F2CD5C8F68CB}"; Key: "DOMAIN"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E390372A-3FAB-417F-940E-F2CD5C8F68CB}"; Key: "DHCPDOMAIN"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\INTERFACES\{E390372A-3FAB-417F-940E-F2CD5C8F68CB}"; Key: "DHCPV6DOMAIN"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{846EE342-7039-11DE-9D20-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{846EE342-7039-11DE-9D20-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "")41:T41a,Found api reference "CertFreeCertificateContext" (Indicator: "CertFreeCertificateContext"; File: "file") Found api reference "CertFreeCertificateChain" (Indicator: "CertFreeCertificateChain"; File: "file") Found api reference "CertCreateCertificateContext" (Indicator: "CertCreateCertificateContext"; File: "file") Found api reference "CertGetCertificateChain" (Indicator: "CertGetCertificateChain"; File: "file") Found api reference "CertCreateCertificateContext" (Indicator: "CertCreateCertificateContext"; Source: "00000000-00002764.00000001.159193.01663000.00000004.mdmp") Found api reference "CertFreeCertificateChain" (Indicator: "CertFreeCertificateChain"; Source: "00000000-00002764.00000001.159193.01663000.00000004.mdmp") Found api reference "CertFreeCertificateContext" (Indicator: "CertFreeCertificateContext"; Source: "00000000-00002764.00000001.159193.01663000.00000004.mdmp") Found api reference "CertGetCertificateChain" (Indicator: "CertGetCertificateChain"; Source: "00000000-00002764.00000001.159193.01663000.00000004.mdmp")42:T450,RegCreateKeyExW RegCloseKey RegDeleteKeyW OpenProcessToken RegOpenKeyExW RegEnumKeyExW RegDeleteValueW GetDriveTypeW GetFileAttributesW OpenFileMappingW UnhandledExceptionFilter GetLogicalDrives GetThreadContext CheckRemoteDebuggerPresent GetTempPathW ConnectNamedPipe OutputDebugStringW OutputDebugStringA DeviceIoControl CopyFileW GetModuleFileNameW IsDebuggerPresent CreateThread GetSystemDirectoryW TerminateProcess GetModuleHandleExW SleepEx LoadLibraryW GetTickCount VirtualProtect LoadLibraryA GetStartupInfoA GetFileSize OpenProcess GetStartupInfoW CreateDirectoryW DeleteFileW GetProcAddress GetSystemInfo CreateFileMappingW FindNextFileW FindFirstFileW FindFirstFileExW CreateFileW CreateFileA GetNativeSystemInfo GetCommandLineW GetTickCount64 MapViewOfFile WriteFileEx GetModuleHandleW GetFileAttributesExW WriteFile CreateProcessW Sleep VirtualAlloc NetShareEnum ShellExecuteW GetCursorPos GetUpdateRect SetWindowsHookExW FindWindowA GetWindowThreadProcessId WSAStartup WSASocketW WSASend listen closesocket bind WSASendTo43:T574,Spawned process "file.exe" (UID: 00000000-00002764) Spawned process "cmd.exe" with commandline "/c bcdedit" (UID: 00000000-00002628) Spawned process "bcdedit.exe" (UID: 00000000-00004004) Spawned process "cmd.exe" with commandline "/c schtasks /create /tn "OneDrive AutoRemove" /tr "%WINDIR%\\System32\\cmd.exe /c del /f /q C:/file.exe" /sc daily /st 10:30:30 /ru SYSTEM" (UID: 00000000-00004324) Spawned process "schtasks.exe" with commandline "schtasks /create /tn "OneDrive AutoRemove" /tr "%WINDIR%\\System32\\cmd.exe /c del /f /q C:/file.exe" /sc daily /st 10:30:30 /ru SYSTEM" (UID: 00000000-00004452) Spawned process "cmd.exe" with commandline "/c schtasks /delete /f /tn "Microsoft\\Windows\\light Service Manager"" (UID: 00000000-00003788) Spawned process "schtasks.exe" with commandline "schtasks /delete /f /tn "Microsoft\\Windows\\light Service Manager"" (UID: 00000000-00003496) Spawned process "cmd.exe" with commandline "/c bcdedit" (UID: 00000000-00003948) Spawned process "bcdedit.exe" (UID: 00000000-00004384) Spawned process "cmd.exe" with commandline "/c schtasks /create /tn "Microsoft\\Windows\\light Service Manager" /tr C:/file.exe /sc onstart /ru SYSTEM" (UID: 00000000-00004484) Spawned process "schtasks.exe" with commandline "schtasks /create /tn "Microsoft\\Windows\\light Service Manager" /tr C:/file.exe /sc onstart /ru SYSTEM" (UID: 00000000-00004948)44:T4e7,"file.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "W@�c�0") "file.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "F0B49687E830DB0100000000000000000000000002000000") "file.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "9A4442ABE830DB0100000000000000000000000002000000") "file.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "5DA1C0ABE830DB0100000000000000000000000002000000") "file.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "FCEA83CFE830DB0100000000000000000000000002000000")45:T468,"cmd.exe" wrote 32 bytes to a remote process "C:\Windows\System32\bcdedit.exe" (Handle: 128) "cmd.exe" wrote 52 bytes to a remote process "C:\Windows\System32\bcdedit.exe" (Handle: 128) "cmd.exe" wrote 8 bytes to a remote process "C:\Windows\System32\bcdedit.exe" (Handle: 128) "cmd.exe" wrote 32 bytes to a remote process "C:\Windows\System32\schtasks.exe" (Handle: 140) "cmd.exe" wrote 52 bytes to a remote process "C:\Windows\System32\schtasks.exe" (Handle: 140) "cmd.exe" wrote 8 bytes to a remote process "C:\Windows\System32\schtasks.exe" (Handle: 140) "cmd.exe" wrote 32 bytes to a remote process "C:\Windows\System32\schtasks.exe" (Handle: 144) "cmd.exe" wrote 52 bytes to a remote process "C:\Windows\System32\schtasks.exe" (Handle: 144) "cmd.exe" wrote 8 bytes to a remote process "C:\Windows\System32\schtasks.exe" (Handle: 144) "cmd.exe" wrote 32 bytes to a remote process "C:\Windows\System32\bcdedit.exe" (Handle: 140) "cmd.exe" wrote 52 bytes to a remote process "C:\Windows\System32\bcdedit.exe" (Handle: 140) "cmd.exe" wrote 8 bytes to a remote process "C:\Windows\System32\bcdedit.exe" (Handle: 140)46:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==47:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"f6827dc5af661fbb4bf64bc625c78283ef836c6985bb2bfb836bd0c8d5397332","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1791242794190,"unified_at":"2026-10-05T23:26:34.190Z","metadata":{"hashes":{"sha256":"f6827dc5af661fbb4bf64bc625c78283ef836c6985bb2bfb836bd0c8d5397332","sha1":"a3555a77826df6c8b2886cc0f40e7d7a2bd99610","md5":"b4c9b903dfd18bd67a3824b0109f955b","sha512":"73ec5620b9c607c96e883d95ac6ea4033444cb74def871d16875bb90cdf6560e592c1dcb9d6e9b406cd7d238464f46f61ca5f95bf07b0367ee826971ff151aed","ssdeep":"196608:99rTfn5Mp6Z9j2ujTh4e9q77AJsv6tWKFdu9CqK:9F+p6Z3Ph4e9qoJsv6tWKFdu9C","ssdeep_chunks":["196608:99rTfn5","196608:9rTfn5M","196608:rTfn5Mp","196608:Tfn5Mp6","196608:fn5Mp6Z","196608:n5Mp6Z9","196608:5Mp6Z9j","196608:Mp6Z9j2","196608:p6Z9j2u","196608:6Z9j2uj","196608:Z9j2ujT","196608:9j2ujTh","196608:j2ujTh4","196608:2ujTh4e","196608:ujTh4e9","196608:jTh4e9q","196608:Th4e9q7","196608:h4e9q77","196608:4e9q77A","196608:e9q77AJ","196608:9q77AJs","196608:q77AJsv","196608:77AJsv6","196608:7AJsv6t","196608:AJsv6tW","196608:Jsv6tWK","196608:sv6tWKF","196608:v6tWKFd","196608:6tWKFdu","196608:tWKFdu9","196608:WKFdu9C","196608:KFdu9Cq","196608:Fdu9CqK","393216:99rTfn5","393216:9rTfn5M","393216:rTfn5Mp","393216:Tfn5Mp6","393216:fn5Mp6Z","393216:n5Mp6Z9","393216:5Mp6Z9j","393216:Mp6Z9j2","393216:p6Z9j2u","393216:6Z9j2uj","393216:Z9j2ujT","393216:9j2ujTh","393216:j2ujTh4","393216:2ujTh4e","393216:ujTh4e9","393216:jTh4e9q","393216:Th4e9q7","393216:h4e9q77","393216:4e9q77A","393216:e9q77AJ","393216:9q77AJs","393216:q77AJsv","393216:77AJsv6","393216:7AJsv6t","393216:AJsv6tW","393216:Jsv6tWK","393216:sv6tWKF","393216:v6tWKFd","393216:6tWKFdu","393216:tWKFdu9","393216:WKFdu9C","393216:KFdu9Cq","393216:Fdu9CqK","196608:9F+p6Z3","196608:F+p6Z3P","196608:+p6Z3Ph","196608:p6Z3Ph4","196608:6Z3Ph4e","196608:Z3Ph4e9","196608:3Ph4e9q","196608:Ph4e9qo","196608:h4e9qoJ","196608:4e9qoJs","196608:e9qoJsv","196608:9qoJsv6","196608:qoJsv6t","196608:oJsv6tW"],"imphash":"207a191ca5a5ececab300a9baa69d115"},"file_info":{"file_name":"tmpzkizu8h_","file_type":["peexe","64bits","executable"],"file_type_id":"64-bit exe","file_size":19347968,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1662568373000,"last_seen":1749482667000,"last_multi_scan":1749482667000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["criminal","downloader","elarzero","gop","guardianofpeace","loader","operationtroy","scripttrawler","silentchollima","suspicious","targeted","targetedcrimeware","tigerloader","whoisteam","jigsaw","keylogger","ransomware"]},"stats":{"av":{"malicious_count":15,"suspicious_count":0,"total_engines":26},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":76},"sandbox_signatures":{"informative_count":168,"suspicious_count":17,"malicious_count":12,"total":197},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Backdoor/Win.Agent","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Lazarus","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/Dldr.Agent.cgnms","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Trojan.MagicRAT.A","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cylance":{"name":"Cylance","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan.MagicRAT.A (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win64/Andariel.K trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan-Downloader ( 00595f051 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"Trojan.uf","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win64.Drop.jqjysq","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"malicious","threat_name":"Backdoor/W32.MagicRAT.19347968","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W64/ABRisk.OYIK-7825","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win64.Genus.BUF","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"TrojanDownloader.Win64.Agent","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Downloader.Agent.Win64.3379","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.MagicRAT","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Connects to LPC ports"},{"type":"informative","value":"Contains ability to create/connect to a named pipe (API string)"},{"type":"informative","value":"Found named pipe like strings"}],"sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Creates new processes"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"}],"sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"6323325635d3af22000ae4bc"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to executes commands or batch file"},{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"},{"type":"informative","value":"Runs shell commands"}],"sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"6323325635d3af22000ae4bc"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"tactic":"Execution","technique":"Scheduled Task","attack_id":"T1053.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1053/005","identifiers":[{"type":"malicious","value":"Schedules a task to be executed at a specific time and date"}],"sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"6323325635d3af22000ae4bc"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"}],"sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"tactic":"Execution","technique":"Component Object Model","attack_id":"T1559.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1559/001","identifiers":[{"type":"malicious","value":"Loads the task scheduler COM API"}],"sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"6323325635d3af22000ae4bc"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"tactic":"Persistence","technique":"Device Registration","attack_id":"T1098.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1098/005","identifiers":[{"type":"informative","value":"Contains ability to register device notification handler (API string)"}],"sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"tactic":"Persistence","technique":"Account Manipulation","attack_id":"T1098","attack_id_wiki":"https://attack.mitre.org/techniques/T1098","identifiers":[{"type":"informative","value":"Contains ability to modify the user configuration/privilege (API string)"}],"sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Contains ability to create/control drivers (API string)"},{"type":"informative","value":"Creates or modifies windows services"}],"sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"tactic":"Persistence","technique":"Bootkit","attack_id":"T1542.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1542/003","identifiers":[{"type":"malicious","value":"Interacts with the primary disk partition (DR0)"}],"sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"6323325635d3af22000ae4bc"}]},{"tactic":"Persistence","technique":"DLL Side-Loading","attack_id":"T1574.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/002","identifiers":[{"type":"informative","value":"Fails to load modules at runtime"}],"sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"},{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"},{"type":"informative","value":"Imports system security related APIs"}],"sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"6323325635d3af22000ae4bc"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"suspicious","value":"Writes data to a remote process"},{"type":"informative","value":"Contains ability to inject code into another process (API string)"},{"type":"malicious","value":"Allocates virtual memory in a remote process"}],"sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"6323325635d3af22000ae4bc"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"tactic":"Privilege Escalation","technique":"Thread Local Storage","attack_id":"T1055.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/005","identifiers":[{"type":"suspicious","value":"Found TLS callbacks"}],"sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"suspicious","value":"Writes registry keys"},{"type":"informative","value":"Creates or modifies windows services"},{"type":"informative","value":"Contains ability to create/load registry keys (API string)"},{"type":"informative","value":"Contains ability to modify registry key/value (API string)"},{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Contains ability to delete registry key/value (API string)"}],"sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"6323325635d3af22000ae4bc"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"PE file contains zero-size sections"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"informative","value":"Contains ability to perform AES/RC4 encryption (API string)"},{"type":"informative","value":"Found XOR operators (encryption/decryption)"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"YARA signature match - AES encryption"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"}],"sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"},{"type":"informative","value":"Contains ability to set file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"},{"type":"informative","value":"Contains ability to check debugger is running (API string)"}],"sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Contains ability to delete files"},{"type":"informative","value":"Contains ability to delete files/directories (API string)"},{"type":"suspicious","value":"Marks file for deletion"},{"type":"suspicious","value":"Opens file with deletion access rights"},{"type":"suspicious","value":"Delete file or directory"}],"sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"6323325635d3af22000ae4bc"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Renames files"}],"sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"malicious","value":"Tries to delete scheduled tasks"},{"type":"suspicious","value":"Able to delete scheduled task(s)"},{"type":"malicious","value":"Tries to disable/delete scheduled tasks"}],"sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"6323325635d3af22000ae4bc"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"tactic":"Defense Evasion","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"informative","value":".rdata section contains high entropy"},{"type":"suspicious","value":"section contains high entropy"}],"sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"suspicious","value":"PE file contains unusual section name"}],"sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"6323325635d3af22000ae4bc"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Contains ability to detect sandbox (imports API)"}],"sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"tactic":"Defense Evasion","technique":"Direct Volume Access","attack_id":"T1006","attack_id_wiki":"https://attack.mitre.org/techniques/T1006","identifiers":[{"type":"informative","value":"Contains ability to enumerate volumes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"}],"sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to show a graphical window (API string)"}],"sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"tactic":"Defense Evasion","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Found virtual disk drive like strings"}],"sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"tactic":"Defense Evasion","technique":"Double File Extension","attack_id":"T1036.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1036/007","sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"}]},{"tactic":"Defense Evasion","technique":"Masquerade Task or Service","attack_id":"T1036.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1036/004","sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"tactic":"Defense Evasion","technique":"Dynamic API Resolution","attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","identifiers":[{"type":"informative","value":"Contains ability to dynamically determine API calls"}],"sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"informative","value":"Contains ability to retrieve information about pressed keystrokes (API string)"},{"type":"informative","value":"Contains ability to hook/unhook windows functions (API string)"}],"sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Contains ability to query network adapter information (API string)"},{"type":"informative","value":"Contains ability to free the memory used by network management functions (API string)"},{"type":"informative","value":"Contains ability to retrieve network parameters of a computer (API string)"},{"type":"informative","value":"Contains ability to retrieve the local name for a socket (API string)"}],"sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Contains ability to retrieve the host name of a computer (API string)"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Contains ability to find logical drives of the machine (API string)"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Contains ability to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Contains ability to determine disk drive type (API string)"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Contains ability to retrieve volume information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"suspicious","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Calls an API typically used to get system version information"}],"sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"6323325635d3af22000ae4bc"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Calls an API's typically used for searching a directory for a files"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"References Windows filepaths for DLLs (possible dropped files)"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Contains ability to read files (API string)"}],"sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"6323325635d3af22000ae4bc"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Contains ability to query system locale (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve local language"}],"sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to find open windows (API string)"},{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"}],"sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"tactic":"Discovery","technique":"Remote System Discovery","attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","identifiers":[{"type":"informative","value":"Contains ability to retrieve remote session information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Queries TCP/IP interface details"},{"type":"suspicious","value":"Reads the active computer name"},{"type":"suspicious","value":"Reads information about supported languages"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Contains ability to query registry keys (API string)"},{"type":"informative","value":"Queries registry keys"}],"sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"6323325635d3af22000ae4bc"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"tactic":"Discovery","technique":"Account Discovery","attack_id":"T1087","attack_id_wiki":"https://attack.mitre.org/techniques/T1087","sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Process launched with changed environment"},{"type":"malicious","value":"Spawns a lot of processes"},{"type":"informative","value":"Contains ability to retrieve/open a process (API string)"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Contains ability to retrieve process ID (API string)"},{"type":"informative","value":"Queries basic information of the specified process"}],"sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Contains ability to retrieve system language (API string)"},{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine time (API string)"},{"type":"informative","value":"Contains ability to retrieve machine timezone (API string)"}],"sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Contains ability to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve account information for specified SID"},{"type":"informative","value":"Calls an API typically used to retrieve user name"}],"sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"tactic":"Discovery","technique":"Network Share Discovery","attack_id":"T1135","attack_id_wiki":"https://attack.mitre.org/techniques/T1135","identifiers":[{"type":"informative","value":"Contains ability to query information about shared network resources (API string)"}],"sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Calls an API typically used to create an instance of a named pipe"},{"type":"informative","value":"Contains ability to move file or directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"tactic":"Lateral Movement","technique":"Remote Desktop Protocol","attack_id":"T1021.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1021/001","identifiers":[{"type":"informative","value":"Contains ability to perform remote desktop activity (API string)"},{"type":"suspicious","value":"Reads terminal service related keys (often RDP related)"}],"sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"6323325635d3af22000ae4bc"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Contains ability to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Calls an API typically used to create a directory"},{"type":"informative","value":"Contains ability to create directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"tactic":"Collection","technique":"Clipboard Data","attack_id":"T1115","attack_id_wiki":"https://attack.mitre.org/techniques/T1115","identifiers":[{"type":"informative","value":"Contains ability to access clipboard data (API string)"}],"sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"tactic":"Collection","technique":"Automated Collection","attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","identifiers":[{"type":"informative","value":"Shows ability to send encrypted data to the internet"}],"sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"informative","value":"Contains ability to communicate with C2 using Sockets (API string)"}],"sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Contacts server"},{"type":"informative","value":"Contains ability to communicate with network (API string)"}],"sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"suspicious","value":"YARA signature match – Public-private key pair"},{"type":"suspicious","value":"Contains ability to use Microsoft's Enhanced Cryptographic Provider"},{"type":"informative","value":"Making HTTPS connections using secure TLS/SSL version"}],"sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"informative","value":"Contains ability to open a port and listen for incoming connection (API string)"},{"type":"informative","value":"References server/domain address with port number"}],"sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Sends GET/POST requests (HTTPS)"},{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"},{"type":"informative","value":"Found user-agent related strings"},{"type":"informative","value":"Found string related to HTTP headers"},{"type":"informative","value":"GETs files from a webserver (HTTPS)"}],"sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","identifiers":[{"type":"informative","value":"References OpenSSL library string"}],"sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"suspicious","value":"Drops executable files"}],"sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"tactic":"Command and Control","technique":"Mail Protocols","attack_id":"T1071.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/003","identifiers":[{"type":"informative","value":"Found mail related domain names"}],"sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over C2 Channel","attack_id":"T1041","attack_id_wiki":"https://attack.mitre.org/techniques/T1041","sources":[{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"tactic":"Discovery","technique":"Peripheral Device Discovery","attack_id":"T1120","attack_id_wiki":"https://attack.mitre.org/techniques/T1120","identifiers":[{"type":"informative","value":"Queries volume information"}],"sources":[{"report_type":"sandbox","report_id":"6323325635d3af22000ae4bc"}]},{"tactic":"Defense Evasion","technique":"Masquerade File Type","attack_id":"T1036.008","attack_id_wiki":"https://attack.mitre.org/techniques/T1036/008","sources":[{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"tactic":"Exfiltration","technique":"Data Transfer Size Limits","attack_id":"T1030","attack_id_wiki":"https://attack.mitre.org/techniques/T1030","sources":[{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"$25","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to impersonate access tokens (API string)","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; File: \"file\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00002764.00000001.159193.01663000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-306","sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to inject code into another process (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"file\")\n Found reference to API \"VirtualFree\" (Indicator: \"VirtualFree\"; File: \"file\")\n Found reference to API \"VirtualAlloc\" (Indicator: \"VirtualAlloc\"; File: \"file\")\n Found reference to API \"WTSFreeMemory\" (Indicator: \"FreeMemory\"; File: \"file\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; File: \"file\")\n Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; File: \"file\")\n Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"file\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to modify registry key/value (API string)","description":"Found reference to API \"RegFlushKey\" (Indicator: \"RegFlushKey\"; File: \"file\")\n Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; File: \"file\")\n Found reference to API \"RegFlushKey\" (Indicator: \"RegFlushKey\"; Source: \"00000000-00002764.00000001.159193.01663000.00000004.mdmp\")\n Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; Source: \"00000000-00002764.00000001.159193.01663000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-304","sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to set file time (API string)","description":"Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; File: \"file\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-409","sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to use Cryptographic classes","description":"Found reference to \"CryptCNGInitHMAC\" (Indicator: \"HMAC\"; Source: \"00000000-00002764.00000000.157268.01800000.00000004.mdmp, 00000000-00002764.00000001.159193.01800000.00000004.mdmp, 00000000-00002764.00000002.161113.01800000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Found virtual disk drive like strings","description":"$26","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-145","sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Renames files","description":"\"file.exe\" renamed original file\"C:\\ProgramData\\WindowsSoftwareToolkit\\visual.1991-06.com.microsoft_sd.kit.kdDFyh\" to \"%ALLUSERSPROFILE%\\WindowsSoftwareToolkit\\visual.1991-06.com.microsoft_sd.kit\"","origin":"API Call","mitre_attack_id":"T1036","relevance":1,"id":"api-162","sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"CheckRemoteDebuggerPresent\" (Indicator: \"CheckRemoteDebuggerPresent\"; File: \"file\")\n Found reference to API \"OutputDebugStringW\" (Indicator: \"OutputDebugString\"; File: \"file\")\n Found reference to API \"OutputDebugStringA\" (Indicator: \"OutputDebugString\"; File: \"file\")\n Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; File: \"file\")\n Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"file\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"file\")\n Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount\"; File: \"file\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"file\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"file\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"file\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-148","sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"PE file contains zero-size sections","description":"Raw size of \".bss\" is zero","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-5","sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"6323325635d3af22000ae4bc"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform AES/RC4 encryption (API string)","description":"Found reference to API \"CertFreeCertificateContext\" (Indicator: \"CertFreeCertificateContext\"; File: \"file\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-438","sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"level":"informative","category":"Cryptographic Related","name":"Found XOR operators (encryption/decryption)","description":"Found string \"!!(type & ATTACH_TYPE_MARK) ^ !!(type & ATTACH_TYPE_CURSIVE)\" (Indicator: \" ^ \"; File: \"file\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-624","sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Found XOR operators (encryption/decryption)\n Matched sigs: YARA signature match - AES encryption","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains ability to perform AES/RC4 encryption (API string)\n Matched sigs: Found XOR operators (encryption/decryption)\n Matched sigs: Contains CRYPTO related strings\n Matched sigs: Contains ability to use Cryptographic classes\n Matched sigs: Contains ability to use Microsoft's Enhanced Cryptographic Provider\n Matched sigs: Reads the cryptographic machine GUID\n Matched sigs: YARA signature match - AES encryption","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Found XOR operators (encryption/decryption)\n Matched sigs: YARA signature match - AES encryption\n Matched sigs: Found potential URL in binary/memory\n Matched sigs: Found potential URLs in memory dumps\n Matched sigs: Found potential IP address in binary/memory\n Matched sigs: Contacts server\n Matched sigs: Contains ability to communicate with network (API string)\n Matched sigs: Spawned process connects to a network","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"file\")\n Found string \"GetCursorPos\" (Indicator: \"GetCursorPos\"; File: \"file\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"file.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00002764)\n \"bcdedit.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00004004)\n \"schtasks.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00004452)\n \"schtasks.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00003496)\n \"bcdedit.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00004384)\n \"schtasks.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00004948)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$27","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"\"bcdedit.exe\" called \"GetVersionExA\" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b203100000000000000000000000000000100000000000000bbba83fefe070000c0af34000000000010147cfefe07000001000000000000001aab88fdfe070000010000000000000059bc83fefe0700000000000000000000000000000000000000000000000000009ad17dfefe07000007000000 (UID: 00000000-00004384)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve account information for specified SID","description":"\"schtasks.exe\" called \"LookupAccountSidW\" with param Name %OSUSER% (UID: 00000000-00004452)\n \"schtasks.exe\" called \"LookupAccountSidW\" with param Name %OSUSER% (UID: 00000000-00003496)\n \"schtasks.exe\" called \"LookupAccountSidW\" with param Name %OSUSER% (UID: 00000000-00004948)","origin":"API Call","mitre_attack_id":"T1033","relevance":3,"id":"api-148","sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"file.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00002764)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to enumerate volumes (API string)","description":"Found reference to API \"GetVolumePathNamesForVolumeNameW\" (Indicator: \"GetVolumePathNamesForVolumeName\"; File: \"file\")\n Found reference to API \"GetVolumePathNamesForVolumeNameW\" (Indicator: \"GetVolumePathName\"; File: \"file\")","origin":"File/Memory","mitre_attack_id":"T1006","relevance":1,"id":"string-194","sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to find open windows (API string)","description":"Found reference to API \"FindWindowA\" (Indicator: \"FindWindowA\"; File: \"file\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-413","sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform scheduled transfer (API string)","description":"Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; File: \"file\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"file\")\n Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; File: \"file\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query system locale (API string)","description":"Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; File: \"file\")\n Found reference to API \"GetUserDefaultLCID\" (Indicator: \"GetUserDefaultLCID\"; File: \"file\")","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"file.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"file.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")\n \"cmd.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"cmd.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"6323325635d3af22000ae4bc"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"FileTimeToSystemTime\" (Indicator: \"FileTimeToSystemTime\"; File: \"file\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; File: \"file\")\n Found reference to API \"SystemTimeToFileTime\" (Indicator: \"SystemTimeToFileTime\"; File: \"file\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve information about the current system (API string)","description":"Found reference to API \"GetSystemInfo\" (Indicator: \"GetSystemInfo\"; File: \"file\")\n Found reference to API \"ExpandEnvironmentStringsW\" (Indicator: \"ExpandEnvironmentStrings\"; File: \"file\")\n Found reference to API \"GetNativeSystemInfo\" (Indicator: \"GetNativeSystemInfo\"; File: \"file\")\n Found reference to API \"GetMonitorInfoW\" (Indicator: \"GetMonitorInfo\"; File: \"file\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine time (API string)","description":"Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; File: \"file\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"file\")\n Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; File: \"file\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine timezone (API string)","description":"Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; File: \"file\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-248","sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve network parameters of a computer (API string)","description":"Found reference to API \"GetNetworkParams\" (Indicator: \"GetNetworkParams\"; File: \"file\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-222","sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"Found reference to API \"GetForegroundWindow\" (Indicator: \"GetForegroundWindow\"; File: \"file\")\n Found reference to API \"GetWindowTextW\" (Indicator: \"GetWindowText\"; File: \"file\")\n Found reference to API \"EnumWindows\" (Indicator: \"EnumWindows\"; File: \"file\")\n Found reference to API \"FindWindowA\" (Indicator: \"FindWindow\"; File: \"file\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve system language (API string)","description":"Found reference to API \"GetUserPreferredUILanguages\" (Indicator: \"GetUserPreferredUILanguages\"; File: \"file\")\n Found reference to API \"GetUserDefaultLangID\" (Indicator: \"GetUserDefaultLangID\"; File: \"file\")\n Found reference to API \"GetKeyboardLayoutList\" (Indicator: \"GetKeyboardLayoutList\"; File: \"file\")\n Found reference to API \"GetKeyboardLayout\" (Indicator: \"GetKeyboardLayout\"; File: \"file\")","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Found reference to API \"GetStartupInfoA\" (Indicator: \"GetStartupInfo\"; File: \"file\")\n Found reference to API \"GetStartupInfoW\" (Indicator: \"GetStartupInfo\"; File: \"file\")","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-167","sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve volume information (API string)","description":"Found reference to API \"GetVolumeInformationW\" (Indicator: \"GetVolumeInformation\"; File: \"file\")\n Found reference to API \"GetVolumePathNamesForVolumeNameW\" (Indicator: \"GetVolumePathNamesForVolumeName\"; File: \"file\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-162","sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"level":"informative","category":"Environment Awareness","name":"Queries TCP/IP interface details","description":"$28","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-130","sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"file.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"6323325635d3af22000ae4bc"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"file.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"6323325635d3af22000ae4bc"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"level":"informative","category":"General","name":".rdata section contains high entropy","description":"\"file\" has section name .rdata with entropy \"6.18805744644\"","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-187","sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"\"file.exe\" called \"CreateDirectoryW\" with parameter \\\\?\\C:\\ProgramData (UID: 00000000-00002764)\n \"file.exe\" called \"CreateDirectoryW\" with parameter \\\\?\\%ALLUSERSPROFILE%\\WindowsSoftwareToolkit (UID: 00000000-00002764)","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"\"file.exe\" called \"CreateProcessW\" with parameter \"cmd.exe /c bcdedit\" - (UID: 00000000-00002764)\n \"file.exe\" called \"CreateProcessW\" with parameter \"cmd.exe /c schtasks /create /tn \"OneDrive AutoRemove\" /tr \"%WINDIR%\\System32\\cmd.exe /c del /f /q C:/file.exe\" /sc daily /st 10\" - (UID: 00000000-00002764)\n \"file.exe\" called \"CreateProcessW\" with parameter \"cmd.exe /c schtasks /delete /f /tn \"Microsoft\\Windows\\light Service Manager\"\" - (UID: 00000000-00002764)\n \"file.exe\" called \"CreateProcessW\" with parameter \"cmd.exe /c schtasks /create /tn \"Microsoft\\Windows\\light Service Manager\" /tr C:/file.exe /sc onstart /ru SYSTEM\" - (UID: 00000000-00002764)\n \"cmd.exe\" called \"CreateProcessW\" with parameter \"schtasks /delete /f /tn \"Microsoft\\Windows\\light Service Manager\"\" - (UID: 00000000-00003788)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create an instance of a named pipe","description":"$29","origin":"API Call","mitre_attack_id":"T1570","relevance":3,"id":"api-138","sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$2a","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$2b","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"64.188.27.73:80\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"6323325635d3af22000ae4bc"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; File: \"file\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; File: \"file\")","origin":"File/Memory","mitre_attack_id":"T1074.001","relevance":1,"id":"string-423","sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"level":"informative","category":"General","name":"Contains ability to create/control drivers (API string)","description":"Found reference to API \"DeviceIoControl\" (Indicator: \"DeviceIoControl\"; File: \"file\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-220","sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"level":"informative","category":"General","name":"Contains ability to create/load registry keys (API string)","description":"Found reference to API \"RegCreateKeyExW\" (Indicator: \"RegCreateKey\"; File: \"file\")\n Found reference to API \"RegCreateKeyExW\" (Indicator: \"RegCreateKey\"; Source: \"00000000-00002764.00000001.159193.01663000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-307","sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFileMappingW\" (Indicator: \"CreateFile\"; File: \"file\")\n Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; File: \"file\")\n Found reference to API \"CreateFileA\" (Indicator: \"CreateFile\"; File: \"file\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; File: \"file\")\n Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00002764.00000001.159193.01663000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically determine API calls","description":"Found GetProcAddress() and LoadLibraryA() in an import section (Source: file)","origin":"Static Parser","mitre_attack_id":"T1027.007","relevance":1,"id":"static-79","sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$2c","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Found reference to API \"ShellExecuteW\" (Indicator: \"ShellExecute\"; File: \"file\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-240","sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"level":"informative","category":"General","name":"Contains ability to executes commands or batch file","description":"$2d","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-174","sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"level":"informative","category":"General","name":"Contains ability to move file or directory (API string)","description":"Found reference to API \"MoveFileW\" (Indicator: \"MoveFile\"; File: \"file\")\n Found reference to API \"MoveFileExW\" (Indicator: \"MoveFile\"; File: \"file\")","origin":"File/Memory","mitre_attack_id":"T1570","relevance":1,"id":"string-322","sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"file\")\n Found reference to API \"CommandLineToArgvW\" (Indicator: \"CommandLineToArgv\"; File: \"file\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"GetThreadContext\" (Indicator: \"GetThreadContext\"; File: \"file\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"file\")\n Found reference to API \"SetThreadContext\" (Indicator: \"SetThreadContext\"; File: \"file\")\n Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; File: \"file\")\n Found reference to API \"SuspendThread\" (Indicator: \"SuspendThread\"; File: \"file\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/open a process (API string)","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcess\"; File: \"file\")\n Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; File: \"file\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcess\"; Source: \"00000000-00002764.00000001.159193.01663000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; File: \"file\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; File: \"file\")\n Found reference to API \"WSAGetLastError\" (Indicator: \"GetLastError\"; File: \"file\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; File: \"file\")\n Found reference to API \"GetWindowThreadProcessId\" (Indicator: \"GetWindowThreadProcessId\"; File: \"file\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-208","sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"level":"informative","category":"General","name":"Contains export functions","description":"$2e","origin":"Static Parser","relevance":1,"id":"static-78","sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"6323325635d3af22000ae4bc"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"\"Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\" in Source: file\n \"Software\\Microsoft\\Windows\\Shell\\Associations\\UrlAssociations\\mailto\\UserChoice\" in Source: file\n \"Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\" in Source: file\n \"SOFTWARE\\Microsoft\\Cryptography\" in Source: file\n \"HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Fonts\" in Source: file\n \"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Fonts\" in Source: file\n \"Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\" in Source: file\n \"Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\" in Source: file\n \"EGISTRY\\USER\\S-1-5-21-686412048-2446563785-1323799475-1001\\Software\\Policies\\Microsoft\\Windows\\Safer\\CodeIdentifiers\" in Source: 00000000-00002764.00000001.159193.01800000.00000004.mdmp\n 00000000-00002764.00000002.161113.01800000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"6323325635d3af22000ae4bc"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\DBWinMutex\"\n \"DBWinMutex\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"6323325635d3af22000ae4bc"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"\"file.exe\" failed to load missing module \"api-ms-win-core-fibers-l1-1-1\" - [base:0; Status:ffffffffc0000135]\n \"file.exe\" failed to load missing module \"api-ms-win-core-localization-l1-2-1\" - [base:0; Status:ffffffffc0000135]\n \"cmd.exe\" failed to load missing module \"api-ms-win-core-fibers-l1-1-1\" - [base:0; Status:ffffffffc0000135]\n \"cmd.exe\" failed to load missing module \"api-ms-win-core-localization-l1-2-1\" - [base:0; Status:ffffffffc0000135]\n \"schtasks.exe\" failed to load missing module \"api-ms-win-core-fibers-l1-1-1\" - [base:0; Status:ffffffffc0000135]\n \"schtasks.exe\" failed to load missing module \"api-ms-win-core-localization-l1-2-1\" - [base:0; Status:ffffffffc0000135]\n \"bcdedit.exe\" failed to load missing module \"api-ms-win-core-fibers-l1-1-1\" - [base:0; Status:ffffffffc0000135]\n \"bcdedit.exe\" failed to load missing module \"api-ms-win-core-localization-l1-2-1\" - [base:0; Status:ffffffffc0000135]","origin":"API Call","mitre_attack_id":"T1574.002","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"}]},{"level":"informative","category":"General","name":"Found named pipe like strings","description":"Found string - \\\\.\\pipe\\qt-%lX-%X\n Found string - \\\\.\\pipe\\qt-ACC-B1CEF811\n Found string - \\\\.\\pipe\\qt-ACC-746B003B\n Found string - \\\\.\\pipe\\qt-ACC-43595CE6\n Found string - \\\\.\\pipe\\qt-ACC-36F393E8\n Found string - \\\\.\\pipe\\qt-ACC-AFD5EFC6\n Found string - \\\\.\\pipe\\qt-ACC-B5197C96\n Found string - \\\\.\\pipe\\qt-ACC-183E5002\n Found string - \\\\.\\pipe\\qt-ACC-BA596EAC\n Found string - \\\\.\\pipe\\qt-ACC-4E168657\n Found string - \\\\.\\pipe\\qt-ACC-B09E4C7C\n Found string - \\\\.\\pipe\\qt-ACC-21322A46\n Found string - \\\\.\\pipe\\qt-ACC-1D9F31E7\n Found string - \\\\.\\pipe\\qt-ACC-DDC5A242\n Found string - \\\\.\\pipe\\qt-ACC-31898D8F\n Found string - \\\\.\\pipe\\qt-ACC-84A48AB7","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-146","sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"level":"informative","category":"General","name":"Found user-agent related strings","description":"Found string \"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:78.0) Gecko/20100101 Firefox/78.0\" (Indicator: \"mozilla/5.0 (\"; Source: \"00000000-00002764.00000000.157268.019A0000.00000004.mdmp, 00000000-00002764.00000001.159193.019A0000.00000004.mdmp, 00000000-00002764.00000001.159193.019B0000.00000004.mdmp, 00000000-00002764.00000001.159193.05470000.00000004.mdmp, 00000000-00002764.00000002.161113.019A0000.00000004.mdmp, 00000000-00002764.00000002.161113.019B0000.00000004.mdmp, 00000000-00002764.00000002.161113.05470000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-127","sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$2f","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"file.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at FE090000\n \"cmd.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at FE090000\n \"bcdedit.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at FE090000\n \"schtasks.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at FE090000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"$30","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"file\" was detected as \"MinGW\" and name: \"Compiler\"\n \"file\" was detected as \"Qt\" and name: \"Library\"\n \"file\" was detected as \"GNU linker ld (GNU Binutils)\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"file\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"6323325635d3af22000ae4bc"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"file\" has an writable section named \".data\"\n \"file\" has an writable section named \".bss\"\n \"file\" has an writable section named \".idata\"\n \"file\" has an writable section named \".CRT\"\n \"file\" has an writable section named \".tls\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"6323325635d3af22000ae4bc"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"\"file\" file has an entrypoint instructions - \"sub\trsp, 0x28,mov\trax, qword ptr [rip + 0xe627a5],mov\tdword ptr [rax], 1,call\t0x46a3b0,call\t0x401180,nop\t,nop\t,add\trsp, 0x28,ret\t,nop\tdword ptr [rax],nop\tword ptr cs:[rax + rax],sub\trsp, 0x28,mov\trax, qword ptr [rip + 0xe62775],mov\tdword ptr [rax], 0,call\t0x46a3b0,call\t0x401180,nop\t,nop\t,add\trsp, 0x28,ret\t,nop\tdword ptr [rax],nop\tword ptr cs:[rax + rax],sub\trsp, 0x28,\"","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"6323325635d3af22000ae4bc"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"level":"informative","category":"General","name":"PE file has a big raw size section","description":"Raw size of \".text\" is \"0xd87200\" greater than 0x100000\n Raw size of \".rdata\" is \"0x3b2e00\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-125","sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"level":"informative","category":"General","name":"PE file has a big virtual size section","description":"Virtual size of \".text\" is \"0xd871b0\" greater than 0x100000\n Virtual size of \".rdata\" is \"0x3b2c80\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-124","sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"Observed system executable string:\"cmd.exe /c schtasks /create /tn \"OneDrive AutoRemove\" /tr \"%WINDIR%\\System32\\cmd.exe /c del /f /q C:/file.exe\" /sc daily /st 10\" [Source: 00000000-00002764-00000C44-3173099506793]\n Observed system executable string:\"%WINDIR%\\system32\\bcdedit.exe\" [Source: 00000000-00004004-00000C28-1481344233]\n Observed system executable string:\"%WINDIR%\\system32\\schtasks.exe\" [Source: 00000000-00003788-00000C44-144225240171]\n Observed system executable string:\"/c schtasks /create /tn \"OneDrive AutoRemove\" /tr \"%WINDIR%\\System32\\cmd.exe /c del /f /q C:/file.exe\" /sc daily /st 10:30:30 /ru SYSTEM\" [Source: cmd.exe]\n Observed system executable string:\"schtasks /create /tn \"OneDrive AutoRemove\" /tr \"%WINDIR%\\System32\\cmd.exe /c del /f /q C:/file.exe\" /sc daily /st 10:30:30 /ru SYSTEM\" [Source: schtasks.exe]","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"bcdedit.exe\" (UID: 00000000-00004004) was launched with new environment variables: \"PROMPT=\"$P$G\"\"\n Process \"cmd.exe\" (UID: 00000000-00004324) was launched with missing environment variables: \"PROMPT\"\n Process \"schtasks.exe\" (UID: 00000000-00004452) was launched with new environment variables: \"PROMPT=\"$P$G\"\"\n Process \"cmd.exe\" (UID: 00000000-00003788) was launched with missing environment variables: \"PROMPT\"\n Process \"schtasks.exe\" (UID: 00000000-00003496) was launched with new environment variables: \"PROMPT=\"$P$G\"\"\n Process \"cmd.exe\" (UID: 00000000-00003948) was launched with missing environment variables: \"PROMPT\"\n Process \"bcdedit.exe\" (UID: 00000000-00004384) was launched with new environment variables: \"PROMPT=\"$P$G\"\"\n Process \"cmd.exe\" (UID: 00000000-00004484) was launched with missing environment variables: \"PROMPT\"\n Process \"schtasks.exe\" (UID: 00000000-00004948) was launched with new environment variables: \"PROMPT=\"$P$G\"\"","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"6323325635d3af22000ae4bc"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"gendoraduragonkgp126.com\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"file.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"file.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"6323325635d3af22000ae4bc"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"level":"informative","category":"General","name":"References Windows filepaths for DLLs (possible dropped files)","description":"Observed system executable string:\"%WINDIR%\\system32\\uxtheme.dll\" [Source: 00000000-00002764-00000C28-1460496902]\n Observed system executable string:\"%WINDIR%\\system32\\winhttp.dll\" [Source: 00000000-00002764-00000C28-1460918916]\n Observed system executable string:\"%WINDIR%\\system32\\Advapi32.dll\" [Source: 00000000-00002764-00000C28-1462080347]\n Observed system executable string:\"%WINDIR%\\system32\\shell32.dll\" [Source: 00000000-00002764-00000C28-1492364575]\n Observed system executable string:\"%WINDIR%\\system32\\IMM32.DLL\" [Source: 00000000-00004384-00000C60-1486130089]","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"$31","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"6323325635d3af22000ae4bc"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"$32","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"6323325635d3af22000ae4bc"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"level":"informative","category":"Installation/Persistence","name":"Connects to LPC ports","description":"\"file.exe\" connecting to \"\\ThemeApiPort\"\n \"schtasks.exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","mitre_attack_id":"T1559","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"6323325635d3af22000ae4bc"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; File: \"file\")\n Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"file\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to register device notification handler (API string)","description":"Found reference to API \"RegisterDeviceNotificationW\" (Indicator: \"RegisterDeviceNotification\"; File: \"file\")","origin":"File/Memory","mitre_attack_id":"T1098.005","relevance":1,"id":"string-543","sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"file.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)\n \"schtasks.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates new processes","description":"\"cmd.exe\" is creating a new process (Name: \"C:\\Windows\\system32\\bcdedit.exe\")\n \"cmd.exe\" is creating a new process (Name: \"C:\\Windows\\system32\\schtasks.exe\")","origin":"API Call","mitre_attack_id":"T1106","relevance":8,"id":"api-2","sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"\"visual.1991-06.com.microsoft_sd.kit.kdDFyh\" has type \"ASCII text with CRLF line terminators\"- Location: [%ALLUSERSPROFILE%\\WindowsSoftwareToolkit\\visual.1991-06.com.microsoft_sd.kit.kdDFyh]- [targetUID: 00000000-00002764]\n \"visual.1991-06.com.microsoft_sd.kit.lock\" has type \"ASCII text\"- Location: [%ALLUSERSPROFILE%\\WindowsSoftwareToolkit\\visual.1991-06.com.microsoft_sd.kit.lock]- [targetUID: 00000000-00002764]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"6323325635d3af22000ae4bc"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$33","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"file.exe\" queries basic process information of the \"\\Device\\Nsi\" (UID: 2764)\n \"file.exe\" queries basic process information of the \"C:\\Windows\\System32\\apphelp.dll\" (UID: 2764)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$34","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to detect sandbox (imports API)\n Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: Able to identify virtual environment by using user activity (API string)","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$35","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$36","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"\"file.exe\" trying to access non-existent file \"\\DEVICE\\NETBT_TCPIP_{846EE342-7039-11DE-9D20-806E6F6E6963}\"\n \"file.exe\" trying to access non-existent file \"\\DEVICE\\NETBT_TCPIP_{B1B7B0FA-A148-4AFC-9AC6-41A074232BA5}\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"file.exe\" writes file \"c:\\programdata\\windowssoftwaretoolkit\\visual.1991-06.com.microsoft_sd.kit.lock\"\n \"file.exe\" writes file \"c:\\programdata\\windowssoftwaretoolkit\\visual.1991-06.com.microsoft_sd.kit.kddfyh\"\n \"file.exe\" writes file \"%allusersprofile%\\windowssoftwaretoolkit\\visual.1991-06.com.microsoft_sd.kit.kddfyh\"\n \"file.exe\" writes file \"%allusersprofile%\\windowssoftwaretoolkit\\visual.1991-06.com.microsoft_sd.kit.lock\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with C2 using Sockets (API string)","description":"Found reference to API \"WSARecvFrom\" (Indicator: \"WSARecv\"; File: \"file\")\n Found reference to API \"WSARecv\" (Indicator: \"WSARecv\"; File: \"file\")\n Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; File: \"file\")\n Found reference to API \"WSASend\" (Indicator: \"WSASend\"; File: \"file\")\n Found reference to API \"WSASendTo\" (Indicator: \"WSASend\"; File: \"file\")","origin":"File/Memory","mitre_attack_id":"T1095","relevance":1,"id":"string-228","sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"Found reference to API \"WSARecvFrom\" (Indicator: \"WSARecv\"; File: \"file\")\n Found reference to API \"WSARecv\" (Indicator: \"WSARecv\"; File: \"file\")\n Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; File: \"file\")\n Found reference to API \"WSASend\" (Indicator: \"WSASend\"; File: \"file\")\n Found reference to API \"WSASendTo\" (Indicator: \"WSASend\"; File: \"file\")\n Found reference to API \"WinHttpOpen\" (Indicator: \"WinHttpOpen\"; Source: \"00000000-00002764-00000C29-1461024261\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create/connect to a named pipe (API string)","description":"Found reference to API \"ConnectNamedPipe\" (Indicator: \"ConnectNamedPipe\"; File: \"file\")\n Found reference to API \"PeekNamedPipe\" (Indicator: \"PeekNamedPipe\"; File: \"file\")\n Found reference to API \"CreateNamedPipeW\" (Indicator: \"CreateNamedPipe\"; File: \"file\")","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-210","sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"level":"informative","category":"Network Related","name":"Contains ability to open a port and listen for incoming connection (API string)","description":"Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; File: \"file\")","origin":"File/Memory","mitre_attack_id":"T1571","relevance":1,"id":"string-419","sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"level":"informative","category":"Network Related","name":"Contains ability to query information about shared network resources (API string)","description":"Found reference to API \"NetShareEnum\" (Indicator: \"NetShareEnum\"; File: \"file\")","origin":"File/Memory","mitre_attack_id":"T1135","relevance":3,"id":"string-190","sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"level":"informative","category":"Network Related","name":"Found mail related domain names","description":"Observed email domain:\".pop.gdem\" [Source: file]","origin":"File/Memory","mitre_attack_id":"T1071.003","relevance":1,"id":"string-169","sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"$37","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$38","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"6323325635d3af22000ae4bc"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$39","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: 05af1f5ca1b87cc9cc9b25185115607d\n Observed JA3 fingerprint: db95a4cb23548a635a1dfebcee9991cb","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"level":"informative","category":"Network Related","name":"References OpenSSL library string","description":"Observed string: \"OpenSSL 1.1.1h 22 Sep 2020\" (Indicator: \"OpenSSL 1.\")","origin":"File/Memory","mitre_attack_id":"T1573.002","relevance":1,"id":"string-5003","sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"level":"informative","category":"Network Related","name":"References server/domain address with port number","description":"Found ip/domain with port number \"http://64.188.27.73:80\"Found ip/domain with port number \"http://172.16.3.81:80\"Found ip/domain with port number \"http://gendoraduragonkgp126.com:80\"","origin":"Indicator Combinations","mitre_attack_id":"T1571","id":"summary-25","sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"level":"informative","category":"Network Related","name":"Shows ability to send encrypted data to the internet","description":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network","origin":"Indicator Combinations","mitre_attack_id":"T1119","relevance":2,"id":"summary-27","sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - AES encryption","description":"YARA signature for AES encryption matched on file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-103","sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"level":"informative","category":"Remote Access Related","name":"Contains ability to perform remote desktop activity (API string)","description":"Found reference to API \"WTSFreeMemory\" (Indicator: \"WTSFreeMemory\"; File: \"file\")","origin":"File/Memory","mitre_attack_id":"T1021.001","relevance":1,"id":"string-436","sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"level":"informative","category":"Remote Access Related","name":"Contains ability to retrieve remote session information (API string)","description":"Found reference to API \"WTSQuerySessionInformationW\" (Indicator: \"WTSQuerySessionInformation\"; File: \"file\")","origin":"File/Memory","mitre_attack_id":"T1018","relevance":1,"id":"string-546","sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"file.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"cmd.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"schtasks.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"bcdedit.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"Found string \"euskaraEspainia\" (Indicator: \"aes\"; File: \"file\")\n Found string \"inaSlovenijaSoomaaliSoomaaliyaJabuutiItoobiyaespa\" (Indicator: \"aes\"; File: \"file\")\n Found string \"aespa\" (Indicator: \"aes\"; File: \"file\")\n file/memory contains long string with (Indicator: \"aes\"; File: \"file\")\n Found string \"data:text/plain;base64,\" (Indicator: \"base64\"; File: \"file\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to access clipboard data (API string)","description":"Found reference to API \"GetClipboardFormatNameW\" (Indicator: \"GetClipboardFormatName\"; File: \"file\")","origin":"File/Memory","mitre_attack_id":"T1115","relevance":1,"id":"string-188","sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to capture screen (API string)","description":"$3a","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to detect sandbox (imports API)","description":"Found GetCursorPos() in an import section (Source: file)","origin":"Static Parser","mitre_attack_id":"T1497","relevance":1,"id":"static-132","sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to determine disk drive type (API string)","description":"Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveType\"; File: \"file\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-80","sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"Found reference to API \"FindNextFileW\" (Indicator: \"FindNextFile\"; File: \"file\")\n Found reference to API \"FindFirstFileW\" (Indicator: \"FindFirstFile\"; File: \"file\")\n Found reference to API \"FindFirstFileExW\" (Indicator: \"FindFirstFile\"; File: \"file\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"Found reference to API \"GetCurrentProcess\" (Indicator: \"GetCurrentProcess\"; File: \"file\")\n Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; File: \"file\")\n Found reference to API \"GetEnvironmentStringsW\" (Indicator: \"GetEnvironmentStrings\"; File: \"file\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; File: \"file\")\n Found reference to API \"GetCurrentProcessId\" (Indicator: \"GetCurrentProcess\"; File: \"file\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to find logical drives of the machine (API string)","description":"Found reference to API \"GetLogicalDrives\" (Indicator: \"GetLogicalDrives\"; File: \"file\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-84","sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to query network adapter information (API string)","description":"Found reference to API \"GetAdaptersAddresses\" (Indicator: \"GetAdaptersAddresses\"; File: \"file\")\n Found reference to API \"16153948009961,2076,3177,,GetAdaptersAddresses,Iphlpapi.dll,\"252:27:04.633\",RX=0,PX=0\" (Indicator: \"GetAdaptersAddresses\"; Source: \"00000000-00002764.00000002.161113.01800000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-118","sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to query registry keys (API string)","description":"$3b","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; File: \"file\")","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; File: \"file\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; File: \"file\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"file\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"$3c","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about pressed keystrokes (API string)","description":"Found reference to API \"MapVirtualKeyW\" (Indicator: \"MapVirtualKey\"; File: \"file\")\n Found reference to API \"GetKeyboardState\" (Indicator: \"GetKeyboardState\"; File: \"file\")\n Found reference to API \"AttachThreadInput\" (Indicator: \"AttachThreadInput\"; File: \"file\")\n Found reference to API \"GetAsyncKeyState\" (Indicator: \"GetAsyncKeyState\"; File: \"file\")\n Found reference to API \"GetKeyState\" (Indicator: \"GetKeyState\"; File: \"file\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-88","sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve process ID (API string)","description":"Found reference to API \"GetProcessId\" (Indicator: \"GetProcessId\"; File: \"file\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-478","sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; File: \"file\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host name of a computer (API string)","description":"Found reference to API \"gethostname\" (Indicator: \"gethostname\"; File: \"file\")\n Found reference to API \"9663812209929,3756,3274,,gethostname,ws2_32.dll,\"252:26:55.086\",RX=0,PX=0\" (Indicator: \"gethostname\"; Source: \"00000000-00002764.00000001.159193.01800000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-532","sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the local name for a socket (API string)","description":"Found reference to API \"getsockname\" (Indicator: \"getsockname\"; File: \"file\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-224","sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; File: \"file\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-131","sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"file\")\n Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount\"; File: \"file\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve usernames and/or user information (API string)","description":"Found reference to API \"LookupAccountSidW\" (Indicator: \"LookupAccountSid\"; File: \"file\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; File: \"file\")\n Found reference to API \"GetTokenInformation\" (Indicator: \"GetTokenInformation\"; File: \"file\")\n Found reference to API \"WTSQuerySessionInformationW\" (Indicator: \"WTSQuerySessionInformation\"; File: \"file\")\n Found reference to API \"GetTokenInformation\" (Indicator: \"GetTokenInformation\"; Source: \"00000000-00002764.00000001.159193.01663000.00000004.mdmp\")\n Found reference to API \"LookupAccountSidW\" (Indicator: \"LookupAccountSid\"; Source: \"00000000-00002764.00000001.159193.01663000.00000004.mdmp\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00002764.00000001.159193.01663000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"Found string \"Invalid password (character '%1' not permitted)\" (Indicator: \"password\"; File: \"file\")","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"Found string \"\\Device\\HarddiskVolume2\\file.exe\" (Indicator: \"\\Device\\\"; Source: \"00000000-00002764.00000000.157268.01800000.00000004.mdmp, 00000000-00002764.00000001.159193.01800000.00000004.mdmp, 00000000-00002764.00000002.161113.01800000.00000004.mdmp\")\n Found string \"\\Device\\{E63BE247-2D1C-4749-B86C-7B5FABD92F0C}\" (Indicator: \"\\Device\\\"; Source: \"00000000-00002764.00000000.157268.01800000.00000004.mdmp, 00000000-00002764.00000001.159193.01800000.00000004.mdmp, 00000000-00002764.00000002.161113.01800000.00000004.mdmp\")\n Found string \"\\Device\\{E390372A-3FAB-417F-940E-F2CD5C8F68CB}\" (Indicator: \"\\Device\\\"; Source: \"00000000-00002764.00000001.159193.01800000.00000004.mdmp, 00000000-00002764.00000002.161113.01800000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files","description":"$3d","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-408","sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; File: \"file\")\n Found reference to API \"RemoveDirectoryW\" (Indicator: \"RemoveDirectory\"; File: \"file\")","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete registry key/value (API string)","description":"Found reference to API \"RegDeleteKeyW\" (Indicator: \"RegDeleteKey\"; File: \"file\")\n Found reference to API \"RegDeleteValueW\" (Indicator: \"RegDeleteValue\"; File: \"file\")\n Found reference to API \"RegDeleteKeyW\" (Indicator: \"RegDeleteKey\"; Source: \"00000000-00002764.00000001.159193.01663000.00000004.mdmp\")\n Found reference to API \"RegDeleteValueW\" (Indicator: \"RegDeleteValue\"; Source: \"00000000-00002764.00000001.159193.01663000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-230","sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"level":"informative","category":"System Security","name":"Contains ability to hook/unhook windows functions (API string)","description":"Found reference to API \"CallNextHookEx\" (Indicator: \"CallNextHook\"; File: \"file\")\n Found reference to API \"SetWindowsHookExW\" (Indicator: \"SetWindowsHook\"; File: \"file\")\n Found reference to API \"UnhookWindowsHookEx\" (Indicator: \"UnhookWindowsHook\"; File: \"file\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-91","sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify the user configuration/privilege (API string)","description":"Found reference to API \"SystemParametersInfoW\" (Indicator: \"SystemParametersInfo\"; File: \"file\")","origin":"File/Memory","mitre_attack_id":"T1098","relevance":1,"id":"string-132","sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"$3e","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; File: \"file\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; File: \"file\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"file\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"file.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"6323325635d3af22000ae4bc"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"level":"informative","category":"System Security","name":"Imports system security related APIs","description":"$3f","origin":"Static Parser","mitre_attack_id":"T1134.001","relevance":1,"id":"static-87","sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"6323325635d3af22000ae4bc"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"file.exe\" opened \"\\Device\\KsecDD\"\n \"schtasks.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"6323325635d3af22000ae4bc"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$40","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to free the memory used by network management functions (API string)","description":"Found reference to API \"NetApiBufferFree\" (Indicator: \"NetApiBufferFree\"; File: \"file\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-223","sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"Found reference to API \"ReleaseMutex\" (Indicator: \"ReleaseMutex\"; File: \"file\")\n Found reference to API \"CreateMutexW\" (Indicator: \"CreateMutex\"; File: \"file\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-354","sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"section contains high entropy","description":"\"file\" has section name .text with entropy \"6.36952349334\"\n \"file\" has section name .rdata with entropy \"6.18805744644\"\n \"file\" has section name .pdata with entropy \"6.72516346433\"","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"level":"suspicious","category":"Cryptographic Related","name":"Contains ability to use Microsoft's Enhanced Cryptographic Provider","description":"$41","origin":"File/Memory","mitre_attack_id":"T1573","relevance":2,"id":"string-602","sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 64.188.27.73 on port 80 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"6323325635d3af22000ae4bc"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match – Public-private key pair","description":"YARA signature for public-private key pair used in file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1573","relevance":2,"id":"yara-122","sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Able to delete scheduled task(s)","description":"Found string \"cmd.exe /c schtasks /delete /f /tn \"Microsoft\\Windows\\light Service Manager\"\" (Indicator: \"schtasks /delete\"; Source: \"00000000-00002764-00000C44-4615496132596\")\n Found string \"/c schtasks /delete /f /tn \"Microsoft\\Windows\\light Service Manager\"\" (Indicator: \"schtasks /delete\"; File: \"cmd.exe\")","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-629","sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"file.exe\" marked \"C:\\ProgramData\\WindowsSoftwareToolkit\\visual.1991-06.com.microsoft_sd.kit.yXINol\" for deletion\n \"file.exe\" marked \"C:\\ProgramData\\WindowsSoftwareToolkit\\visual.1991-06.com.microsoft_sd.kit.lock\" for deletion","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"6323325635d3af22000ae4bc"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"file.exe\" opened \"C:\\ProgramData\\WindowsSoftwareToolkit\\visual.1991-06.com.microsoft_sd.kit.yXINol\" with delete access\n \"file.exe\" opened \"C:\\ProgramData\\WindowsSoftwareToolkit\\visual.1991-06.com.microsoft_sd.kit.kdDFyh\" with delete access\n \"file.exe\" opened \"C:\\ProgramData\\WindowsSoftwareToolkit\\visual.1991-06.com.microsoft_sd.kit.lock\" with delete access","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"6323325635d3af22000ae4bc"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Found TLS callbacks","description":"\"file\" has a TLS callback with entrypoint at 0x46a5c0","origin":"Static Parser","mitre_attack_id":"T1055.005","relevance":10,"id":"static-17","sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"$42","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"6323325635d3af22000ae4bc"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"PE file contains unusual section name","description":"\"file\" has a section named \".qtmetad\"\n \"file\" has a section named \".CRT\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-60","sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"PE files contains large number of export functions (more than 100)","description":"file contains more than 100 export function","origin":"Static Parser","relevance":5,"id":"static-98","sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"6323325635d3af22000ae4bc"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"level":"malicious","category":"Installation/Persistence","name":"Allocates virtual memory in a remote process","description":"\"file.exe\" allocated memory in \"C:\\file.exe\"","origin":"API Call","mitre_attack_id":"T1055","relevance":7,"id":"api-20","sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"}]},{"level":"malicious","category":"Installation/Persistence","name":"Schedules a task to be executed at a specific time and date","description":"Process \"schtasks.exe\" with commandline \"schtasks /create /tn \"OneDrive AutoRemove\" /tr \"%WINDIR%\\\\System32\\\\cmd.exe /c del /f /q C:/file.exe\" /sc daily /st 10:30:30 /ru SYSTEM\" (UID: 00000000-00004452)\n Process \"schtasks.exe\" with commandline \"schtasks /create /tn \"Microsoft\\\\Windows\\\\light Service Manager\" /tr C:/file.exe /sc onstart /ru SYSTEM\" (UID: 00000000-00004948)","origin":"Monitored Target","mitre_attack_id":"T1053.005","relevance":8,"id":"target-13","sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"6323325635d3af22000ae4bc"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"level":"malicious","category":"Ransomware/Banking","name":"Tries to delete scheduled tasks","description":"Process \"schtasks.exe\" with commandline \"schtasks /delete /f /tn \"Microsoft\\\\Windows\\\\light Service Manager\"\" (UID: 00000000-00003496)","origin":"Monitored Target","mitre_attack_id":"T1562.001","relevance":7,"id":"target-177","sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"level":"malicious","category":"System Destruction","name":"Interacts with the primary disk partition (DR0)","description":"\"bcdedit.exe\" interacting with \"\\Device\\Harddisk0\\DR0\" using IoControlCode 0x70050","origin":"API Call","mitre_attack_id":"T1542.003","relevance":5,"id":"api-59","sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"6323325635d3af22000ae4bc"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"$43","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"6323325635d3af22000ae4bc"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"file.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at AFB40000\n \"cmd.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at AFB40000\n \"schtasks.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at AFB40000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"level":"informative","category":"Network Related","name":"Found string related to HTTP headers","description":"Found string \"POST /adm_bord/login_new_check.php%20 HTTP/1.1\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00004408.00000000.91586.05B60000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-457","sources":[{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"level":"informative","category":"Network Related","name":"GETs files from a webserver (HTTPS)","description":"GET /service/msn/livetile/singletile?market=en-US&source=appxmanifest&tenant=amp&vertical=finance HTTP/1.1Connection: Keep-Alive\n User-Agent: Microsoft-WNS/10.0\n Host: assets.msn.com\n","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":3,"id":"network-72","sources":[{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"}]},{"level":"informative","category":"Network Related","name":"Making HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"level":"informative","category":"Network Related","name":"Sends GET/POST requests (HTTPS)","description":"Found HTTPS GET request to https://assets.msn.com/service/msn/livetile/singletile?market=en-US&source=appxmanifest&tenant=amp&vertical=finance","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-66","sources":[{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve user name","description":"\"file.exe\" called \"GetUserNameW\" (UID: 00000000-00004408)","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-135","sources":[{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"level":"suspicious","category":"System Security","name":"Writes registry keys","description":"$44","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"level":"malicious","category":"Installation/Persistence","name":"Loads the task scheduler COM API","description":"\"schtasks.exe\" loaded module \"%WINDIR%\\System32\\taskschd.dll\" at AABE0000","origin":"Loaded Module","mitre_attack_id":"T1559.001","relevance":5,"id":"module-4","sources":[{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"\"file.exe\" queries volume information of \"%ALLUSERSPROFILE%\\WindowsSoftwareToolkit\\visual.1991-06.com.microsoft_sd.kit\" at 00000000-00000596-00000046-1936295\n \"file.exe\" queries volume information of \"%ALLUSERSPROFILE%\\WindowsSoftwareToolkit\\visual.1991-06.com.microsoft_sd.kit\" at 00000000-00000596-00000046-1940017","origin":"API Call","mitre_attack_id":"T1120","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"6323325635d3af22000ae4bc"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"gendoraduragonkgp126.com\"","origin":"Network Traffic","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"6323325635d3af22000ae4bc"}]},{"level":"informative","category":"General","name":"Found API related strings","description":"\"qtopengltest\" (Indicator: \"open\")\n \"qtopenglproxytest\" (Indicator: \"open\")\n \"..\\..\\..\\3rdparty\\libtiff\\libtiff\\tif_open.c\" (Indicator: \"open\")\n \"src\\hb-open-type-private.hh\" (Indicator: \"open\")\n \"select-all\" (Indicator: \"select\")\n \":/qt-project.org/windows/openglblacklists/default.json\" (Indicator: \"open\")\n \"ThemeApiConnectionRequest\" (Indicator: \"ThemeApiConnectionRequest\")","origin":"File/Memory","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"6323325635d3af22000ae4bc"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"\"schtasks.exe\" touched \"TaskScheduler class\" (Path: \"HKCU\\CLSID\\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\")","origin":"Registry Access","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"6323325635d3af22000ae4bc"}]},{"level":"informative","category":"General","name":"Runs shell commands","description":"\"/c bcdedit\" on 2022-9-15.14:50:00.296\n \"/c schtasks /create /tn \"OneDrive AutoRemove\" /tr \"%WINDIR%\\System32\\cmd.exe /c del /f /q C:/file.exe\" /sc daily /st 10:30:30 /ru SYSTEM\" on 2022-9-15.14:51:00.296\n \"/c schtasks /delete /f /tn \"Microsoft\\Windows\\light Service Manager\"\" on 2022-9-15.14:52:00.734\n \"/c bcdedit\" on 2022-9-15.14:53:00.703\n \"/c schtasks /create /tn \"Microsoft\\Windows\\light Service Manager\" /tr C:/file.exe /sc onstart /ru SYSTEM\" on 2022-9-15.14:55:00.343","origin":"Monitored Target","mitre_attack_id":"T1059.003","relevance":5,"id":"target-3","sources":[{"report_type":"sandbox","report_id":"6323325635d3af22000ae4bc"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API's typically used for searching a directory for a files","description":"\"cmd.exe\" called \"FindFirstFileW\" (UID: 00000000-00003680)\n \"cmd.exe\" called \"FindFirstFileW\" (UID: 00000000-00001868)\n \"cmd.exe\" called \"FindFirstFileW\" (UID: 00000000-00001860)","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"6323325635d3af22000ae4bc"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"3/35 Antivirus vendors marked sample as malicious (8% detection rate)\n 46/71 Antivirus vendors marked sample as malicious (64% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6323325635d3af22000ae4bc"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"$45","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"6323325635d3af22000ae4bc"}]},{"level":"suspicious","category":"Remote Access Related","name":"Reads terminal service related keys (often RDP related)","description":"\"file.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TERMINAL SERVER\"; Key: \"TSUSERENABLED\")\n \"file.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TERMINAL SERVER\"; Key: \"TSAPPCOMPAT\")","origin":"Registry Access","mitre_attack_id":"T1021.001","relevance":10,"id":"registry-61","sources":[{"report_type":"sandbox","report_id":"6323325635d3af22000ae4bc"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"46/71 Antivirus vendors marked sample as malicious (64% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"6323325635d3af22000ae4bc"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted Antivirus engine","description":"No specific details available","origin":"External System","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"6323325635d3af22000ae4bc"}]},{"level":"malicious","category":"General","name":"The analysis spawned a process that was identified as malicious","description":"41/95 Antivirus vendors marked spawned process \"file.exe\" (PID: 596) as malicious (classified as \"Trojan.MagicRAT\" with 43% detection rate)","origin":"Monitored Target","relevance":10,"id":"target-58","sources":[{"report_type":"sandbox","report_id":"6323325635d3af22000ae4bc"}]},{"level":"malicious","category":"Network Related","name":"Malicious artifacts seen in the context of a contacted host","description":"Found malicious artifacts related to \"64.188.27.73\": ...\n\n URL: http://64.188.27.73/board/pct.gif (AV positives: 10/88 scanned on 09/15/2022 03:19:34)\n URL: http://64.188.27.73/board/logo_adm_org.gif (AV positives: 9/88 scanned on 09/15/2022 03:12:37)\n URL: http://64.188.27.73/board/mfcom1.gif (AV positives: 10/88 scanned on 09/15/2022 03:06:04)\n URL: http://64.188.27.73/board/tour_upt.html (AV positives: 9/88 scanned on 09/15/2022 03:03:41)\n URL: http://64.188.27.73/boardboard/pct.gif (AV positives: 8/88 scanned on 09/13/2022 08:05:38)\n File SHA256: f6827dc5af661fbb4bf64bc625c78283ef836c6985bb2bfb836bd0c8d5397332 (Date: 07/19/2022 08:33:26)\n File SHA256: bffe910904efd1f69544daa9b72f2a70fb29f73c51070bde4ea563de862ce4b1 (AV positives: 44/72 scanned on 06/09/2022 09:56:52)\n File SHA256: d20959b615af699d8fff3f0087faade16ed4919355a458a32f5ae61badb5b0ca (AV positives: 40/72 scanned on 05/26/2022 07:35:39)","origin":"Network Traffic","relevance":10,"id":"network-21","sources":[{"report_type":"sandbox","report_id":"6323325635d3af22000ae4bc"}]},{"level":"malicious","category":"Ransomware/Banking","name":"Tries to disable/delete scheduled tasks","description":"Process \"schtasks.exe\" with commandline \"schtasks /delete /f /tn \"Microsoft\\Windows\\light Service Manager\"\" (UID: 00000000-00002588)","origin":"Monitored Target","mitre_attack_id":"T1562.001","relevance":7,"id":"target-177","sources":[{"report_type":"sandbox","report_id":"6323325635d3af22000ae4bc"}]},{"level":"informative","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"SURICATA IPv4 invalid checksum\" (SID: 2200073, Rev: 2, Severity: 3) categorized as \"Generic Protocol Command Decode\"\n Detected alert \"SURICATA UDPv4 invalid checksum\" (SID: 2200075, Rev: 2, Severity: 3) categorized as \"Generic Protocol Command Decode\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-0","sources":[{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"level":"suspicious","category":"General","name":"Delete file or directory","description":"Process \"cmd.exe\" with commandline \"/c schtasks /create /tn \"OneDrive AutoRemove\" /tr \"%WINDIR%\\\\System32\\\\cmd.exe /c del /f /q C:/file.exe\" /sc daily /st 10:30:30 /ru SYSTEM\" (UID: 00000000-00005792)\n Process \"schtasks.exe\" with commandline \"schtasks /create /tn \"OneDrive AutoRemove\" /tr \"%WINDIR%\\\\System32\\\\cmd.exe /c del /f /q C:/file.exe\" /sc daily /st 10:30:30 /ru SYSTEM\" (UID: 00000000-00005716)","origin":"Monitored Target","mitre_attack_id":"T1070.004","relevance":3,"id":"target-164","sources":[{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"\"file.exe.bin\" has type \"PE32+ executable (GUI) x86-64 (stripped to external PDB) for MS Windows\"- [targetUID: N/A]","origin":"Binary File","mitre_attack_id":"T1105","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]}],"incidents":[{"name":"Spyware","details_count":1,"details":[{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"name":"Persistence","details_count":3,"details":[{"detail":"Interacts with the primary disk partition (DR0)"},{"detail":"Schedules a task to be executed at a specific time and date"},{"detail":"Spawns a lot of processes"}],"sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"6323325635d3af22000ae4bc"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"name":"Evasive","details_count":2,"details":[{"detail":"Marks file for deletion"},{"detail":"Tries to delete scheduled tasks"}],"sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"6323325635d3af22000ae4bc"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 1 domain and 1 host"}],"sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"6323325635d3af22000ae4bc"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"name":"Fingerprint","details_count":1,"details":[{"detail":"Queries process information"}],"sources":[{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"6323325635d3af22000ae4bc"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"name":"Remote Access","details_count":1,"details":[{"detail":"Reads terminal service related keys (often RDP related)"}],"sources":[{"report_type":"sandbox","report_id":"6323325635d3af22000ae4bc"}]}]},"activity":{"stats":{"process_count":12,"spawned_processes_count":12,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":14,"imported_dlls_count":81,"dropped_files_count":0,"extracted_files_count":7,"files_written_count":14,"files_deleted_count":0,"registry_keys_created_count":3,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":3,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":2,"dns_resolutions_count":1,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["criminal","downloader","elarzero","gop","guardianofpeace","loader","operationtroy","scripttrawler","silentchollima","suspicious","targeted","targetedcrimeware","tigerloader","whoisteam","jigsaw","keylogger","ransomware"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"672bf6ec75b123157b07fcbb","environment_id":140,"environment_description":"Windows 11 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"contacted_countries":["USA"],"submit_name":"file","analysis_start_time":"2024-11-06T23:09:52+00:00","indicators_count":{"informative":148,"suspicious":34,"malicious":5},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true},{"id":"672bf6e443ced817e604865e","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"contacted_countries":["USA"],"submit_name":"file","analysis_start_time":"2024-11-06T23:08:22+00:00","indicators_count":{"informative":153,"suspicious":35,"malicious":5},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true},{"id":"672bf6dca5f15d46e8041ba5","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"contacted_countries":["USA"],"submit_name":"file","analysis_start_time":"2024-11-06T23:08:16+00:00","indicators_count":{"informative":155,"suspicious":33,"malicious":6},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true},{"id":"63233b9b46334908c75107da","environment_id":110,"environment_description":"Windows 7 32 bit (HWP Support)","state":"ERROR","error_type":"Analysis failed.","verdict":"undetected","submit_name":"tmpzkizu8h_","analysis_start_time":"2022-09-15T14:50:04+00:00","indicators_count":{"informative":0,"suspicious":0,"malicious":0},"is_in_unified_schema":false},{"id":"6323325635d3af22000ae4bc","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.MagicRAT","contacted_countries":["JPN","USA"],"submit_name":"file","analysis_start_time":"2022-09-15T14:10:33+00:00","indicators_count":{"informative":24,"suspicious":16,"malicious":9},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"64.188.27.73","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"6323325635d3af22000ae4bc"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"address":"153.248.16.141","port":80,"protocol":"TCP","country":"Japan","sources":[{"report_type":"sandbox","report_id":"6323325635d3af22000ae4bc"}]}],"dns_resolutions":[{"domain":"gendoraduragonkgp126.com","country":"-","sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"6323325635d3af22000ae4bc"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]}],"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6323325635d3af22000ae4bc"}],"processes":[{"pid":3816,"ppid":0,"name":"file.exe","command_line":"","sha256":"f6827dc5af661fbb4bf64bc625c78283ef836c6985bb2bfb836bd0c8d5397332","normalized_path":"C:\\file.exe","uid":"00000000-00003816","icon":"$46"},{"pid":3248,"ppid":3816,"name":"cmd.exe","command_line":"/c bcdedit","sha256":"db06c3534964e3fc79d2763144ba53742d7fa250ca336f4a0fe724b75aaff386","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00003816","uid":"00000000-00003248"},{"pid":1180,"ppid":3248,"name":"bcdedit.exe","command_line":"","sha256":"29dbfde0ab20f31de72b8a9b50f9843ae7cafb62933f4f306e7168d4acf33947","normalized_path":"%WINDIR%\\system32\\bcdedit.exe","parent_uid":"00000000-00003248","uid":"00000000-00001180"},{"pid":3680,"ppid":3816,"name":"cmd.exe","command_line":"/c schtasks /create /tn \"OneDrive AutoRemove\" /tr \"%WINDIR%\\System32\\cmd.exe /c del /f /q C:/file.exe\" /sc daily /st 10:30:30 /ru SYSTEM","sha256":"db06c3534964e3fc79d2763144ba53742d7fa250ca336f4a0fe724b75aaff386","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00003816","uid":"00000000-00003680"},{"pid":756,"ppid":3680,"name":"schtasks.exe","command_line":"schtasks /create /tn \"OneDrive AutoRemove\" /tr \"%WINDIR%\\System32\\cmd.exe /c del /f /q C:/file.exe\" /sc daily /st 10:30:30 /ru SYSTEM","sha256":"6dce7d58ebb0d705fcb4179349c441b45e160c94e43934c5ed8fa1964e2cd031","normalized_path":"%WINDIR%\\system32\\schtasks.exe","parent_uid":"00000000-00003680","uid":"00000000-00000756"},{"pid":1868,"ppid":3816,"name":"cmd.exe","command_line":"/c schtasks /delete /f /tn \"Microsoft\\Windows\\light Service Manager\"","sha256":"db06c3534964e3fc79d2763144ba53742d7fa250ca336f4a0fe724b75aaff386","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00003816","uid":"00000000-00001868"},{"pid":2588,"ppid":1868,"name":"schtasks.exe","command_line":"schtasks /delete /f /tn \"Microsoft\\Windows\\light Service Manager\"","sha256":"6dce7d58ebb0d705fcb4179349c441b45e160c94e43934c5ed8fa1964e2cd031","normalized_path":"%WINDIR%\\system32\\schtasks.exe","parent_uid":"00000000-00001868","uid":"00000000-00002588"},{"pid":1860,"ppid":3816,"name":"cmd.exe","command_line":"/c bcdedit","sha256":"db06c3534964e3fc79d2763144ba53742d7fa250ca336f4a0fe724b75aaff386","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00003816","uid":"00000000-00001860"},{"pid":2340,"ppid":1860,"name":"bcdedit.exe","command_line":"","sha256":"29dbfde0ab20f31de72b8a9b50f9843ae7cafb62933f4f306e7168d4acf33947","normalized_path":"%WINDIR%\\system32\\bcdedit.exe","parent_uid":"00000000-00001860","uid":"00000000-00002340"},{"pid":3308,"ppid":3816,"name":"cmd.exe","command_line":"/c schtasks /create /tn \"Microsoft\\Windows\\light Service Manager\" /tr C:/file.exe /sc onstart /ru SYSTEM","sha256":"db06c3534964e3fc79d2763144ba53742d7fa250ca336f4a0fe724b75aaff386","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00003816","uid":"00000000-00003308"},{"pid":4004,"ppid":3308,"name":"schtasks.exe","command_line":"schtasks /create /tn \"Microsoft\\Windows\\light Service Manager\" /tr C:/file.exe /sc onstart /ru SYSTEM","sha256":"6dce7d58ebb0d705fcb4179349c441b45e160c94e43934c5ed8fa1964e2cd031","normalized_path":"%WINDIR%\\system32\\schtasks.exe","parent_uid":"00000000-00003308","uid":"00000000-00004004"},{"pid":596,"ppid":0,"name":"file.exe","command_line":"","sha256":"f6827dc5af661fbb4bf64bc625c78283ef836c6985bb2bfb836bd0c8d5397332","normalized_path":"C:\\file.exe","uid":"00000000-00000596","icon":"$47"}],"all_imported_dlls":["dwmapi.dll","imm32.dll","wkscli.dll","samcli.dll","webio.dll","credssp.dll","cfgmgr32.dll","nsi.dll","api-ms-win-core-synch-l1-2-0.dll","dhcpcsvc.dll","winhttp.dll","taskschd.dll","rpcrt4.dll","gdi32.dll","netapi32.dll","ws2_32.dll","xmllite.dll","msvcrt.dll","winrnr.dll","ktmw32.dll","NapiNSP.dll","cryptsp.dll","netutils.dll","uxtheme.dll","dhcpcsvc6.dll","nlaapi.dll","WSHTCPIP.DLL","wship6.dll","sechost.dll","srvcli.dll","userenv.dll","version.dll","wtsapi32.dll","pnrpnsp.dll","winbrand.dll","oleaut32.dll","kernel32.dll","fltLib.dll","tzres.dll","clbcatq.dll","IPHLPAPI.DLL","cryptbase.dll","ntdll.dll","advapi32.dll","msasn1.dll","winnsi.dll","apphelp.dll","KernelBase.dll","profapi.dll","winmm.dll","lpk.dll","msctf.dll","ole32.dll","psapi.dll","rpcss.dll","crypt32.dll","user32.dll","VxSSL64.dll","mswsock.dll","rasadhlp.dll","usp10.dll","shell32.dll","dnsapi.dll","sspicli.dll","shlwapi.dll","bcryptprimitives.dll","winmmbase.dll","OnDemandConnRouteHelper.dll","powrprof.dll","kernel.appcore.dll","msvcp_win.dll","combase.dll","ucrtbase.dll","gdi32full.dll","SHCore.dll","windows.storage.dll","win32u.dll","FWPUCLNT.DLL","WinTypes.dll","nlansp_c.dll","wshbth.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"visual.1991-06.com.microsoft_sd.kit.kdDFyh","sha256":"9887f5042901e4e0759ffa963fef18ae2a9affb663fbcabdc886740adba28c8c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"}]},{"name":"visual.1991-06.com.microsoft_sd.kit.lock","sha256":"50efc08313ea2d4c2cfce7a1ae49b7410ee5277634f120dd55172d456f2e0aa6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"6323325635d3af22000ae4bc"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"name":"visual.1991-06.com.microsoft_sd.kit.nCwwHh","sha256":"9887f5042901e4e0759ffa963fef18ae2a9affb663fbcabdc886740adba28c8c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"}]},{"name":"visual.1991-06.com.microsoft_sd.kit.UZdkbl","sha256":"9887f5042901e4e0759ffa963fef18ae2a9affb663fbcabdc886740adba28c8c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6323325635d3af22000ae4bc"}]},{"name":"visual.1991-06.com.microsoft_sd.kit.mhaobs","sha256":"9887f5042901e4e0759ffa963fef18ae2a9affb663fbcabdc886740adba28c8c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6323325635d3af22000ae4bc"}]},{"name":"file.exe.bin","sha256":"f6827dc5af661fbb4bf64bc625c78283ef836c6985bb2bfb836bd0c8d5397332","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6323325635d3af22000ae4bc"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"name":"visual.1991-06.com.microsoft_sd.kit.zJKMNm","sha256":"9887f5042901e4e0759ffa963fef18ae2a9affb663fbcabdc886740adba28c8c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]}],"files_written":[{"path":"\\FileSystem\\Filters\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{846EE342-7039-11DE-9D20-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"6323325635d3af22000ae4bc"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{B1B7B0FA-A148-4AFC-9AC6-41A074232BA5}","sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"}]},{"path":"C:\\ProgramData","sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"6323325635d3af22000ae4bc"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"path":"%ALLUSERSPROFILE%\\WindowsSoftwareToolkit\\visual.1991-06.com.microsoft_sd.kit.yXINol","sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"}]},{"path":"%ALLUSERSPROFILE%\\WindowsSoftwareToolkit\\visual.1991-06.com.microsoft_sd.kit.lock","sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"path":"%ALLUSERSPROFILE%\\WindowsSoftwareToolkit\\visual.1991-06.com.microsoft_sd.kit.kdDFyh","sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"}]},{"path":"%ALLUSERSPROFILE%\\WindowsSoftwareToolkit\\visual.1991-06.com.microsoft_sd.kit.qRmMEZ","sources":[{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"}]},{"path":"%ALLUSERSPROFILE%\\WindowsSoftwareToolkit\\visual.1991-06.com.microsoft_sd.kit.nCwwHh","sources":[{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{C3450F58-7060-4AEA-B0A0-C245927D78D0}","sources":[{"report_type":"sandbox","report_id":"6323325635d3af22000ae4bc"}]},{"path":"%ALLUSERSPROFILE%\\WindowsSoftwareToolkit\\visual.1991-06.com.microsoft_sd.kit.ZTAxBp","sources":[{"report_type":"sandbox","report_id":"6323325635d3af22000ae4bc"}]},{"path":"%ALLUSERSPROFILE%\\WindowsSoftwareToolkit\\visual.1991-06.com.microsoft_sd.kit.mhaobs","sources":[{"report_type":"sandbox","report_id":"6323325635d3af22000ae4bc"}]},{"path":"%ALLUSERSPROFILE%\\WindowsSoftwareToolkit\\visual.1991-06.com.microsoft_sd.kit.LwiUDJ","sources":[{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"path":"%ALLUSERSPROFILE%\\WindowsSoftwareToolkit\\visual.1991-06.com.microsoft_sd.kit.zJKMNm","sources":[{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"key":"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"6323325635d3af22000ae4bc"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\CONNECTIONS\\","sources":[{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\DBWinMutex","sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"6323325635d3af22000ae4bc"},{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"name":"DBWinMutex","sources":[{"report_type":"sandbox","report_id":"672bf6dca5f15d46e8041ba5"},{"report_type":"sandbox","report_id":"672bf6e443ced817e604865e"},{"report_type":"sandbox","report_id":"6323325635d3af22000ae4bc"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6612:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6612:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2972:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"name":"Local\\SM0:2972:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5792:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"name":"Local\\SM0:5792:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7096:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"name":"Local\\SM0:7096:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2128:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"name":"Local\\SM0:2128:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6232:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]},{"name":"Local\\SM0:6232:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"672bf6ec75b123157b07fcbb"}]}]}},"report_ids":{"sandbox_job_ids":["672bf6e443ced817e604865e","672bf6dca5f15d46e8041ba5","672bf6ec75b123157b07fcbb","6323325635d3af22000ae4bc"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Trojan.MagicRAT Sample f6827dc5af66… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample f6827dc5af66…. Malware family: Trojan.MagicRAT. Threat score 100/100. 15/26 AV engines flagged this file. 12 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/f6827dc5af661fbb4bf64bc625c78283ef836c6985bb2bfb836bd0c8d5397332"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.MagicRAT Sample f6827dc5af66… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample f6827dc5af66…. Malware family: Trojan.MagicRAT. Threat score 100/100. 15/26 AV engines flagged this file. 12 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/f6827dc5af661fbb4bf64bc625c78283ef836c6985bb2bfb836bd0c8d5397332"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.MagicRAT Sample f6827dc5af66… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample f6827dc5af66…. Malware family: Trojan.MagicRAT. Threat score 100/100. 15/26 AV engines flagged this file. 12 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L48","11",{}]]