34:"SampleDetailWrapper" 35:I[7638,["$1","$2","$3","$4","$5","$8","$9","$a","$b"],"$34"] 4d:I[99539,["$1","$2","$3","$4","$5"],"IconMark"] 33:T4c9,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious TrojanDldr.Agent.BX Sample f9761da0d282… — Score 65/100 — Hybrid Analysis","description":"Malicious verdict for sample f9761da0d282…. Malware family: TrojanDldr.Agent.BX. Threat score 65/100. 1/26 AV engines flagged this file. 1 malicious and 11 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666","keywords":["Malicious","TrojanDldr.Agent.BX","malware analysis","sandbox report","threat intelligence","f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666"],"about":{"@type":"SoftwareApplication","name":"f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666","applicationCategory":["compressed","7zip"],"identifier":"f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666","additionalType":"Malicious sample"},"threatScore":65,"malwareFamily":"TrojanDldr.Agent.BX","antivirusDetections":{"malicious":1,"total":26},"behavioralIndicators":{"malicious":1,"suspicious":11},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}36:T2c21,Found reference to API (Indicator: "DeleteFileA"; Source: "sample.bin"), Found reference to API (Indicator: "AdjustTokenPrivileges"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemMenu"; Source: "sample.bin"), Found reference to API (Indicator: "DestroyWindow"; Source: "sample.bin"), Found reference to API (Indicator: "MulDiv"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileAttributesA"; Source: "sample.bin"), Found reference to API (Indicator: "GetPrivateProfileStringA"; Source: "sample.bin"), Found reference to API (Indicator: "SetForegroundWindow"; Source: "sample.bin"), Found reference to API (Indicator: "SeShutdownPrivilege"; Source: "sample.bin"), Found reference to API (Indicator: "SelectObject"; Source: "sample.bin"), Found reference to API (Indicator: "InvalidateRect"; Source: "sample.bin"), Found reference to API (Indicator: "SHBrowseForFolderA"; Source: "sample.bin"), Found reference to API (Indicator: "lstrcmpA"; Source: "sample.bin"), Found reference to API (Indicator: "GetExitCodeProcess"; Source: "sample.bin"), Found reference to API (Indicator: "SendMessageTimeoutA"; Source: "sample.bin"), Found reference to API (Indicator: "ExitProcess"; Source: "sample.bin"), Found reference to API (Indicator: "GetClassInfoA"; Source: "sample.bin"), Found reference to API (Indicator: "OleInitialize"; Source: "sample.bin"), Found reference to API (Indicator: "DrawTextA"; Source: "sample.bin"), Found reference to API (Indicator: "IsWindowEnabled"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemDirectoryA"; Source: "sample.bin"), Found reference to API (Indicator: "CreateDirectoryA"; Source: "sample.bin"), Found reference to API (Indicator: "SHGetPathFromIDListA"; Source: "sample.bin"), Found reference to API (Indicator: "CreateWindowExA"; Source: "sample.bin"), Found reference to API (Indicator: "DefWindowProcA"; Source: "sample.bin"), Found reference to API (Indicator: "LoadImageA"; Source: "sample.bin"), Found reference to API (Indicator: "RegDeleteKeyA"; Source: "sample.bin"), Found reference to API (Indicator: "WritePrivateProfileStringA"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleFileNameA"; Source: "sample.bin"), Found reference to API (Indicator: "GlobalFree"; Source: "sample.bin"), Found reference to API (Indicator: "LoadLibraryA"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileSize"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentProcess"; Source: "sample.bin"), Found reference to API (Indicator: "GetClientRect"; Source: "sample.bin"), Found reference to API (Indicator: "SetEnvironmentVariableA"; Source: "sample.bin"), Found reference to API (Indicator: "lstrcatA"; Source: "sample.bin"), Found reference to API (Indicator: "CreateThread"; Source: "sample.bin"), Found reference to API (Indicator: "LoadLibraryExA"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileVersionInfoSizeA"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleHandleA"; Source: "sample.bin"), Found reference to API (Indicator: "SystemParametersInfoA"; Source: "sample.bin"), Found reference to API (Indicator: "CopyFileA"; Source: "sample.bin"), Found reference to API (Indicator: "PostQuitMessage"; Source: "sample.bin"), Found reference to API (Indicator: "RegQueryValueExA"; Source: "sample.bin"), Found reference to API (Indicator: "RegDeleteValueA"; Source: "sample.bin"), Found reference to API (Indicator: "RegSetValueExA"; Source: "sample.bin"), Found reference to API (Indicator: "BeginPaint"; Source: "sample.bin"), Found reference to API (Indicator: "GetWindowRect"; Source: "sample.bin"), Found reference to API (Indicator: "CharPrevA"; Source: "sample.bin"), Found reference to API (Indicator: "SetCursor"; Source: "sample.bin"), Found reference to API (Indicator: "SetFileAttributesA"; Source: "sample.bin"), Found reference to API (Indicator: "RegOpenKeyExA"; Source: "sample.bin"), Found reference to API (Indicator: "ShellExecuteA"; Source: "sample.bin"), Found reference to API (Indicator: "lstrcmpiA"; Source: "sample.bin"), Found reference to API (Indicator: "FillRect"; Source: "sample.bin"), Found reference to API (Indicator: "GetDeviceCaps"; Source: "sample.bin"), Found reference to API (Indicator: "ReleaseDC"; Source: "sample.bin"), Found reference to API (Indicator: "GetFullPathNameA"; Source: "sample.bin"), Found reference to API (Indicator: "CharNextA"; Source: "sample.bin"), Found reference to API (Indicator: "GetUserDefaultUILanguage"; Source: "sample.bin"), Found reference to API (Indicator: "lstrcpynA"; Source: "sample.bin"), Found reference to API (Indicator: "RegDeleteKeyExA"; Source: "sample.bin"), Found reference to API (Indicator: "SHGetFolderPathA"; Source: "sample.bin"), Found reference to API (Indicator: "SetWindowPos"; Source: "sample.bin"), Found reference to API (Indicator: "ShowWindow"; Source: "sample.bin"), Found reference to API (Indicator: "CoCreateInstance"; Source: "sample.bin"), Found reference to API (Indicator: "SetClipboardData"; Source: "sample.bin"), Found reference to API (Indicator: "SetWindowTextA"; Source: "sample.bin"), Found reference to API (Indicator: "ExpandEnvironmentStringsA"; Source: "sample.bin"), Found reference to API (Indicator: "OleUninitialize"; Source: "sample.bin"), Found reference to API (Indicator: "SendMessageA"; Source: "sample.bin"), Found reference to API (Indicator: "VerQueryValueA"; Source: "sample.bin"), Found reference to API (Indicator: "DispatchMessageA"; Source: "sample.bin"), Found reference to API (Indicator: "EnableWindow"; Source: "sample.bin"), Found reference to API (Indicator: "PeekMessageA"; Source: "sample.bin"), Found reference to API (Indicator: "SHGetFileInfoA"; Source: "sample.bin"), Found reference to API (Indicator: "DeleteObject"; Source: "sample.bin"), Found reference to API (Indicator: "EmptyClipboard"; Source: "sample.bin"), Found reference to API (Indicator: "RegEnumValueA"; Source: "sample.bin"), Found reference to API (Indicator: "SetErrorMode"; Source: "sample.bin"), Found reference to API (Indicator: "IsWindowVisible"; Source: "sample.bin"), Found reference to API (Indicator: "SetClassLongA"; Source: "sample.bin"), Found reference to API (Indicator: "GetWindowLongA"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileVersionInfoA"; Source: "sample.bin"), Found reference to API (Indicator: "LookupPrivilegeValueA"; Source: "sample.bin"), Found reference to API (Indicator: "GlobalUnlock"; Source: "sample.bin"), Found reference to API (Indicator: "GetCommandLineA"; Source: "sample.bin"), Found reference to API (Indicator: "SearchPathA"; Source: "sample.bin"), Found reference to API (Indicator: "FindFirstFileA"; Source: "sample.bin"), Found reference to API (Indicator: "GetProcAddress"; Source: "sample.bin"), Found reference to API (Indicator: "MoveFileExA"; Source: "sample.bin"), Found reference to API (Indicator: "CreateFileA"; Source: "sample.bin"), Found reference to API (Indicator: "WriteFile"; Source: "sample.bin"), Found reference to API (Indicator: "Sleep"; Source: "sample.bin"), Found reference to API (Indicator: "SHGetSpecialFolderLocation"; Source: "sample.bin"), Found reference to API (Indicator: "wsprintfA"; Source: "sample.bin"), Found reference to API (Indicator: "GlobalAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "SetFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "EnableMenuItem"; Source: "sample.bin"), Found reference to API (Indicator: "RegCloseKey"; Source: "sample.bin"), Found reference to API (Indicator: "FindWindowExA"; Source: "sample.bin"), Found reference to API (Indicator: "CompareFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "GetTempPathA"; Source: "sample.bin"), Found reference to API (Indicator: "CreateProcessA"; Source: "sample.bin"), Found reference to API (Indicator: "SetTimer"; Source: "sample.bin"), Found reference to API (Indicator: "FreeLibrary"; Source: "sample.bin"), Found reference to API (Indicator: "LoadCursorA"; Source: "sample.bin"), Found reference to API (Indicator: "RegCreateKeyExA"; Source: "sample.bin"), Found reference to API (Indicator: "RemoveDirectoryA"; Source: "sample.bin"), Found reference to API (Indicator: "FindNextFileA"; Source: "sample.bin"), Found reference to API (Indicator: "SetWindowLongA"; Source: "sample.bin"), Found reference to API (Indicator: "TrackPopupMenu"; Source: "sample.bin"), Found reference to API (Indicator: "GlobalLock"; Source: "sample.bin"), Found reference to API (Indicator: "FindClose"; Source: "sample.bin"), Found reference to API (Indicator: "ReadFile"; Source: "sample.bin"), Found reference to API (Indicator: "CallWindowProcA"; Source: "sample.bin"), Found reference to API (Indicator: "CloseClipboard"; Source: "sample.bin"), Found reference to API (Indicator: "OpenProcessToken"; Source: "sample.bin"), Found reference to API (Indicator: "IsWindow"; Source: "sample.bin"), Found reference to API (Indicator: "ExitWindowsEx"; Source: "sample.bin"), Found reference to API (Indicator: "RegEnumKeyA"; Source: "sample.bin"), Found reference to API (Indicator: "GetTempFileNameA"; Source: "sample.bin"), Found reference to API (Indicator: "lstrcpyA"; Source: "sample.bin"), Found reference to API (Indicator: "GetVersion"; Source: "sample.bin"), Found reference to API (Indicator: "MoveFileA"; Source: "sample.bin"), Found reference to API (Indicator: "ScreenToClient"; Source: "sample.bin"), Found reference to API (Indicator: "GetLastError"; Source: "sample.bin"), Found reference to API (Indicator: "RegisterClassA"; Source: "sample.bin"), Found reference to API (Indicator: "GetTickCount"; Source: "sample.bin"), Found reference to API (Indicator: "SetCurrentDirectoryA"; Source: "sample.bin"), Found reference to API (Indicator: "GetDC"; Source: "sample.bin"), Found reference to API (Indicator: "lstrlenA"; Source: "sample.bin"), Found reference to API (Indicator: "AppendMenuA"; Source: "sample.bin"), Found reference to API (Indicator: "CreateFontIndirectA"; Source: "sample.bin"), Found reference to API (Indicator: "MultiByteToWideChar"; Source: "sample.bin"), Found reference to API (Indicator: "GetDiskFreeSpaceA"; Source: "sample.bin"), Found reference to API (Indicator: "SHFileOperationA"; Source: "sample.bin"), Found reference to API (Indicator: "SetFilePointer"; Source: "sample.bin"), Found reference to API (Indicator: "CoTaskMemFree"; Source: "sample.bin"), Found reference to API (Indicator: "GetWindowsDirectoryA"; Source: "sample.bin"), Found reference to API (Indicator: "CreatePopupMenu"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemMetrics"; Source: "sample.bin"), Found reference to API (Indicator: "GetDiskFreeSpaceExA"; Source: "sample.bin"), Found reference to API (Indicator: "WaitForSingleObject"; Source: "sample.bin"), Found reference to API (Indicator: "GetSysColor"; Source: "sample.bin"), Found reference to API (Indicator: "LoadBitmapA"; Source: "sample.bin"), Found reference to API (Indicator: "OpenClipboard"; Source: "sample.bin"), Found reference to API (Indicator: "CloseHandle"; Source: "sample.bin"), Found reference to API (Indicator: "GetShortPathNameA"; Source: "sample.bin")37:T13f2,"f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES\40AA38731BD189F9CDB5B9DC35E2136F38777AF4") "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES\43D9BCB568E039D073A74A71D8511F7476089CC3") "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES\471C949A8143DB5AD5CDF1C972864A2504FA23C9") "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES\51C3247D60F356C7CA3BAF4C3F429DAC93EE7B74") "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES\5DE83EE82AC5090AEA9D6AC4E7A6E213F946E179") "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES\61793FCBFA4F9008309BBA5FF12D2CB29CD4151A") "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES\637162CC59A3A1E25956FA5FA8F60D2E1C52EAC6") "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES\63FEAE960BAA91E343CE2BD8B71798C76BDB77D0") "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES\6431723036FD26DEA502792FA595922493030F97") "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES\7D7F4414CCEF168ADF6BF40753B5BECD78375931") "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES\80962AE4D6C5B442894E95A13E4A699E07D694CF") "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES\86E817C81A5CA672FE000F36F878C19518D6F844") "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES\8E5BD50D6AE686D65252F843A9D4B96D197730AB") "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES\9845A431D51959CAF225322B4A4FE9F223CE6D15") "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES\B533345D06F64516403C00DA03187D3BFEF59156") "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES\B86E791620F759F17B8D25E38CA8BE32E7D5EAC2") "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES\C060ED44CBD881BD0EF86C0BA287DDCF8167478C") "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES\CEA586B2CE593EC7D939898337C57814708AB2BE") "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES\D018B62DC518907247DF50925BB09ACF4A5CB3AD") "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES\F8A54E03AADC5692B850496A4C4630FFEAA29D83") "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES\FA6660A94AB45F6A88C0D7874D89A863D74DEE97") "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES")38:T1264,Found api reference "CryptQueryObject" (Indicator: "CryptQueryObject"; Source: "00000000-00004372.00000000.90136.00409000.00000004.mdmp, 00000000-00004372.00000000.90136.680A2000.00000002.mdmp, 00000000-00004372.00000001.90199.00409000.00000004.mdmp") Found api reference "CryptMsgClose" (Indicator: "CryptMsgClose"; Source: "00000000-00004372.00000000.90136.00409000.00000004.mdmp, 00000000-00004372.00000000.90136.680A2000.00000002.mdmp, 00000000-00004372.00000001.90199.00409000.00000004.mdmp") Found api reference "CertCloseStore" (Indicator: "CertCloseStore"; Source: "00000000-00004372.00000000.90136.00409000.00000004.mdmp, 00000000-00004372.00000000.90136.680A2000.00000002.mdmp, 00000000-00004372.00000001.90199.00409000.00000004.mdmp") Found api reference "CryptReleaseContext" (Indicator: "CryptReleaseContext"; Source: "00000000-00004372.00000000.90136.00409000.00000004.mdmp, 00000000-00004372.00000000.90136.680A2000.00000002.mdmp, 00000000-00004372.00000001.90199.00409000.00000004.mdmp") Found api reference "CryptDestroyHash" (Indicator: "CryptDestroyHash"; Source: "00000000-00004372.00000000.90136.00409000.00000004.mdmp, 00000000-00004372.00000000.90136.680A2000.00000002.mdmp, 00000000-00004372.00000001.90199.00409000.00000004.mdmp") Found api reference "CryptGetHashParam" (Indicator: "CryptGetHashParam"; Source: "00000000-00004372.00000000.90136.00409000.00000004.mdmp, 00000000-00004372.00000000.90136.680A2000.00000002.mdmp, 00000000-00004372.00000001.90199.00409000.00000004.mdmp") Found api reference "CryptHashData" (Indicator: "CryptHashData"; Source: "00000000-00004372.00000000.90136.00409000.00000004.mdmp, 00000000-00004372.00000000.90136.680A2000.00000002.mdmp, 00000000-00004372.00000001.90199.00409000.00000004.mdmp") Found api reference "CryptCreateHash" (Indicator: "CryptCreateHash"; Source: "00000000-00004372.00000000.90136.00409000.00000004.mdmp, 00000000-00004372.00000000.90136.680A2000.00000002.mdmp, 00000000-00004372.00000001.90199.00409000.00000004.mdmp") Found api reference "CryptAcquireContextW" (Indicator: "CryptAcquireContextW"; Source: "00000000-00004372.00000000.90136.00409000.00000004.mdmp, 00000000-00004372.00000000.90136.680A2000.00000002.mdmp, 00000000-00004372.00000001.90199.00409000.00000004.mdmp") Found api reference "CryptMsgGetParam" (Indicator: "CryptMsgGetParam"; Source: "00000000-00004372.00000000.90136.00409000.00000004.mdmp, 00000000-00004372.00000000.90136.680A2000.00000002.mdmp, 00000000-00004372.00000001.90199.00409000.00000004.mdmp") Found api reference "CertGetSubjectCertificateFromStore" (Indicator: "CertGetSubjectCertificateFromStore"; Source: "00000000-00004372.00000000.90136.00409000.00000004.mdmp, 00000000-00004372.00000000.90136.680A2000.00000002.mdmp, 00000000-00004372.00000001.90199.00409000.00000004.mdmp") Found api reference "CertGetCertificateChain" (Indicator: "CertGetCertificateChain"; Source: "00000000-00004372.00000000.90136.00409000.00000004.mdmp, 00000000-00004372.00000000.90136.680A2000.00000002.mdmp, 00000000-00004372.00000001.90199.00409000.00000004.mdmp") Found api reference "CertVerifyCertificateChainPolicy" (Indicator: "CertVerifyCertificateChainPolicy"; Source: "00000000-00004372.00000000.90136.00409000.00000004.mdmp, 00000000-00004372.00000000.90136.680A2000.00000002.mdmp, 00000000-00004372.00000001.90199.00409000.00000004.mdmp") Found api reference "CertFreeCertificateContext" (Indicator: "CertFreeCertificateContext"; Source: "00000000-00004372.00000000.90136.00409000.00000004.mdmp, 00000000-00004372.00000000.90136.680A2000.00000002.mdmp, 00000000-00004372.00000001.90199.00409000.00000004.mdmp") Found api reference "CertFreeCertificateChain" (Indicator: "CertFreeCertificateChain"; Source: "00000000-00004372.00000000.90136.00409000.00000004.mdmp, 00000000-00004372.00000000.90136.680A2000.00000002.mdmp, 00000000-00004372.00000001.90199.00409000.00000004.mdmp") Found api reference "CertGetNameStringW" (Indicator: "CertGetNameStringW"; Source: "00000000-00004372.00000000.90136.00409000.00000004.mdmp, 00000000-00004372.00000000.90136.680A2000.00000002.mdmp, 00000000-00004372.00000001.90199.00409000.00000004.mdmp") Found api reference "CertGetCertificateContextProperty" (Indicator: "CertGetCertificateContextProperty"; Source: "00000000-00004372.00000000.90136.00409000.00000004.mdmp, 00000000-00004372.00000000.90136.680A2000.00000002.mdmp, 00000000-00004372.00000001.90199.00409000.00000004.mdmp") Found api reference "CryptDecodeObject" (Indicator: "CryptDecodeObject"; Source: "00000000-00004372.00000000.90136.00409000.00000004.mdmp, 00000000-00004372.00000000.90136.680A2000.00000002.mdmp, 00000000-00004372.00000001.90199.00409000.00000004.mdmp")39:T57c,Found XOR loop in file "McCSPInstall.dll" at offset 110063; code bytes = 30d0 Found XOR loop in file "McCSPInstall.dll" at offset 64714; code bytes = 33c1 Found XOR loop in file "McCSPInstall.dll" at offset 64852; code bytes = 33c1 Found XOR loop in file "McCSPInstall.dll" at offset 106549; code bytes = 33c1 Found XOR loop in file "McCSPInstall.dll" at offset 110044; code bytes = 8030 Found XOR loop in file "McCSPInstall.dll" at offset 114214; code bytes = 8030 Found XOR loop in file "McCSPInstall.dll" at offset 115552; code bytes = 8030 Found XOR loop in file "System.dll" at offset 13253; code bytes = 8030 Found XOR loop in file "System.dll" at offset 14591; code bytes = 8030 Found XOR loop in file "DISMHOST.EXE.6AF0FC96.bin" at offset 76665; code bytes = 30d0 Found XOR loop in file "DISMHOST.EXE.6AF0FC96.bin" at offset 77648; code bytes = 8030 Found XOR loop in file "DISMHOST.EXE.6AF0FC96.bin" at offset 77788; code bytes = 8030 Found XOR loop in file "DISMHOST.EXE.6AF0FC96.bin" at offset 78978; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 65094; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 89386; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 109947; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 117238; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 118576; code bytes = 80303a:T101e,"f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004372) "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004372) "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000032366635633000000000000000000000000000000000373730613032373600000000000033300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000032366636346600000000000000000000000000000000000000000000313938353137333933390000000000003139 (UID: 00000000-00004372) "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d0041003600420042003200310036002606fc567cd812006d823777e4f4680004010000 (UID: 00000000-00004372) "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000061003700640036006100350065006600380037003200340033003500630033003700390039003200620036006300310031006600310063003500350034003200370066003300650031003600360036002e00650078006500000000000000000000000000000000000000000000000000000000000000ff2b1e77b2232177d8eb6275ac01630000006300000000000000000014009800ff0100000000000000000000000000000000000015009300ff0100000000000000000000606f630000000000200000000000000000000000c8eb6600506c6300706d6300a0fb680018716300 (UID: 00000000-00004372) "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000012007099510018e9120080f48876000051000000000089f488766b34fc56020000008ce9120088e91200bce9120098e91200e23040000000000000001000dce81200c83a927650e91200d58c8a768ce9120020e9120042a48876a802927660e91200d2f48876080000006ef5887644f588761334fc5602000000ec363377000013004548337734e912000200000000001300ec36337764e9120042a48876a8029276a8e91200c035337708000000953533770f7fb85402000000ec3633770000130045483377889951007099510074e91200e061357734ea12001ed833773fa39923 (UID: 00000000-00004372)3b:T865,"f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\MY"; Key: "") "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\2E4916B07F3DE90C8DDE2566FD9B9B400D89BBBA"; Key: "BLOB") "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\5AEAEE3F7F2A9449CEBAFEEC68FDD184F20124A7"; Key: "BLOB") "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\E6A3B45B062D509B3382282D196EFE97D5956CCB"; Key: "BLOB") "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\F5AD0BCC1AD56CD150725B1C866C30AD92EF21B0"; Key: "BLOB") "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\109F1CAED645BB78B3EA2B94C0697C740733031C"; Key: "BLOB")3c:T4f2,"f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Microsoft\Windows\Caches (UID: 00000000-00004372) "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" called "CreateDirectoryA" with parameter %TEMP%\ (UID: 00000000-00004372) "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" called "CreateDirectoryA" with parameter C:\Users (UID: 00000000-00004372) "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" called "CreateDirectoryA" with parameter C:\Users\%OSUSER% (UID: 00000000-00004372) "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" called "CreateDirectoryA" with parameter %USERPROFILE%\AppData (UID: 00000000-00004372) "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" called "CreateDirectoryA" with parameter %USERPROFILE%\AppData\Local (UID: 00000000-00004372) "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" called "CreateDirectoryA" with parameter %LOCALAPPDATA%\Temp (UID: 00000000-00004372) "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" called "CreateDirectoryA" with parameter %TEMP%\nsg676A.tmp (UID: 00000000-00004372)3d:Tb7d,"f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00004372) "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" called "LoadLibrary" with a parameter API-MS-Win-Core-LocalRegistry-L1-1-0.dll (UID: 00000000-00004372) "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" called "LoadLibrary" with a parameter propsys.dll (UID: 00000000-00004372) "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" called "LoadLibrary" with a parameter ntmarta.dll (UID: 00000000-00004372) "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" called "LoadLibrary" with a parameter %TEMP%\nsg676A.tmp\System.dll (UID: 00000000-00004372) "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" called "LoadLibrary" with a parameter %TEMP%\McCSPInstall.dll (UID: 00000000-00004372) "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" called "LoadLibrary" with a parameter WINTRUST.DLL (UID: 00000000-00004372) "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\CRYPT32.dll (UID: 00000000-00004372) "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" called "LoadLibrary" with a parameter imagehlp.dll (UID: 00000000-00004372) "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" called "LoadLibrary" with a parameter CRYPTSP.dll (UID: 00000000-00004372) "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00004372) "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00004372) "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" called "LoadLibrary" with a parameter ncrypt.dll (UID: 00000000-00004372) "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\bcryptprimitives.dll (UID: 00000000-00004372) "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00004372) "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-SDDL-L1-1-0.dll (UID: 00000000-00004372) "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\cryptnet.dll (UID: 00000000-00004372) "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" called "LoadLibrary" with a parameter cryptnet.dll (UID: 00000000-00004372) "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00004372)3e:T3e34,"f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004372) "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00004372) "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00004372) "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00004372) "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00004372) "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00004372) "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" called "GetProcAddress" with a parameter RegisterTraceGuidsW (UID: 00000000-00004372) "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00004372) "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00004372) "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" called "GetProcAddress" with a parameter EventEnabled (UID: 00000000-00004372) "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" called "GetProcAddress" with a parameter EventWrite (UID: 00000000-00004372) "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" called "GetProcAddress" with a parameter InitializeSecurityDescriptor (UID: 00000000-00004372) "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" called "GetProcAddress" with a parameter SetEntriesInAclW (UID: 00000000-00004372) "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" called "GetProcAddress" with a parameter GetMartaExtensionInterface (UID: 00000000-00004372) "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" called "GetProcAddress" with a parameter SetSecurityDescriptorDacl (UID: 00000000-00004372) "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" called "GetProcAddress" with a parameter GetUserDefaultUILanguage (UID: 00000000-00004372) "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" called "GetProcAddress" with a parameter Call (UID: 00000000-00004372) "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00004372) "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" called "GetProcAddress" with a parameter IsWow64Process (UID: 00000000-00004372) "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" called "GetProcAddress" with a parameter LoadLibrary (UID: 00000000-00004372) "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" called "GetProcAddress" with a parameter LoadLibraryA (UID: 00000000-00004372) "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00004372) "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00004372) "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00004372) "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00004372) "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00004372) "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00004372) "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" called "GetProcAddress" with a parameter SetThreadStackGuarantee (UID: 00000000-00004372) "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00004372) "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00004372) "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00004372) "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00004372) "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00004372) "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00004372) "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00004372) "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00004372) "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00004372) "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00004372) "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" called "GetProcAddress" with a parameter GetLogicalProcessorInformation (UID: 00000000-00004372) "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00004372) "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" called "GetProcAddress" with a parameter SetDefaultDllDirectories (UID: 00000000-00004372) "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" called "GetProcAddress" with a parameter EnumSystemLocalesEx (UID: 00000000-00004372) "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00004372) "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" called "GetProcAddress" with a parameter GetDateFormatEx (UID: 00000000-00004372) "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00004372) "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" called "GetProcAddress" with a parameter GetTimeFormatEx (UID: 00000000-00004372) "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00004372) "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" called "GetProcAddress" with a parameter IsValidLocaleName (UID: 00000000-00004372) "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00004372) "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00004372) "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00004372) "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleExW (UID: 00000000-00004372) "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" called "GetProcAddress" with a parameter SetFileInformationByHandleW (UID: 00000000-00004372) "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" called "GetProcAddress" with a parameter RegisterAsMFETrusted (UID: 00000000-00004372) "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" called "GetProcAddress" with a parameter DllCanUnloadNow (UID: 00000000-00004372) "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" called "GetProcAddress" with a parameter CryptSIPPutSignedDataMsg (UID: 00000000-00004372) "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" called "GetProcAddress" with a parameter CryptSIPGetSignedDataMsg (UID: 00000000-00004372) "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" called "GetProcAddress" with a parameter ImageGetCertificateData (UID: 00000000-00004372) "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" called "GetProcAddress" with a parameter CryptAcquireContextA (UID: 00000000-00004372) "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00004372) "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00004372) "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00004372) "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" called "GetProcAddress" with a parameter EqualSid (UID: 00000000-00004372) "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00004372) "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" called "GetProcAddress" with a parameter SystemFunction036 (UID: 00000000-00004372) "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" called "GetProcAddress" with a parameter LoadStringW (UID: 00000000-00004372) "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" called "GetProcAddress" with a parameter BCryptOpenAlgorithmProvider (UID: 00000000-00004372) "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" called "GetProcAddress" with a parameter GetHashInterface (UID: 00000000-00004372) "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" called "GetProcAddress" with a parameter BCryptGetProperty (UID: 00000000-00004372) "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" called "GetProcAddress" with a parameter BCryptCreateHash (UID: 00000000-00004372) "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" called "GetProcAddress" with a parameter BCryptHashData (UID: 00000000-00004372) "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" called "GetProcAddress" with a parameter BCryptDestroyHash (UID: 00000000-00004372) "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" called "GetProcAddress" with a parameter GetUserProfileDirectoryW (UID: 00000000-00004372) "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" called "GetProcAddress" with a parameter ConvertStringSidToSidW (UID: 00000000-00004372) "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" called "GetProcAddress" with a parameter RegisterGPNotification (UID: 00000000-00004372) "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" called "GetProcAddress" with a parameter CryptImportKey (UID: 00000000-00004372) "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" called "GetProcAddress" with a parameter CryptGetKeyParam (UID: 00000000-00004372) "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" called "GetProcAddress" with a parameter CryptDestroyKey (UID: 00000000-00004372) "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" called "GetProcAddress" with a parameter CryptCreateHash (UID: 00000000-00004372) "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" called "GetProcAddress" with a parameter CryptHashData (UID: 00000000-00004372) "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" called "GetProcAddress" with a parameter CryptVerifySignatureA (UID: 00000000-00004372) "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" called "GetProcAddress" with a parameter CryptDestroyHash (UID: 00000000-00004372) "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" called "GetProcAddress" with a parameter CryptGetObjectUrl (UID: 00000000-00004372) "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" called "GetProcAddress" with a parameter WintrustCertificateTrust (UID: 00000000-00004372) "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" called "GetProcAddress" with a parameter SoftpubAuthenticode (UID: 00000000-00004372) "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" called "GetProcAddress" with a parameter SoftpubInitialize (UID: 00000000-00004372) "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" called "GetProcAddress" with a parameter SoftpubLoadMessage (UID: 00000000-00004372) "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" called "GetProcAddress" with a parameter SoftpubLoadSignature (UID: 00000000-00004372) "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" called "GetProcAddress" with a parameter SoftpubCheckCert (UID: 00000000-00004372) "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" called "GetProcAddress" with a parameter SoftpubCleanup (UID: 00000000-00004372) "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" called "GetProcAddress" with a parameter WVTAsn1SpcIndirectDataContentDecode (UID: 00000000-00004372) "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" called "GetProcAddress" with a parameter CryptSIPVerifyIndirectData (UID: 00000000-00004372) "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" called "GetProcAddress" with a parameter WVTAsn1SpcPeImageDataDecode (UID: 00000000-00004372) "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" called "GetProcAddress" with a parameter BCryptFinishHash (UID: 00000000-00004372) "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" called "GetProcAddress" with a parameter BCryptCloseAlgorithmProvider (UID: 00000000-00004372) "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" called "GetProcAddress" with a parameter CryptSetHashParam (UID: 00000000-00004372) "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" called "GetProcAddress" with a parameter SaferiSearchMatchingHashRules (UID: 00000000-00004372) "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" called "GetProcAddress" with a parameter CryptReleaseContext (UID: 00000000-00004372) "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" called "GetProcAddress" with a parameter UnregisterAsMFETrusted (UID: 00000000-00004372) "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00004372) "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00004372)3f:T9eb,"Software\Microsoft\Windows\CurrentVersion" in Source: 00000000-00004372.00000000.90136.00407000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion" in Source: 00000000-00004372.00000000.90136.00409000.00000004.mdmp "SOFTWARE\Wow6432Node\McAfee\SystemCore" in Source: 00000000-00004372.00000000.90136.00409000.00000004.mdmp "SOFTWARE\McAfee\SystemCore" in Source: 00000000-00004372.00000000.90136.00409000.00000004.mdmp "HKLM\Software\McAfee\CSP\**" in Source: 00000000-00004372.00000000.90136.00409000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00004372.00000000.90136.00630000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion" in Source: 00000000-00004372.00000000.90136.00630000.00000004.mdmp "Software\McAfee\CSP" in Source: 00000000-00004372.00000000.90136.00630000.00000004.mdmp "Software\McAfee\CSP\APPS" in Source: 00000000-00004372.00000000.90136.00630000.00000004.mdmp "Software\McAfee\" in Source: 00000000-00004372.00000000.90136.00630000.00000004.mdmp "Software\McAfee\SystemCore" in Source: 00000000-00004372.00000000.90136.680A2000.00000002.mdmp "Software\McAfee" in Source: 00000000-00004372.00000000.90136.680A2000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion" in Source: 00000000-00004372.00000000.90136.680A2000.00000002.mdmp "SOFTWARE\Wow6432Node\McAfee\SystemCore" in Source: 00000000-00004372.00000000.90136.680A2000.00000002.mdmp "SOFTWARE\McAfee\SystemCore" in Source: 00000000-00004372.00000000.90136.680A2000.00000002.mdmp "HKLM\Software\McAfee\CSP\**" in Source: 00000000-00004372.00000000.90136.680A2000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion" in Source: 00000000-00004372.00000001.90199.00409000.00000004.mdmp "SOFTWARE\Wow6432Node\McAfee\SystemCore" in Source: 00000000-00004372.00000001.90199.00409000.00000004.mdmp "SOFTWARE\McAfee\SystemCore" in Source: 00000000-00004372.00000001.90199.00409000.00000004.mdmp "HKLM\Software\McAfee\CSP\**" in Source: 00000000-00004372.00000001.90199.00409000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00004372.00000001.90199.00630000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion" in Source: 00000000-00004372.00000001.90199.00630000.00000004.mdmp "Software\McAfee\CSP" in Source: 00000000-00004372.00000001.90199.00630000.00000004.mdmp "Software\McAfee\CSP\APPS" in Source: 00000000-00004372.00000001.90199.00630000.00000004.mdmp "Software\McAfee\" in Source: 00000000-00004372.00000001.90199.00630000.00000004.mdmp40:Tdbc,"f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" loaded module "ADVAPI32.DLL" at base 76a10000 "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 76930000 "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" loaded module "SETUPAPI.DLL" at base 76ff0000 "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" loaded module "RPCRT4.DLL" at base 76610000 "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" loaded module "CLBCATQ.DLL" at base 766c0000 "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 73bf0000 "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" loaded module "NTMARTA.DLL" at base 74500000 "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 772e0000 "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" loaded module "PROFAPI.DLL" at base 750b0000 "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" loaded module "%TEMP%\NSG676A.TMP\SYSTEM.DLL" at base 10000000 "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" loaded module "%TEMP%\MCCSPINSTALL.DLL" at base 68090000 "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" loaded module "WINTRUST.DLL" at base 75390000 "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 75250000 "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" loaded module "IMAGEHLP.DLL" at base 77330000 "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" loaded module "CRYPTSP.DLL" at base 74aa0000 "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 74830000 "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" loaded module "CRYPTBASE.DLL" at base 74f90000 "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" loaded module "USER32.DLL" at base 76540000 "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" loaded module "NCRYPT.DLL" at base 74bd0000 "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 74770000 "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" loaded module "USERENV.DLL" at base 751a0000 "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" loaded module "GPAPI.DLL" at base 74670000 "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" loaded module "API-MS-WIN-SERVICE-MANAGEMENT-L1-1-0.DLL" at base 772e0000 "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" loaded module "API-MS-WIN-SERVICE-MANAGEMENT-L2-1-0.DLL" at base 772e0000 "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" loaded module "%WINDIR%\SYSTEM32\CRYPTNET.DLL" at base 716f0000 "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" loaded module "CRYPTNET.DLL" at base 716f0000 "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" loaded module "BCRYPT.DLL" at base 74bb0000 "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" loaded module "OLEAUT32.DLL" at base 7675000041:T565,The input sample is signed with a certificate issued by "CN=Thawte Timestamping CA, OU=Thawte Certification, O=Thawte, L=Durbanville, ST=Western Cape, C=ZA" (SHA1: 6C:07:45:3F:FD:DA:08:B8:37:07:C0:9B:82:FB:3D:15:F3:53:36:B1; see report for more information) The input sample is signed with a certificate issued by "CN=Symantec Time Stamping Services CA - G2, O=Symantec Corporation, C=US" (SHA1: 65:43:99:29:B6:79:73:EB:19:2D:6F:F2:43:E6:76:7A:DF:08:34:E4; see report for more information) The input sample is signed with a certificate issued by "CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa c10, OU=VeriSign Trust Network, O="VeriSign Inc.", C=US" (SHA1: D3:7F:61:D5:7C:B0:48:1F:3D:77:ED:AC:7D:E7:21:96:C4:31:4E:2C; see report for more information) The input sample is signed with a certificate issued by "CN=Microsoft Code Verification Root, O=Microsoft Corporation, L=Redmond, ST=Washington, C=US" (SHA1: 57:53:4C:CC:33:91:4C:41:F7:0E:2C:BB:21:03:A1:DB:18:81:7D:8B; see report for more information) The input sample is signed with a certificate issued by "CN=VeriSign Class 3 Public Primary Certification Authority - G5, OU="c 2006 VeriSign Inc. - For authorized use only", OU=VeriSign Trust Network, O="VeriSign Inc.", C=US" (SHA1: 49:58:47:A9:31:87:CF:B8:C7:1F:84:0C:B7:B4:14:97:AD:95:C6:4F; see report for more information)42:Tb38,"f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE\ASSEMBLYSTORAGEROOTS"; Key: ""; Value: "") "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\ERROR MESSAGE INSTRUMENT"; Key: ""; Value: "") "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: ""; Value: "") "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: ""; Value: "") "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IME COMPATIBILITY"; Key: ""; Value: "") "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED\MACHINELANGUAGECONFIGURATION"; Key: ""; Value: "") "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\MUI\SETTINGS"; Key: ""; Value: "") "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\CONTROL PANEL\DESKTOP"; Key: ""; Value: "") "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\LANGUAGECONFIGURATION"; Key: ""; Value: "") "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: ""; Value: "")43:T1177,"f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "CWDILLEGALINDLLSEARCH"; Value: "") "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "COMPATDLL"; Value: "") "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "00060101.00060101"; Value: "") "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SAFEDLLSEARCHMODE"; Value: "") "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: "DISABLEMETAFILES"; Value: "") "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: "F9761DA0D2822C35A631A059A7D6A5EF872435C37992B6C11F1C55427F3E1666"; Value: "") "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS"; Key: "LOADAPPINIT_DLLS"; Value: "") "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORUSESYSTEMHEAP"; Value: "") "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORSYSTEMHEAPISPRIVATE"; Value: "") "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US"; Value: "") "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US"; Value: "") "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: "PREFEREXTERNALMANIFEST"; Value: "") "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: "ATTRIBUTES"; Value: "") "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: "CALLFORATTRIBUTES"; Value: "") "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: "RESTRICTEDATTRIBUTES"; Value: "") "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: "WANTSFORDISPLAY"; Value: "") "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: "HIDEFOLDERVERBS"; Value: "") "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: "USEDROPHANDLER"; Value: "")44:Tb84,"f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" trying to touch file "C:\Windows\SYSTEM32\sechost.dll" "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" trying to touch file "C:\f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe.Local\" "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" trying to touch file "C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.18837_none_ec86b8d6858ec0bc" "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" trying to touch file "C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.18837_none_ec86b8d6858ec0bc\COMCTL32.dll" "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" trying to touch file "C:\VERSION.dll" "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" trying to touch file "C:\Windows\system32\VERSION.dll" "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" trying to touch file "C:\Windows\system32\IMM32.DLL" "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" trying to touch file "C:\Windows\system32\rpcss.dll" "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" trying to touch file "C:\CRYPTBASE.dll" "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" trying to touch file "C:\Windows\system32\CRYPTBASE.dll" "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" trying to touch file "\Device\KsecDD" "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" trying to touch file "C:\Windows\system32\uxtheme.dll" "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" trying to touch file "C:\SHFOLDER.DLL" "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" trying to touch file "C:\Windows\system32\SHFOLDER.DLL" "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" trying to touch file "C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d" "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" trying to touch file "C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d\comctl32.dll" "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" trying to touch file "C:\Windows\Temp\VxSSL32.dll" "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" trying to touch file "C:\FLTLIB.DLL" "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" trying to touch file "C:\Windows\system32\FLTLIB.DLL" "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" trying to touch file "C:\MSVCP140.dll" "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" trying to touch file "C:\Windows\system32\MSVCP140.dll"45:Tdc5,"f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" trying to access non-existent file "C:\VERSION.dll" "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" trying to access non-existent file "C:\CRYPTBASE.dll" "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" trying to access non-existent file "C:\SHFOLDER.DLL" "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" trying to access non-existent file "C:\FLTLIB.DLL" "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" trying to access non-existent file "C:\MSVCP140.dll" "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" trying to access non-existent file "C:\VCRUNTIME140.dll" "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" trying to access non-existent file "C:\api-ms-win-crt-runtime-l1-1-0.dll" "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" trying to access non-existent file "C:\ucrtbase.DLL" "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" trying to access non-existent file "C:\api-ms-win-core-timezone-l1-1-0.dll" "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" trying to access non-existent file "C:\api-ms-win-core-file-l2-1-0.dll" "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" trying to access non-existent file "C:\api-ms-win-core-localization-l1-2-0.dll" "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" trying to access non-existent file "C:\api-ms-win-core-synch-l1-2-0.dll" "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" trying to access non-existent file "C:\api-ms-win-core-processthreads-l1-1-1.dll" "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" trying to access non-existent file "C:\api-ms-win-core-file-l1-2-0.dll" "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" trying to access non-existent file "C:\api-ms-win-crt-heap-l1-1-0.dll" "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" trying to access non-existent file "C:\api-ms-win-crt-string-l1-1-0.dll" "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" trying to access non-existent file "C:\api-ms-win-crt-stdio-l1-1-0.dll" "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" trying to access non-existent file "C:\api-ms-win-crt-convert-l1-1-0.dll" "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" trying to access non-existent file "C:\api-ms-win-crt-locale-l1-1-0.dll" "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" trying to access non-existent file "C:\api-ms-win-crt-filesystem-l1-1-0.dll" "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" trying to access non-existent file "C:\api-ms-win-crt-time-l1-1-0.dll" "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" trying to access non-existent file "C:\api-ms-win-crt-environment-l1-1-0.dll" "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" trying to access non-existent file "C:\api-ms-win-crt-math-l1-1-0.dll" "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" trying to access non-existent file "C:\api-ms-win-crt-utility-l1-1-0.dll" "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-fibers-l1-1-1.DLL"46:T7be6,Found URL "http://nsis.sf.net/nsis_errorerror" - Source: "00000000-00004372.00000000.90136.00409000.00000004.mdmp") Found URL "http://ocsp.thawte.com080604.http://crl.thawte.com/thawtetimestampingca.crl0timestamp-2048-10y@b%symantec" - Source: "00000000-00004372.00000000.90136.00409000.00000004.mdmp") Found URL "http://ts-ocsp.ws.symantec.com07+http://ts-aia.ws.symantec.com/tss-ca-g2.cer0<50301+http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(timestamp-2048-20b07x,&c3\vno^efany3+." - Source: "00000000-00004372.00000000.90136.00409000.00000004.mdmp") Found URL "https://www.verisign.com/rpa" - Source: "00000000-00004372.00000000.90136.00409000.00000004.mdmp") Found URL "http://csc3-2010-crl.verisign.com/csc3-2010.crl0d=0;090*0(https://www.verisign.com/rpa0e0c0$http://ocsp.verisign.com0;/http://csc3-2010-aia.verisign.com/csc3-2010.cer0,frug" - Source: "00000000-00004372.00000000.90136.00409000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftcodeverifroot.crl0,n9iqmgvw,czc0?1$0" - Source: "00000000-00004372.00000000.90136.00630000.00000004.mdmp") Found URL "http://isrg.trustid.ocsp.identrust.com0;/http://apps.identrust.com/roots/dstrootcax3.p7c0m0k0000." - Source: "00000000-00004372.00000000.90136.00630000.00000004.mdmp") Found URL "http://cps.root-x1.letsencrypt.org0<50301+http://crl.identrust.com/dstrootcax3crl.crl0ig'" - Source: "00000000-00004372.00000000.90136.00630000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00004372.00000000.90136.00630000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0p1<92a@ef" - Source: "00000000-00004372.00000000.90136.00630000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-hardware0110315000000z140314235959z0384771florida1english1sea" - Source: "00000000-00004372.00000000.90136.00630000.00000004.mdmp") Found URL "https://secure.comodo.com/cps0" - Source: "00000000-00004372.00000000.90136.00630000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com05addons.mozilla.orgwww.addons.mozilla.org0zsb)j9e/salt" - Source: "00000000-00004372.00000000.90136.00630000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0%www.google.comgoogle.com0io]l,e9n(" - Source: "00000000-00004372.00000000.90136.00630000.00000004.mdmp") Found URL "http://www.public-trust.com/cps/omniroot.html0w0u1gte" - Source: "00000000-00004372.00000000.90136.00630000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0dmxt*j]+xijom5o" - Source: "00000000-00004372.00000000.90136.00630000.00000004.mdmp") Found URL "http://ocsp.entrust.net03,0*0(" - Source: "00000000-00004372.00000000.90136.00630000.00000004.mdmp") Found URL "http://crl.entrust.net/server1.crl0;8kbv7.11c)d[b" - Source: "00000000-00004372.00000000.90136.00630000.00000004.mdmp") Found URL "http://www.diginotar.nl/cps/pkioverheid0w0u1staat" - Source: "00000000-00004372.00000000.90136.00630000.00000004.mdmp") Found URL "http://crl.pkioverheid.nl/domovlatestcrl.crl0]ko)tsz'rl" - Source: "00000000-00004372.00000000.90136.00630000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0/login.skype.comwww.login.skype.com0gte" - Source: "00000000-00004372.00000000.90136.00630000.00000004.mdmp") Found URL "http://cybertrust.omniroot.com/repository.cfm0w0u1gte" - Source: "00000000-00004372.00000000.90136.00630000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0j)z" - Source: "00000000-00004372.00000000.90136.00630000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-hardware0110315000000z140314235959z0384771florida1tampa1sea" - Source: "00000000-00004372.00000000.90136.00630000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0global" - Source: "00000000-00004372.00000000.90136.00630000.00000004.mdmp") Found URL "http://www.diginotar.nl/cps/pkioverheid0\0z1staat" - Source: "00000000-00004372.00000000.90136.00630000.00000004.mdmp") Found URL "http://crl.pkioverheid.nl/domorganisatielatestcrl-g2.crl0^tl*" - Source: "00000000-00004372.00000000.90136.00630000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0or" - Source: "00000000-00004372.00000000.90136.00630000.00000004.mdmp") Found URL "https://www.verisign.com/repository/cpsthis" - Source: "00000000-00004372.00000000.90136.00630000.00000004.mdmp") Found URL "https://www.verisign.com;" - Source: "00000000-00004372.00000000.90136.00630000.00000004.mdmp") Found URL "https://www.verisign.com/repository/verisignlogo.gif0d=0;090*0(https://www.verisign.com/rpa0(+pw)salt" - Source: "00000000-00004372.00000000.90136.00630000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0/login.yahoo.comwww.login.yahoo.com0yvr,salt" - Source: "00000000-00004372.00000000.90136.00630000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0/mail.google.comwww.mail.google.com0?=*k!\yro2;nki0!!salt" - Source: "00000000-00004372.00000000.90136.00630000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0login.yahoo.com0kw(=n" - Source: "00000000-00004372.00000000.90136.00630000.00000004.mdmp") Found URL "https://www.verisign.com/repository/verisignlogo.gif0d=0;090*0(https://www.verisign.com/rpa0f$\_)$bf!;8kb%2+jo;8kbentrust.net1;092www.entrust.net/cps" - Source: "00000000-00004372.00000000.90136.00630000.00000004.mdmp") Found URL "http://crl.entrust.net/server1.crl0;8kbv7.1q7z?,entrust.net1@0>7www.entrust.net/cps_2048" - Source: "00000000-00004372.00000000.90136.00630000.00000004.mdmp") Found URL "http://ocsp.entrust.net0d=0;09000." - Source: "00000000-00004372.00000000.90136.00630000.00000004.mdmp") Found URL "http://www.digicert.com.my/cps.htm02+0)0'!http://crl.entrust.net/2048ca.crl09yk3y!c/i9/-k" - Source: "00000000-00004372.00000000.90136.00630000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0\0" - Source: "00000000-00004372.00000000.90136.00630000.00000004.mdmp") Found URL "http://crl.pkioverheid.nl/domovlatestcrl.crl00ev" - Source: "00000000-00004372.00000000.90136.00630000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0-login.live.comwww.login.live.com0nwk1uy1un:0a0" - Source: "00000000-00004372.00000000.90136.00630000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0login.yahoo.com0oc*9entrust.net1;092www.entrust.net/cps" - Source: "00000000-00004372.00000000.90136.00630000.00000004.mdmp") Found URL "http://crl.entrust.net/server1.crl0v7.1ctj7+>.entrusverisign" - Source: "00000000-00004372.00000000.90136.00630000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0>ej-+\lu>gvpob\hzagxr" - Source: "00000000-00004372.00000000.90136.00630000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?3bv:t6a[jr0m0]>-xgjus1!0the" - Source: "00000000-00004372.00000000.90136.00630000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnk't" - Source: "00000000-00004372.00000000.90136.00630000.00000004.mdmp") Found URL "http://crl.globalsign.2.crl0ndx9dmyf1" - Source: "00000000-00004372.00000000.90136.00630000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0" - Source: "00000000-00004372.00000000.90136.00630000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20certificate%20list%20ca%202024.crl0pd0b0" - Source: "00000000-00004372.00000000.90136.00630000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20certificate%20list%20ca%202024.crt0y" - Source: "00000000-00004372.00000000.90136.00630000.00000004.mdmp") Found URL "http://www.microsoft.com0h3y0w'q<@2/l:p" - Source: "00000000-00004372.00000000.90136.00630000.00000004.mdmp") Found URL "http://nsis.sf.net/nsis_errorerror" - Source: "00000000-00004372.00000001.90199.00409000.00000004.mdmp") Found URL "http://ocsp.thawte.com080604.http://crl.thawte.com/thawtetimestampingca.crl0timestamp-2048-10y@b%symantec" - Source: "00000000-00004372.00000001.90199.00409000.00000004.mdmp") Found URL "http://ts-ocsp.ws.symantec.com07+http://ts-aia.ws.symantec.com/tss-ca-g2.cer0<50301+http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(timestamp-2048-20b07x,&c3\vno^efany3+." - Source: "00000000-00004372.00000001.90199.00409000.00000004.mdmp") Found URL "https://www.verisign.com/rpa" - Source: "00000000-00004372.00000001.90199.00409000.00000004.mdmp") Found URL "http://csc3-2010-crl.verisign.com/csc3-2010.crl0d=0;090*0(https://www.verisign.com/rpa0e0c0$http://ocsp.verisign.com0;/http://csc3-2010-aia.verisign.com/csc3-2010.cer0,frug" - Source: "00000000-00004372.00000001.90199.00409000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftcodeverifroot.crl0,n9iqmgvw,czc0?1$0" - Source: "00000000-00004372.00000001.90199.00630000.00000004.mdmp") Found URL "http://isrg.trustid.ocsp.identrust.com0;/http://apps.identrust.com/roots/dstrootcax3.p7c0m0k0000." - Source: "00000000-00004372.00000001.90199.00630000.00000004.mdmp") Found URL "http://cps.root-x1.letsencrypt.org0<50301+http://crl.identrust.com/dstrootcax3crl.crl0ig'" - Source: "00000000-00004372.00000001.90199.00630000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00004372.00000001.90199.00630000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0p1<92a@ef" - Source: "00000000-00004372.00000001.90199.00630000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-hardware0110315000000z140314235959z0384771florida1english1sea" - Source: "00000000-00004372.00000001.90199.00630000.00000004.mdmp") Found URL "https://secure.comodo.com/cps0" - Source: "00000000-00004372.00000001.90199.00630000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com05addons.mozilla.orgwww.addons.mozilla.org0zsb)j9e/salt" - Source: "00000000-00004372.00000001.90199.00630000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0%www.google.comgoogle.com0io]l,e9n(" - Source: "00000000-00004372.00000001.90199.00630000.00000004.mdmp") Found URL "http://www.public-trust.com/cps/omniroot.html0w0u1gte" - Source: "00000000-00004372.00000001.90199.00630000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0dmxt*j]+xijom5o" - Source: "00000000-00004372.00000001.90199.00630000.00000004.mdmp") Found URL "http://ocsp.entrust.net03,0*0(" - Source: "00000000-00004372.00000001.90199.00630000.00000004.mdmp") Found URL "http://crl.entrust.net/server1.crl0;8kbv7.11c)d[b" - Source: "00000000-00004372.00000001.90199.00630000.00000004.mdmp") Found URL "http://www.diginotar.nl/cps/pkioverheid0w0u1staat" - Source: "00000000-00004372.00000001.90199.00630000.00000004.mdmp") Found URL "http://crl.pkioverheid.nl/domovlatestcrl.crl0]ko)tsz'rl" - Source: "00000000-00004372.00000001.90199.00630000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0/login.skype.comwww.login.skype.com0gte" - Source: "00000000-00004372.00000001.90199.00630000.00000004.mdmp") Found URL "http://cybertrust.omniroot.com/repository.cfm0w0u1gte" - Source: "00000000-00004372.00000001.90199.00630000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0j)z" - Source: "00000000-00004372.00000001.90199.00630000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-hardware0110315000000z140314235959z0384771florida1tampa1sea" - Source: "00000000-00004372.00000001.90199.00630000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0global" - Source: "00000000-00004372.00000001.90199.00630000.00000004.mdmp") Found URL "http://www.diginotar.nl/cps/pkioverheid0\0z1staat" - Source: "00000000-00004372.00000001.90199.00630000.00000004.mdmp") Found URL "http://crl.pkioverheid.nl/domorganisatielatestcrl-g2.crl0^tl*" - Source: "00000000-00004372.00000001.90199.00630000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0or" - Source: "00000000-00004372.00000001.90199.00630000.00000004.mdmp") Found URL "https://www.verisign.com/repository/cpsthis" - Source: "00000000-00004372.00000001.90199.00630000.00000004.mdmp") Found URL "https://www.verisign.com;" - Source: "00000000-00004372.00000001.90199.00630000.00000004.mdmp") Found URL "https://www.verisign.com/repository/verisignlogo.gif0d=0;090*0(https://www.verisign.com/rpa0(+pw)salt" - Source: "00000000-00004372.00000001.90199.00630000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0/login.yahoo.comwww.login.yahoo.com0yvr,salt" - Source: "00000000-00004372.00000001.90199.00630000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0/mail.google.comwww.mail.google.com0?=*k!\yro2;nki0!!salt" - Source: "00000000-00004372.00000001.90199.00630000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0login.yahoo.com0kw(=n" - Source: "00000000-00004372.00000001.90199.00630000.00000004.mdmp") Found URL "https://www.verisign.com/repository/verisignlogo.gif0d=0;090*0(https://www.verisign.com/rpa0f$\_)$bf!;8kb%2+jo;8kbentrust.net1;092www.entrust.net/cps" - Source: "00000000-00004372.00000001.90199.00630000.00000004.mdmp") Found URL "http://crl.entrust.net/server1.crl0;8kbv7.1q7z?,entrust.net1@0>7www.entrust.net/cps_2048" - Source: "00000000-00004372.00000001.90199.00630000.00000004.mdmp") Found URL "http://ocsp.entrust.net0d=0;09000." - Source: "00000000-00004372.00000001.90199.00630000.00000004.mdmp") Found URL "http://www.digicert.com.my/cps.htm02+0)0'!http://crl.entrust.net/2048ca.crl09yk3y!c/i9/-k" - Source: "00000000-00004372.00000001.90199.00630000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0\0" - Source: "00000000-00004372.00000001.90199.00630000.00000004.mdmp") Found URL "http://crl.pkioverheid.nl/domovlatestcrl.crl00ev" - Source: "00000000-00004372.00000001.90199.00630000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0-login.live.comwww.login.live.com0nwk1uy1un:0a0" - Source: "00000000-00004372.00000001.90199.00630000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0login.yahoo.com0oc*9entrust.net1;092www.entrust.net/cps" - Source: "00000000-00004372.00000001.90199.00630000.00000004.mdmp") Found URL "http://crl.entrust.net/server1.crl0v7.1ctj7+>.entrusverisign" - Source: "00000000-00004372.00000001.90199.00630000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0>ej-+\lu>gvpob\hzagxr" - Source: "00000000-00004372.00000001.90199.00630000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?3bv:t6a[jr0m0]>-xgjus1!0the" - Source: "00000000-00004372.00000001.90199.00630000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnk't" - Source: "00000000-00004372.00000001.90199.00630000.00000004.mdmp") Found URL "http://crl.globalsign.2.crl0ndx9dmyf1" - Source: "00000000-00004372.00000001.90199.00630000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0" - Source: "00000000-00004372.00000001.90199.00630000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20certificate%20list%20ca%202024.crl0pd0b0" - Source: "00000000-00004372.00000001.90199.00630000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20certificate%20list%20ca%202024.crt0y" - Source: "00000000-00004372.00000001.90199.00630000.00000004.mdmp") Found URL "http://www.microsoft.com0h3y0w'q<@2/l:p" - Source: "00000000-00004372.00000001.90199.00630000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif04-0+0)" - Source: "00000000-00004372.00000001.90199.00630000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3-g5.crl04(0&0$http://ocsp.verisign.com0verisignmpki-2-803130g8j-lb=e6western" - Source: "00000000-00004372.00000001.90199.00630000.00000004.mdmp") Found URL "http://ocsp.thawte.com080604.http://crl.thawte.com/thawtetimestampingca.crl0timestamp-2048-10y@b%symantec" - Source: "00000000-00004372.00000001.90199.00630000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0$d.2c=mkrbf" - Source: "00000000-00004372.00000001.90199.01F90000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00004372.00000001.90199.01F90000.00000004.mdmp") Found URL "http://www.microsoft.com0" - Source: "00000000-00004372.00000001.90199.01F90000.00000004.mdmp") Found URL "http://ts-ocsp.ws.symantec.com07+http://ts-aia.ws.symantec.com/tss-ca-g2.cer0<50301+http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(timestamp-2048-20b07x,&c3\vno^efany3+." - Source: "00000000-00004372.00000001.90199.01F90000.00000004.mdmp") Found URL "https://www.verisign.com/rpa" - Source: "00000000-00004372.00000001.90199.01F90000.00000004.mdmp") Found URL "http://csc3-2010-crl.verisign.com/csc3-2010.crl0d=0;090*0(https://www.verisign.com/rpa0e0c0$http://ocsp.verisign.com0;/http://csc3-2010-aia.verisign.com/csc3-2010.cer0,frug" - Source: "00000000-00004372.00000001.90199.01F90000.00000004.mdmp") Found URL "http://www.mcafee.com" - Source: "00000000-00004372.00000001.90199.01F90000.00000004.mdmp") Found URL "http://ocsp.thawte.com080604.http://crl.thawte.com/thawtetimestampingca.crl0timestamp-2048-10y@b%western" - Source: "00000000-00004372.00000001.90199.01F90000.00000004.mdmp") Found URL "http://ocsp.thawte.com080604.http://crl.thawte.com/thawtetimestampingca.crl0timestamp-2048-10y@b%verisign," - Source: "00000000-00004372.00000001.90199.01F90000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftcodeverifroot.crl0,nej-+\lu>gvpob\hzagxr" - Source: "00000000-00004372.00000001.90199.01F90000.00000004.mdmp")47:T8ba,"f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" called "FindFirstFileA" with parameter %TEMP%\nsg676A.tmp (UID: 00000000-00004372) "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" called "FindFirstFileW" with parameter %APPDATA%\Microsoft\SystemCertificates\My\Certificates\* (UID: 00000000-00004372) "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00004372) "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" called "FindFirstFileW" with parameter %APPDATA%\Microsoft\SystemCertificates\My\CRLs\* (UID: 00000000-00004372) "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" called "FindFirstFileW" with parameter %APPDATA%\Microsoft\SystemCertificates\My\CTLs\* (UID: 00000000-00004372) "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" called "FindFirstFileA" with parameter %TEMP%\McCSPInstall.dll (UID: 00000000-00004372) "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" called "FindFirstFileA" with parameter %LOCALAPPDATA%\Temp (UID: 00000000-00004372) "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" called "FindFirstFileA" with parameter %USERPROFILE%\AppData\Local (UID: 00000000-00004372) "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" called "FindFirstFileA" with parameter %USERPROFILE%\AppData (UID: 00000000-00004372) "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" called "FindFirstFileA" with parameter C:\Users\%OSUSER% (UID: 00000000-00004372) "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" called "FindFirstFileA" with parameter C:\Users (UID: 00000000-00004372) "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" called "FindFirstFileA" with parameter %TEMP%\nsg676A.tmp\*.* (UID: 00000000-00004372) "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" called "FindNextFileA" with parameter .. (UID: 00000000-00004372) "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" called "FindNextFileA" with parameter System.dll (UID: 00000000-00004372)48:T5c6,Found string ":\Windows\System32\DriverStore" (Indicator: "system32\drivers"; Source: "00000000-00004372.00000000.90136.00630000.00000004.mdmp, 00000000-00004372.00000001.90199.00630000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infpub.dat" (Indicator: "system32\drivers"; Source: "00000000-00004372.00000000.90136.00630000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infstor.dat" (Indicator: "system32\drivers"; Source: "00000000-00004372.00000000.90136.00630000.00000004.mdmp, 00000000-00004372.00000001.90199.00630000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infstrng.dat" (Indicator: "system32\drivers"; Source: "00000000-00004372.00000000.90136.00630000.00000004.mdmp, 00000000-00004372.00000001.90199.00630000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\drvindex.dat" (Indicator: "system32\drivers"; Source: "00000000-00004372.00000000.90136.00630000.00000004.mdmp, 00000000-00004372.00000001.90199.00630000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00004372.00000000.90136.00630000.00000004.mdmp") Found string "indows\System32\DriverStore\infpub.dat" (Indicator: "system32\drivers"; Source: "00000000-00004372.00000001.90199.00630000.00000004.mdmp") Found string "indows\System32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00004372.00000001.90199.00630000.00000004.mdmp")49:T514,"f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "LDAPCLIENTINTEGRITY"; Value: "") "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "USEOLDHOSTRESOLUTIONORDER"; Value: "") "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "USEHOSTNAMEASALIAS"; Value: "") "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "IPV4LOOPBACKALTERNATIVE"; Value: "") "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CRYPT32"; Key: "DEBUGHEAPFLAGS"; Value: "") "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CRYPT32"; Key: "DIAGLEVEL"; Value: "") "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CRYPT32"; Key: "DIAGMATCHANYMASK"; Value: "")4a:Te1e,Found string "MulDiv" (Source: f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666, API is part of module: KERNEL32.DLL) Found string "DeleteFileA" (Source: f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666, API is part of module: KERNELBASE.DLL) Found string "FindFirstFileA" (Source: f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666, API is part of module: KERNELBASE.DLL) Found string "FindNextFileA" (Source: f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666, API is part of module: KERNELBASE.DLL) Found string "FindClose" (Source: f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666, API is part of module: KERNELBASE.DLL) Found string "SetFilePointer" (Source: f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666, API is part of module: KERNELBASE.DLL) Found string "WriteFile" (Source: f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666, API is part of module: KERNELBASE.DLL) Found string "GetPrivateProfileStringA" (Source: f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666, API is part of module: KERNEL32.DLL) Found string "WritePrivateProfileStringA" (Source: f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666, API is part of module: KERNEL32.DLL) Found string "MultiByteToWideChar" (Source: f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666, API is part of module: KERNELBASE.DLL) Found string "FreeLibrary" (Source: f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666, API is part of module: KERNELBASE.DLL) Found string "LoadLibraryExA" (Source: f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666, API is part of module: KERNELBASE.DLL) Found string "GetModuleHandleA" (Source: f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666, API is part of module: KERNELBASE.DLL) Found string "GetExitCodeProcess" (Source: f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666, API is part of module: KERNELBASE.DLL) Found string "WaitForSingleObject" (Source: f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666, API is part of module: KERNELBASE.DLL) Found string "GlobalAlloc" (Source: f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666, API is part of module: KERNELBASE.DLL) Found string "GlobalFree" (Source: f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666, API is part of module: KERNELBASE.DLL) Found string "ExpandEnvironmentStringsA" (Source: f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666, API is part of module: KERNELBASE.DLL) Found string "lstrcmpA" (Source: f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666, API is part of module: KERNELBASE.DLL) Found string "lstrcmpiA" (Source: f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666, API is part of module: KERNELBASE.DLL) Found string "CloseHandle" (Source: f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666, API is part of module: KERNELBASE.DLL) Found string "SetFileTime" (Source: f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666, API is part of module: KERNELBASE.DLL) Found string "CompareFileTime" (Source: f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666, API is part of module: KERNELBASE.DLL) Found string "SearchPathA" (Source: f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666, API is part of module: KERNEL32.DLL) Found string "GetShortPathNameA" (Source: f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666, API is part of module: KERNEL32.DLL)4b:T10a7,"f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT") "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES") "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS") "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS") "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE") "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES") "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CRLS") "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CTLS") "f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE")4c:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAd3AAAAAAAAAAAAAAAAAAd4i7ugAAAAAAAAePjwAAB/j4i7qqAAAAAAAH+PgHAHh/j7uqqIAAAAAAB4+PCHB3h/iLqoiAAAAAAAf4+AeHeHh/i6iI7gAAAAAHj48Id4eHhwCo7u4AAAAAB/j4B4d4eHAADu6IAAAAAAePjwh3iI7gAAeHhwAAAAAH+PgHh47orgB4eHgAAAAAB///CHfuiu6/94eHAAAAAAf//weHeK7uv494cAAAAAAH//8IeHru67j494CIiIAAB///CIiH7ru4j48AAAiHAAf//wiIgHe7uIgAd3d4hwAH//8IiID/d3d3//////cAB3d3CIiAd3d3d3d3d3eHAAd3dwiIgAAAAAAAAAAACAB///9wiIB4iIiIiIiIiHAHd3d3dwiAf/////////hwAAAAd3dwgH8AAAAAAAD4cAAAAAd3dwB/AAAAAAAA+HAAAAAAf//wfwAADwDwAPhwAAAAAAd3dw8AAA8A8AD4cAAAAAAAAAB/AAAP//8A+HAAAAAAAAAAfwAAD///APhwAAAAAAAAAH8A//8AAAD4cAAAAAAAAAB/AA/wAAAA+HAAAAAAAAAAfwAAAAAAAPhwAAAAAAAAAH8AAAAAAAD4cAAAAAAAAAB/////////+HAAAAAAAAAAB3d3d3d3d3dwD//gf/wPgB/8BwAP/AIAB/wAAAf8AAAD/AAAA/wABgP8AAYD/AAAA/wAAAP8AAAAPAAAABwAAAAMAAAADAAAAAwAAAAMAAAACAAAABAAAAAfgAAAH8AAAB/gAAAf8AAAH/+AAB//gAAf/4AAH/+AAB//gAAf/4AAH/+AAB//wAAw==30:["$","$Lc",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$33"}}],["$","$L35",null,{"initialData":{"schema_version":"1.0.17","sha256":"f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":65,"unified_at_epoch_ms":1794174648396,"unified_at":"2026-11-08T21:50:48.396Z","metadata":{"hashes":{"sha256":"f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666","sha1":"bf9574a7cbd22699536817994083382b4aae0897","md5":"721ee5bcfd89705db4d4dd398c7eca0d","sha512":"2281b33c21bd2a9dfd3709e19be1df71e8bc53332741dafaddf81e86def079c8d82833b09f02fd0cb2f9abb2649f8d1153b0efa0f738a20c9bc537822d6afc82","ssdeep":"3072:Z8Dsp+FNX1dFOvDlXJuhEfymv/g4YxVb8GSlLTC3DAuuYUKf0fWq:Z8dNXSEmfcx92LTGFq","ssdeep_chunks":["3072:Z8Dsp+F","3072:8Dsp+FN","3072:Dsp+FNX","3072:sp+FNX1","3072:p+FNX1d","3072:+FNX1dF","3072:FNX1dFO","3072:NX1dFOv","3072:X1dFOvD","3072:1dFOvDl","3072:dFOvDlX","3072:FOvDlXJ","3072:OvDlXJu","3072:vDlXJuh","3072:DlXJuhE","3072:lXJuhEf","3072:XJuhEfy","3072:JuhEfym","3072:uhEfymv","3072:hEfymv/","3072:Efymv/g","3072:fymv/g4","3072:ymv/g4Y","3072:mv/g4Yx","3072:v/g4YxV","3072:/g4YxVb","3072:g4YxVb8","3072:4YxVb8G","3072:YxVb8GS","3072:xVb8GSl","3072:Vb8GSlL","3072:b8GSlLT","3072:8GSlLTC","3072:GSlLTC3","3072:SlLTC3D","3072:lLTC3DA","3072:LTC3DAu","3072:TC3DAuu","3072:C3DAuuY","3072:3DAuuYU","3072:DAuuYUK","3072:AuuYUKf","3072:uuYUKf0","3072:uYUKf0f","3072:YUKf0fW","3072:UKf0fWq","6144:Z8Dsp+F","6144:8Dsp+FN","6144:Dsp+FNX","6144:sp+FNX1","6144:p+FNX1d","6144:+FNX1dF","6144:FNX1dFO","6144:NX1dFOv","6144:X1dFOvD","6144:1dFOvDl","6144:dFOvDlX","6144:FOvDlXJ","6144:OvDlXJu","6144:vDlXJuh","6144:DlXJuhE","6144:lXJuhEf","6144:XJuhEfy","6144:JuhEfym","6144:uhEfymv","6144:hEfymv/","6144:Efymv/g","6144:fymv/g4","6144:ymv/g4Y","6144:mv/g4Yx","6144:v/g4YxV","6144:/g4YxVb","6144:g4YxVb8","6144:4YxVb8G","6144:YxVb8GS","6144:xVb8GSl","6144:Vb8GSlL","6144:b8GSlLT","6144:8GSlLTC","6144:GSlLTC3","6144:SlLTC3D","6144:lLTC3DA","6144:LTC3DAu","6144:TC3DAuu","6144:C3DAuuY","6144:3DAuuYU","6144:DAuuYUK","6144:AuuYUKf","6144:uuYUKf0","6144:uYUKf0f","6144:YUKf0fW","6144:UKf0fWq","3072:Z8dNXSE","3072:8dNXSEm","3072:dNXSEmf","3072:NXSEmfc","3072:XSEmfcx","3072:SEmfcx9","3072:Emfcx92","3072:mfcx92L","3072:fcx92LT","3072:cx92LTG","3072:x92LTGF","3072:92LTGFq"],"imphash":"e160ef8e55bb9d162da4e266afd9eef3"},"file_info":{"file_name":"f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666","file_type":["compressed","7zip"],"file_type_id":"7zip nsis","file_size":123360,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1794174567000,"last_seen":1794174567000,"last_multi_scan":1794174567000},"additional_metadata":[{"name":"package_manager","type":"str","values":["nsis"]}]},"detections":{"summary":{"verdict":"malicious","score":65,"tags":null},"stats":{"av":{"malicious_count":1,"suspicious_count":0,"total_engines":26},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":63},"sandbox_signatures":{"informative_count":145,"suspicious_count":11,"malicious_count":1,"total":157},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"malicious","threat_name":"TrojanDldr.Agent.BX.ynvu","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"TrojanDldr.Agent.BX","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Contains ability to retrieve process ID (API string)"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"tactic":"Stealth","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"tactic":"Privilege Escalation","technique":"Account Manipulation","attack_id":"T1098","attack_id_wiki":"https://attack.mitre.org/techniques/T1098","identifiers":[{"type":"informative","value":"Contains ability to modify the user configuration/privilege (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"tactic":"Stealth","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to create/control drivers (API string)"},{"type":"informative","value":"Contains ability to modify system service (API string)"},{"type":"informative","value":"Contains ability to access device drivers"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Input file contains API references not part of its Import Address Table (IAT)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","identifiers":[{"type":"malicious","value":"Reads Antivirus engine related registry keys"},{"type":"informative","value":"Possibly checks for the presence of an Antivirus engine"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Calls an API typically used for searching a directory for files"},{"type":"informative","value":"Able to rename or move file/directory (API string)"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Contains ability to retrieve path in which Windows is installed (API string)"},{"type":"suspicious","value":"Reads configuration files (.ini files)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Touches files in the Windows directory"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"tactic":"Stealth","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Found virtual disk drive like strings"},{"type":"informative","value":"Contains reference to method used by Windows shell items (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"informative","value":"Contains ability to open a service (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"},{"type":"informative","value":"Contains ability to close a handle to a service (API string)"},{"type":"informative","value":"Able to change the configuration parameters of a service"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"tactic":"Privilege Escalation","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to modify access token privileges (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Able to create/load registry keys (API string)"},{"type":"informative","value":"Contains ability to modify registry key/value (API string)"},{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"suspicious","value":"Modifies Software Policy Settings"},{"type":"informative","value":"Writes registry keys"},{"type":"informative","value":"Accesses System Certificates Settings"},{"type":"informative","value":"Able to delete registry key/value (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"tactic":"Stealth","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Able to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Able to query security token membership for user discovery (API string)"},{"type":"informative","value":"Queries the user identity associated with the current process token"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Able to query volume/memory size (API string)"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"tactic":"Stealth","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"},{"type":"informative","value":"Contains ability to set file time (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"tactic":"Stealth","technique":"Time Based Checks","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"tactic":"Stealth","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"},{"type":"informative","value":"Contains ability to show a graphical window (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"tactic":"Stealth","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Contains ability to perform AES/RC4 encryption (API string)"},{"type":"informative","value":"Contains key cryptographic functions (API string)"},{"type":"informative","value":"Able to utilize the Windows bcrypt cryptographic API"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Sample file has high entropy (likely encrypted/compressed content)"},{"type":"informative","value":"Shows ability to obfuscate file or information"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Able to query service configuration on system (API string)"},{"type":"informative","value":"Queries services related registry keys"},{"type":"informative","value":"Able to enumerate service (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Able to capture screen (API string)"},{"type":"suspicious","value":"Calls an API that may be used to take screenshots"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"tactic":"Stealth","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"},{"type":"informative","value":"Contains ability to check debugger is running (API string)"},{"type":"suspicious","value":"Queries kernel debugger information"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Able to retrieve system language (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"tactic":"Defense Impairment","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"suspicious","value":"Writes a PE file header to disc"},{"type":"suspicious","value":"Drops executable files"},{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Drops executable files inside temp directory"},{"type":"informative","value":"Contains ability to write files (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"tactic":"Stealth","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Able to inject code into another process (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"tactic":"Stealth","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"suspicious","value":"Marks file for deletion"},{"type":"informative","value":"Calls an API typically used to remove a directory"},{"type":"informative","value":"Contains ability to delete files/directories (API string)"},{"type":"suspicious","value":"Opens file with deletion access rights"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to find open windows (API string)"},{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"tactic":"Discovery","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Able to query registry keys (API string)"},{"type":"informative","value":"Found registry location strings in memory"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Reads Windows Trust Settings"},{"type":"informative","value":"Contains registry location strings"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Able to use Microsoft's Enhanced Cryptographic Provider"},{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Able to query system locale information (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"tactic":"Defense Impairment","technique":"Disable or Modify Tools","attack_id":"T1685","attack_id_wiki":"https://attack.mitre.org/techniques/T1685","identifiers":[{"type":"informative","value":"Found anti-virus related strings names"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Contains references to network communication API (string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"},{"type":"informative","value":"Able to retrieve command line parameters of the running process"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"tactic":"Collection","technique":"Clipboard Data","attack_id":"T1115","attack_id_wiki":"https://attack.mitre.org/techniques/T1115","identifiers":[{"type":"informative","value":"Contains ability to access clipboard data (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Contains ability to move file or directory (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Able to retrieve date formats supported by the local system (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"},{"type":"informative","value":"Calls an API typically used to create a directory"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to reboot/shutdown the operating system (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Connects to LPC ports"}],"sources":[{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"}],"sources":[{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"tactic":"Execution","technique":"DLL","attack_id":"T1574.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/001","identifiers":[{"type":"informative","value":"Potential hijacking of DLL execution flow detected"},{"type":"informative","value":"Possible DLL sideloading"}],"sources":[{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"tactic":"Discovery","technique":"Domain Groups","attack_id":"T1069.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1069/002","identifiers":[{"type":"informative","value":"References Windows LDAP client module"},{"type":"informative","value":"Loads Windows LDAP client module"}],"sources":[{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"tactic":"Discovery","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Observed a high volume of repeated registry API calls (API Hammering)"}],"sources":[{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"informative","value":"Found E-Mail address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"Writes files in a temp directory"}],"sources":[{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"Contains ability to perform Base64 encoding/decoding"}],"sources":[{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"tactic":"Command and Control","technique":"Mail Protocols","attack_id":"T1071.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/003","identifiers":[{"type":"informative","value":"Found mail related domain names"}],"sources":[{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains reference to crypto DLLs"}],"sources":[{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"tactic":"Stealth","technique":"Direct Volume Access","attack_id":"T1006","attack_id_wiki":"https://attack.mitre.org/techniques/T1006","identifiers":[{"type":"informative","value":"Attempts to read volume data via DOS device path"}],"sources":[{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"tactic":"Stealth","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"}],"sources":[{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"tactic":"Stealth","technique":"Masquerade File Type","attack_id":"T1036.008","attack_id_wiki":"https://attack.mitre.org/techniques/T1036/008","identifiers":[{"type":"suspicious","value":"Drops binary executable file with an unexpected extension"}],"sources":[{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"tactic":"Stealth","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"tactic":"Stealth","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"tactic":"Defense Impairment","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]}],"sandbox_signatures":[{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$36","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-101","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"\"Software\\Microsoft\\Windows\\CurrentVersion\" in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1012","id":"string-120","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \"CreateDirectoryA\" (Indicator: \"CreateDirectory\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1074.001","id":"string-423","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-161","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"level":"informative","category":"General","name":"Possibly checks for the presence of an Antivirus engine","description":"\"McAfee Inc.\" (Indicator: \"mcafee\") in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1518.001","id":"string-8","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Found reference to API \"ShellExecuteA\" (Indicator: \"ShellExecute\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-240","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1564.003","id":"string-208","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1059.003","id":"string-206","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"level":"informative","category":"General","name":"Contains ability to move file or directory (API string)","description":"Found reference to API \"MoveFileExA\" (Indicator: \"MoveFile\"; Source: \"sample.bin\"), Found reference to API \"MoveFileA\" (Indicator: \"MoveFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1570","id":"string-322","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"level":"informative","category":"General","name":"Able to rename or move file/directory (API string)","description":"Found string \"MoveFileExA\" (Indicator: \"MoveFileExA\"; Source: \"sample.bin\"), Found string \"MoveFileA\" (Indicator: \"MoveFileA\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-884","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFileA\" (Indicator: \"CreateFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-315","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1112","id":"string-345","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"Found reference to API \"CreateProcessA\" (Indicator: \"CreateProcess\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-204","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"level":"informative","category":"General","name":"Able to create/load registry keys (API string)","description":"Found registry modification API: \"RegCreateKeyExA\" in \"sample.bin\"","origin":"sample.bin","mitre_attack_id":"T1112","id":"string-307","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-319","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"level":"informative","category":"General","name":"Contains reference to method used by Windows shell items (API string)","description":"Found reference to API \"SHFileOperationA\" (Indicator: \"SHFileOperation\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1564","id":"string-269","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"DeleteFileA\" (Indicator: \"DeleteFile\"; Source: \"sample.bin\"), Found reference to API \"RemoveDirectoryA\" (Indicator: \"RemoveDirectory\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1070.004","id":"string-308","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"Found reference to API \"AdjustTokenPrivileges\" (Indicator: \"AdjustTokenPrivileges\"; Source: \"sample.bin\"), Found reference to API \"SeShutdownPrivilege\" (Indicator: \"SeShutdownPrivilege\"; Source: \"sample.bin\"), Found reference to API \"LookupPrivilegeValueA\" (Indicator: \"LookupPrivilegeValue\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1134","id":"string-77","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1489","id":"string-316","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"level":"informative","category":"System Security","name":"Able to delete registry key/value (API string)","description":"Found registry deletion API: \"RegDeleteKeyA\" in \"sample.bin\", Found registry deletion API: \"RegDeleteValueA\" in \"sample.bin\", Found registry deletion API: \"RegDeleteKeyExA\" in \"sample.bin\"","origin":"sample.bin","mitre_attack_id":"T1112","id":"string-230","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify the user configuration/privilege (API string)","description":"Found reference to API \"SystemParametersInfoA\" (Indicator: \"SystemParametersInfo\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1098","id":"string-132","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify file attributes (API string)","description":"Found reference to API \"SetFileAttributesA\" (Indicator: \"SetFileAttributes\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1222","id":"string-426","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"crl.microsoft.com/pki/crl/products/microsoftcodeverifroot.crl0\", Pattern match: \"http://crl.thawte.com/thawtetimestampingca.crl0\", Heuristic match: \";(g.ca\", Pattern match: \"http://csc3-2010-aia.verisign.com/csc3-2010.cer0\", Pattern match: \"https://www.verisign.com/cps0*\", Pattern match: \"https://www.verisign.com/rpa0\", Pattern match: \"http://crl.verisign.com/pca3-g5.crl04\", Pattern match: \"http://ts-aia.ws.symantec.com/tss-ca-g2.cer0\", Pattern match: \"http://ocsp.verisign.com0\", Pattern match: \"http://ts-ocsp.ws.symantec.com07\", Pattern match: \"http://logo.verisign.com/vslogo.gif04\", Pattern match: \"http://ts-crl.ws.symantec.com/tss-ca-g2.crl0\", Pattern match: \"http://csc3-2010-crl.verisign.com/csc3-2010.crl0d\", Pattern match: \"http://ocsp.thawte.com0\", Pattern match: \"http://www.mcafee.com\", Pattern match: \"http://nsis.sf.net/nsis_error\", Pattern match: \"https://www.verisign.com/rpa\"","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-3","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"Found HTTPS url \"https://www.verisign.com\"","origin":"sample.bin","mitre_attack_id":"T1573","id":"string-98","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"Found reference to API \"GetFileAttributesA\" (Indicator: \"GetFileAttributes\"; Source: \"sample.bin\"), Found reference to API \"GetSystemDirectoryA\" (Indicator: \"GetSystemDirectory\"; Source: \"sample.bin\"), Found reference to API \"GetFileSize\" (Indicator: \"GetFileSize\"; Source: \"sample.bin\"), Found reference to API \"GetFileVersionInfoSizeA\" (Indicator: \"GetFileVersionInfo\"; Source: \"sample.bin\"), Found reference to API \"GetFileVersionInfoSizeA\" (Indicator: \"GetFileVersionInfoSize\"; Source: \"sample.bin\"), Found reference to API \"GetFileVersionInfoA\" (Indicator: \"GetFileVersionInfo\"; Source: \"sample.bin\"), Found reference to API \"SHGetSpecialFolderLocation\" (Indicator: \"SHGetSpecialFolderLocation\"; Source: \"sample.bin\"), Found reference to API \"GetTempPathA\" (Indicator: \"GetTempPath\"; Source: \"sample.bin\"), Found reference to API \"GetTempFileNameA\" (Indicator: \"GetTempFileName\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-207","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-164","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"Found reference to API \"GetCurrentProcess\" (Indicator: \"GetCurrentProcess\"; Source: \"sample.bin\"), Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1057","id":"string-85","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-427","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"Found registry query API: \"RegQueryValueExA\" in \"sample.bin\", Found registry query API: \"RegOpenKeyExA\" in \"sample.bin\", Found registry query API: \"RegEnumValueA\" in \"sample.bin\", Found registry query API: \"RegEnumKeyA\" in \"sample.bin\"","origin":"sample.bin","mitre_attack_id":"T1012","id":"string-229","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"Found reference to API \"FindFirstFileA\" (Indicator: \"FindFirstFile\"; Source: \"sample.bin\"), Found reference to API \"FindNextFileA\" (Indicator: \"FindNextFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-83","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-317","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1497.003","id":"string-205","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture screen (API string)","description":"Found reference to API \"GetDC\" (Indicator: \"GetDC\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1113","id":"string-78","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-131","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to access clipboard data (API string)","description":"Found reference to API \"OpenClipboard\" (Indicator: \"OpenClipboard\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1115","id":"string-188","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"Found reference to API \"SendMessageTimeoutA\" (Indicator: \"sendmessage\"; Source: \"sample.bin\"), Found reference to API \"SendMessageA\" (Indicator: \"sendmessage\"; Source: \"sample.bin\"), Found reference to API \"FindWindowExA\" (Indicator: \"findwindow\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055.015","id":"string-721","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve system language (API string)","description":"Found reference to API \"GetUserDefaultUILanguage\" (Indicator: \"GetUserDefaultUILanguage\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1614.001","id":"string-143","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"Found system information discovery API: \"ExpandEnvironmentStringsA\" in \"sample.bin\"","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-89","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1497.002","id":"string-661","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"Found reference to API \"FindWindowExA\" (Indicator: \"FindWindow\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1010","id":"string-141","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to find open windows (API string)","description":"Found reference to API \"FindWindowExA\" (Indicator: \"FindWindowExA\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1010","id":"string-413","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"GetVersion\" (Indicator: \"GetVersion\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-171","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query volume/memory size (API string)","description":"Found reference to API \"GetDiskFreeSpaceA\" (Indicator: \"GetDiskFreeSpace\"; Source: \"sample.bin\"), Found reference to API \"GetDiskFreeSpaceExA\" (Indicator: \"GetDiskFreeSpace\"; Source: \"sample.bin\"), Found reference to API \"GetDiskFreeSpaceExA\" (Indicator: \"GetDiskFreeSpaceEx\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-193","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve path in which Windows is installed (API string)","description":"Found reference to API \"GetWindowsDirectoryA\" (Indicator: \"GetWindowsDirectory\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-312","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\"), Found reference to API \"LoadLibraryExA\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\"), Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055.001","id":"string-318","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055","id":"string-92","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify registry key/value (API string)","description":"Found reference to API \"RegSetValueExA\" (Indicator: \"RegSetValue\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1112","id":"string-304","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to set file time (API string)","description":"Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1070.006","id":"string-409","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"Found reference to API \"SetTimer\" (Indicator: \"SetTimer\"; Source: \"sample.bin\"), Found reference to API \"WaitForSingleObject\" (Indicator: \"WaitForSingleObject\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1497.003","id":"string-226","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to pass information to a window procedure (API string)","description":"Found reference to API \"CallWindowProcA\" (Indicator: \"CallWindowProc\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1564.003","id":"string-320","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to impersonate access tokens (API string)","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1134.001","id":"string-306","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\"), Found reference to API \"LoadLibraryExA\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-310","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to reboot/shutdown the operating system (API string)","description":"Found reference to API \"InitiateShutdownA\" (Indicator: \"InitiateShutdown\"; Source: \"sample.bin\"), Found reference to API \"ExitWindowsEx\" (Indicator: \"ExitWindows\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1529","id":"string-189","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1622","id":"string-183","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to load a resource in memory","description":"\"f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe\" called \"LoadResource with parameter {'hModule': '4194304', 'hResInfo': '4440488'}\" (UID: 00000000-00004372)\n \"f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe\" called \"LoadResource with parameter {'hModule': '4194304', 'hResInfo': '4440424'}\" (UID: 00000000-00004372)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to remove a directory","description":"\"f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe\" called \"RemoveDirectoryA\" with parameter %TEMP%\\nsg676A.tmp\\ (UID: 00000000-00004372)","origin":"API Call","mitre_attack_id":"T1070.004","relevance":3,"id":"api-121","sources":[{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify system service (API string)","description":"Found reference to API \"ChangeServiceConfigW\" (Indicator: \"ChangeServiceConfig\"; Source: \"00000000-00004372.00000000.90136.00409000.00000004.mdmp, 00000000-00004372.00000000.90136.680A2000.00000002.mdmp, 00000000-00004372.00000001.90199.00409000.00000004.mdmp\")\n Found reference to API \"ControlService\" (Indicator: \"ControlService\"; Source: \"00000000-00004372.00000000.90136.00409000.00000004.mdmp, 00000000-00004372.00000000.90136.680A2000.00000002.mdmp, 00000000-00004372.00000001.90199.00409000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-192","sources":[{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to open a service (API string)","description":"Found reference to API \"OpenServiceW\" (Indicator: \"OpenService\"; Source: \"00000000-00004372.00000000.90136.00409000.00000004.mdmp, 00000000-00004372.00000000.90136.680A2000.00000002.mdmp, 00000000-00004372.00000001.90199.00409000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":1,"id":"string-544","sources":[{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to perform Base64 encoding/decoding","description":"Found string \"abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-{}\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-\"; Source: \"00000000-00004372.00000000.90136.00630000.00000004.mdmp, 00000000-00004372.00000001.90199.00630000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1132","relevance":1,"id":"string-338","sources":[{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"Found reference to \"SA/SHA384\" (Indicator: \"SHA384\"; Source: \"00000000-00004372.00000000.90136.00630000.00000004.mdmp, 00000000-00004372.00000001.90199.00630000.00000004.mdmp\")\n Found reference to \"CryptCNGInitHMAC\" (Indicator: \"HMAC\"; Source: \"00000000-00004372.00000000.90136.00630000.00000004.mdmp, 00000000-00004372.00000001.90199.00630000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found virtual disk drive like strings","description":"Found string - \\\\.\\Global\\WGUARDNT; Source: \"00000000-00004372.00000000.90136.680A2000.00000002.mdmp\")\n Found string - \\\\.\\WGUARDNT; Source: \"00000000-00004372.00000000.90136.680A2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-145","sources":[{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"$37","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to use Microsoft's Enhanced Cryptographic Provider","description":"$38","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-602","sources":[{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to utilize the Windows bcrypt cryptographic API","description":"Found reference to API \"BCryptOpenAlgorithmProvider\" (Indicator: \"BCryptOpenAlgorithmProvider\"; Source: \"00000000-00004372-00000C2C-417006687\")\n Found reference to API \"BCryptCloseAlgorithmProvider\" (Indicator: \"BCryptCloseAlgorithmProvider\"; Source: \"00000000-00004372-00000C2C-419466114\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-927","sources":[{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to crypto DLLs","description":"Found string \":\\Windows\\system32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00004372.00000000.90136.00630000.00000004.mdmp, 00000000-00004372.00000001.90199.00630000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-493","sources":[{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"level":"informative","category":"Cryptographic Related","name":"Sample file has high entropy (likely encrypted/compressed content)","description":"Sample file \"sample.bin\" has high entropy 7.74113","origin":"Binary File","mitre_attack_id":"T1027","relevance":1,"id":"binary-71","sources":[{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to perform Base64 encoding/decoding","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Able to utilize the Windows bcrypt cryptographic API\n Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider\n Matched sigs: Contains reference to crypto DLLs\n Matched sigs: Contains ability to use Cryptographic classes\n Matched sigs: Contains CRYPTO related strings\n Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: Reads the cryptographic machine GUID\n Matched sigs: Sample file has high entropy (likely encrypted/compressed content)","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$39","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; Source: \"00000000-00004372-00000C2C-416606763\")\n Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; Source: \"00000000-00004372-00000C2C-416606901\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"Found reference to API \"EnumSystemLocalesEx\" (Indicator: \"EnumSystemLocales\"; Source: \"00000000-00004372.00000000.90136.680A2000.00000002.mdmp\")\n Found reference to API \"GetLocaleInfoEx\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00004372.00000000.90136.680A2000.00000002.mdmp\")\n Found reference to API \"GetUserDefaultLocaleName\" (Indicator: \"GetUserDefaultLocaleName\"; Source: \"00000000-00004372.00000000.90136.680A2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve date formats supported by the local system (API string)","description":"Found reference to API \"GetDateFormatEx\" (Indicator: \"GetDateFormat\"; Source: \"00000000-00004372.00000000.90136.680A2000.00000002.mdmp\")\n Found reference to API \"GetTimeFormatEx\" (Indicator: \"GetTimeFormat\"; Source: \"00000000-00004372.00000000.90136.680A2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-901","sources":[{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00004372)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00004372)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe\" called \"IsWow64Process\" with parameter \"4372\" - (UID: 00000000-00004372)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00004372)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$3a","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"\"f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe\" called \"GetVersionExA\" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000200000000000000d8eb6275a0fb68000040fd7f9a5c1f7700f0fd7f28c412004440fd7f00000000400000003f0000001e0000000040fd7f1cc41200c15c1f77608226771e0000000040fd7f9a5c1f7700f0fd7f40c4120057891e778083267713170d75d8eb6275 (UID: 00000000-00004372)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to determine if process is running under WOW64 (API string)","description":"Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00004372.00000000.90136.00409000.00000004.mdmp, 00000000-00004372.00000000.90136.680A2000.00000002.mdmp, 00000000-00004372.00000001.90199.00409000.00000004.mdmp\")\n Found reference to API \"kernel32::IsWow64Process(ps,*i0s)\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00004372.00000000.90136.00630000.00000004.mdmp, 00000000-00004372.00000001.90199.00630000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-450","sources":[{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00004372.00000000.90136.00409000.00000004.mdmp, 00000000-00004372.00000000.90136.680A2000.00000002.mdmp, 00000000-00004372.00000001.90199.00409000.00000004.mdmp\")\n Found reference to API \"SystemTimeToFileTime\" (Indicator: \"SystemTimeToFileTime\"; Source: \"00000000-00004372.00000000.90136.00409000.00000004.mdmp, 00000000-00004372.00000000.90136.680A2000.00000002.mdmp, 00000000-00004372.00000001.90199.00409000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"level":"informative","category":"Environment Awareness","name":"Possible DLL sideloading","description":"Possible dll side loading: %TEMP%\\MCCSPINSTALL.DLL\n %TEMP%\\NSG676A.TMP\\SYSTEM.DLL","origin":"Indicator Combinations","mitre_attack_id":"T1574.001","relevance":5,"id":"summary-47","sources":[{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"level":"informative","category":"Environment Awareness","name":"Queries the user identity associated with the current process token","description":"\"f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe\" queried token user identity (UID: 00000000-00004372)","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-328","sources":[{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"level":"informative","category":"General","name":"Able to enumerate service (API string)","description":"Found reference to API \"OpenSCManagerW\" (Indicator: \"OpenSCManager\"; Source: \"00000000-00004372.00000000.90136.00409000.00000004.mdmp, 00000000-00004372.00000000.90136.680A2000.00000002.mdmp, 00000000-00004372.00000001.90199.00409000.00000004.mdmp\")\n Found reference to API \"QueryServiceStatus\" (Indicator: \"QueryServiceStatus\"; Source: \"00000000-00004372.00000000.90136.00409000.00000004.mdmp, 00000000-00004372.00000000.90136.680A2000.00000002.mdmp, 00000000-00004372.00000001.90199.00409000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1007","relevance":1,"id":"string-191","sources":[{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"level":"informative","category":"General","name":"Able to retrieve command line parameters of the running process","description":"file/memory contains long string(File: \"McCSPInstall.dll\")\n file/memory contains long string(File: \"DISMHOST.EXE.6AF0FC96.bin\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-930","sources":[{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"level":"informative","category":"General","name":"Able to retrieve/open a process (API string)","description":"Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00004372.00000000.90136.00409000.00000004.mdmp, 00000000-00004372.00000000.90136.680A2000.00000002.mdmp, 00000000-00004372.00000001.90199.00409000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"$3b","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"$3c","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$3d","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$3e","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"level":"informative","category":"General","name":"Contains ability to close a handle to a service (API string)","description":"Found reference to API \"CloseServiceHandle\" (Indicator: \"CloseServiceHandle\"; Source: \"00000000-00004372.00000000.90136.00409000.00000004.mdmp, 00000000-00004372.00000000.90136.680A2000.00000002.mdmp, 00000000-00004372.00000001.90199.00409000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-242","sources":[{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"level":"informative","category":"General","name":"Contains ability to create/control drivers (API string)","description":"Found reference to API \"DeviceIoControl\" (Indicator: \"DeviceIoControl\"; Source: \"00000000-00004372.00000000.90136.00409000.00000004.mdmp, 00000000-00004372.00000000.90136.680A2000.00000002.mdmp, 00000000-00004372.00000001.90199.00409000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-220","sources":[{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"Antivirus vendors marked dropped file \"McCSPInstall.dll\" as clean (type is \"PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections\"), Antivirus vendors marked dropped file \"DISMHOST.EXE.6AF0FC96.bin\" as clean (type is \"PE32 executable for MS Windows 5.01 (GUI) Intel i386 4 sections\")","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_NO_SEH\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\n \"McCSPInstall.dll\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n \"DISMHOST.EXE.6AF0FC96.bin\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"level":"informative","category":"General","name":"Found E-Mail address in binary/memory","description":"Pattern match: \"info@diginotar.nl\"\n Pattern match: \"cps-requests@verisign.com\"\n Pattern match: \"premium-server@thawte.com\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"$3f","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"level":"informative","category":"General","name":"Loads Windows LDAP client module","description":"\"f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe\" loaded module \"%WINDIR%\\System32\\Wldap32.dll\" at 755F0000","origin":"Loaded Module","mitre_attack_id":"T1069.002","relevance":3,"id":"module-17","sources":[{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$40","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 74BB0000\n \"f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 74770000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 76610000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"1800190068e80f68@api-ms-win-core-synch-l1-2-0.dll\"\n \"1800190088e80f68@api-ms-win-core-synch-l1-2-0.dll\"\n \"0d000e00cc5f0f68@ntdll.dll\"\n \"0b000c0004f2c475@ADVAPI32.dll\"\n \"1500160020732268@ADVAPI32.dll\"\n \"0e000f00e4732268@ADVAPI32.dll\"\n \"0e000f0050742268@ADVAPI32.dll\"\n \"11001200d47d2268@ADVAPI32.dll\"\n \"110012007c7e2268@ADVAPI32.dll\"\n \"12001300cc7e2268@ADVAPI32.dll\"\n \"12001300387f2268@ADVAPI32.dll\"\n \"14001500dcb82268@ADVAPI32.dll\"\n \"14001500f8b82268@ADVAPI32.dll\"\n \"1400150014b92268@ADVAPI32.dll\"\n \"1700180030b92268@ADVAPI32.dll\"\n \"0d000e004cb92268@ADVAPI32.dll\"\n \"110012005cb92268@ADVAPI32.dll\"\n \"1100120074b92268@ADVAPI32.dll\"\n \"0d000e009c7f2268@SHELL32.dll\"\n \"0d000e0028802268@SHELL32.dll\"\n \"0f001000e4ba2268@ADVAPI32.dll\"\n \"1400150030bb2268@ADVAPI32.dll\"\n \"140015004cbb2268@ADVAPI32.dll\"\n \"0c000d00a0bb2268@ADVAPI32.dll\"\n \"0c000d00b0bb2268@ADVAPI32.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666\" was detected as \"Nullsoft Scriptable Install System\" and name: \"Installer\"\n \"f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666\" was detected as \"Microsoft Linker\" and name: \"Linker\"\n \"McCSPInstall.dll\" was detected as \"Nullsoft Scriptable Install System\" and name: \"Installer\"\n \"McCSPInstall.dll\" was detected as \"Microsoft Linker\" and name: \"Linker\"\n \"System.dll\" was detected as \"Nullsoft Scriptable Install System\" and name: \"Installer\"\n \"System.dll\" was detected as \"Microsoft Linker\" and name: \"Linker\"\n \"DISMHOST.EXE.6AF0FC96.bin\" was detected as \"Nullsoft Scriptable Install System\" and name: \"Installer\"\n \"DISMHOST.EXE.6AF0FC96.bin\" was detected as \"Microsoft Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"\"f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe\" touched \"Computer\" (Path: \"HKCU\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\SHELLFOLDER\")\n \"f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe\" touched \"Memory Mapped Cache Mgr\" (Path: \"HKCU\\CLSID\\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\")","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"level":"informative","category":"General","name":"Reads Windows Trust Settings","description":"\"f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-20","sources":[{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"level":"informative","category":"General","name":"References Windows LDAP client module","description":"Found string \":\\Windows\\system32\\WLDAP32.dll\" (Source: \"00000000-00004372.00000000.90136.00630000.00000004.mdmp, 00000000-00004372.00000001.90199.00630000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1069.002","relevance":1,"id":"string-987","sources":[{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"level":"informative","category":"General","name":"References Windows file paths for DLLs (possible dropped files)","description":"Observed system executable string:\"%WINDIR%\\system32\\CRYPT32.dll\" [Source: 00000000-00004372-00000C2B-416074223]\n Observed system executable string:\"%WINDIR%\\system32\\bcryptprimitives.dll\" [Source: 00000000-00004372-00000C2B-417010781]\n Observed system executable string:\"%WINDIR%\\system32\\cryptnet.dll\" [Source: 00000000-00004372-00000C2B-417656470]","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"$41","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"McCSPInstall.dll\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"System.dll\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"DISMHOST.EXE.6AF0FC96.bin\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"level":"informative","category":"General","name":"Writes files in a temp directory","description":"\"f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\nsg676A.tmp\\System.dll\"\n \"f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\McCSPInstall.dll\"","origin":"API Call","mitre_attack_id":"T1005","relevance":1,"id":"api-267","sources":[{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"level":"informative","category":"Installation/Persistence","name":"Connects to LPC ports","description":"\"f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","mitre_attack_id":"T1559","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe\" creates a thread in process \"-1\" (Handle: 4294967295)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"\"McCSPInstall.dll\" has type \"PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections\"- Location: [%TEMP%\\McCSPInstall.dll]- [targetUID: 00000000-00004372]\n \"System.dll\" has type \"PE32 executable for MS Windows 4.00 (DLL) Intel i386 4 sections\"- Location: [%TEMP%\\nsg676A.tmp\\System.dll]- [targetUID: 00000000-00004372]\n \"DISMHOST.EXE.6AF0FC96.bin\" has type \"PE32 executable for MS Windows 5.01 (GUI) Intel i386 4 sections\"- [targetUID: 00000000-00004372]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$42","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"level":"informative","category":"Installation/Persistence","name":"Potential hijacking of DLL execution flow detected","description":"\"McCSPInstall.dll\" has type \"PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections\"- Location: [%TEMP%\\McCSPInstall.dll]- [targetUID: 00000000-00004372]\n \"System.dll\" has type \"PE32 executable for MS Windows 4.00 (DLL) Intel i386 4 sections\"- Location: [%TEMP%\\nsg676A.tmp\\System.dll]- [targetUID: 00000000-00004372]","origin":"Binary File","mitre_attack_id":"T1574.001","relevance":5,"id":"binary-91","sources":[{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$43","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe\" reads file \"c:\\f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: Able to identify virtual environment by using user activity (API string)\n Matched sigs: Observed a high volume of repeated registry API calls (API Hammering)","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$44","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"\"f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\Caches\"\n \"f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\"","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$45","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"\"f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe\" trying to access non-existent file \"C:\\f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe.Local\\\"\n \"f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe\" trying to access non-existent file \"C:\\F9761DA0D2822C35A631A059A7D6A5EF872435C37992B6C11F1C55427F3E1666.EXE.LOCAL\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\nsg676a.tmp\\system.dll\"\n \"f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\mccspinstall.dll\"\n \"f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe\" writes file \"%temp%\\mccspinstall.dll\"\n \"f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe\" writes file \"%temp%\\nsg676a.tmp\\system.dll\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"Found reference to API \"AUTHUI.DLL: Shutdown Choices Message Window\" (Indicator: \" shutdown \"; Source: \"00000000-00004372.00000000.90136.00730000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"level":"informative","category":"Network Related","name":"Found mail related domain names","description":"Observed email domain:\"www.mail.google.com0\" [Source: 00000000-00004372.00000000.90136.00630000.00000004.mdmp\n 00000000-00004372.00000001.90199.00630000.00000004.mdmp]","origin":"File/Memory","mitre_attack_id":"T1071.003","relevance":1,"id":"string-169","sources":[{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"2.5.29.35\"\n \"2.5.29.37\"\n \"2.5.29.14\"\n \"2.5.29.19\"\n \"2.5.29.31\"\n Potential IP \"2.5.29.37\" found in string \"%2.5.29.37\"\n \"2.5.29.15\"\n \"2.5.29.17\"\n Potential IP \"2.5.29.35\" found in string \"#2.5.29.35\"\n \"2.5.29.32\"\n \"2.5.4.6\"\n \"2.5.4.8\"\n \"2.5.4.7\"\n \"2.5.4.10\"\n \"2.5.4.11\"\n \"2.5.4.3\"\n \"2.5.29.1\"\n \"2.5.29.4\"\n \"2.5.29.10\"\n \"2.5.29.16\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$46","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve usernames and/or user information (API string)","description":"Found reference to API \"GetUserObjectInformationW\" (Indicator: \"GetUserObjectInformation\"; Source: \"00000000-00004372.00000000.90136.00409000.00000004.mdmp, 00000000-00004372.00000000.90136.680A2000.00000002.mdmp, 00000000-00004372.00000001.90199.00409000.00000004.mdmp\")\n Found reference to API \"GetProcessWindowStation\" (Indicator: \"GetProcessWindowStation\"; Source: \"00000000-00004372.00000000.90136.00409000.00000004.mdmp, 00000000-00004372.00000000.90136.680A2000.00000002.mdmp, 00000000-00004372.00000001.90199.00409000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Attempts to read volume data via DOS device path","description":"\"f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe\" tries to directly access volume data \"C:\"\n \"f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe\" tries to directly access volume data \"Z:\"","origin":"API Call","mitre_attack_id":"T1006","relevance":1,"id":"api-306","sources":[{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$47","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"000000000010000000000100fffffe7f03000000080000004a020000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"Found string \"Microsoft Enhanced RSA and AES Cryptographic Provider\" (Indicator: \"aes\"; Source: \"00000000-00004372.00000000.90136.00630000.00000004.mdmp, 00000000-00004372.00000001.90199.00630000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve process ID (API string)","description":"Found reference to API \"Kernel32::GetProcessId(i R0) i.R2\" (Indicator: \"GetProcessId\"; Source: \"00000000-00004372.00000000.90136.00630000.00000004.mdmp, 00000000-00004372.00000001.90199.00630000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-478","sources":[{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"level":"informative","category":"System Security","name":"Able to change the configuration parameters of a service","description":"file/memory contains long string with (Indicator: \"changeserviceconfigw\"; File: \"McCSPInstall.dll\")\n Found string \"ChangeServiceConfigW\" (Indicator: \"changeserviceconfigw\"; Source: \"00000000-00004372.00000000.90136.00409000.00000004.mdmp, 00000000-00004372.00000000.90136.680A2000.00000002.mdmp, 00000000-00004372.00000001.90199.00409000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-10073","sources":[{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"$48","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$49","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"level":"informative","category":"System Security","name":"Writes registry keys","description":"\"f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\LOCAL SETTINGS\\MUICACHE\\137\\52C64B7E\"; Key: \"LANGUAGELIST\"; Value: \"en-US\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops executable files inside temp directory","description":"\"McCSPInstall.dll\" has type \"PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections\"- Location: [%TEMP%\\McCSPInstall.dll]- [targetUID: 00000000-00004372]\n \"System.dll\" has type \"PE32 executable for MS Windows 4.00 (DLL) Intel i386 4 sections\"- Location: [%TEMP%\\nsg676A.tmp\\System.dll]- [targetUID: 00000000-00004372]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-33","sources":[{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"level":"informative","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"$4a","origin":"File/Memory","mitre_attack_id":"T1106","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"Queries kernel debugger information","description":"\"f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe\" at 00000000-00004372-00000105-2586329","origin":"API Call","mitre_attack_id":"T1622","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"1/26 Antivirus vendors marked sample as malicious (3% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"level":"suspicious","category":"General","name":"Reads configuration files (.ini files)","description":"\"f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe\" reads file \"C:\\Users\\%OSUSER%\\Desktop\\desktop.ini\"","origin":"API Call","mitre_attack_id":"T1083","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"\"McCSPInstall.dll\" has type \"PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections\"- Location: [%TEMP%\\McCSPInstall.dll]- [targetUID: 00000000-00004372]\n \"System.dll\" has type \"PE32 executable for MS Windows 4.00 (DLL) Intel i386 4 sections\"- Location: [%TEMP%\\nsg676A.tmp\\System.dll]- [targetUID: 00000000-00004372]\n \"DISMHOST.EXE.6AF0FC96.bin\" has type \"PE32 executable for MS Windows 5.01 (GUI) Intel i386 4 sections\"- [targetUID: 00000000-00004372]","origin":"Binary File","mitre_attack_id":"T1105","relevance":5,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes a PE file header to disc","description":"\"f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe\" wrote 19376 bytes starting with PE header signature to file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\nsg676A.tmp\\System.dll\": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...\n \"f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe\" wrote 28536 bytes starting with PE header signature to file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\McCSPInstall.dll\": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...","origin":"API Call","mitre_attack_id":"T1105","relevance":5,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API that may be used to take screenshots","description":"\"f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"310106fd\"\n \"cx\": \"32\"\n \"cy\": \"32\"}","origin":"API Call","mitre_attack_id":"T1113","relevance":1,"id":"api-105","sources":[{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Found an instant messenger related domain","description":"\"login.skype.com0\" (Indicator: \"skype.com\")\n \"login.skype.com\" (Indicator: \"skype.com\")\n \"www.login.skype.com0\" (Indicator: \"skype.com\")","origin":"File/Memory","relevance":10,"id":"string-61","sources":[{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\nsg6769.tmp\" for deletion\n \"f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\nsg676A.tmp\" for deletion\n \"f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\McCSPInstall.dll\" for deletion\n \"f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\nsg676A.tmp\\System.dll\" for deletion","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\nsg6769.tmp\" with delete access\n \"f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\nsg676A.tmp\" with delete access\n \"f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\McCSPInstall.dll\" with delete access\n \"f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\nsg676A.tmp\\System.dll\" with delete access","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"level":"suspicious","category":"System Security","name":"Modifies Software Policy Settings","description":"$4b","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-19","sources":[{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Drops binary executable file with an unexpected extension","description":"\"DISMHOST.EXE.6AF0FC96.bin\" has unusual extension","origin":"Binary File","mitre_attack_id":"T1036.008","relevance":3,"id":"binary-75","sources":[{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Reads Antivirus engine related registry keys","description":"\"f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe\" (Path: \"HKLM\\SOFTWARE\\MCAFEE\\SYSTEMCORE\")\n \"f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe\" (Path: \"HKLM\\SOFTWARE\\MCAFEE\\CSP\")\n \"f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe\" (Path: \"HKLM\\SOFTWARE\\MCAFEE\\CSP\\APPS\")","origin":"Registry Access","mitre_attack_id":"T1518.001","relevance":8,"id":"registry-32","sources":[{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]}],"incidents":[{"name":"Spyware","details_count":1,"details":[{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"name":"Fingerprint","details_count":1,"details":[{"detail":"Queries kernel debugger information"}],"sources":[{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"name":"Evasive","details_count":2,"details":[{"detail":"Marks file for deletion"},{"detail":"Reads Antivirus engine related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]}],"intel_graph":{"map":{"File:1f9f2810d0aab01dd83da1eae18e7e0ea11d61711f0194f5d2b4107afb841b68":{"type":"File","value":"1f9f2810d0aab01dd83da1eae18e7e0ea11d61711f0194f5d2b4107afb841b68"},"File:aff643e3be72c49b30f5d1b5bfc0233b2b98cbcf7e198b41e04ef42b4f50e831":{"type":"File","value":"aff643e3be72c49b30f5d1b5bfc0233b2b98cbcf7e198b41e04ef42b4f50e831"},"File:ecb636b278261eade712e68ec7d805d20e802628248da872d3d0ada1432ffc11":{"type":"File","value":"ecb636b278261eade712e68ec7d805d20e802628248da872d3d0ada1432ffc11"},"File:f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666":{"type":"File","value":"f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666"}},"chains":[{"id":"sandbox_files","root":"File:f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666","edges":[{"edge_kind":"extracted","from_key":"File:f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666","to_key":"File:aff643e3be72c49b30f5d1b5bfc0233b2b98cbcf7e198b41e04ef42b4f50e831"},{"edge_kind":"extracted","from_key":"File:f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666","to_key":"File:1f9f2810d0aab01dd83da1eae18e7e0ea11d61711f0194f5d2b4107afb841b68"},{"edge_kind":"extracted","from_key":"File:f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666","to_key":"File:ecb636b278261eade712e68ec7d805d20e802628248da872d3d0ada1432ffc11"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}}]}},"activity":{"stats":{"process_count":1,"spawned_processes_count":1,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":69,"dropped_files_count":0,"extracted_files_count":3,"files_written_count":11,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"sample_flags":["Extracted Files"],"sandbox_reports":[{"id":"6af0ee66c67bdfdd0c0d042d","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":65,"malware_family":"TrojanDldr.Agent.BX","submit_name":"f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666","analysis_start_time":"2026-11-08T21:49:27+00:00","indicators_count":{"informative":145,"suspicious":16,"malicious":1},"tags":["Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}],"processes":[{"pid":4372,"ppid":0,"name":"f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe","command_line":"","sha256":"f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666","normalized_path":"C:\\f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666.exe","uid":"00000000-00004372","icon":"$4c"}],"all_imported_dlls":["msctf.dll","api-ms-win-crt-runtime-l1-1-0.dll","api-ms-win-core-processthreads-l1-1-1.dll","setupapi.dll","profapi.dll","userenv.dll","gdi32.dll","ole32.dll","api-ms-win-crt-string-l1-1-0.dll","cryptnet.dll","kernel32.dll","ucrtbase.dll","api-ms-win-crt-locale-l1-1-0.dll","clbcatq.dll","propsys.dll","bcrypt.dll","shell32.dll","ntdll.dll","cryptbase.dll","api-ms-win-core-synch-l1-2-0.dll","api-ms-win-crt-heap-l1-1-0.dll","api-ms-win-crt-math-l1-1-0.dll","rsaenh.dll","KernelBase.dll","shlwapi.dll","ws2_32.dll","msvcp140.dll","api-ms-win-core-timezone-l1-1-0.dll","api-ms-win-core-localization-l1-2-0.dll","api-ms-win-crt-convert-l1-1-0.dll","api-ms-win-crt-environment-l1-1-0.dll","lpk.dll","version.dll","msasn1.dll","usp10.dll","imm32.dll","McCSPInstall.dll","sechost.dll","uxtheme.dll","shfolder.dll","api-ms-win-crt-filesystem-l1-1-0.dll","devobj.dll","System.dll","cryptsp.dll","gpapi.dll","VxSSL32.dll","cfgmgr32.dll","bcryptprimitives.dll","rpcss.dll","oleaut32.dll","nsi.dll","user32.dll","comctl32.dll","fltLib.dll","api-ms-win-core-file-l2-1-0.dll","api-ms-win-crt-time-l1-1-0.dll","Wldap32.dll","api-ms-win-crt-utility-l1-1-0.dll","ntmarta.dll","crypt32.dll","api-ms-win-core-file-l1-2-0.dll","imagehlp.dll","msvcrt.dll","advapi32.dll","rpcrt4.dll","api-ms-win-crt-stdio-l1-1-0.dll","ncrypt.dll","vcruntime140.dll","wintrust.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"System.dll","sha256":"aff643e3be72c49b30f5d1b5bfc0233b2b98cbcf7e198b41e04ef42b4f50e831","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"name":"McCSPInstall.dll","sha256":"1f9f2810d0aab01dd83da1eae18e7e0ea11d61711f0194f5d2b4107afb841b68","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"name":"DISMHOST.EXE.6AF0FC96.bin","sha256":"ecb636b278261eade712e68ec7d805d20e802628248da872d3d0ada1432ffc11","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]}],"files_written":[{"path":"\\FileSystem\\Filters\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"path":"%LOCALAPPDATA%\\Temp","sources":[{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"path":"%TEMP%\\nsg6769.tmp","sources":[{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"path":"%TEMP%\\nsg676A.tmp","sources":[{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"path":"C:\\Users","sources":[{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"path":"%USERPROFILE%\\AppData","sources":[{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"path":"%TEMP%\\nsg676A.tmp\\System.dll","sources":[{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]},{"path":"%TEMP%\\McCSPInstall.dll","sources":[{"report_type":"sandbox","report_id":"6af0ee66c67bdfdd0c0d042d"}]}],"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":null}},"report_ids":{"sandbox_job_ids":["6af0ee66c67bdfdd0c0d042d"]}}}]]}] 2c:[["$","title","0",{"children":"Malicious TrojanDldr.Agent.BX Sample f9761da0d282… — Score 65/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample f9761da0d282…. Malware family: TrojanDldr.Agent.BX. Threat score 65/100. 1/26 AV engines flagged this file. 1 malicious and 11 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666"}],["$","meta","4",{"property":"og:title","content":"Malicious TrojanDldr.Agent.BX Sample f9761da0d282… — Score 65/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample f9761da0d282…. Malware family: TrojanDldr.Agent.BX. Threat score 65/100. 1/26 AV engines flagged this file. 1 malicious and 11 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/f9761da0d2822c35a631a059a7d6a5ef872435c37992b6c11f1c55427f3e1666"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious TrojanDldr.Agent.BX Sample f9761da0d282… — Score 65/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample f9761da0d282…. Malware family: TrojanDldr.Agent.BX. Threat score 65/100. 1/26 AV engines flagged this file. 1 malicious and 11 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L4d","11",{}]] 32:null