26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 44:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4f2,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious MSIL/Kryptik_AGeneric.AOH trojan Sample fc2bcad21d96… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample fc2bcad21d96…. Malware family: MSIL/Kryptik_AGeneric.AOH trojan. Threat score 100/100. 3/28 AV engines flagged this file. 12 malicious and 25 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/fc2bcad21d96b3e31b27f0610209f0aa33fb1aa83504e8c346d390ac2da19504","keywords":["Malicious","MSIL/Kryptik_AGeneric.AOH trojan","malware analysis","sandbox report","threat intelligence","fc2bcad21d96b3e31b27f0610209f0aa33fb1aa83504e8c346d390ac2da19504"],"about":{"@type":"SoftwareApplication","name":"0e71408d394b8b78ae90813be74e3047.exe","applicationCategory":["peexe","assembly","executable"],"identifier":"fc2bcad21d96b3e31b27f0610209f0aa33fb1aa83504e8c346d390ac2da19504","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"MSIL/Kryptik_AGeneric.AOH trojan","antivirusDetections":{"malicious":3,"total":28},"behavioralIndicators":{"malicious":12,"suspicious":25},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:Tdb6,Observed string: "-----BEGIN RSA PRIVATE KEY-----" (Indicator: "private key") in Source: 00000000-00001172.00000000.71169.00400000.00000040.mdmp 00000000-00001172.00000001.73090.00400000.00000040.mdmp 00000000-00001172.00000002.75012.00400000.00000040.mdmp Observed string: "-----END RSA PRIVATE KEY-----" (Indicator: "private key") in Source: 00000000-00001172.00000000.71169.00400000.00000040.mdmp 00000000-00001172.00000001.73090.00400000.00000040.mdmp 00000000-00001172.00000002.75012.00400000.00000040.mdmp Observed string: "-----BEGIN PRIVATE KEY-----" (Indicator: "private key") in Source: 00000000-00001172.00000000.71169.00400000.00000040.mdmp 00000000-00001172.00000001.73090.00400000.00000040.mdmp 00000000-00001172.00000002.75012.00400000.00000040.mdmp Observed string: "-----END PRIVATE KEY-----" (Indicator: "private key") in Source: 00000000-00001172.00000000.71169.00400000.00000040.mdmp 00000000-00001172.00000001.73090.00400000.00000040.mdmp 00000000-00001172.00000002.75012.00400000.00000040.mdmp Observed string: "-----BEGIN ENCRYPTED PRIVATE KEY-----" (Indicator: "private key") in Source: 00000000-00001172.00000000.71169.00400000.00000040.mdmp 00000000-00001172.00000001.73090.00400000.00000040.mdmp 00000000-00001172.00000002.75012.00400000.00000040.mdmp Observed string: "-----END ENCRYPTED PRIVATE KEY-----" (Indicator: "private key") in Source: 00000000-00001172.00000000.71169.00400000.00000040.mdmp 00000000-00001172.00000001.73090.00400000.00000040.mdmp 00000000-00001172.00000002.75012.00400000.00000040.mdmp Observed string: "-----BEGIN EC PRIVATE KEY-----" (Indicator: "private key") in Source: 00000000-00001172.00000000.71169.00400000.00000040.mdmp 00000000-00001172.00000001.73090.00400000.00000040.mdmp 00000000-00001172.00000002.75012.00400000.00000040.mdmp Observed string: "-----END EC PRIVATE KEY-----" (Indicator: "private key") in Source: 00000000-00001172.00000000.71169.00400000.00000040.mdmp 00000000-00001172.00000001.73090.00400000.00000040.mdmp 00000000-00001172.00000002.75012.00400000.00000040.mdmp Observed string: "-----BEGIN DSA PRIVATE KEY-----" (Indicator: "private key") in Source: 00000000-00001172.00000000.71169.00400000.00000040.mdmp 00000000-00001172.00000001.73090.00400000.00000040.mdmp 00000000-00001172.00000002.75012.00400000.00000040.mdmp Observed string: "-----END DSA PRIVATE KEY-----" (Indicator: "private key") in Source: 00000000-00001172.00000000.71169.00400000.00000040.mdmp 00000000-00001172.00000001.73090.00400000.00000040.mdmp 00000000-00001172.00000002.75012.00400000.00000040.mdmp Observed string: "-----BEGIN PUBLIC KEY-----" (Indicator: "public key") in Source: 00000000-00001172.00000000.71169.00400000.00000040.mdmp 00000000-00001172.00000001.73090.00400000.00000040.mdmp 00000000-00001172.00000002.75012.00400000.00000040.mdmp Observed string: "-----END PUBLIC KEY-----" (Indicator: "public key") in Source: 00000000-00001172.00000000.71169.00400000.00000040.mdmp 00000000-00001172.00000001.73090.00400000.00000040.mdmp 00000000-00001172.00000002.75012.00400000.00000040.mdmp Observed string: "http://www.w3.org/2001/04/xmlenc# EncryptedKey" (Indicator: "encryptedkey") in Source: 00000000-00002840.00000000.67255.01B00000.00000004.mdmp Observed string: "System.Security.Cryptography.Xml.KeyInfoEncryptedKey, System.Security, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" (Indicator: "encryptedkey") in Source: 00000000-00002840.00000000.67255.01B00000.00000004.mdmp28:T7be,".exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002840) ".exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002840) ".exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000009f10000000381d52000000000080000000c0f12f005640001660f4510001000000381d5200020000000c000000589c5100589c5100539c510000000000cc2cea0000004e00000000012cf12f0024f6e96c4cf72f0095e1187771663700feffffff435c1c7750591c7794000000a0000000529c5100509c510094000000d0f22f00fdfe85751000000074f22f0078f22f00010000001c5c1b772e912875ffffffff1a00000058f22f000400000000000000ffffffffccf22f0039f9e86c00000000dcf22f00006b6f680100000047f9e86c000000000300000000000000a0000000 (UID: 00000000-00002840) ".exe" called "RtlGetVersion" (UID: 00000000-00002840)29:T4d6,Observed string: "GetSystemTimePreciseAsFileTime" (Indicator: "GetSystemTime") in Source: 00000000-00002840-00000C1E-19198961 Observed string: "GetSystemTimes" (Indicator: "GetSystemTime") in Source: 00000000-00004016-00000C1E-30981383 Observed string: "GetSystemTimePreciseAsFileTime" (Indicator: "GetSystemTime") in Source: 00000000-00001172.00000000.71169.00400000.00000040.mdmp 00000000-00001172.00000001.73090.00400000.00000040.mdmp 00000000-00001172.00000002.75012.00400000.00000040.mdmp Observed string: "GetSystemTimes" (Indicator: "GetSystemTime") in Source: 00000000-00001172.00000000.71169.00400000.00000040.mdmp 00000000-00001172.00000001.73090.00400000.00000040.mdmp 00000000-00001172.00000002.75012.00400000.00000040.mdmp Observed string: "GetLocalTime" (Indicator: "GetLocalTime") in Source: 00000000-00001172.00000000.71169.00400000.00000040.mdmp 00000000-00001172.00000001.73090.00400000.00000040.mdmp 00000000-00001172.00000002.75012.00400000.00000040.mdmp Observed string: "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime") in Source: 00000000-00001172.00000000.71169.00400000.00000040.mdmp 00000000-00001172.00000001.73090.00400000.00000040.mdmp 00000000-00001172.00000002.75012.00400000.00000040.mdmp2a:T614,Observed string: "GetLocaleInfoEx" [Source: 00000000-00002840-00000C1E-4986813] Observed string: "GetSystemDefaultLCID" [Source: 00000000-00002840-00000C1E-6365389] Observed string: "GetSystemDefaultLCIDW" [Source: 00000000-00002840-00000C1E-6366419] Observed string: "GetLocaleInfoEx" [Source: 00000000-00001172.00000000.71169.00400000.00000040.mdmp 00000000-00001172.00000001.73090.00400000.00000040.mdmp 00000000-00001172.00000002.75012.00400000.00000040.mdmp] Observed string: "EnumSystemLocalesEx" [Source: 00000000-00001172.00000000.71169.00400000.00000040.mdmp 00000000-00001172.00000001.73090.00400000.00000040.mdmp 00000000-00001172.00000002.75012.00400000.00000040.mdmp] Observed string: "GetLocaleInfoA" [Source: 00000000-00001172.00000000.71169.00400000.00000040.mdmp 00000000-00001172.00000001.73090.00400000.00000040.mdmp 00000000-00001172.00000002.75012.00400000.00000040.mdmp] Observed string: "GetLocaleInfoW" [Source: 00000000-00001172.00000000.71169.00400000.00000040.mdmp 00000000-00001172.00000001.73090.00400000.00000040.mdmp 00000000-00001172.00000002.75012.00400000.00000040.mdmp] Observed string: "GetUserDefaultLCID" [Source: 00000000-00001172.00000000.71169.00400000.00000040.mdmp 00000000-00001172.00000001.73090.00400000.00000040.mdmp 00000000-00001172.00000002.75012.00400000.00000040.mdmp] Observed string: "EnumSystemLocalesW" [Source: 00000000-00001172.00000000.71169.00400000.00000040.mdmp 00000000-00001172.00000001.73090.00400000.00000040.mdmp 00000000-00001172.00000002.75012.00400000.00000040.mdmp]2b:T53f,".exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") ".exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "WScript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "WScript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "WScript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LEVELS") "WScript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "DEFAULTLEVEL") "WScript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "SAFERFLAGS") "WScript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "POLICYSCOPE") "WScript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LOGFILENAME") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "BIN.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED")2c:T4d6,Observed string: "GetSystemTimePreciseAsFileTime" (Indicator: "GetSystemTime") in Source: 00000000-00002840-00000C1E-19198961 Observed string: "GetSystemTimes" (Indicator: "GetSystemTime") in Source: 00000000-00004016-00000C1E-30981383 Observed string: "GetSystemTimePreciseAsFileTime" (Indicator: "GetSystemTime") in Source: 00000000-00001172.00000000.71169.00400000.00000040.mdmp 00000000-00001172.00000001.73090.00400000.00000040.mdmp 00000000-00001172.00000002.75012.00400000.00000040.mdmp Observed string: "GetSystemTimes" (Indicator: "GetSystemTime") in Source: 00000000-00001172.00000000.71169.00400000.00000040.mdmp 00000000-00001172.00000001.73090.00400000.00000040.mdmp 00000000-00001172.00000002.75012.00400000.00000040.mdmp Observed string: "GetLocalTime" (Indicator: "GetLocalTime") in Source: 00000000-00001172.00000000.71169.00400000.00000040.mdmp 00000000-00001172.00000001.73090.00400000.00000040.mdmp 00000000-00001172.00000002.75012.00400000.00000040.mdmp Observed string: "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime") in Source: 00000000-00001172.00000000.71169.00400000.00000040.mdmp 00000000-00001172.00000001.73090.00400000.00000040.mdmp 00000000-00001172.00000002.75012.00400000.00000040.mdmp2d:T70e,"BIN.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{90A066FE-591C-47F3-850D-9644B684FBA5}"; Key: "ENABLEDHCP"; Value: "") "BIN.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{90A066FE-591C-47F3-850D-9644B684FBA5}"; Key: "REGISTRATIONENABLED"; Value: "") "BIN.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{90A066FE-591C-47F3-850D-9644B684FBA5}"; Key: "REGISTERADAPTERNAME"; Value: "") "BIN.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{90A066FE-591C-47F3-850D-9644B684FBA5}"; Key: "DOMAIN"; Value: "") "BIN.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{90A066FE-591C-47F3-850D-9644B684FBA5}"; Key: "DHCPDOMAIN"; Value: "") "BIN.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "BIN.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "BIN.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "BIN.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "BIN.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "")2e:T586,".exe" called "CreateDirectoryW" with parameter C:\Users\%OSUSER% (UID: 00000000-00002840) ".exe" called "CreateDirectoryW" with parameter %USERPROFILE%\AppData\Roaming (UID: 00000000-00002840) ".exe" called "CreateDirectoryW" with parameter %APPDATA%\BIN (UID: 00000000-00004016) "WScript.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Microsoft\Windows\Caches (UID: 00000000-00003644) "BIN.exe" called "CreateDirectoryW" with parameter C:\Users\%OSUSER% (UID: 00000000-00003200) "BIN.exe" called "CreateDirectoryW" with parameter %USERPROFILE%\AppData\Roaming (UID: 00000000-00003200) "BIN.exe" called "CreateDirectoryW" with parameter %APPDATA%\remcos (UID: 00000000-00001172) "BIN.exe" called "CreateDirectoryW" with parameter C:\Users\%OSUSER% (UID: 00000000-00001172) "BIN.exe" called "CreateDirectoryW" with parameter %USERPROFILE%\AppData\Local (UID: 00000000-00001172) "BIN.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files (UID: 00000000-00001172) "BIN.exe" called "CreateDirectoryW" with parameter %USERPROFILE%\AppData\Roaming (UID: 00000000-00001172) "BIN.exe" called "CreateDirectoryW" with parameter %APPDATA%\Microsoft\Windows\Cookies (UID: 00000000-00001172) "BIN.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Microsoft\Windows\History (UID: 00000000-00001172)2f:T410,".exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002840) ".exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002840) ".exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002840) ".exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002840) ".exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00002840) ".exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00002840) ".exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-0.dll (UID: 00000000-00002840) ".exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00002840) ".exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00002840)30:T61b,".exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00002840) ".exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00002840) ".exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00002840) ".exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00002840) ".exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00002840) ".exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00002840) ".exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00002840) ".exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00002840) ".exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00002840) ".exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00002840) ".exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00002840) ".exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00002840) ".exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00002840) ".exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00002840) ".exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00002840)31:T662,Observed API string: "GetThreadContext" [Source: 00000000-00002840-00000C1E-9585692] Observed API string: "CreateThread" [Source: 00000000-00002840-00000C1E-19189206] Observed API string: "CreateThread" [Source: 00000000-00002840-00000C1E-19191648] Observed API string: "OpenThread" [Source: 00000000-00002840-00000C1E-21404732] Observed API string: "ResumeThread" [Source: 00000000-00002840-00000C1E-29427094] Observed API string: "SetThreadContext" [Source: 00000000-00002840-00000C1E-29448816] Observed API string: "SetThreadContext" [Source: 00000000-00002840-00000C1E-29467187] Observed API string: "GetThreadContext" [Source: 00000000-00002840-00000C1E-29545636] Observed API string: "CreateThread" [Source: 00000000-00003644-00000C1E-13309533] Observed API string: "CreateThread" [Source: 00000000-00001172.00000000.71169.00400000.00000040.mdmp 00000000-00001172.00000001.73090.00400000.00000040.mdmp 00000000-00001172.00000002.75012.00400000.00000040.mdmp] Observed API string: "ResumeThread" [Source: 00000000-00001172.00000000.71169.00400000.00000040.mdmp 00000000-00001172.00000001.73090.00400000.00000040.mdmp 00000000-00001172.00000002.75012.00400000.00000040.mdmp] Observed API string: "GetThreadContext" [Source: 00000000-00001172.00000000.71169.00400000.00000040.mdmp 00000000-00001172.00000001.73090.00400000.00000040.mdmp 00000000-00001172.00000002.75012.00400000.00000040.mdmp] Observed API string: "SetThreadContext" [Source: 00000000-00001172.00000000.71169.00400000.00000040.mdmp 00000000-00001172.00000001.73090.00400000.00000040.mdmp 00000000-00001172.00000002.75012.00400000.00000040.mdmp]32:T438,Observed string: "EnumServicesStatusW" [Source: 00000000-00001172.00000000.71169.00400000.00000040.mdmp 00000000-00001172.00000001.73090.00400000.00000040.mdmp 00000000-00001172.00000002.75012.00400000.00000040.mdmp] Observed string: "OpenServiceW" [Source: 00000000-00001172.00000000.71169.00400000.00000040.mdmp 00000000-00001172.00000001.73090.00400000.00000040.mdmp 00000000-00001172.00000002.75012.00400000.00000040.mdmp] Observed string: "OpenSCManagerA" [Source: 00000000-00001172.00000000.71169.00400000.00000040.mdmp 00000000-00001172.00000001.73090.00400000.00000040.mdmp 00000000-00001172.00000002.75012.00400000.00000040.mdmp] Observed string: "OpenSCManagerW" [Source: 00000000-00001172.00000000.71169.00400000.00000040.mdmp 00000000-00001172.00000001.73090.00400000.00000040.mdmp 00000000-00001172.00000002.75012.00400000.00000040.mdmp] Observed string: "QueryServiceStatus" [Source: 00000000-00001172.00000000.71169.00400000.00000040.mdmp 00000000-00001172.00000001.73090.00400000.00000040.mdmp 00000000-00001172.00000002.75012.00400000.00000040.mdmp]33:T505,".exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] ".exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] ".exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-0.dll" - [base:0; Status:c0000135] ".exe" failed to load missing module "api-ms-win-core-quirks-l1-1-0.dll" - [base:0; Status:c0000135] ".exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2.dll" - [base:0; Status:c0000135] ".exe" failed to load missing module "%WINDIR%\system32\combase.dll" - [base:0; Status:c0000135] ".exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll" - [base:0; Status:c0000135] ".exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] ".exe" failed to load missing module "amsi.dll" - [base:0; Status:c0000135] ".exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\urlmon.dll" - [base:0; Status:c0000135]34:T132ac,Found string "Sleep" (Indicator: "Sleep"; in File: "fc2bcad21d96b3e31b27f0610209f0aa33fb1aa83504e8c346d390ac2da19504.bin") Found string "25,,RtlGetNtProductType,NTDL" (Indicator: "RtlGetNtProductType"; in Source: "00000000-00001172.00000000.71169.002E0000.00000004.mdmp, 00000000-00001172.00000001.73090.002E0000.00000004.mdmp, 00000000-00001172.00000002.75012.002E0000.00000004.mdmp") Found string "User Data\Local State" (Indicator: "Local State"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "Local State" (Indicator: "Local State"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "WScript.Sleep 1000" (Indicator: "Sleep"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "DisplayVersion" (Indicator: "DisplayVersion"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "SleepConditionVariableCS" (Indicator: "Sleep"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "WakeAllConditionVariable" (Indicator: "WakeAllConditionVariable"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "not a socket" (Indicator: "socket"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "not connected" (Indicator: "connect"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "already connected" (Indicator: "connect"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "connection aborted" (Indicator: "connect"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "connection already in progress" (Indicator: "connect"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "connection refused" (Indicator: "connect"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "connection reset" (Indicator: "connect"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "FlsGetValue" (Indicator: "FlsGetValue"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "FlsSetValue" (Indicator: "FlsSetValue"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "InitializeCriticalSectionEx" (Indicator: "InitializeCriticalSection"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "CreateThreadpoolTimer" (Indicator: "CreateThread"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "CreateThreadpoolWait" (Indicator: "CreateThread"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "FreeLibraryWhenCallbackReturns" (Indicator: "FreeLibrary"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "GetCurrentProcessorNumber" (Indicator: "GetCurrentProcess"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "GetTickCount64" (Indicator: "GetTickCount"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "GetFileInformationByHandleEx" (Indicator: "GetFileInfo"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "GetSystemTimePreciseAsFileTime" (Indicator: "GetSystemTime"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "AcquireSRWLockExclusive" (Indicator: "AcquireSRWLockExclusive"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "TryAcquireSRWLockExclusive" (Indicator: "AcquireSRWLockExclusive"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "ReleaseSRWLockExclusive" (Indicator: "ReleaseSRWLockExclusive"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "SleepConditionVariableSRW" (Indicator: "Sleep"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "CreateThreadpoolWork" (Indicator: "CreateThread"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "GetLocaleInfoEx" (Indicator: "GetLocaleInfo"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "CorExitProcess" (Indicator: "ExitProcess"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "GetDateFormatEx" (Indicator: "GetDateFormatEx"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "GetTimeFormatEx" (Indicator: "GetTimeFormatEx"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "GetUserDefaultLocaleName" (Indicator: "GetUserDefaultLocaleName"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "IsValidLocaleName" (Indicator: "IsValidLocale"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "LocaleNameToLCID" (Indicator: "LocaleNameToLCID"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "CryptUnprotectData" (Indicator: "CryptUnprotectData"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "SetFilePointerEx error" (Indicator: "SetFilePointer"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "ReadFile error" (Indicator: "ReadFile"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "SHDeleteKeyW" (Indicator: "SHDeleteKeyW"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "Connection Error: Unable to create socket" (Indicator: "socket"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "Disconnected" (Indicator: "connect"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "ZwCreateSection" (Indicator: "ZwCreateSection"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "ZwMapViewOfSection" (Indicator: "ZwMapViewOfSection"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "ZwUnmapViewOfSection" (Indicator: "ZwUnmapViewOfSection"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "GetCursorInfo" (Indicator: "GetCursor"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "GetLastInputInfo" (Indicator: "GetLastInputInfo"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "GetModuleFileNameExA" (Indicator: "GetModuleFileNameExA"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "GetModuleFileNameExW" (Indicator: "GetModuleFileNameExW"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "NtUnmapViewOfSection" (Indicator: "NtUnmapViewOfSection"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "GlobalMemoryStatusEx" (Indicator: "GlobalMemoryStatus"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "IsWow64Process" (Indicator: "IsWow64Process"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "GetComputerNameExW" (Indicator: "GetComputerName"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "SetProcessDEPPolicy" (Indicator: "SetProcessDEPPolicy"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "GetSystemTimes" (Indicator: "GetSystemTime"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "GetConsoleWindow" (Indicator: "GetConsoleWindow"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "CreateDirectoryW" (Indicator: "CreateDirectoryW"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "WriteFile" (Indicator: "WriteFile"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "CreateFileW" (Indicator: "CreateFileW"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "ExitThread" (Indicator: "ExitThread"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "CloseHandle" (Indicator: "CloseHandle"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "GetModuleFileNameW" (Indicator: "GetModuleFileNameW"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "Sleep" (Indicator: "Sleep"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000000.71169.012F2000.00000020.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.012F2000.00000020.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.012F2000.00000020.mdmp") Found string "WaitForSingleObject" (Indicator: "WaitForSingleObject"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "CreateEventW" (Indicator: "CreateEventW"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "SetEvent" (Indicator: "SetEvent"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "CreateThread" (Indicator: "CreateThread"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "GetLocalTime" (Indicator: "GetLocalTime"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "CreateEventA" (Indicator: "CreateEventA"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "HeapCreate" (Indicator: "HeapCreate"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "HeapFree" (Indicator: "HeapFree"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "ReadFile" (Indicator: "ReadFile"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "TerminateProcess" (Indicator: "TerminateProcess"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "CreatePipe" (Indicator: "CreatePipe"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "PeekNamedPipe" (Indicator: "PeekNamedPipe"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "CreateProcessA" (Indicator: "CreateProcessA"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "LoadLibraryA" (Indicator: "LoadLibraryA"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "GetProcAddress" (Indicator: "GetProcAddress"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "ExitProcess" (Indicator: "ExitProcess"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "FindFirstFileW" (Indicator: "FindFirstFileW"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "GetFileSizeEx" (Indicator: "GetFileSize"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "FindNextFileW" (Indicator: "FindNextFileW"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "GetDriveTypeA" (Indicator: "GetDriveTypeA"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "lstrlenA" (Indicator: "lstrlenA"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "FindClose" (Indicator: "FindClose"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "GetFileAttributesW" (Indicator: "GetFileAttributesW"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "DeleteFileA" (Indicator: "DeleteFileA"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "DeleteFileW" (Indicator: "DeleteFileW"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "GetLogicalDriveStringsA" (Indicator: "GetLogicalDriveStringsA"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "SetFilePointerEx" (Indicator: "SetFilePointer"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "MoveFileW" (Indicator: "MoveFile"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "RemoveDirectoryW" (Indicator: "RemoveDirectoryW"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "GetModuleHandleA" (Indicator: "GetModuleHandleA"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "SetFileAttributesW" (Indicator: "SetFileAttributesW"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "GetLastError" (Indicator: "GetLastError"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "TerminateThread" (Indicator: "TerminateThread"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "GetFileSize" (Indicator: "GetFileSize"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "FindFirstFileA" (Indicator: "FindFirstFileA"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "FindNextFileA" (Indicator: "FindNextFileA"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "ExpandEnvironmentStringsA" (Indicator: "ExpandEnvironmentStringsA"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "GetLongPathNameW" (Indicator: "GetLongPathNameW"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "CopyFileW" (Indicator: "CopyFileW"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "CreateMutexA" (Indicator: "CreateMutexA"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "GetLocaleInfoA" (Indicator: "GetLocaleInfo"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "OpenMutexA" (Indicator: "OpenMutexA"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "Process32NextW" (Indicator: "Process32Next"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "Process32FirstW" (Indicator: "Process32First"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "VirtualProtect" (Indicator: "VirtualProtect"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "SetLastError" (Indicator: "SetLastError"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "VirtualFree" (Indicator: "VirtualFree"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "VirtualAlloc" (Indicator: "VirtualAlloc"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "GetNativeSystemInfo" (Indicator: "GetNativeSystemInfo"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "HeapAlloc" (Indicator: "HeapAlloc"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "GetProcessHeap" (Indicator: "GetProcessHeap"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "FreeLibrary" (Indicator: "FreeLibrary"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "IsBadReadPtr" (Indicator: "IsBadReadPtr"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "GetTempPathW" (Indicator: "GetTempPathW"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "OpenProcess" (Indicator: "OpenProcess"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "lstrcatW" (Indicator: "lstrcat"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "GetTempFileNameW" (Indicator: "GetTempFileNameW"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "GetCurrentProcess" (Indicator: "GetCurrentProcess"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "GetSystemDirectoryA" (Indicator: "GetSystemDirectoryA"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "GlobalAlloc" (Indicator: "GlobalAlloc"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "GlobalLock" (Indicator: "GlobalLock"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "GetTickCount" (Indicator: "GetTickCount"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "GlobalUnlock" (Indicator: "GlobalUnlock"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "WriteProcessMemory" (Indicator: "WriteProcessMemory"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "ResumeThread" (Indicator: "ResumeThread"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "GetThreadContext" (Indicator: "GetThreadContext"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "ReadProcessMemory" (Indicator: "ReadProcessMemory"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "CreateProcessW" (Indicator: "CreateProcessW"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "SetThreadContext" (Indicator: "SetThreadContext"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "LocalAlloc" (Indicator: "LocalAlloc"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "GlobalFree" (Indicator: "GlobalFree"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "MulDiv" (Indicator: "MulDiv"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "SizeofResource" (Indicator: "SizeofResource"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "SetFilePointer" (Indicator: "SetFilePointer"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "FindResourceA" (Indicator: "FindResourceA"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "LockResource" (Indicator: "LockResource"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "LoadResource" (Indicator: "LoadResource"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "LocalFree" (Indicator: "LocalFree"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "FormatMessageA" (Indicator: "FormatMessageA"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "AllocConsole" (Indicator: "AllocConsole"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "GetModuleFileNameA" (Indicator: "GetModuleFileNameA"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "lstrcpynA" (Indicator: "lstrcpynA"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "EnterCriticalSection" (Indicator: "EnterCriticalSection"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "LeaveCriticalSection" (Indicator: "LeaveCriticalSection"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "InitializeCriticalSection" (Indicator: "InitializeCriticalSection"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "DeleteCriticalSection" (Indicator: "DeleteCriticalSection"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "TranslateMessage" (Indicator: "TranslateMessage"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "DispatchMessageA" (Indicator: "DispatchMessageA"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "GetMessageA" (Indicator: "GetMessageA"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "GetWindowTextW" (Indicator: "GetWindow"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "wsprintfW" (Indicator: "wsprintfW"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "GetClipboardData" (Indicator: "GetClipboardData"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "UnhookWindowsHookEx" (Indicator: "UnhookWindowsHookEx"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "GetForegroundWindow" (Indicator: "GetForegroundWindow"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "ToUnicodeEx" (Indicator: "ToUnicodeEx"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "GetKeyboardLayout" (Indicator: "GetKeyboardLayout"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "SetWindowsHookExA" (Indicator: "SetWindowsHookExA"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "CloseClipboard" (Indicator: "CloseClipboard"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "OpenClipboard" (Indicator: "OpenClipboard"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "GetKeyboardState" (Indicator: "GetKeyboardState"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "CallNextHookEx" (Indicator: "CallNextHookEx"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "GetKeyboardLayoutNameA" (Indicator: "GetKeyboardLayout"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "GetKeyState" (Indicator: "GetKeyState"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "GetWindowTextLengthW" (Indicator: "GetWindow"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "GetWindowThreadProcessId" (Indicator: "GetWindow"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "SetForegroundWindow" (Indicator: "SetForegroundWindow"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "SetClipboardData" (Indicator: "SetClipboardData"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "EnumWindows" (Indicator: "EnumWindows"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "ExitWindowsEx" (Indicator: "ExitWindowsEx"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "EmptyClipboard" (Indicator: "EmptyClipboard"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "ShowWindow" (Indicator: "ShowWindow"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "SetWindowTextW" (Indicator: "SetWindowTextW"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "MessageBoxW" (Indicator: "MessageBoxW"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "IsWindowVisible" (Indicator: "IsWindow"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "CloseWindow" (Indicator: "CloseWindow"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "SendInput" (Indicator: "SendInput"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "DrawIcon" (Indicator: "DrawIcon"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "GetSystemMetrics" (Indicator: "GetSystemMetrics"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "GetIconInfo" (Indicator: "GetIconInfo"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "SystemParametersInfoW" (Indicator: "SystemParametersInfoW"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "GetCursorPos" (Indicator: "GetCursor"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "RegisterClassExA" (Indicator: "RegisterClassExA"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "AppendMenuA" (Indicator: "AppendMenuA"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "CreateWindowExA" (Indicator: "CreateWindowExA"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "DefWindowProcA" (Indicator: "DefWindowProcA"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "TrackPopupMenu" (Indicator: "TrackPopupMenu"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "CreatePopupMenu" (Indicator: "CreatePopupMenu"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "GetObjectA" (Indicator: "GetObjectA"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "CreateDCA" (Indicator: "CreateDCA"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "DeleteObject" (Indicator: "DeleteObject"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "DeleteDC" (Indicator: "DeleteDC"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "GetDIBits" (Indicator: "GetDIBits"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "StretchBlt" (Indicator: "StretchBlt"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "SelectObject" (Indicator: "SelectObject"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "CreateCompatibleBitmap" (Indicator: "CreateCompatibleBitmap"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "RegDeleteKeyA" (Indicator: "RegDeleteKeyA"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "RegQueryValueExW" (Indicator: "RegQueryValueExW"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "RegEnumValueW" (Indicator: "RegEnumValueW"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "RegDeleteValueW" (Indicator: "RegDeleteValueW"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "RegCreateKeyW" (Indicator: "RegCreateKeyW"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "RegOpenKeyExW" (Indicator: "RegOpenKeyExW"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "RegOpenKeyExA" (Indicator: "RegOpenKeyExA"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "RegSetValueExA" (Indicator: "RegSetValueExA"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "RegSetValueExW" (Indicator: "RegSetValueExW"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "RegEnumKeyExW" (Indicator: "RegEnumKeyExW"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "RegCreateKeyExW" (Indicator: "RegCreateKeyExW"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "RegQueryValueExA" (Indicator: "RegQueryValueExA"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "RegQueryInfoKeyW" (Indicator: "RegQueryInfoKeyW"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "RegCloseKey" (Indicator: "RegCloseKey"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "RegCreateKeyA" (Indicator: "RegCreateKeyA"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "OpenProcessToken" (Indicator: "OpenProcess"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "LookupPrivilegeValueA" (Indicator: "LookupPrivilegeValueA"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "EnumServicesStatusW" (Indicator: "EnumServicesStatus"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "OpenServiceW" (Indicator: "OpenService"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "ChangeServiceConfigW" (Indicator: "ChangeServiceConfigW"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "QueryServiceConfigW" (Indicator: "QueryServiceConfigW"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "StartServiceW" (Indicator: "StartServiceW"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "ControlService" (Indicator: "ControlService"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "OpenSCManagerA" (Indicator: "OpenSCManager"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "OpenSCManagerW" (Indicator: "OpenSCManager"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "CloseServiceHandle" (Indicator: "CloseServiceHandle"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "QueryServiceStatus" (Indicator: "QueryServiceStatus"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "RegEnumKeyExA" (Indicator: "RegEnumKeyExA"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "GetUserNameW" (Indicator: "GetUserName"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "CryptReleaseContext" (Indicator: "CryptReleaseContext"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "CryptGenRandom" (Indicator: "CryptGenRandom"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "CryptAcquireContextA" (Indicator: "CryptAcquireContextA"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "ShellExecuteW" (Indicator: "ShellExecuteW"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "ShellExecuteExA" (Indicator: "ShellExecuteExA"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "Shell_NotifyIconA" (Indicator: "Shell_NotifyIconA"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "ExtractIconA" (Indicator: "ExtractIconA"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "StrToIntA" (Indicator: "StrToIntA"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "PathFileExistsW" (Indicator: "PathFileExistsW"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "PathFileExistsA" (Indicator: "PathFileExistsA"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "URLDownloadToFileW" (Indicator: "URLDownloadToFile"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "URLOpenBlockingStreamW" (Indicator: "URLOpenBlockingStream"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "InternetOpenUrlW" (Indicator: "InternetOpenUrlW"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "InternetOpenW" (Indicator: "InternetOpenW"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "InternetCloseHandle" (Indicator: "CloseHandle"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "InternetReadFile" (Indicator: "InternetReadFile"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "ResetEvent" (Indicator: "ResetEvent"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "GetModuleHandleW" (Indicator: "GetModuleHandleW"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "IsDebuggerPresent" (Indicator: "IsDebuggerPresent"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "UnhandledExceptionFilter" (Indicator: "UnhandledExceptionFilter"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "SetUnhandledExceptionFilter" (Indicator: "SetUnhandledExceptionFilter"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "GetStartupInfoW" (Indicator: "GetStartupInfoW"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "IsProcessorFeaturePresent" (Indicator: "IsProcessorFeaturePresent"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "GetCurrentThreadId" (Indicator: "GetCurrentThread"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "InitializeSListHead" (Indicator: "InitializeSListHead"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "WideCharToMultiByte" (Indicator: "WideCharToMultiByte"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "EncodePointer" (Indicator: "EncodePointer"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "DecodePointer" (Indicator: "DecodePointer"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "MultiByteToWideChar" (Indicator: "MultiByteToWideChar"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "InitializeCriticalSectionAndSpinCount" (Indicator: "InitializeCriticalSection"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "TlsAlloc" (Indicator: "TlsAlloc"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "TlsGetValue" (Indicator: "TlsGetValue"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "TlsSetValue" (Indicator: "TlsSetValue"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "TlsFree" (Indicator: "TlsFree"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "CompareStringW" (Indicator: "CompareStringW"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "LCMapStringW" (Indicator: "LCMapStringW"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "GetStringTypeW" (Indicator: "GetStringTypeW"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "GetCPInfo" (Indicator: "GetCPInfo"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "LoadLibraryExW" (Indicator: "LoadLibraryExW"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "RaiseException" (Indicator: "RaiseException"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "RtlUnwind" (Indicator: "RtlUnwind"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "MoveFileExW" (Indicator: "MoveFile"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "GetModuleHandleExW" (Indicator: "GetModuleHandleExW"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "GetStdHandle" (Indicator: "GetStdHandle"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "GetACP" (Indicator: "GetACP"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "HeapReAlloc" (Indicator: "HeapReAlloc"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "GetDateFormatW" (Indicator: "GetDateFormatW"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "GetTimeFormatW" (Indicator: "GetTimeFormatW"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "IsValidLocale" (Indicator: "IsValidLocale"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "GetUserDefaultLCID" (Indicator: "GetUserDefaultLCID"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "EnumSystemLocalesW" (Indicator: "EnumSystemLocalesW"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "GetTimeZoneInformation" (Indicator: "GetTimeZoneInformation"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "GetFileType" (Indicator: "GetFileType"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "FlushFileBuffers" (Indicator: "FlushFileBuffers"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "GetConsoleCP" (Indicator: "GetConsoleCP"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "GetConsoleMode" (Indicator: "GetConsoleMode"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "ReadConsoleW" (Indicator: "ReadConsoleW"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "FindFirstFileExA" (Indicator: "FindFirstFileExA"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "IsValidCodePage" (Indicator: "IsValidCodePage"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "GetOEMCP" (Indicator: "GetOEMCP"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "GetCommandLineA" (Indicator: "GetCommandLineA"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "GetCommandLineW" (Indicator: "GetCommandLineW"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "FreeEnvironmentStringsW" (Indicator: "FreeEnvironmentStringsW"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "SetEnvironmentVariableA" (Indicator: "SetEnvironmentVariableA"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "SetEnvironmentVariableW" (Indicator: "SetEnvironmentVariableW"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "SetStdHandle" (Indicator: "SetStdHandle"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "WriteConsoleW" (Indicator: "WriteConsoleW"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "HeapSize" (Indicator: "HeapSize"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "SetEndOfFile" (Indicator: "SetEndOfFile"; in Source: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") Found string "18446744039251223639,3984,3180,,InternetReadFile,Wininet.dll,"252:05:27.328",RX=0,PX=0" (Indicator: "InternetReadFile"; in Source: "00000000-00001172.00000001.73090.00341000.00000004.mdmp") Found string "connection" (Indicator: "connect"; in Source: "00000000-00001172.00000001.73090.00760000.00000004.mdmp, 00000000-00001172.00000002.75012.00760000.00000004.mdmp") Found string "18446744044877814741,3000,3121,,CreateDirectoryW,kernel32.dll,"252:05:56.375",RX=0,PX=0" (Indicator: "CreateDirectoryW"; in Source: "00000000-00001172.00000002.75012.0036B000.00000004.mdmp") Found string "Sleep" (Indicator: "Sleep"; in Source: "00000000-00002840.00000000.67255.00B42000.00000020.mdmp, 00000000-00002840.00000000.67255.01B00000.00000004.mdmp, 00000000-00002840.00000001.68768.00660000.00000004.mdmp, 00000000-00002840.00000001.68768.00B42000.00000020.mdmp, 00000000-00002840.00000001.68768.04A10000.00000004.mdmp") Found string "EnableWindowsFormsHighDpiAutoResizing" (Indicator: "EnableWindow"; in Source: "00000000-00002840.00000000.67255.01B00000.00000004.mdmp") Found string "connectionStrings" (Indicator: "connect"; in Source: "00000000-00002840.00000000.67255.01B00000.00000004.mdmp") Found string "connectionManagement" (Indicator: "connect"; in Source: "00000000-00002840.00000000.67255.01B00000.00000004.mdmp") Found string "connectionString" (Indicator: "connect"; in Source: "00000000-00002840.00000000.67255.01B00000.00000004.mdmp") Found string "connectionStringName" (Indicator: "connect"; in Source: "00000000-00002840.00000000.67255.01B00000.00000004.mdmp") Found string "connectionStringName="LocalSqlServer"" (Indicator: "connect"; in Source: "00000000-00002840.00000000.67255.01B00000.00000004.mdmp") Found string "" (Indicator: "connect"; in Source: "00000000-00002840.00000000.67255.01B00000.00000004.mdmp") Found string "" (Indicator: "connect"; in Source: "00000000-00002840.00000000.67255.01B00000.00000004.mdmp") Found string "" (Indicator: "connect"; in Source: "00000000-00002840.00000000.67255.01B00000.00000004.mdmp")35:T9db,".exe" touched "Computer" (Path: "HKCU\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") ".exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}") ".exe" touched "UsersFiles" (Path: "HKCU\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\SHELLFOLDER") ".exe" touched "Property System Both Class Factory" (Path: "HKCU\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}") ".exe" touched "delegate folder that appears in Users Files Folder" (Path: "HKCU\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\SHELLFOLDER") ".exe" touched "Shell File System Folder" (Path: "HKCU\CLSID\{0E5AAE11-A475-4C5B-AB00-C66DE400274E}\INPROCSERVER32") ".exe" touched "Security Manager" (Path: "HKCU\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\TREATAS") "WScript.exe" touched "Network" (Path: "HKCU\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\SHELLFOLDER") "WScript.exe" touched "Recycle Bin" (Path: "HKCU\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\SHELLFOLDER") "WScript.exe" touched "Control Panel" (Path: "HKCU\CLSID\{26EE0668-A00A-44D7-9371-BEB064C98683}\SHELLFOLDER") "WScript.exe" touched "UsersLibraries" (Path: "HKCU\CLSID\{031E4825-7B94-4DC3-B131-E946B44C8DD5}\SHELLFOLDER") "WScript.exe" touched "CLSID_SearchFolder" (Path: "HKCU\CLSID\{04731B67-D933-450A-90E6-4ACD2E9408FE}\SHELLFOLDER") "WScript.exe" touched "Microsoft OneNote Namespace Extension for Windows Desktop Search" (Path: "HKCU\CLSID\{0875DCB6-C686-4243-9432-ADCCF0B9F2D7}\SHELLFOLDER") "WScript.exe" touched "IE History and Feeds Shell Data Source for Windows Search" (Path: "HKCU\CLSID\{11016101-E366-4D22-BC06-4ADA335C892B}\SHELLFOLDER") "WScript.exe" touched "@C:\Program Files (x86)\Microsoft Office\Office15\MAPISHELL.DLL,-110" (Path: "HKCU\CLSID\{138508BC-1E03-49EA-9C8F-EA9E1D05D65D}\SHELLFOLDER") "WScript.exe" touched "Public Folder" (Path: "HKCU\CLSID\{4336A54D-038B-4685-AB02-99BB52D3FB8B}\SHELLFOLDER") "WScript.exe" touched "Control Panel command object for Start menu and desktop" (Path: "HKCU\CLSID\{5399E694-6CE5-4D6C-8FCE-1D8870FDCBA0}\SHELLFOLDER") "WScript.exe" touched "@%systemroot%\system32\mssvp.dll,-110" (Path: "HKCU\CLSID\{89D83576-6BD1-4C86-9454-BEB04E94C819}\SHELLFOLDER") "WScript.exe" touched "DXP" (Path: "HKCU\CLSID\{8FD8B88D-30E1-4F25-AC2B-553D3D65F0EA}\SHELLFOLDER") "WScript.exe" touched "CLSID_SearchHome" (Path: "HKCU\CLSID\{9343812E-1C37-4A49-A12E-4B2D810D956B}\SHELLFOLDER")36:T947,"fc2bcad21d96b3e31b27f0610209f0aa33fb1aa83504e8c346d390ac2da19504.bin" file has an entrypoint instructions - "jmp dword ptr [0x402000],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al," "BIN.exe" file has an entrypoint instructions - "jmp dword ptr [0x402000],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,"37:T595,".exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") ".exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") ".exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") ".exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN") ".exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN") "WScript.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "WScript.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "WScript.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "cmd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "cmd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "cmd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "BIN.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "BIN.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "BIN.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "BIN.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN") "BIN.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN")38:T6fd,".exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll" ".exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll" ".exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll" ".exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll" ".exe" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\clr.dll" ".exe" touched file "C:\Windows\Microsoft.Net\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll.config" ".exe" touched file "C:\Windows\System32\en\WScript.exe.mui" ".exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches" ".exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches" "WScript.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches" "WScript.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches" "cmd.exe" touched file "C:\Windows\AppPatch\sysmain.sdb" "BIN.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll" "BIN.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll" "BIN.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll" "BIN.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll" "BIN.exe" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\clr.dll" "BIN.exe" touched file "C:\Windows\Microsoft.Net\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll.config" "BIN.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files" "BIN.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\History"39:T5d6,".exe" trying to access non-existent file "C:\FLTLIB.DLL" ".exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-fibers-l1-1-1.DLL" ".exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-localization-l1-2-1.DLL" ".exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-appmodel-runtime-l1-1-0.dll" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ucrtbase_clr0400.dll" ".exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-quirks-l1-1-0.dll" ".exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-appmodel-runtime-l1-1-2.dll" ".exe" trying to access non-existent file "C:\Windows\system32\combase.dll" ".exe" trying to access non-existent file "C:\CRYPTBASE.dll" ".exe" trying to access non-existent file "C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll" ".exe" trying to access non-existent file "C:\Windows\System32\API-MS-WIN-CORE-FIBERS-L1-1-1.DLL" ".exe" trying to access non-existent file "C:\Windows\System32\API-MS-WIN-CORE-LOCALIZATION-L1-2-1.DLL" ".exe" trying to access non-existent file "C:\Windows\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll"3a:T60f,".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\fusion.localgac" ".exe" trying to access non-existent file "C:\fc2bcad21d96b3e31b27f0610209f0aa33fb1aa83504e8c346d390ac2da19504.exe.config" ".exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_32\jvwkaml\" ".exe" trying to access non-existent file "C:\fc2bcad21d96b3e31b27f0610209f0aa33fb1aa83504e8c346d390ac2da19504.INI" ".exe" trying to access non-existent file "C:\fc2bcad21d96b3e31b27f0610209f0aa33fb1aa83504e8c346d390ac2da19504.exe.Local\" ".exe" trying to access non-existent file "C:\FC2BCAD21D96B3E31B27F0610209F0AA33FB1AA83504E8C346D390AC2DA19504.EXE.CONFIG" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\FUSION.LOCALGAC" ".exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_32\JVWKAML" ".exe" trying to access non-existent file "C:\FC2BCAD21D96B3E31B27F0610209F0AA33FB1AA83504E8C346D390AC2DA19504.INI" ".exe" trying to access non-existent file "C:\Windows\assembly\GAC\PUBLISHERPOLICY.TME" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\SYSTEM.DATA.DLL.CONFIG" ".exe" trying to access non-existent file "C:\FC2BCAD21D96B3E31B27F0610209F0AA33FB1AA83504E8C346D390AC2DA19504.EXE.LOCAL"3b:T7c4c,Heuristic match: "T,.Sv" Heuristic match: "^*.NE" Heuristic match: "v).DZ" Heuristic match: "ke.aZ" Heuristic match: "w].KN" Heuristic match: "nh.na" Heuristic match: "iG.Kn" Heuristic match: "E_W.gr" Heuristic match: "geoplugin.net" Heuristic match: "/json.gp" Heuristic match: "ucremcz1.ddns.net" Pattern match: "ww.reddit.com/r/gifs" Heuristic match: "cremcz1.ddns.net" Pattern match: "reddit.com/r/gifs" Pattern match: "www.reddit.com/r/gifs" Pattern match: "http://geoplugin.net/json.gp" Heuristic match: "* BreakingSecurity.net" Heuristic match: "mcz1.ddns.net" Pattern match: "geoplugin.net/json.gp" Heuristic match: "son.gp" Pattern match: "www.metacafe.com/" Pattern match: "www.kohls.com/" Pattern match: "www.submarino.com.br/" Heuristic match: "secure-assets.rubiconproject.com" Pattern match: "www.urbandictionary.com" Heuristic match: "nationalgeographic.com" Heuristic match: "rum-dytrc.corriere.it" Pattern match: "www.americanas.com.br" Heuristic match: "ads.creative-serving.com" Pattern match: "www.howstuffworks.com" Heuristic match: "api.webdata.ledu.com" Heuristic match: "livechatinc.com" Pattern match: "www.reuters.wallst.com" Pattern match: "www.juegosdiarios.com" Heuristic match: "kakakucom.112.2o7.net" Heuristic match: "statse.webtrendslive.com" Heuristic match: "neural09.cdnwebcloud.com" Heuristic match: "adaptv.advertising.com" Heuristic match: "duba.com" Heuristic match: "wsj.com" Heuristic match: "gap.com" Heuristic match: "bidr.io" Heuristic match: "naver.jp" Heuristic match: "7k7k.com" Heuristic match: "ioam.de" Heuristic match: "java.com" Heuristic match: "tanx.com" Heuristic match: "songs.pk" Heuristic match: "fout.jp" Heuristic match: "2ch.net" Heuristic match: "9223.com" Heuristic match: "krxd.net" Heuristic match: "popin.cc" Heuristic match: "daum.net" Heuristic match: "yimg.com" Heuristic match: "knet.cn" Heuristic match: "xiti.com" Heuristic match: "rk.oc.tm" Heuristic match: "mt.co.kr" Heuristic match: "webs.com" Heuristic match: "etsy.com" Heuristic match: "nasa.gov" Heuristic match: "hulu.com" Heuristic match: "ikea.com" Heuristic match: "3366.com" Heuristic match: "Host: geoplugin.net" Pattern match: "www.laredoute.fr" Heuristic match: "autoscout24.de" Heuristic match: "unrulymedia.com" Heuristic match: "partycasino.com" Heuristic match: "lfstmedia.com" Heuristic match: "directadvert.ru" Heuristic match: "spotxchange.com" Heuristic match: "tiara.daum.net" Pattern match: "www.blogcu.com" Heuristic match: "tribalfusion.com" Heuristic match: "x01.aidata.io" Heuristic match: "u3s.mathtag.com" Heuristic match: "listenvid.com" Heuristic match: "urbandictionary.com" Pattern match: "www.thecredits.org" Pattern match: "www.gamesgames.com" Heuristic match: "server.seadform.net" Pattern match: "www.lowermybills.com" Pattern match: "www.eastmoney.com" Heuristic match: "config.parsely.com" Heuristic match: "y.one.impact-ad.jp" Heuristic match: "secure.calcch.com" Heuristic match: "yjtag.yahoo.co.jp" Pattern match: "www.microsoft.com" Heuristic match: "ads.stickyadstv.com" Heuristic match: "verizonwireless.com" Pattern match: "www.virginmedia.com" Pattern match: "www.southwest.com" Heuristic match: "accounts.google.com" Heuristic match: "ibeu2.mookie1.com" Heuristic match: "it.altervista.org" Heuristic match: "ggsearch.2345.com" Heuristic match: "skimresources.com" Pattern match: "www.babycenter.com" Heuristic match: "americanas.com.br" Heuristic match: "strawberryperl.com" Heuristic match: "200632758.log.optimizely.com" Heuristic match: "match.adsby.bidtheatre.com" Heuristic match: "login.microsoftonline.com" Heuristic match: "tap2-cdn.rubiconproject.com" Heuristic match: "targeting.unrulymedia.com" Heuristic match: "px.powerlinks.com" Pattern match: "www.nationalgeographic.com" Heuristic match: "621373388.log.optimizely.com" Heuristic match: "58011369.log.optimizely.com" Pattern match: "www.maxmind.com" Pattern match: "www.rakuten.co.jp/" Heuristic match: "eoplugin.net" Heuristic match: "json.gp" Pattern match: "secure-assets.rubiconproject.com/utils/xapi/" Pattern match: "www.bing.com/" Pattern match: "api.webdata.ledu.com/api/" Pattern match: "www.scribd.com/" Pattern match: "www.mynet.com/" Pattern match: "www.sapo.pt/" Pattern match: "www.eol.cn/" Pattern match: "ih.adscale.de/adscale-ih/" Pattern match: "www.gmx.net/" Pattern match: "www.match.com/" Pattern match: "www.priceline.com/" Pattern match: "www.monografias.com/" Heuristic match: "oplugin.net" Heuristic match: "st: geoplugin.net" Heuristic match: "virgul.com" Heuristic match: "izlesene.com" Heuristic match: "youku.com" Heuristic match: "trugaze.io" Heuristic match: "ip138.com" Heuristic match: "gssprt.jp" Heuristic match: "baidu.com" Heuristic match: "semasio.net" Heuristic match: "kuwan8.com" Pattern match: "www.aa.com" Pattern match: "www.irs.gov" Heuristic match: "owneriq.net" Heuristic match: "t-mobile.com" Heuristic match: "conectiva.io" Heuristic match: "ngfiles.com" Heuristic match: "gamespot.com" Heuristic match: "abtasty.com" Heuristic match: "adhigh.net" Heuristic match: "zoosnet.net" Heuristic match: "yahoo.com" Heuristic match: "yabidos.com" Heuristic match: "pardot.com" Heuristic match: "kugou.com" Heuristic match: "wbtrk.net" Heuristic match: "stardoll.com" Heuristic match: "adnxs.com" Heuristic match: "bitauto.com" Heuristic match: "esmas.com" Heuristic match: "adtdp.com" Heuristic match: "tidaltv.com" Heuristic match: "meituan.com" Heuristic match: "tw.yahoo.com" Heuristic match: "11st.co.kr" Heuristic match: "break.com" Heuristic match: "youdao.com" Heuristic match: "mashable.com" Heuristic match: "wrating.com" Heuristic match: "livedoor.com" Heuristic match: "85play.com" Heuristic match: "kpruanalytics.solution.weborama.fr" Heuristic match: "8428790487.log.optimizely.com" Heuristic match: "buenastareas.com" Heuristic match: "virginmedia.com" Pattern match: "www.amazon.de" Heuristic match: "convertro.com" Heuristic match: "api.unthem.com" Pattern match: "www.hao123.com" Heuristic match: "wordpress.org" Heuristic match: "pconline.com.cn" Pattern match: "www.blizzard.com" Heuristic match: "people.com.cn" Heuristic match: "walgreens.com" Heuristic match: "it.ebayrtm.com" Pattern match: "www.114la.com" Pattern match: "www.toshiba.com" Heuristic match: "sharethis.com" Pattern match: "www.sogou.com" Heuristic match: "newgrounds.com" Heuristic match: "impress.co.jp" Heuristic match: "bigmining.com" Pattern match: "www.topix.com" Heuristic match: "infospace.com" Heuristic match: "baixaki.com.br" Heuristic match: "pos.baidu.com" Heuristic match: "infolinks.com" Heuristic match: "match.rundsp.com" Heuristic match: "go.sonobi.com" Heuristic match: "wunderground.com" Heuristic match: "rtb.4finance.com" Pattern match: "www.msn.com" Heuristic match: "lightboxcdn.com" Heuristic match: "pi.pardot.com" Heuristic match: "indiatimes.com" Heuristic match: "pixel.keywee.co" Pattern match: "www.oricon.co.jp" Heuristic match: "springserve.com" Heuristic match: "accuweather.com" Pattern match: "www.pixnet.net" Heuristic match: "adsymptotic.com" Heuristic match: "groupon.co.uk" Heuristic match: "pclady.com.cn" Pattern match: "www.corriere.it" Heuristic match: "casalemedia.com" Heuristic match: "mediaplex.com" Heuristic match: "tns-counter.ru" Heuristic match: "ads.linkedin.com" Heuristic match: "eastmoney.com" Heuristic match: "autoscout24.be" Heuristic match: "autotrader.com" Heuristic match: "pzd.rakuten.co.jp" Heuristic match: "image.livedoor.com" Heuristic match: "amazon-adsystem.com" Heuristic match: "giveawayoftheday.com" Heuristic match: "stats02.topix.com" Pattern match: "www.firstload.com" Heuristic match: "rubiconproject.com" Heuristic match: "autouk.demdex.net" Pattern match: "www.groupon.co.uk" Heuristic match: "wordreference.com" Heuristic match: "savings-united.com" Pattern match: "www.foodnetwork.com" Heuristic match: "juegosdiarios.com" Heuristic match: "bpid.bigpoint.net" Heuristic match: "trtstats.topix.com" Heuristic match: "count.pclady.com.cn" Pattern match: "www.tripadvisor.com" Heuristic match: "bbs.aoshitang.com" Heuristic match: "horyzon-media.com" Pattern match: "www.pcauto.com.cn" Heuristic match: "adfarm1.adition.com" Heuristic match: "acuityplatform.com" Pattern match: "www.autotrader.co.uk" Heuristic match: "bedbathandbeyond.com" Pattern match: "www.accuweather.com" Heuristic match: "howstuffworks.com" Heuristic match: "webcollect.kugou.com" Pattern match: "www.submarino.com.br" Heuristic match: "worldstarhiphop.com" Heuristic match: "dmg.digitaltarget.ru" Heuristic match: "ezinearticles.com" Heuristic match: "brightonclick.com" Pattern match: "www.bloomberg.com" Heuristic match: "logging.admicro.vn" Heuristic match: "rincondelvago.com" Pattern match: "www.moviefone.com" Heuristic match: "moc.ataderusaert.ni" Heuristic match: "in.treasuredata.com" Heuristic match: "next.co.uk" Heuristic match: "newscgp.com" Heuristic match: "videoamp.com" Heuristic match: "openx.net" Heuristic match: "irs01.com" Heuristic match: "weborama.com" Heuristic match: "dotomi.com" Heuristic match: "pingdom.net" Heuristic match: "xunlei.com" Heuristic match: "cxense.com" Heuristic match: "xfinity.com" Heuristic match: "hubpages.com" Heuristic match: "mookie1.com" Heuristic match: "marinsm.com" Pattern match: "www.wsj.com" Heuristic match: "ad-stir.com" Heuristic match: "yaplog.jp" Heuristic match: "miaozhen.com" Heuristic match: "amazon.de" Heuristic match: "webkinz.com" Heuristic match: "iza.ne.jp" Heuristic match: "soflopxl.com" Heuristic match: "patch.com" Heuristic match: "s3xified.com" Heuristic match: "united.com" Heuristic match: "zimbio.com" Heuristic match: "p.crm4d.com" Heuristic match: "114la.com" Heuristic match: "adgrx.com" Heuristic match: "topixcdn.com" Heuristic match: "weather.gov" Heuristic match: "cbsnews.com" Heuristic match: "seadform.net" Heuristic match: "c.bing.com" Pattern match: "www.fifa.com" Heuristic match: "sogou.com" Heuristic match: "net.finam.ru" Heuristic match: "topix.com" Heuristic match: "impdesk.com" Heuristic match: "outbrain.com" Heuristic match: "rising.cn" Heuristic match: "itsfogo.com" Heuristic match: "innovid.com" Heuristic match: "trialpay.com" Heuristic match: "yieldmo.com" Heuristic match: "tesco.com" Heuristic match: "thench.net" Heuristic match: "iqiyi.com" Heuristic match: "google.es" Heuristic match: "yieldlab.net" Pattern match: "www.onet.pl" Heuristic match: "rfihub.com" Heuristic match: "criteo.com" Heuristic match: "droit-finances.commentcamarche.net" Pattern match: "www.nextag.com" Heuristic match: "espncricinfo.com" Heuristic match: "undertone.com" Heuristic match: "doubleclick.net" Heuristic match: "scanscout.com" Heuristic match: "flashtalking.com" Pattern match: "www.ryanair.com" Pattern match: "www.latimes.com" Pattern match: "www.reuters.com" Pattern match: "www.toysrus.com" Heuristic match: "sharethrough.com" Heuristic match: "myvisualiq.net" Pattern match: "www.foxnews.com" Heuristic match: "send.microad.jp" Heuristic match: "ads.pubmatic.com" Heuristic match: "track.wvtu.net" Heuristic match: "etsystudio.com" Pattern match: "www.drugs.com" Heuristic match: "dantri.com.vn" Heuristic match: "onesignal.com" Heuristic match: "ads.webkinz.com" Pattern match: "www.usatoday.com" Heuristic match: "my.rtmark.net" Pattern match: "www.agame.com" Heuristic match: "hubstatic.com" Heuristic match: "travelzoo.com" Heuristic match: "moviefone.com" Heuristic match: "vagalume.com.br" Pattern match: "www.aipai.com" Heuristic match: "tripadvisor.com" Pattern match: "www.mp3raid.xyz" Heuristic match: "thecredits.org" Heuristic match: "dpm.demdex.net" Heuristic match: "sundaysky.com" Heuristic match: "switchadhub.com" Heuristic match: "nakanohito.jp" Heuristic match: "hit.gemius.pl" Heuristic match: "gosunpro.com" Heuristic match: "xdating.com" Pattern match: "www.pof.com" Heuristic match: "mobile.de" Heuristic match: "ml314.com" Heuristic match: "abril.com.br" Heuristic match: "duote.com" Heuristic match: "renren.com" Heuristic match: "adotmob.com" Heuristic match: "thesun.co.uk" Heuristic match: "xcar.com.cn" Heuristic match: "makepolo.com" Heuristic match: "mthai.com" Heuristic match: "gumtree.com" Heuristic match: "melia.com" Heuristic match: "usafis.org" Heuristic match: "wikihow.com" Heuristic match: "verizon.com" Pattern match: "www.citi.com" Heuristic match: "yahoo.co.jp" Heuristic match: "scribd.com" Heuristic match: "weborama.fr" Heuristic match: "51job.com" Heuristic match: "demdex.net" Heuristic match: "extend.tv" Heuristic match: "norton.com" Heuristic match: "answers.com" Heuristic match: "aipai.com" Heuristic match: "3lift.com" Heuristic match: "mxptint.net" Heuristic match: "xtgreat.com" Heuristic match: "taboola.com" Heuristic match: "exblog.jp" Heuristic match: "media.net" Heuristic match: "adobe.com" Heuristic match: "drugs.com" Heuristic match: "oracle.com" Heuristic match: "jivox.com" Heuristic match: "friend.ly" Heuristic match: "wupload.com" Heuristic match: "logly.co.jp" Heuristic match: "gametop.com" Pattern match: "www.gov.uk" Heuristic match: "hotwire.com" Heuristic match: "adhood.com" Heuristic match: "sanspo.com" Heuristic match: "facebook.com" Heuristic match: "mmstat.com" Heuristic match: "teacup.com" Heuristic match: "w55c.net" Heuristic match: "moc.ae" Heuristic match: "ea.com" Heuristic match: "ning.com" Heuristic match: "wwe.com" Heuristic match: "pho.to" Heuristic match: "csdn.net" Heuristic match: "g.58.com" Heuristic match: "dell.com" Heuristic match: "ebay.com" Heuristic match: "cpx.to" Heuristic match: "pof.com" Heuristic match: "yoka.com" Heuristic match: "1rx.io" Heuristic match: "bing.com" Heuristic match: "teads.tv" Heuristic match: "2o7.net" Heuristic match: "vk.com" Heuristic match: "m18.com" Heuristic match: "m6r.eu" Heuristic match: "ebay.it" Heuristic match: "ups.com" Heuristic match: "mtv.com" Heuristic match: "ing.nl" Heuristic match: "mail.ru" Heuristic match: "king.com" Heuristic match: "turn.com" Heuristic match: "ledu.com" Heuristic match: "smi2.net" Heuristic match: "yadro.ru" Heuristic match: "l.qq.com" Heuristic match: "zedo.com" Heuristic match: "kbb.com" Heuristic match: "goal.com" Heuristic match: "ya.ru" Heuristic match: "erne.co" Heuristic match: "imvu.com" Heuristic match: "wat.tv" Heuristic match: "sapo.pt" Heuristic match: "96pk.com" Heuristic match: "dsp.io" Heuristic match: "kdata.fr" Heuristic match: "5ch.net" Heuristic match: "ask.com" Heuristic match: "citi.com" Heuristic match: "qvc.com" Heuristic match: "esm1.net" Heuristic match: "ur.pk" Heuristic match: "kp.ru" Heuristic match: "254a.com" Heuristic match: "hi5.com" Heuristic match: "58.com" Heuristic match: "chip.de" Heuristic match: "msn.com" Heuristic match: "web.de" Heuristic match: "abmr.net" Heuristic match: "imdb.com" Heuristic match: "tmz.com" Heuristic match: "eol.cn" Heuristic match: "51.com" Heuristic match: "bild.de" Heuristic match: "1dmp.io" Heuristic match: "alot.com" Heuristic match: "smi2.ru" Heuristic match: "gmarket.co.kr" Pattern match: "www.avast.com" Heuristic match: "infoseek.co.jp" Heuristic match: "craigslist.es" Heuristic match: "capitalone.com" Heuristic match: "monografias.com" Heuristic match: "foodnetwork.com" Heuristic match: "everesttech.net" Pattern match: "www.zimbio.com" Pattern match: "www.hc360.com" Pattern match: "www.izlesene.com" Pattern match: "www.stardoll.com" Heuristic match: "doctissimo.fr" Heuristic match: "domaintools.com" Pattern match: "www.aweber.com" Pattern match: "www.amazon.com" Heuristic match: "optimatic.com" Pattern match: "www.linkedin.com" Pattern match: "www.compado.es" Heuristic match: "ke.youdao.com" Heuristic match: "nickelodeon.es" Heuristic match: "mtvnservices.com" Heuristic match: "eyeviewads.com" Heuristic match: "basebanner.com" Heuristic match: "admaster.com.cn" Heuristic match: "tealiumiq.com" Heuristic match: "xpg.uol.com.br" Heuristic match: "ipredictive.com" Heuristic match: "creativecdn.com" Heuristic match: "ad.360yield.com" Heuristic match: "craigslist.org" Pattern match: "www.livedoor.com" Heuristic match: "moc.tniopgib.se" Heuristic match: "es.bigpoint.com" Heuristic match: "stars.topix.com" Heuristic match: "slideshare.net" Heuristic match: "minijuegos.com" Heuristic match: "yumenetworks.com" Heuristic match: "statcounter.com" Heuristic match: "autoitscript.com" Heuristic match: "quantserve.com" Heuristic match: "freegeoip.net" Heuristic match: "connexity.net" Heuristic match: "justanswer.com" Pattern match: "www.mynet.com" Heuristic match: "crwdcntrl.net" Heuristic match: "homedepot.com" Pattern match: "www.kohls.com" Heuristic match: "rockyou.net" Heuristic match: "nicovideo.jp" Heuristic match: "im-apps.net" Heuristic match: "adingo.jp" Heuristic match: "socdm.com" Heuristic match: "agame.com" Heuristic match: "eonline.com" Heuristic match: "altergeo.ru" Heuristic match: "yoyi.com.cn" Heuristic match: "adtechus.com" Heuristic match: "zillow.com" Heuristic match: "keyade.com" Heuristic match: "qunar.com" Heuristic match: "addthis.com" Heuristic match: "durasite.net" Heuristic match: "adriver.ru" Heuristic match: "tao123.com" Heuristic match: "gwallet.com" Heuristic match: "atwiki.jp" Heuristic match: "globo.com" Heuristic match: "vtracy.de" Heuristic match: "zappos.com" Heuristic match: "yandex.ru" Heuristic match: "europa.eu" Heuristic match: "ad.zanox.com" Pattern match: "www.kbb.com" Pattern match: "www.7k7k.com" Heuristic match: "antdsp.com" Heuristic match: "virool.com" Pattern match: "www.duba.com" Heuristic match: "asahi.com" Heuristic match: "elpais.com" Heuristic match: "yengo.com" Heuristic match: "adtechjp.com" Heuristic match: "bluekai.com" Heuristic match: "pubmatic.com" Heuristic match: "amazon.co.jp" Heuristic match: "ctnsnet.com" Heuristic match: "btrll.com" Heuristic match: "easydmp.net" Heuristic match: "mirtesen.ru" Heuristic match: "state.gov" Heuristic match: "kakaku.com" Heuristic match: "pixnet.net" Heuristic match: "aidata.io" Heuristic match: "eyeota.net" Heuristic match: "directv.com" Heuristic match: "twitter.com" Pattern match: "www.3366.com" Heuristic match: "mapquest.com" Pattern match: "www.ing.nl" Heuristic match: "laredoute.fr" Heuristic match: "addtoany.com" Heuristic match: "fandango.com" Heuristic match: "netseer.com" Heuristic match: "softonic.com" Pattern match: "www.whitepages.com" Pattern match: "www.warnerbros.com" Heuristic match: "angelfire.lycos.com" Heuristic match: "s.thebrighttag.com" Heuristic match: "sxp.smartclip.net" Heuristic match: "count.pcauto.com.cn" Pattern match: "www.netshoes.com.br" Heuristic match: "minijuegosgratis.com" Heuristic match: "vatrack.hinet.net" Heuristic match: "whisky.ana.stg8.com" Heuristic match: "globalwebindex.net" Pattern match: "www.buenastareas.com" Heuristic match: "cstatic.weborama.fr" Heuristic match: "beacon.walmart.com" Pattern match: "www.pagesjaunes.fr" Pattern match: "www.newgrounds.com" Heuristic match: "counter.pixplug.in" Pattern match: "www.milliyet.com.tr" Pattern match: "www.superpages.com" Heuristic match: "power.gosunpro.com" Heuristic match: "ads.programattik.com" Heuristic match: "company-target.com" Heuristic match: "liveadexchanger.com" Pattern match: "www.wunderground.com" Heuristic match: "bleacherreport.com" Pattern match: "www.maxonclick.com" Heuristic match: "sp1.convertro.com" Heuristic match: "moshimonsters.com" Pattern match: "www.cheapoair.com" Pattern match: "www.instagram.com" Heuristic match: "moc.sys-gnivres.sb" Heuristic match: "bs.serving-sys.com" Heuristic match: "addictinggames.com" Heuristic match: "bankofamerica.com" Heuristic match: "tripadvisor.co.uk" Pattern match: "www.espncricinfo.com" Heuristic match: "deqwas.net" Heuristic match: "foxnews.com" Heuristic match: "glotgrx.com" Heuristic match: "mathtag.com" Heuristic match: "hc360.com" Heuristic match: "adsrvr.org" Heuristic match: "4shared.com" Heuristic match: "hubspot.net" Heuristic match: "netmng.com" Heuristic match: "365profx.com" Heuristic match: "simpli.fi" Heuristic match: "latimes.com" Heuristic match: "reuters.com" Heuristic match: "ryanair.com" Heuristic match: "toysrus.com" Heuristic match: "districtm.ca" Heuristic match: "rlcdn.com" Heuristic match: "blogcu.com" Pattern match: "www.free.fr" Heuristic match: "ligadx.com" Heuristic match: "sahcdn.com" Heuristic match: "moc.udiab.mh" Heuristic match: "hm.baidu.com" Heuristic match: "api.bing.com" Pattern match: "www.pnc.com" Heuristic match: "pixnet.cc" Heuristic match: "360doc.com" Heuristic match: "liadm.com" Heuristic match: "python.org" Heuristic match: "docin.com" Heuristic match: "moc.hctam.se" Heuristic match: "es.match.com" Heuristic match: "zemanta.com" Heuristic match: "oricon.co.jp" Heuristic match: "pj.abema.nl" Heuristic match: "ln.ameba.jp" Heuristic match: "lashou.com" Heuristic match: "cookpad.com" Heuristic match: "hao123.com" Heuristic match: "blizzard.com" Heuristic match: "rambler.ru" Heuristic match: "badoo.com" Heuristic match: "amazon.com" Heuristic match: "m0mentum.net" Pattern match: "www.ikea.com" Heuristic match: "atdmt.com" Heuristic match: "adswizz.com" Heuristic match: "libero.it" Pattern match: "www.webs.com" Heuristic match: "360daily.com" Heuristic match: "adrta.com" Heuristic match: "compado.es" Heuristic match: "priceline.com" Heuristic match: "sitescout.com" Heuristic match: "shutterfly.com" Pattern match: "www.answers.com" Heuristic match: "track.adform.net" Heuristic match: "blackberry.com" Pattern match: "www2.bing.com" Pattern match: "www.goo.ne.jp" Heuristic match: "dowjoneson.com" Heuristic match: "pixanalytics.com" Pattern match: "www.sanspo.com" Pattern match: "www.teacup.com" Pattern match: "www.zillow.com" Heuristic match: "linternaute.com" Heuristic match: "usmagazine.com" Pattern match: "www.gosunpro.com" Pattern match: "www.xfinity.com" Heuristic match: "serving-sys.com" Heuristic match: "velocecdn.com" Heuristic match: "i-mobile.co.jp" Heuristic match: "imrworldwide.com" Heuristic match: "mtvn.demdex.net" Heuristic match: "babycenter.com" Heuristic match: "rakuten.co.jp" Heuristic match: "gamesgames.com" Heuristic match: "skysports.com" Heuristic match: "autotrader.co.uk" Heuristic match: "contextweb.com" Heuristic match: "armorgames.com" Heuristic match: "dragonfable.com" Pattern match: "www.jalan.net" Heuristic match: "mediafire.com" Heuristic match: "pcauto.com.cn" Heuristic match: "nexac.demdex.net" Pattern match: "www.lazada.vn" Heuristic match: "reference.com" Pattern match: "www.scribd.com" Heuristic match: "flipboard.com" Heuristic match: "piximedia.com" Heuristic match: "milliyet.com.tr" Heuristic match: "tap-secure.rubiconproject.com" Heuristic match: "tagged.com" Heuristic match: "fidelity.com" Heuristic match: "youtube.com" Heuristic match: "foxtab.com" Heuristic match: "wretch.cc" Heuristic match: "60photos.com" Heuristic match: "aweber.com" Heuristic match: "weather.com" Heuristic match: "bigpoint.com" Heuristic match: "taobao.com" Heuristic match: "ebay.com.au" Heuristic match: "musica.com" Heuristic match: "wushen.com" Heuristic match: "exelator.com" Heuristic match: "navdmp.com" Heuristic match: "popads.net" Heuristic match: "douban.com" Heuristic match: "jxedt.com" Heuristic match: "adscale.de" Pattern match: "www.pof.es" Heuristic match: "buzzle.com" Pattern match: "www.ning.com" Pattern match: "www.kp.ru" Heuristic match: "kohls.com" Heuristic match: "impact-ad.jp" Heuristic match: "corriere.it" Heuristic match: "mynet.com" Heuristic match: "bla01.com" Heuristic match: "gnavi.co.jp" Heuristic match: "metacafe.com" Heuristic match: "adyun.com" Pattern match: "www.sapo.pt" Heuristic match: "stat.eol.cn" Heuristic match: "digitru.st" Pattern match: "www.eol.cn" Heuristic match: "afy11.net" Heuristic match: "i.liadm.com" Heuristic match: "angsrvr.com" Heuristic match: "adform.net" Heuristic match: "moevideo.net" Pattern match: "www.bing.com" Heuristic match: "nexage.com" Heuristic match: "districtm.io" Heuristic match: "tapad.com" Heuristic match: "gismeteo.ru" Heuristic match: "linkedin.com" Heuristic match: "deloton.com" Heuristic match: "c.msn.com" Heuristic match: "goo.ne.jp" Heuristic match: "readme.ru" Heuristic match: "bat.bing.com" Heuristic match: "rutube.ru" Pattern match: "www.qvc.com" Heuristic match: "wayfair.com" Heuristic match: "bttrack.com" Heuristic match: "commander1.com" Heuristic match: "j.mrpdata.net" Heuristic match: "accengage.net" Heuristic match: "brothersoft.com" Heuristic match: "allabout.co.jp" Heuristic match: "bidswitch.net" Pattern match: "www.meetic.es" Heuristic match: "enfemenino.com" Heuristic match: "sync.shinobi.jp" Pattern match: "www.match.com" Heuristic match: "advertising.com" Heuristic match: "matome.naver.jp" Heuristic match: "cheapoair.com" Heuristic match: "netshoes.com.br" Heuristic match: "legolas-media.com" Pattern match: "www.monografias.com" Pattern match: "www.priceline.com" Heuristic match: "ih.adscale.de" Pattern match: "www.rakuten.co.jp" Heuristic match: "gateway.foresee.com" Heuristic match: "same.eastmoney.com" Heuristic match: "smartadserver.com" Heuristic match: "ournba.net" Heuristic match: "toshiba.com" Heuristic match: "beemp3s.org" Heuristic match: "qtmojo.com" Heuristic match: "piriform.com" Heuristic match: "adtech.de" Heuristic match: "ixiaa.com" Pattern match: "www.gmx.net" Heuristic match: "jalan.net" Heuristic match: "nextag.com" Pattern match: "www.metacafe.com" Heuristic match: "4paradigm.com" Heuristic match: "rcsmetrics.it" Heuristic match: "adventori.com" Heuristic match: "city-data.com" Heuristic match: "southwest.com" Heuristic match: "serve.popads.net" Pattern match: "www.musica.com" Heuristic match: "tripod.lycos.com" Heuristic match: "shopathome.com" Pattern match: "www.tamgrt.com" Heuristic match: "a1.adform.net" Heuristic match: "lineadirecta.com" Heuristic match: "shockwave.com" Heuristic match: "postrelease.com" Heuristic match: "visualdna.com" Pattern match: "www.iqiyi.com" Heuristic match: "liutilities.com" Heuristic match: "superpages.com" Heuristic match: "acxiomapac.com" Heuristic match: "websimages.com" Heuristic match: "dlx.addthis.com" Pattern match: "www.tripadvisor.co.uk" Pattern match: "www.credit-agricole.fr" Heuristic match: "dotlinux02.doubledot.es" Heuristic match: "technical-service.net" Heuristic match: "scorecardresearch.com" Heuristic match: "pixel.rubiconproject.com" Heuristic match: "tap.rubiconproject.com" Heuristic match: "adobe.tt.omtrdc.net" Pattern match: "www.liveadexchanger.com" Heuristic match: "laredoute.commander1.com" Heuristic match: "national-lottery.co.uk" Heuristic match: "lugin.net" Pattern match: "Microsoft.NET/Framework/v4.0.30319/" Pattern match: "http://go.microsoft.com/fwlink/?LinkId=42127" Pattern match: "http://www.w3.org/2000/09/xmldsig#dsa-sha1" Pattern match: "http://www.w3.org/2000/09/xmldsig#rsa-sha1" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#rsa-sha256" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#rsa-sha384" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#rsa-sha512" Pattern match: "http://www.w3.org/2000/09/xmldsig#sha1" Pattern match: "http://www.w3.org/2001/04/xmlenc#sha256" Pattern match: "http://www.w3.org/2001/04/xmlenc#sha512" Pattern match: "http://www.w3.org/2001/04/xmlenc#ripemd160" Pattern match: "http://www.w3.org/2001/04/xmlenc#des-cbc" Pattern match: "http://www.w3.org/2001/04/xmlenc#tripledes-cbc" Pattern match: "http://www.w3.org/2001/04/xmlenc#kw-tripledes" Pattern match: "http://www.w3.org/2001/04/xmlenc#aes128-cbc" Pattern match: "http://www.w3.org/2001/04/xmlenc#kw-aes128" Pattern match: "http://www.w3.org/2001/04/xmlenc#aes192-cbc" Pattern match: "http://www.w3.org/2001/04/xmlenc#kw-aes192" Pattern match: "http://www.w3.org/2001/04/xmlenc#aes256-cbc" Pattern match: "http://www.w3.org/2001/04/xmlenc#kw-aes256" Pattern match: "http://www.w3.org/TR/2001/REC-xml-c14n-20010315" Pattern match: "http://www.w3.org/TR/2001/REC-xml-c14n-20010315#WithComments" Pattern match: "http://www.w3.org/2001/10/xml-exc-c14n#" Pattern match: "http://www.w3.org/2001/10/xml-exc-c14n#WithComments" Pattern match: "http://www.w3.org/2000/09/xmldsig#base64" Pattern match: "http://www.w3.org/TR/1999/REC-xpath-19991116" Pattern match: "http://www.w3.org/TR/1999/REC-xslt-19991116" Pattern match: "http://www.w3.org/2000/09/xmldsig#enveloped-signature" Pattern match: "http://www.w3.org/2002/07/decrypt#XML" Pattern match: "http://www.w3.org/2000/09/xmldsig#" Pattern match: "http://www.w3.org/2001/04/xmlenc#" Pattern match: "http://www.w3.org/2000/09/xmldsig#hmac-sha1" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#md5" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#sha384" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#hmac-md5" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#hmac-ripemd160" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#hmac-sha256" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#hmac-sha384" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#hmac-sha512" Pattern match: "http://www.w3.org/2000/xmlns/" Pattern match: "http://www.w3.org/XML/1998/namespace" Pattern match: "http://schemas.microsoft.com/.NetConfiguration/v2.0" Pattern match: "system.web/anonymousIdentification" Pattern match: "system.web/authentication" Pattern match: "system.web/authorization" Pattern match: "system.web/browserCaps" Pattern match: "system.web/clientTarget" Pattern match: "system.web/compilation" Pattern match: "system.web/customErrors" Pattern match: "system.web/deployment" Pattern match: "system.web/deviceFilters" Pattern match: "system.web/fullTrustAssemblies" Pattern match: "system.web/globalization" Pattern match: "system.web/healthMonitoring" Pattern match: "system.web/hostingEnvironment" Pattern match: "system.web/httpCookies" Pattern match: "system.web/httpHandlers" Pattern match: "system.web/httpModules" Pattern match: "system.web/httpRuntime" Pattern match: "system.web/identity" Pattern match: "system.web/machineKey" Pattern match: "system.web/membership" Pattern match: "system.web/mobileControls" Pattern match: "system.web/pages" Pattern match: "system.web/partialTrustVisibleAssemblies" Pattern match: "system.web/processModel" Pattern match: "system.web/profile" Pattern match: "system.web/protocols" Pattern match: "system.web/roleManager" Pattern match: "system.web/securityPolicy" Pattern match: "system.web/sessionPageState" Pattern match: "system.web/sessionState" Pattern match: "system.web/siteMap" Pattern match: "system.web/trace" Pattern match: "system.web/trust" Pattern match: "system.web/urlMappings" Pattern match: "system.web/webControls" Pattern match: "system.web/webParts" Pattern match: "system.web/webServices" Pattern match: "system.web/xhtmlConformance" Pattern match: "system.web/caching" Pattern match: "system.web/caching/cache" Pattern match: "system.web/caching/outputCache" Pattern match: "system.web/caching/outputCacheSettings" Pattern match: "system.web/caching/sqlCacheDependency"3c:T84f,".exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\\* (UID: 00000000-00002840) ".exe" called "FindNextFileW" with parameter .. (UID: 00000000-00002840) ".exe" called "FindNextFileW" with parameter NETFXSBS10.exe (UID: 00000000-00002840) ".exe" called "FindNextFileW" with parameter netfxsbs12.hkf (UID: 00000000-00002840) ".exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00002840) ".exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00002840) ".exe" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00002840) ".exe" called "FindNextFileW" with parameter sbs_diasymreader.dll (UID: 00000000-00002840) ".exe" called "FindNextFileW" with parameter sbs_iehost.dll (UID: 00000000-00002840) ".exe" called "FindNextFileW" with parameter sbs_microsoft.jscript.dll (UID: 00000000-00002840) ".exe" called "FindNextFileW" with parameter sbs_microsoft.vsa.vb.codedomprocessor.dll (UID: 00000000-00002840) ".exe" called "FindNextFileW" with parameter sbs_mscordbi.dll (UID: 00000000-00002840) ".exe" called "FindNextFileW" with parameter sbs_mscorrc.dll (UID: 00000000-00002840) ".exe" called "FindNextFileW" with parameter sbs_mscorsec.dll (UID: 00000000-00002840) ".exe" called "FindNextFileW" with parameter sbs_system.configuration.install.dll (UID: 00000000-00002840) ".exe" called "FindNextFileW" with parameter sbs_system.data.dll (UID: 00000000-00002840) ".exe" called "FindNextFileW" with parameter sbs_system.enterpriseservices.dll (UID: 00000000-00002840) ".exe" called "FindNextFileW" with parameter sbs_VsaVb7rt.dll (UID: 00000000-00002840) ".exe" called "FindNextFileW" with parameter sbs_wminet_utils.dll (UID: 00000000-00002840) ".exe" called "FindNextFileW" with parameter SharedReg12.dll (UID: 00000000-00002840)3d:T9ed,Observed string: "RegQueryValueExW" (Indicator: "RegQueryValue") in Source: 00000000-00002840-00000C1E-3161589 Observed string: "RegOpenKeyExW" (Indicator: "RegOpenKey") in Source: 00000000-00002840-00000C1E-3390476 Observed string: "RegOpenKeyEx" (Indicator: "RegOpenKey") in Source: 00000000-00002840-00000C1E-5013458 Observed string: "RegEnumKeyExW" (Indicator: "RegEnumKey") in Source: 00000000-00002840-00000C1E-19214362 Observed string: "RegQueryValueEx" (Indicator: "RegQueryValue") in Source: 00000000-00002840-00000C1E-21815991 Observed string: "RegGetValueW" (Indicator: "RegGetValue") in Source: 00000000-00004016-00000C1E-32764204 Observed string: "RegOpenKeyW" (Indicator: "RegOpenKey") in Source: 00000000-00003644-00000C1E-34474613 Observed string: "RegQueryValueW" (Indicator: "RegQueryValue") in Source: 00000000-00003644-00000C1E-34477108 Observed string: "RegGetValueA" (Indicator: "RegGetValue") in Source: 00000000-00001172-00000C1E-27271133 Observed string: "RegQueryValueExA" (Indicator: "RegQueryValue") in Source: 00000000-00001172-00000C1E-56393146 Observed string: "RegQueryValueExW" (Indicator: "RegQueryValue") in Source: 00000000-00001172.00000000.71169.00400000.00000040.mdmp 00000000-00001172.00000001.73090.00400000.00000040.mdmp 00000000-00001172.00000002.75012.00400000.00000040.mdmp Observed string: "RegOpenKeyExW" (Indicator: "RegOpenKey") in Source: 00000000-00001172.00000000.71169.00400000.00000040.mdmp 00000000-00001172.00000001.73090.00400000.00000040.mdmp 00000000-00001172.00000002.75012.00400000.00000040.mdmp Observed string: "RegOpenKeyExA" (Indicator: "RegOpenKey") in Source: 00000000-00001172.00000000.71169.00400000.00000040.mdmp 00000000-00001172.00000001.73090.00400000.00000040.mdmp 00000000-00001172.00000002.75012.00400000.00000040.mdmp Observed string: "RegEnumKeyExW" (Indicator: "RegEnumKey") in Source: 00000000-00001172.00000000.71169.00400000.00000040.mdmp 00000000-00001172.00000001.73090.00400000.00000040.mdmp 00000000-00001172.00000002.75012.00400000.00000040.mdmp Observed string: "RegQueryValueExA" (Indicator: "RegQueryValue") in Source: 00000000-00001172.00000000.71169.00400000.00000040.mdmp 00000000-00001172.00000001.73090.00400000.00000040.mdmp 00000000-00001172.00000002.75012.00400000.00000040.mdmp Observed string: "RegEnumKeyExA" (Indicator: "RegEnumKey") in Source: 00000000-00001172.00000000.71169.00400000.00000040.mdmp 00000000-00001172.00000001.73090.00400000.00000040.mdmp 00000000-00001172.00000002.75012.00400000.00000040.mdmp3e:T77c,Observed string: "GetFileSize" (Indicator: "GetFileSize") in Source: 00000000-00002840-00000C1E-5896990 Observed string: "GetTempPath" (Indicator: "GetTempPath") in Source: 00000000-00002840-00000C1E-8896762 Observed string: "GetTempPathW" (Indicator: "GetTempPath") in Source: 00000000-00002840-00000C1E-8897938 Observed string: "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfo") in Source: 00000000-00002840-00000C1E-19502011 Observed string: "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfoSize") in Source: 00000000-00002840-00000C1E-19502011 Observed string: "GetFileVersionInfoW" (Indicator: "GetFileVersionInfo") in Source: 00000000-00002840-00000C1E-19544235 Observed string: "GetFileSizeEx" (Indicator: "GetFileSize") in Source: 00000000-00001172.00000000.71169.00400000.00000040.mdmp 00000000-00001172.00000001.73090.00400000.00000040.mdmp 00000000-00001172.00000002.75012.00400000.00000040.mdmp Observed string: "GetFileSize" (Indicator: "GetFileSize") in Source: 00000000-00001172.00000000.71169.00400000.00000040.mdmp 00000000-00001172.00000001.73090.00400000.00000040.mdmp 00000000-00001172.00000002.75012.00400000.00000040.mdmp Observed string: "GetTempPathW" (Indicator: "GetTempPath") in Source: 00000000-00001172.00000000.71169.00400000.00000040.mdmp 00000000-00001172.00000001.73090.00400000.00000040.mdmp 00000000-00001172.00000002.75012.00400000.00000040.mdmp Observed string: "GetTempFileNameW" (Indicator: "GetTempFileName") in Source: 00000000-00001172.00000000.71169.00400000.00000040.mdmp 00000000-00001172.00000001.73090.00400000.00000040.mdmp 00000000-00001172.00000002.75012.00400000.00000040.mdmp Observed string: "GetSystemDirectoryA" (Indicator: "GetSystemDirectory") in Source: 00000000-00001172.00000000.71169.00400000.00000040.mdmp 00000000-00001172.00000001.73090.00400000.00000040.mdmp 00000000-00001172.00000002.75012.00400000.00000040.mdmp3f:T761,"1.0.0.0" "16.0.0.0" "9.0.0.0" Potential IP "1.0.0.0" found in string "Microsoft.Windows.IsolationAutomation,processorArchitecture="x86",publicKeyToken="6595b64144ccf1df",type="win32",version="1.0.0.0"C:\Windows\WinSxS\manifests\x86_microsoft.windows.isolationautomation_6595b64144ccf1df_1.0.0.0_none_35d357a66c38ade4.manifest" Potential IP "1.0.0.0" found in string "MyApplication.app,version="1.0.0.0"C:\Users\HAPUBWS\AppData\Roaming\BIN\BIN.exe" Potential IP "16.10.0.0" found in string "KMicrosoft.VisualStudio.Editors.SettingsDesigner.SettingsSingleFileGenerator 16.10.0.0" Potential IP "1.0.0.0" found in string "" "192.168.242.6" Potential IP "67.218.111.202" found in string "plugin_request":"67.218.111.202" ", Potential IP "67.218.111.202" found in string ""geoplugin_request":"67.218.111.202" ", Potential IP "1.0.0.0" found in string "Windows.WinINET processorArchitecture="x86" publicKeyToken="6595b64144ccf1df" type="win32" version="1.0.0.0"C:\Windows\system32\WININET.dll", Potential IP "5.1.0.0" found in string "Microsoft.Windows.Shell.shell32 processorArchitecture="*" type="win32" version="5.1.0.0"C:\Windows\WindowsShell.Manifest", Potential IP "1.0.0.0" found in string "MyApplication.app version="1.0.0.0"C:\fc2bcad21d96b3e31b27f0610209f0aa33fb1aa83504e8c346d390ac2da19504.exe", Potential IP "4.0.0.0" found in string "em.Windows.Forms 4.0.0.0 b77a5c561934e089", "0.0.0.00000", Potential IP "4.0.0.0" found in string "n=4.0.0.0 C", Potential IP "4.0.0.0" found in string "=4.0.0.0 Cu", Potential IP "4.0.0.0" found in string "4.0.0.0 Cul", Potential IP "4.0.0.0" found in string "rsion=4.0.0.0 Culture=neu", "4.0.0.0", Potential IP "4.0.0.0" found in string "=4.0.0.0 Culture=neutral PublicKeyToken=31bf3856ad364e35" />" "2.5.29.10" "2.5.29.19" "2.5.29.14" "2.5.29.15" "2.5.29.37"40:T502,".exe" (Access type: "DELETEVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS") ".exe" (Access type: "DELETEVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS") "WScript.exe" (Access type: "DELETEVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS") "WScript.exe" (Access type: "DELETEVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS") "BIN.exe" (Access type: "DELETEVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS") "BIN.exe" (Access type: "DELETEVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS") "BIN.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "PROXYENABLE"; Value: "00000000") "BIN.exe" (Access type: "DELETEVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "PROXYSERVER") "BIN.exe" (Access type: "DELETEVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "PROXYOVERRIDE")41:Tc7f,".exe" wrote 32 bytes to a remote process "C:\fc2bcad21d96b3e31b27f0610209f0aa33fb1aa83504e8c346d390ac2da19504.exe" (Handle: 724) ".exe" wrote 52 bytes to a remote process "C:\fc2bcad21d96b3e31b27f0610209f0aa33fb1aa83504e8c346d390ac2da19504.exe" (Handle: 724) ".exe" wrote 4 bytes to a remote process "C:\fc2bcad21d96b3e31b27f0610209f0aa33fb1aa83504e8c346d390ac2da19504.exe" (Handle: 724) ".exe" wrote 1024 bytes to a remote process "C:\fc2bcad21d96b3e31b27f0610209f0aa33fb1aa83504e8c346d390ac2da19504.exe" (Handle: 724) ".exe" wrote 345088 bytes to a remote process "C:\fc2bcad21d96b3e31b27f0610209f0aa33fb1aa83504e8c346d390ac2da19504.exe" (Handle: 724) ".exe" wrote 95232 bytes to a remote process "C:\fc2bcad21d96b3e31b27f0610209f0aa33fb1aa83504e8c346d390ac2da19504.exe" (Handle: 724) ".exe" wrote 3584 bytes to a remote process "C:\fc2bcad21d96b3e31b27f0610209f0aa33fb1aa83504e8c346d390ac2da19504.exe" (Handle: 724) ".exe" wrote 512 bytes to a remote process "C:\fc2bcad21d96b3e31b27f0610209f0aa33fb1aa83504e8c346d390ac2da19504.exe" (Handle: 724) ".exe" wrote 19456 bytes to a remote process "C:\fc2bcad21d96b3e31b27f0610209f0aa33fb1aa83504e8c346d390ac2da19504.exe" (Handle: 724) ".exe" wrote 14848 bytes to a remote process "C:\fc2bcad21d96b3e31b27f0610209f0aa33fb1aa83504e8c346d390ac2da19504.exe" (Handle: 724) ".exe" wrote 32 bytes to a remote process "C:\Windows\System32\wscript.exe" (Handle: 604) ".exe" wrote 52 bytes to a remote process "C:\Windows\System32\wscript.exe" (Handle: 604) ".exe" wrote 4 bytes to a remote process "C:\Windows\System32\wscript.exe" (Handle: 604) "cmd.exe" wrote 32 bytes to a remote process "C:\Users\%OSUSER%\AppData\Roaming\BIN\BIN.exe" (Handle: 136) "cmd.exe" wrote 52 bytes to a remote process "C:\Users\%OSUSER%\AppData\Roaming\BIN\BIN.exe" (Handle: 136) "cmd.exe" wrote 4 bytes to a remote process "C:\Users\%OSUSER%\AppData\Roaming\BIN\BIN.exe" (Handle: 136) "BIN.exe" wrote 32 bytes to a remote process "C:\Users\%OSUSER%\AppData\Roaming\BIN\BIN.exe" (Handle: 724) "BIN.exe" wrote 52 bytes to a remote process "C:\Users\%OSUSER%\AppData\Roaming\BIN\BIN.exe" (Handle: 724) "BIN.exe" wrote 4 bytes to a remote process "C:\Users\%OSUSER%\AppData\Roaming\BIN\BIN.exe" (Handle: 724) "BIN.exe" wrote 1024 bytes to a remote process "C:\Users\%OSUSER%\AppData\Roaming\BIN\BIN.exe" (Handle: 724) "BIN.exe" wrote 345088 bytes to a remote process "C:\Users\%OSUSER%\AppData\Roaming\BIN\BIN.exe" (Handle: 724) "BIN.exe" wrote 95232 bytes to a remote process "C:\Users\%OSUSER%\AppData\Roaming\BIN\BIN.exe" (Handle: 724) "BIN.exe" wrote 3584 bytes to a remote process "C:\Users\%OSUSER%\AppData\Roaming\BIN\BIN.exe" (Handle: 724) "BIN.exe" wrote 512 bytes to a remote process "C:\Users\%OSUSER%\AppData\Roaming\BIN\BIN.exe" (Handle: 724) "BIN.exe" wrote 19456 bytes to a remote process "C:\Users\%OSUSER%\AppData\Roaming\BIN\BIN.exe" (Handle: 724) "BIN.exe" wrote 14848 bytes to a remote process "C:\Users\%OSUSER%\AppData\Roaming\BIN\BIN.exe" (Handle: 724)42:T7d7,"geoplugin.net" (Indicator: "geoplugin.net"; File: "PCAP") "GET /json.gp HTTP/1.1Host: geoplugin.netCache-Control: no-cache" (Indicator: "geoplugin.net"; File: "PCAP") "http://geoplugin.net/json.gp" (Indicator: "geoplugin.net"; File: "00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00341000.00000004.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp") "tp://geoplugin.net/json.gp" (Indicator: "geoplugin.net"; File: "00000000-00001172.00000001.73090.002E0000.00000004.mdmp, 00000000-00001172.00000001.73090.00341000.00000004.mdmp, 00000000-00001172.00000002.75012.002E0000.00000004.mdmp, 00000000-00001172.00000002.75012.00341000.00000004.mdmp") "ttp://geoplugin.net/json.gp" (Indicator: "geoplugin.net"; File: "00000000-00001172.00000001.73090.002E0000.00000004.mdmp, 00000000-00001172.00000002.75012.002E0000.00000004.mdmp") "Host: geoplugin.net" (Indicator: "geoplugin.net"; File: "00000000-00001172.00000001.73090.002E0000.00000004.mdmp, 00000000-00001172.00000002.75012.002E0000.00000004.mdmp") ""geoplugin_credit":"Some of the returned data includes GeoLite data created by MaxMind available from http:\/\/www.maxmind.com<\/a>."," (Indicator: "maxmind.com"; File: "00000000-00001172.00000001.73090.002E0000.00000004.mdmp, 00000000-00001172.00000001.73090.00341000.00000004.mdmp, 00000000-00001172.00000002.75012.002E0000.00000004.mdmp, 00000000-00001172.00000002.75012.00385000.00000004.mdmp") "geoplugin.net" (Indicator: "geoplugin.net"; File: "00000000-00001172.00000001.73090.00341000.00000004.mdmp, 00000000-00001172.00000001.73090.00720000.00000004.mdmp, 00000000-00001172.00000002.75012.00341000.00000004.mdmp, 00000000-00001172.00000002.75012.00720000.00000004.mdmp") "st: geoplugin.net" (Indicator: "geoplugin.net"; File: "00000000-00001172.00000001.73090.00341000.00000004.mdmp, 00000000-00001172.00000002.75012.00357000.00000004.mdmp")43:T590,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD80lEQVR4Xu2W21cTVxTG/b/6Tq22VuSi4DWiLXYtXAoiIOiChNwDMQawSDCESwiEgNTWVmpfbSH2wSf7ZN/oCyHJZGYyueDXfWZIMkwyQmwXfaiz1rfO5JyZs3/7O/ucyZEjH6//+rI63RgYtB2qBi0OFAEsNgf+eLuJ12/+JL39V/V1t6diyyBKDtiH8et69B9pfeMVNqK/Y+OVonW6/436mLTPMu0BMJkdSAlpZDMSMlL6A6S8J1WQ9lkWQ8zktAB2ufMwVQaQy+flgbW1l3jxy+sDae3nl8jnsrKi0WhFFTL/5NqULHZfESC/C8AmrutbQv3dMBr6F9FoXMBpcwhnrCE0O4NoHprDOc8Mznun5Wf/2txEJi2UWa1VVQCXbKswOJ7A4FxBy/AyrngiuOpdwldji2gdX8A1Xwjf+OdVAHxZ5lU5wH7sqADavD+gbfR7XH/4FDcekXyraPc/QUdgBbdml9EZjKBrIVwEyBIAm1iSRKVNK63WgRrTqD4ALyoDbNKuyefo8f+EnsCP6J19hpsU/Lo/jNbJIC5P+GHwTaJlylcCEIWyzLUOsOAnHzr1ATheLAIYgy9wb+45WkZCOGGbwKeWEXzmeIDjQx58ft+NE94hnBxzqgB2HaDM5e3HWo0LLHjzXP/BANoff4fj5nHUDI7iqM2LY04KPnwfXzwYxpejLnmyU4/sKoBUWeZaB1jw1mdt+gApFUCNcUzJ2k7Bi1lT8DEXar914NSEDfWPLXtqQKLDKC3q7wYW/P0AQgngqHXXcpa1h4KPDMlZ147bUeezosFvxumAqbQLxP13wQEASkV4zEVZu1WWs6zJ8vpJKxqnBnFm2ogmsrQIIPBVHeP7AqgLrXbcgTqyvIEsbwxQ8JkBWs97OBfqq+ocqApAXWj1BcunTWia7cfZ4F2cX+jFxXD3HoDM7g7QBqukfQHUhSZbPmNUsp7vw4XFO7i41A3DcmcRIE01wApQu/WYWJ9IYxzHIZFIIJmI7w+gLrSm2QHKmlneiwvhHlyKdOHySidaVjuKANJ7tqGUpnkJMJlMIB6PIxHf1gFQnYTqQjs7zyy/I1tuiNym4LdwZbUdV5/eUAFwFbMvOCBQkbLMY7EYtrdjlQEEUfmjMD2zLE98EE0FIsoSCPpFKPA8UlySAm8rADEdgGRKcYB929mk1UhIlRxgLasHnk+BSynrzrLe2tqSpQsQ59LyJxk7GWQlHkAWyFNfRkCOhB2J+t6Rdkh5ZRwZvMspRVY4/9OiCJ4cSVFwjjJP0Nqz9S+IuaELwAYOS3sA2H/0vgGz3PkhMtH7FrsLdpcbVocbZqsTxgrPqXWz43YJ4OP1v7/+BnvlpAT3X7SfAAAAAElFTkSuQmCC1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"fc2bcad21d96b3e31b27f0610209f0aa33fb1aa83504e8c346d390ac2da19504","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790589047490,"unified_at":"2026-09-28T09:50:47.490Z","metadata":{"hashes":{"sha256":"fc2bcad21d96b3e31b27f0610209f0aa33fb1aa83504e8c346d390ac2da19504","sha1":"966865cdbe92c4f5add92c7182ac5bfc1d54a03c","md5":"0e71408d394b8b78ae90813be74e3047","sha512":"bbcc8316f6bf8b0ac6d8871fcb743ea5d52eee196e1e2f34207f4598b8fffc186ffb1bf78c7e042520c21aa8c4322ec4dac6e66c9b3b50c34a06bc653207c7cc","ssdeep":"24576:NTn83l5n6i2YWGVjTJZHWFMwH52Sp7UkG:NT815n6hYdJZHWFMOd","ssdeep_chunks":["24576:NTn83l5","24576:Tn83l5n","24576:n83l5n6","24576:83l5n6i","24576:3l5n6i2","24576:l5n6i2Y","24576:5n6i2YW","24576:n6i2YWG","24576:6i2YWGV","24576:i2YWGVj","24576:2YWGVjT","24576:YWGVjTJ","24576:WGVjTJZ","24576:GVjTJZH","24576:VjTJZHW","24576:jTJZHWF","24576:TJZHWFM","24576:JZHWFMw","24576:ZHWFMwH","24576:HWFMwH5","24576:WFMwH52","24576:FMwH52S","24576:MwH52Sp","24576:wH52Sp7","24576:H52Sp7U","24576:52Sp7Uk","24576:2Sp7UkG","49152:NTn83l5","49152:Tn83l5n","49152:n83l5n6","49152:83l5n6i","49152:3l5n6i2","49152:l5n6i2Y","49152:5n6i2YW","49152:n6i2YWG","49152:6i2YWGV","49152:i2YWGVj","49152:2YWGVjT","49152:YWGVjTJ","49152:WGVjTJZ","49152:GVjTJZH","49152:VjTJZHW","49152:jTJZHWF","49152:TJZHWFM","49152:JZHWFMw","49152:ZHWFMwH","49152:HWFMwH5","49152:WFMwH52","49152:FMwH52S","49152:MwH52Sp","49152:wH52Sp7","49152:H52Sp7U","49152:52Sp7Uk","49152:2Sp7UkG","24576:NT815n6","24576:T815n6h","24576:815n6hY","24576:15n6hYd","24576:5n6hYdJ","24576:n6hYdJZ","24576:6hYdJZH","24576:hYdJZHW","24576:YdJZHWF","24576:dJZHWFM","24576:JZHWFMO","24576:ZHWFMOd"],"imphash":"f34d5f2d4577ed6d9ceec516c1f5a744"},"file_info":{"file_name":"0e71408d394b8b78ae90813be74e3047.exe","file_type":["peexe","assembly","executable"],"file_type_id":".NET exe","file_size":893952,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1680654608000,"last_seen":1680656564000,"last_multi_scan":1680656564000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["commodity","credentialharvesting","criminal","remcos"]},"stats":{"av":{"malicious_count":3,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":69},"sandbox_signatures":{"informative_count":140,"suspicious_count":25,"malicious_count":12,"total":177},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_70% (D)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"malicious","threat_name":"W32/MSIL_Agent.FAT.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of MSIL/Kryptik_AGen.AOH trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"microsoftdefender":{"name":"Microsoft Defender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"MSIL/Kryptik_AGeneric.AOH trojan","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Resource Development","technique":"Email Accounts","attack_id":"T1585.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1585/002","identifiers":[{"type":"informative","value":"Found email domains (string)"}],"sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Connects to LPC ports"},{"type":"informative","value":"Contains ability to create/connect to a named pipe (API string)"}],"sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"malicious","value":"Calls an API typically used to execute an application"},{"type":"informative","value":"Calls an API typically used to retrieve function address"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to modify process thread functionality (API string)"},{"type":"informative","value":"Contains ability to create files (API string)"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"suspicious","value":"Input file contains API references not part of its Import Address Table (IAT)"},{"type":"informative","value":"Calls an API typically used to find a resource in a module"},{"type":"informative","value":"Found Windows API related strings"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"}],"sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Loads the .NET runtime environment"}],"sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"tactic":"Execution","technique":"Malicious File","attack_id":"T1204.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1204/002","identifiers":[{"type":"malicious","value":"The analysis spawned a process that was identified as malicious"},{"type":"suspicious","value":"The analysis extracted a file that was identified as malicious"}],"sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"tactic":"Execution","technique":"Visual Basic","attack_id":"T1059.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/005","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"tactic":"Execution","technique":"Command and Scripting Interpreter","attack_id":"T1059","attack_id_wiki":"https://attack.mitre.org/techniques/T1059","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Runs shell commands"},{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"tactic":"Persistence","technique":"DLL Side-Loading","attack_id":"T1574.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/002","identifiers":[{"type":"informative","value":"Fails to load modules at runtime"}],"sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"tactic":"Persistence","technique":"Registry Run Keys / Startup Folder","attack_id":"T1547.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/001","identifiers":[{"type":"informative","value":"References user shell folders registry key string"},{"type":"suspicious","value":"Modifies auto-execute functionality by setting/creating a value in the registry"}],"sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"},{"type":"informative","value":"Contains reference to Hijacked CLSID(s)"}],"sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Creates or modifies windows services"},{"type":"informative","value":"Contains ability to retrieve/open a process (API string)"},{"type":"informative","value":"Contains the ability to modify system service (API string)"},{"type":"informative","value":"Contains ability to start a service (API string)"}],"sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"tactic":"Persistence","technique":"Account Manipulation","attack_id":"T1098","attack_id_wiki":"https://attack.mitre.org/techniques/T1098","identifiers":[{"type":"informative","value":"Contains ability to update the user profile (API string)"}],"sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"malicious","value":"Writes data to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"tactic":"Privilege Escalation","technique":"Portable Executable Injection","attack_id":"T1055.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/002","identifiers":[{"type":"malicious","value":"Writes PE header to memory"}],"sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"tactic":"Privilege Escalation","technique":"Process Hollowing","attack_id":"T1055.012","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/012","identifiers":[{"type":"informative","value":"Contains ability to write data into process memory (API string)"},{"type":"malicious","value":"Creates a process in suspended mode (likely for process injection)"},{"type":"malicious","value":"Allocates virtual memory in a remote process"}],"sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"}],"sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to free a loaded DLL module (API string)"}],"sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Contains ability to modify process memory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"tactic":"Privilege Escalation","technique":"Process Doppelgänging","attack_id":"T1055.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/013","identifiers":[{"type":"informative","value":"Contains ability to unmaps a view of a section from the process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to modify access token privileges (API string)"}],"sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"suspicious","value":"Queries kernel debugger information"}],"sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"},{"type":"suspicious","value":"Tries to sleep for a long time (more than two minutes)"}],"sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"tactic":"Defense Evasion","technique":"Reflective Code Loading","attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Loads the CLR Loader DLL"}],"sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"suspicious","value":"Modifies proxy settings"},{"type":"informative","value":"Contains ability to close the handle to a registry key (API string)"},{"type":"informative","value":"Contains ability to create/open registry keys (API string)"},{"type":"informative","value":"Contains ability to delete registry value (API string)"}],"sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"suspicious","value":"Marks file for deletion"},{"type":"informative","value":"Contains ability to delete files (API string)"},{"type":"suspicious","value":"Opens file with deletion access rights"}],"sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to show a graphical window (API string)"},{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Possibly use system binaries"},{"type":"informative","value":"Drops files inside appdata directory"}],"sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"},{"type":"suspicious","value":"PE file has unusual entropy sections"}],"sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"suspicious","value":"Dotnet file contains pe file in dotnet resource"},{"type":"informative","value":"Dotnet file resource with suspicious entropy"},{"type":"informative","value":"YARA signature match - RC4 Encryption"},{"type":"informative","value":"YARA signature match - AES Encryption"}],"sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Contains ability to perform decryption (API string)"}],"sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"tactic":"Credential Access","technique":"Credential API Hooking","attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","identifiers":[{"type":"suspicious","value":"Installs hooks/patches the running process"},{"type":"informative","value":"Contains ability to hook/unhook windows functions (API string)"}],"sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"suspicious","value":"Calls an API typically used for keylogging"},{"type":"informative","value":"Contains ability to retrieve information about pressed keystrokes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"tactic":"Credential Access","technique":"Credentials from Web Browsers","attack_id":"T1555.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1555/003","identifiers":[{"type":"informative","value":"References Firefox browser credentials files"}],"sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Contains ability to verify if file exist on disk (API string)"},{"type":"suspicious","value":"Reads configuration files (.ini files)"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Calls an API's typically used for searching a directory for a files"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains ability to determine disk drive type (API string)"},{"type":"informative","value":"Contains ability to find logical drives of the machine (API string)"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Calls an API typically used to determine whether a process running under Wow64"},{"type":"informative","value":"Calls an API typically used to retrieve SID domain name"},{"type":"informative","value":"Contains ability to retrieve environment variable settings"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Contains ability to retrieve information about operating system (API string)"},{"type":"suspicious","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Contains ability to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains ability to query volume/memory size (API string)"},{"type":"informative","value":"Contains ability to retrieve the NetBIOS name of the local computer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve local language"},{"type":"informative","value":"Contains ability to query system locale (API string)"}],"sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"malicious","value":"Spawns a lot of processes"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Contains ability to enumerate processes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Contains ability to read registry keys (API string)"},{"type":"suspicious","value":"Read windows product name from registry"},{"type":"suspicious","value":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Found registry key string for installed applications"},{"type":"suspicious","value":"Checks warning level of secure to non-secure traffic redirection"},{"type":"informative","value":"Reads Windows Trust Settings"},{"type":"informative","value":"Queries TCP/IP interface details"}],"sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"suspicious","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"},{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"},{"type":"informative","value":"Calls an API typically used to get active windows title"}],"sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"malicious","value":"Tries to identify its external IP address"},{"type":"malicious","value":"Found a reference to an external IP address lookup service"}],"sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine time (API string)"},{"type":"informative","value":"Contains ability to retrieve machine timezone (API string)"}],"sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Contains ability to retrieve information about user logon sessions (API string)"},{"type":"informative","value":"Contains ability to retrieve usernames (API string)"}],"sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"tactic":"Discovery","technique":"Remote System Discovery","attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","identifiers":[{"type":"informative","value":"Contains ability to enumerate system network resources (API string)"}],"sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Contains the ability to enumerate system service (API string)"}],"sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Contains ability to move file or directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Calls an API typically used to create a directory"},{"type":"informative","value":"Writes log files"}],"sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Calls an API possibly used to take screenshots"},{"type":"informative","value":"Contains ability to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"Calls an API typically used to copy file from one location to another"}],"sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"tactic":"Collection","technique":"Archive Collected Data","attack_id":"T1560","attack_id_wiki":"https://attack.mitre.org/techniques/T1560","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"tactic":"Collection","technique":"Clipboard Data","attack_id":"T1115","attack_id_wiki":"https://attack.mitre.org/techniques/T1115","identifiers":[{"type":"informative","value":"Contains ability to access clipboard data (API string)"}],"sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"suspicious","value":"Drops script files inside temp directory"},{"type":"informative","value":"Calls an API typically used to retrieve the URL data"},{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Drops executable files"},{"type":"informative","value":"Contains ability to download a file from a URL (API string)"},{"type":"informative","value":"Contains ability to copy files"}],"sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"malicious","value":"Uses network protocols on unusual ports"}],"sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"},{"type":"suspicious","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Contacts server"},{"type":"informative","value":"Contacts domains"},{"type":"informative","value":"Found potential URL in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Communicates with HTTP webserver (GET/POST requests)"},{"type":"informative","value":"GETs files from a webserver"},{"type":"informative","value":"Contains reference to Windows HTTP services (API string)"}],"sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Making HTTPS connections using secure TLS/SSL version"}],"sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"informative","value":"Contains ability to communicate with C2 using Sockets (API string)"}],"sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"tactic":"Command and Control","technique":"Mail Protocols","attack_id":"T1071.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/003","identifiers":[{"type":"informative","value":"Found mail related domain names"}],"sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"},{"type":"informative","value":"Contains ability to close a handle to a service (API string)"}],"sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains reference to cryptographic keys"},{"type":"informative","value":"Contains ability to perform encryption (API string)"}],"sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to reboot/shutdown the operating system (API string)"}],"sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Calls an API typically used to find a resource in a module","description":"\".exe\" called \"FindResourceA\" (UID: 00000000-00004016)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-140","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Calls an API typically used to load a resource in memory","description":"\".exe\" called \"LoadResource\" (UID: 00000000-00004016)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to free a loaded DLL module (API string)","description":"Observed string: \"FreeLibraryWhenCallbackReturns\" (Indicator: \"FreeLibrary\") in Source: 00000000-00002840-00000C1E-19194280\n Observed string: \"FreeLibraryWhenCallbackReturns\" (Indicator: \"FreeLibrary\") in Source: 00000000-00001172.00000000.71169.00400000.00000040.mdmp\n 00000000-00001172.00000001.73090.00400000.00000040.mdmp\n 00000000-00001172.00000002.75012.00400000.00000040.mdmp\n Observed string: \"FreeLibrary\" (Indicator: \"FreeLibrary\") in Source: 00000000-00001172.00000000.71169.00400000.00000040.mdmp\n 00000000-00001172.00000001.73090.00400000.00000040.mdmp\n 00000000-00001172.00000002.75012.00400000.00000040.mdmp","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to impersonate access tokens (API string)","description":"Observed string: \"OpenProcessToken\" (Indicator: \"OpenProcessToken\") in Source: 00000000-00002840-00000C1E-4025084\n Observed string: \"OpenProcessTokenW\" (Indicator: \"OpenProcessToken\") in Source: 00000000-00002840-00000C1E-5557848\n Observed string: \"OpenThreadToken\" (Indicator: \"OpenThreadToken\") in Source: 00000000-00002840-00000C1E-21404732\n Observed string: \"OpenProcessToken\" (Indicator: \"OpenProcessToken\") in Source: 00000000-00001172.00000000.71169.00400000.00000040.mdmp\n 00000000-00001172.00000001.73090.00400000.00000040.mdmp\n 00000000-00001172.00000002.75012.00400000.00000040.mdmp","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-306","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to modify process memory (API string)","description":"Observed string: \"VirtualAllocEx\" (Indicator: \"VirtualAlloc\") in Source: 00000000-00002840-00000C1E-29565570\n Observed string: \"VirtualFree\" (Indicator: \"VirtualFree\") in Source: 00000000-00001172.00000000.71169.00400000.00000040.mdmp\n 00000000-00001172.00000001.73090.00400000.00000040.mdmp\n 00000000-00001172.00000002.75012.00400000.00000040.mdmp\n Observed string: \"VirtualAlloc\" (Indicator: \"VirtualAlloc\") in Source: 00000000-00001172.00000000.71169.00400000.00000040.mdmp\n 00000000-00001172.00000001.73090.00400000.00000040.mdmp\n 00000000-00001172.00000002.75012.00400000.00000040.mdmp","origin":"File/Memory","mitre_attack_id":"T1055.003","relevance":1,"id":"string-309","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to pass information to a window procedure (API string)","description":"Observed string: \"CallWindowProc\" (Indicator: \"CallWindowProc\") in Source: 00000000-00002840-00000C1E-6150546\n Observed string: \"CallWindowProcW\" (Indicator: \"CallWindowProc\") in Source: 00000000-00002840-00000C1E-6151677","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to unmaps a view of a section from the process (API string)","description":"Observed string: \"ZwUnmapViewOfSection\" [Source: 00000000-00002840-00000C1E-29621889]\n Observed string: \"NtUnmapViewOfSection\" [Source: 00000000-00004016-00000C1E-30933724]\n Observed string: \"ZwUnmapViewOfSection\" [Source: 00000000-00001172.00000000.71169.00400000.00000040.mdmp\n 00000000-00001172.00000001.73090.00400000.00000040.mdmp\n 00000000-00001172.00000002.75012.00400000.00000040.mdmp]\n Observed string: \"NtUnmapViewOfSection\" [Source: 00000000-00001172.00000000.71169.00400000.00000040.mdmp\n 00000000-00001172.00000001.73090.00400000.00000040.mdmp\n 00000000-00001172.00000002.75012.00400000.00000040.mdmp]","origin":"File/Memory","mitre_attack_id":"T1055.013","relevance":1,"id":"string-90","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to write data into process memory (API string)","description":"Observed string: \"WriteProcessMemory\" [Source: 00000000-00002840-00000C1E-9645782]\n Observed string: \"WriteProcessMemory\" [Source: 00000000-00001172.00000000.71169.00400000.00000040.mdmp\n 00000000-00001172.00000001.73090.00400000.00000040.mdmp\n 00000000-00001172.00000002.75012.00400000.00000040.mdmp]","origin":"File/Memory","mitre_attack_id":"T1055.012","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains the ability to modify system service (API string)","description":"Observed string: \"ChangeServiceConfigW\" [Source: 00000000-00001172.00000000.71169.00400000.00000040.mdmp\n 00000000-00001172.00000001.73090.00400000.00000040.mdmp\n 00000000-00001172.00000002.75012.00400000.00000040.mdmp]","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-192","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Dotnet file resource with suspicious entropy","description":"fc2bcad21d96b3e31b27f0610209f0aa33fb1aa83504e8c346d390ac2da19504.bin has big resource with name: \"prser.no_reader\" size: \"7302686\" and abnormal entropy:\"7.99445326562\"\n fc2bcad21d96b3e31b27f0610209f0aa33fb1aa83504e8c346d390ac2da19504.bin has big resource with name: \"o3\" size: \"13952\" and abnormal entropy:\"7.37370943403\"\n fc2bcad21d96b3e31b27f0610209f0aa33fb1aa83504e8c346d390ac2da19504.bin has big resource with name: \"o2\" size: \"13952\" and abnormal entropy:\"6.1789964674\"\n BIN.exe has big resource with name: \"prser.no_reader\" size: \"7302686\" and abnormal entropy:\"7.99445326562\"\n BIN.exe has big resource with name: \"o3\" size: \"13952\" and abnormal entropy:\"7.37370943403\"\n BIN.exe has big resource with name: \"o2\" size: \"13952\" and abnormal entropy:\"6.1789964674\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-129","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform decryption (API string)","description":"Observed string: \"CryptUnprotectData\" which can perform decryption and does an integrity check of the data. [Source: 00000000-00001172.00000000.71169.00400000.00000040.mdmp\n 00000000-00001172.00000001.73090.00400000.00000040.mdmp\n 00000000-00001172.00000002.75012.00400000.00000040.mdmp]","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-238","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform encryption (API string)","description":"Observed string: \"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\" which can performs encryption on the data. [Source: 00000000-00002840.00000000.67255.01B00000.00000004.mdmp]\n Observed string: \"description=\"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\"\" which can performs encryption on the data. [Source: 00000000-00002840.00000000.67255.01B00000.00000004.mdmp]","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-108","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to cryptographic keys","description":"$27","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-280","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API possibly used to retrieve a handle to the foreground window","description":"\".exe\" called \"GetForegroundWindow\" (UID: 00000000-00004016)\n \"WScript.exe\" called \"GetForegroundWindow\" (UID: 00000000-00003644)\n \"BIN.exe\" called \"GetForegroundWindow\" (UID: 00000000-00001172)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-142","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine whether a process running under Wow64","description":"\".exe\" called \"IsWow64Process\" with parameter \"2840\" - (UID: 00000000-00002840)\n \".exe\" called \"IsWow64Process\" with parameter \"4016\" - (UID: 00000000-00004016)\n \".exe\" called \"IsWow64Process\" (UID: 00000000-00004016)\n \"WScript.exe\" called \"IsWow64Process\" with parameter \"3644\" - (UID: 00000000-00003644)\n \"WScript.exe\" called \"IsWow64Process\" (UID: 00000000-00003644)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get active windows title","description":"\"BIN.exe\" called \"GetWindowTextW\" with parameter \"Program Manager\" - (UID: 00000000-00001172)\n \"BIN.exe\" called \"GetWindowTextW\" with parameter \"Task Switching\" - (UID: 00000000-00001172)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-151","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\".exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00002840)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$28","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve SID domain name","description":"\".exe\" called \"LookupAccountSidW\" (UID: 00000000-00002840)\n \"WScript.exe\" called \"LookupAccountSidW\" (UID: 00000000-00003644)\n \"BIN.exe\" called \"LookupAccountSidW\" (UID: 00000000-00003200)\n \"BIN.exe\" called \"LookupAccountSidW\" (UID: 00000000-00001172)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-148","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\".exe\" called \"GetLocaleInfoW\" with parameter \"9\" - (UID: 00000000-00002840)\n \".exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00002840)\n \"WScript.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00003644)\n \"BIN.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00003200)\n \"BIN.exe\" called \"GetLocaleInfoW\" (UID: 00000000-00003200)\n \"BIN.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00001172)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform scheduled transfer (API string)","description":"$29","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query system locale (API string)","description":"$2a","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query volume/memory size (API string)","description":"Observed string: \"GlobalMemoryStatusEx\" [Source: 00000000-00004016-00000C1E-30952163]\n Observed string: \"GlobalMemoryStatusEx\" [Source: 00000000-00001172.00000000.71169.00400000.00000040.mdmp\n 00000000-00001172.00000001.73090.00400000.00000040.mdmp\n 00000000-00001172.00000002.75012.00400000.00000040.mdmp]","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-193","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"$2b","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve environment variable settings","description":"Observed string: \"Set fso = CreateObject(\"Scripting.FileSystemObject\")\" (Indicator: \"set \") in Source: 00000000-00001172.00000000.71169.00400000.00000040.mdmp\n 00000000-00001172.00000001.73090.00400000.00000040.mdmp\n 00000000-00001172.00000002.75012.00400000.00000040.mdmp","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-326","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Observed string: \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\") in Source: 00000000-00001172.00000000.71169.00400000.00000040.mdmp\n 00000000-00001172.00000001.73090.00400000.00000040.mdmp\n 00000000-00001172.00000002.75012.00400000.00000040.mdmp","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine time (API string)","description":"$2c","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine timezone (API string)","description":"Observed string: \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\") in Source: 00000000-00001172.00000000.71169.00400000.00000040.mdmp\n 00000000-00001172.00000001.73090.00400000.00000040.mdmp\n 00000000-00001172.00000002.75012.00400000.00000040.mdmp","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-248","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"Observed api:\"GetWindowText\"[Source: 00000000-00001172.00000000.71169.00400000.00000040.mdmp\n 00000000-00001172.00000001.73090.00400000.00000040.mdmp\n 00000000-00001172.00000002.75012.00400000.00000040.mdmp]\n Observed api:\"GetForegroundWindow\"[Source: 00000000-00001172.00000000.71169.00400000.00000040.mdmp\n 00000000-00001172.00000001.73090.00400000.00000040.mdmp\n 00000000-00001172.00000002.75012.00400000.00000040.mdmp]\n Observed api:\"EnumWindows\"[Source: 00000000-00001172.00000000.71169.00400000.00000040.mdmp\n 00000000-00001172.00000001.73090.00400000.00000040.mdmp\n 00000000-00001172.00000002.75012.00400000.00000040.mdmp]","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to verify if file exist on disk (API string)","description":"Observed string: \"PathFileExistsW\" [Source: 00000000-00001172.00000000.71169.00400000.00000040.mdmp\n 00000000-00001172.00000001.73090.00400000.00000040.mdmp\n 00000000-00001172.00000002.75012.00400000.00000040.mdmp]\n Observed string: \"PathFileExistsA\" [Source: 00000000-00001172.00000000.71169.00400000.00000040.mdmp\n 00000000-00001172.00000001.73090.00400000.00000040.mdmp\n 00000000-00001172.00000002.75012.00400000.00000040.mdmp]","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-140","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"level":"informative","category":"Environment Awareness","name":"Queries TCP/IP interface details","description":"$2d","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-130","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"\".exe\" queries volume information of \"C:\\Windows\\Microsoft.NET\\assembly\\GAC_32\\System.Data\\v4.0_4.0.0.0__b77a5c561934e089\\System.Data.dll\" at 00000000-00002840-0000010C-2534553\n \".exe\" queries volume information of \"C:\\fc2bcad21d96b3e31b27f0610209f0aa33fb1aa83504e8c346d390ac2da19504.exe\" at 00000000-00002840-0000010C-17301534\n \"BIN.exe\" queries volume information of \"C:\\Windows\\Microsoft.NET\\assembly\\GAC_32\\System.Data\\v4.0_4.0.0.0__b77a5c561934e089\\System.Data.dll\" at 00000000-00003200-0000010C-1346020\n \"BIN.exe\" queries volume information of \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\BIN\\BIN.exe\" at 00000000-00003200-0000010C-10340103161313444","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"WScript.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"BIN.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\".exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"WScript.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"BIN.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\".exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\WSCRIPT.EXE\")\n \".exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\WSCRIPT.EXE\")\n \"WScript.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\CMD.EXE\")\n \"WScript.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\CMD.EXE\")","origin":"Registry Access","mitre_attack_id":"T1518","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"level":"informative","category":"General","name":"Calls an API typically used to copy file from one location to another","description":"\".exe\" called \"CopyFileW\" (UID: 00000000-00004016)","origin":"API Call","mitre_attack_id":"T1005","relevance":3,"id":"api-123","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"$2e","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"\".exe\" called \"CreateProcessA\" with parameter \"C:\\fc2bcad21d96b3e31b27f0610209f0aa33fb1aa83504e8c346d390ac2da19504.exe\" - (UID: 00000000-00002840)\n \".exe\" called \"CreateProcessW\" with parameter \"\"%WINDIR%\\System32\\WScript.exe\" \"%TEMP%\\install.vbs\"\" - (UID: 00000000-00004016)\n \"WScript.exe\" called \"CreateProcessW\" with parameter \"\"%WINDIR%\\System32\\cmd.exe\" /c \"%APPDATA%\\BIN\\BIN.exe\"\" - (UID: 00000000-00003644)\n \"cmd.exe\" called \"CreateProcessW\" with parameter \"%APPDATA%\\BIN\\BIN.exe\" - (UID: 00000000-00003280)\n \"BIN.exe\" called \"CreateProcessA\" with parameter \"%APPDATA%\\BIN\\BIN.exe\" - (UID: 00000000-00003200)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$2f","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function address","description":"$30","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"geoplugin.net\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"45.88.67.110:1823\"\n \"178.237.33.50:80\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"jvwkaml.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"level":"informative","category":"General","name":"Contains ability to close a handle to a service (API string)","description":"Observed string: \"CloseServiceHandle\" (Indicator: \"CloseServiceHandle\") in Source: 00000000-00001172.00000000.71169.00400000.00000040.mdmp\n 00000000-00001172.00000001.73090.00400000.00000040.mdmp\n 00000000-00001172.00000002.75012.00400000.00000040.mdmp","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-242","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"level":"informative","category":"General","name":"Contains ability to close the handle to a registry key (API string)","description":"Observed string: \"RegCloseKey\" (Indicator: \"RegCloseKey\") in Source: 00000000-00002840-00000C1E-3394011\n Observed string: \"RegCloseKey\" (Indicator: \"RegCloseKey\") in Source: 00000000-00001172.00000000.71169.00400000.00000040.mdmp\n 00000000-00001172.00000001.73090.00400000.00000040.mdmp\n 00000000-00001172.00000002.75012.00400000.00000040.mdmp","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"Observed string: \"CreateProcessA\" (Indicator: \"CreateProcess\") in Source: 00000000-00002840-00000C1E-9700731\n Observed string: \"CreateProcessA\" (Indicator: \"CreateProcess\") in Source: 00000000-00001172.00000000.71169.00400000.00000040.mdmp\n 00000000-00001172.00000001.73090.00400000.00000040.mdmp\n 00000000-00001172.00000002.75012.00400000.00000040.mdmp\n Observed string: \"CreateProcessW\" (Indicator: \"CreateProcess\") in Source: 00000000-00001172.00000000.71169.00400000.00000040.mdmp\n 00000000-00001172.00000001.73090.00400000.00000040.mdmp\n 00000000-00001172.00000002.75012.00400000.00000040.mdmp","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"level":"informative","category":"General","name":"Contains ability to create files (API string)","description":"Observed string: \"CreateFile\" (Indicator: \"CreateFile\") in Source: 00000000-00002840-00000C1E-21343895\n Observed string: \"CreateFileW\" (Indicator: \"CreateFile\") in Source: 00000000-00002840-00000C1E-21344949\n Observed string: \"CreateFileW\" (Indicator: \"CreateFile\") in Source: 00000000-00001172.00000000.71169.00400000.00000040.mdmp\n 00000000-00001172.00000001.73090.00400000.00000040.mdmp\n 00000000-00001172.00000002.75012.00400000.00000040.mdmp","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"level":"informative","category":"General","name":"Contains ability to create/open registry keys (API string)","description":"Observed string: \"RegCreateKeyExW\" (Indicator: \"RegCreateKey\") in Source: 00000000-00002840-00000C1E-21973568\n Observed string: \"RegCreateKeyExA\" (Indicator: \"RegCreateKey\") in Source: 00000000-00001172-00000C1E-56391516\n Observed string: \"RegCreateKeyW\" (Indicator: \"RegCreateKey\") in Source: 00000000-00001172.00000000.71169.00400000.00000040.mdmp\n 00000000-00001172.00000001.73090.00400000.00000040.mdmp\n 00000000-00001172.00000002.75012.00400000.00000040.mdmp\n Observed string: \"RegCreateKeyExW\" (Indicator: \"RegCreateKey\") in Source: 00000000-00001172.00000000.71169.00400000.00000040.mdmp\n 00000000-00001172.00000001.73090.00400000.00000040.mdmp\n 00000000-00001172.00000002.75012.00400000.00000040.mdmp\n Observed string: \"RegCreateKeyA\" (Indicator: \"RegCreateKey\") in Source: 00000000-00001172.00000000.71169.00400000.00000040.mdmp\n 00000000-00001172.00000001.73090.00400000.00000040.mdmp\n 00000000-00001172.00000002.75012.00400000.00000040.mdmp","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-307","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Observed string: \"EnableShellExecuteHooks\" (Indicator: \"ShellExecute\") in Source: 00000000-00004016-00000BC0-10972935\n Observed string: \"ShellExecuteExW\" (Indicator: \"ShellExecute\") in Source: 00000000-00003644-00000C1E-34576704\n Observed string: \"ShellExecuteW\" (Indicator: \"ShellExecute\") in Source: 00000000-00001172.00000000.71169.00400000.00000040.mdmp\n 00000000-00001172.00000001.73090.00400000.00000040.mdmp\n 00000000-00001172.00000002.75012.00400000.00000040.mdmp\n Observed string: \"ShellExecuteExA\" (Indicator: \"ShellExecute\") in Source: 00000000-00001172.00000000.71169.00400000.00000040.mdmp\n 00000000-00001172.00000001.73090.00400000.00000040.mdmp\n 00000000-00001172.00000002.75012.00400000.00000040.mdmp","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-240","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"level":"informative","category":"General","name":"Contains ability to modify process thread functionality (API string)","description":"$31","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"level":"informative","category":"General","name":"Contains ability to move file or directory (API string)","description":"Observed string: \"MoveFileW\" (Indicator: \"MoveFile\") in Source: 00000000-00001172.00000000.71169.00400000.00000040.mdmp\n 00000000-00001172.00000001.73090.00400000.00000040.mdmp\n 00000000-00001172.00000002.75012.00400000.00000040.mdmp\n Observed string: \"MoveFileExW\" (Indicator: \"MoveFile\") in Source: 00000000-00001172.00000000.71169.00400000.00000040.mdmp\n 00000000-00001172.00000001.73090.00400000.00000040.mdmp\n 00000000-00001172.00000002.75012.00400000.00000040.mdmp","origin":"File/Memory","mitre_attack_id":"T1570","relevance":1,"id":"string-322","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Observed string: \"GetCommandLineA\" (Indicator: \"GetCommandLine\") in Source: 00000000-00001172.00000000.71169.00400000.00000040.mdmp\n 00000000-00001172.00000001.73090.00400000.00000040.mdmp\n 00000000-00001172.00000002.75012.00400000.00000040.mdmp\n Observed string: \"GetCommandLineW\" (Indicator: \"GetCommandLine\") in Source: 00000000-00001172.00000000.71169.00400000.00000040.mdmp\n 00000000-00001172.00000001.73090.00400000.00000040.mdmp\n 00000000-00001172.00000002.75012.00400000.00000040.mdmp","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/open a process (API string)","description":"Observed string: \"OpenProcessToken\" (Indicator: \"OpenProcess\") in Source: 00000000-00002840-00000C1E-4025084\n Observed string: \"OpenProcessTokenW\" (Indicator: \"OpenProcess\") in Source: 00000000-00002840-00000C1E-5557848\n Observed string: \"GetProcessHeap\" (Indicator: \"GetProcessHeap\") in Source: 00000000-00001172.00000000.71169.00400000.00000040.mdmp\n 00000000-00001172.00000001.73090.00400000.00000040.mdmp\n 00000000-00001172.00000002.75012.00400000.00000040.mdmp\n Observed string: \"OpenProcess\" (Indicator: \"OpenProcess\") in Source: 00000000-00001172.00000000.71169.00400000.00000040.mdmp\n 00000000-00001172.00000001.73090.00400000.00000040.mdmp\n 00000000-00001172.00000002.75012.00400000.00000040.mdmp\n Observed string: \"OpenProcessToken\" (Indicator: \"OpenProcess\") in Source: 00000000-00001172.00000000.71169.00400000.00000040.mdmp\n 00000000-00001172.00000001.73090.00400000.00000040.mdmp\n 00000000-00001172.00000002.75012.00400000.00000040.mdmp","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Observed string: \"GetLastError\" (Indicator: \"GetLastError\") in Source: 00000000-00002840-00000C1E-5469309\n Observed string: \"GetLastError\" (Indicator: \"GetLastError\") in Source: 00000000-00001172.00000000.71169.00400000.00000040.mdmp\n 00000000-00001172.00000001.73090.00400000.00000040.mdmp\n 00000000-00001172.00000002.75012.00400000.00000040.mdmp\n Observed string: \"SetLastError\" (Indicator: \"SetLastError\") in Source: 00000000-00001172.00000000.71169.00400000.00000040.mdmp\n 00000000-00001172.00000001.73090.00400000.00000040.mdmp\n 00000000-00001172.00000002.75012.00400000.00000040.mdmp","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Observed string: \"GetWindowThreadProcessId\" (Indicator: \"GetWindowThreadProcessId\") in Source: 00000000-00001172.00000000.71169.00400000.00000040.mdmp\n 00000000-00001172.00000001.73090.00400000.00000040.mdmp\n 00000000-00001172.00000002.75012.00400000.00000040.mdmp\n Observed string: \"ShowWindow\" (Indicator: \"ShowWindow\") in Source: 00000000-00001172.00000000.71169.00400000.00000040.mdmp\n 00000000-00001172.00000001.73090.00400000.00000040.mdmp\n 00000000-00001172.00000002.75012.00400000.00000040.mdmp","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-208","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"level":"informative","category":"General","name":"Contains ability to start a service (API string)","description":"Observed string: \"StartServiceW\" (Indicator: \"StartService\") in Source: 00000000-00001172.00000000.71169.00400000.00000040.mdmp\n 00000000-00001172.00000001.73090.00400000.00000040.mdmp\n 00000000-00001172.00000002.75012.00400000.00000040.mdmp","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-209","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"level":"informative","category":"General","name":"Contains the ability to enumerate system service (API string)","description":"$32","origin":"File/Memory","mitre_attack_id":"T1007","relevance":1,"id":"string-191","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\"\n \"Local\\ZonesLockedCacheCounterMutex\"\n \"Local\\ZonesCacheCounterMutex\"\n \"Rmc-TYHMFA\"\n \"\\Sessions\\1\\BaseNamedObjects\\Rmc-TYHMFA\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"$33","origin":"API Call","mitre_attack_id":"T1574.002","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"level":"informative","category":"General","name":"Found Windows API related strings","description":"$34","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"level":"informative","category":"General","name":"Found a reference to a known community page","description":"\"okie:hapubws@linkedin.com/\" (Indicator: \"linkedin.com\")\n \"ads.linkedin.com\" (Indicator: \"linkedin.com\")\n \"facebook.com\" (Indicator: \"facebook.com\")\n \"www.linkedin.com\" (Indicator: \"linkedin.com\")\n \"craigslist.org\" (Indicator: \"craigslist.org\")\n \"twitter.com\" (Indicator: \"twitter\")\n \"badoo.com\" (Indicator: \"badoo.com\")\n \"youtube.com\" (Indicator: \"youtube\")\n \"linkedin.com\" (Indicator: \"linkedin.com\")","origin":"File/Memory","relevance":7,"id":"string-10","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"level":"informative","category":"General","name":"GETs files from a webserver","description":"\"GET /json.gp HTTP/1.1\nHost: geoplugin.net\nCache-Control: no-cache\"","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"\".exe\" loaded module \"API-MS-WIN-CORE-SYNCH-L1-2-0\" at base 727f0000\n \".exe\" loaded module \"API-MS-WIN-CORE-FIBERS-L1-1-1\" at base 0\n \".exe\" loaded module \"KERNEL32\" at base 75810000\n \".exe\" loaded module \"API-MS-WIN-CORE-LOCALIZATION-L1-2-1\" at base 0\n \".exe\" loaded module \"ADVAPI32.DLL\" at base 75d40000\n \".exe\" loaded module \"%WINDIR%\\MICROSOFT.NET\\FRAMEWORK\\V4.0.30319\\MSCOREEI.DLL\" at base 6cda0000\n \".exe\" loaded module \"API-MS-WIN-APPMODEL-RUNTIME-L1-1-0.DLL\" at base 0\n \".exe\" loaded module \"VERSION.DLL\" at base 745f0000\n \".exe\" loaded module \"%WINDIR%\\MICROSOFT.NET\\FRAMEWORK\\V4.0.30319\\CLR.DLL\" at base 685a0000\n \".exe\" loaded module \"API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL\" at base 0","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\".exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\36eaccfde177c2e7b93b8dbdde4e012a\\mscorlib.ni.dll\" at 67190000\n \"BIN.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\36eaccfde177c2e7b93b8dbdde4e012a\\mscorlib.ni.dll\" at 669E0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-3","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"level":"informative","category":"General","name":"Loads the CLR Loader DLL","description":"\".exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 67DF0000\n \".exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 685A0000\n \"BIN.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 685A0000\n \"BIN.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 67DF0000","origin":"Loaded Module","mitre_attack_id":"T1620","id":"module-7","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\".exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 75BB0000\n \"WScript.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 75BB0000\n \"cmd.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 75BB0000\n \"BIN.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 75BB0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"10001100da02a772@ADVAPI32.dll\"\n \"150016002c7aeb6c@ADVAPI32.dll\"\n \"0e000f00a47aeb6c@ADVAPI32.dll\"\n \"0e000f00d87aeb6c@ADVAPI32.dll\"\n \"11001200387feb6c@ADVAPI32.dll\"\n \"11001200a47feb6c@ADVAPI32.dll\"\n \"12001300b87feb6c@ADVAPI32.dll\"\n \"12001300e07feb6c@ADVAPI32.dll\"\n \"140015009493eb6c@ADVAPI32.dll\"\n \"1b001c00381fda6c@api-ms-win-core-synch-l1-2-0.DLL\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$35","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"level":"informative","category":"General","name":"PE file contains COM data directory","description":"\"fc2bcad21d96b3e31b27f0610209f0aa33fb1aa83504e8c346d390ac2da19504.bin\" has COM data directory \"IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR\"\n \"BIN.exe\" has COM data directory \"IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR\"","origin":"Static Parser","relevance":1,"id":"static-144","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"level":"informative","category":"General","name":"PE file contains Debug data directory","description":"\"fc2bcad21d96b3e31b27f0610209f0aa33fb1aa83504e8c346d390ac2da19504.bin\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"\n \"BIN.exe\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"","origin":"Static Parser","id":"static-146","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"fc2bcad21d96b3e31b27f0610209f0aa33fb1aa83504e8c346d390ac2da19504.bin\" has an executable section named \".text\"\n \"BIN.exe\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"$36","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"level":"informative","category":"General","name":"Possibly use system binaries","description":"Observed system executable string:\"%WINDIR%\\System32\\WScript.exe\" [Source: 00000000-00004016-00000C39-39844727978]\n Observed system executable string:\"\"%WINDIR%\\System32\\WScript.exe\" \"%TEMP%\\install.vbs\"\" [Source: 00000000-00004016-00000C39-39844727978]\n Observed system executable string:\"%WINDIR%\\System32\\cmd.exe\" [Source: 00000000-00003644-00000C39-18446744042980234920]\n Observed system executable string:\"\"%WINDIR%\\System32\\cmd.exe\" /c \"%APPDATA%\\BIN\\BIN.exe\"\" [Source: 00000000-00003644-00000C39-18446744042980234920]","origin":"File/Memory","mitre_attack_id":"T1036","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"BIN.exe\" (UID: 00000000-00003200) was launched with new environment variables: \"PROMPT=\"$P$G\"\"","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"geoplugin.net\"\n \"ucremcz1.ddns.net\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"level":"informative","category":"General","name":"Reads Windows Trust Settings","description":"\"WScript.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-20","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"$37","origin":"Registry Access","mitre_attack_id":"T1012","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"level":"informative","category":"General","name":"Runs shell commands","description":"\"/c \"%APPDATA%\\\\BIN\\\\BIN.exe\"\" on 2023-4-5.00:53:12.373","origin":"Monitored Target","mitre_attack_id":"T1059.003","relevance":5,"id":"target-3","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \".exe\" (UID: 00000000-00004016)\n Spawned process \"WScript.exe\" with commandline \"\"%TEMP%\\\\install.vbs\"\" (UID: 00000000-00003644)\n Spawned process \"cmd.exe\" with commandline \"/c \"%APPDATA%\\\\BIN\\\\BIN.exe\"\" (UID: 00000000-00003280)\n Spawned process \"BIN.exe\" (UID: 00000000-00003200)\n Spawned process \"BIN.exe\" (UID: 00000000-00001172)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \".exe\" (UID: 00000000-00004016)\n Spawned process \"WScript.exe\" with commandline \"\"%TEMP%\\\\install.vbs\"\" (UID: 00000000-00003644)\n Spawned process \"cmd.exe\" with commandline \"/c \"%APPDATA%\\\\BIN\\\\BIN.exe\"\" (UID: 00000000-00003280)\n Spawned process \"BIN.exe\" (UID: 00000000-00003200)\n Spawned process \"BIN.exe\" (UID: 00000000-00001172)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"level":"informative","category":"Installation/Persistence","name":"Connects to LPC ports","description":"\".exe\" connecting to \"\\ThemeApiPort\"\n \"BIN.exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","mitre_attack_id":"T1559","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Observed string: \"LoadLibraryEx\" (Indicator: \"LoadLibrary\") in Source: 00000000-00002840-00000C1E-5933176\n Observed string: \"LoadLibraryExW\" (Indicator: \"LoadLibrary\") in Source: 00000000-00002840-00000C1E-5934199\n Observed string: \"LoadLibraryA\" (Indicator: \"LoadLibrary\") in Source: 00000000-00002840-00000C1E-9451190\n Observed string: \"LoadLibraryA\" (Indicator: \"LoadLibrary\") in Source: 00000000-00001172.00000000.71169.00400000.00000040.mdmp\n 00000000-00001172.00000001.73090.00400000.00000040.mdmp\n 00000000-00001172.00000002.75012.00400000.00000040.mdmp\n Observed string: \"LoadLibraryExW\" (Indicator: \"LoadLibrary\") in Source: 00000000-00001172.00000000.71169.00400000.00000040.mdmp\n 00000000-00001172.00000001.73090.00400000.00000040.mdmp\n 00000000-00001172.00000002.75012.00400000.00000040.mdmp","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"\"BIN.exe\" has type \"PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows\"- Location: [%APPDATA%\\BIN\\BIN.exe]- [targetUID: 00000000-00003280]\n \"install.vbs\" has type \"data\"- Location: [%TEMP%\\install.vbs]- [targetUID: 00000000-00003644]\n \"json_1_.json\" has type \"JSON data\"- [targetUID: N/A]\n \"logs.dat\" has type \"data\"- Location: [%APPDATA%\\remcos\\logs.dat]- [targetUID: 00000000-00001172]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"level":"informative","category":"Installation/Persistence","name":"Drops executable files","description":"\"BIN.exe\" has type \"PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows\"- Location: [%APPDATA%\\BIN\\BIN.exe]- [targetUID: 00000000-00003280]","origin":"Binary File","mitre_attack_id":"T1105","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"level":"informative","category":"Installation/Persistence","name":"References user shell folders registry key string","description":"Found string \"Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\" (Indicator: \"currentversion\\explorer\\user shell folders\"; in Source: \"00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1547.001","relevance":1,"id":"string-410","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"$38","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$39","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$3a","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes log files","description":"\"BIN.exe\" writes a file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\remcos\\logs.dat\"\n \"BIN.exe\" writes a file \"%APPDATA%\\remcos\\logs.dat\"","origin":"API Call","mitre_attack_id":"T1074.001","relevance":1,"id":"api-159","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to retrieve the URL data","description":"\"BIN.exe\" called \"InternetReadFile\" with parameter 65535 (UID: 00000000-00001172)","origin":"API Call","mitre_attack_id":"T1105","relevance":3,"id":"api-118","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"level":"informative","category":"Network Related","name":"Communicates with HTTP webserver (GET/POST requests)","description":"Found http requests in header \"GET /json.gp\"","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-62","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with C2 using Sockets (API string)","description":"Observed string: \"WSASend\" (Indicator: \"WSASend\") in Source: 00000000-00001172-00000C1E-28499709\n Observed string: \"WSARecv\" (Indicator: \"WSARecv\") in Source: 00000000-00001172-00000C1E-28503227","origin":"File/Memory","mitre_attack_id":"T1095","relevance":1,"id":"string-228","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"level":"informative","category":"Network Related","name":"Contains ability to copy files","description":"Observed string: \"Copy\" (Indicator: \"copy\") in Source: 00000000-00001172.00000000.71169.012F2000.00000020.mdmp\n 00000000-00001172.00000001.73090.012F2000.00000020.mdmp\n 00000000-00001172.00000002.75012.012F2000.00000020.mdmp\n Observed string: \"Copy\" (Indicator: \"copy\") in Source: 00000000-00002840.00000000.67255.00B42000.00000020.mdmp\n 00000000-00002840.00000000.67255.01B00000.00000004.mdmp\n 00000000-00002840.00000001.68768.00660000.00000004.mdmp\n 00000000-00002840.00000001.68768.00670000.00000004.mdmp\n 00000000-00002840.00000001.68768.00B42000.00000020.mdmp\n 00000000-00002840.00000001.68768.04A10000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-329","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create/connect to a named pipe (API string)","description":"Observed string: \"CreatePipe\" (Indicator: \"CreatePipe\") in Source: 00000000-00001172.00000000.71169.00400000.00000040.mdmp\n 00000000-00001172.00000001.73090.00400000.00000040.mdmp\n 00000000-00001172.00000002.75012.00400000.00000040.mdmp\n Observed string: \"PeekNamedPipe\" (Indicator: \"PeekNamedPipe\") in Source: 00000000-00001172.00000000.71169.00400000.00000040.mdmp\n 00000000-00001172.00000001.73090.00400000.00000040.mdmp\n 00000000-00001172.00000002.75012.00400000.00000040.mdmp","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-210","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"level":"informative","category":"Network Related","name":"Contains ability to download a file from a URL (API string)","description":"Observed string: \"URLDownloadToFileW\" (Indicator: \"URLDownloadToFile\") in Source: 00000000-00001172.00000000.71169.00400000.00000040.mdmp\n 00000000-00001172.00000001.73090.00400000.00000040.mdmp\n 00000000-00001172.00000002.75012.00400000.00000040.mdmp","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-241","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"level":"informative","category":"Network Related","name":"Contains reference to Windows HTTP services (API string)","description":"Observed string: \"WinHttpCreateProxyResolver\" (Indicator: \"WinHttpCreateProxyResolver\") in Source: 00000000-00001172-00000C1E-56545478","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-323","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"level":"informative","category":"Network Related","name":"Found email domains (string)","description":"Observed string: \"ookie:hapubws@www.gmx.net/\" (Indicator: \".gmx.\") in Source: 00000000-00001172.00000001.73090.00341000.00000004.mdmp\n 00000000-00001172.00000002.75012.00385000.00000004.mdmp\n Observed string: \"www.gmx.net\" (Indicator: \".gmx.\") in Source: 00000000-00001172.00000001.73090.00341000.00000004.mdmp\n 00000000-00001172.00000002.75012.00385000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1585.002","relevance":1,"id":"string-235","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"level":"informative","category":"Network Related","name":"Found mail related domain names","description":"Observed email domain:\"ookie:hapubws@www.gmx.net/\" [Source: 00000000-00001172.00000001.73090.00341000.00000004.mdmp\n 00000000-00001172.00000002.75012.00385000.00000004.mdmp]\n Observed email domain:\"www.gmx.net\" [Source: 00000000-00001172.00000001.73090.00341000.00000004.mdmp\n 00000000-00001172.00000002.75012.00385000.00000004.mdmp]\n Observed email domain:\"ten.sdapop.evres\" [Source: 00000000-00001172.00000001.73090.00341000.00000004.mdmp\n 00000000-00001172.00000002.75012.00385000.00000004.mdmp]","origin":"File/Memory","mitre_attack_id":"T1071.003","relevance":1,"id":"string-169","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$3b","origin":"File/Memory","mitre_attack_id":"T1071","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"level":"informative","category":"Network Related","name":"Making HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x00000303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - AES Encryption","description":"YARA signature for AES encryption matched on process \"00000000-00001172\"\n YARA signature for AES encryption matched on process \"00000000-00004016\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-103","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - RC4 Encryption","description":"YARA signature for RC4 encryption matched on process \"00000000-00001172\"\n YARA signature for RC4 encryption matched on process \"00000000-00004016\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-104","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"level":"informative","category":"Ransomware/Banking","name":"Contains ability to update the user profile (API string)","description":"Observed string: \"SystemParametersInfoW\" [Source: 00000000-00001172.00000000.71169.00400000.00000040.mdmp\n 00000000-00001172.00000001.73090.00400000.00000040.mdmp\n 00000000-00001172.00000002.75012.00400000.00000040.mdmp]","origin":"File/Memory","mitre_attack_id":"T1098","relevance":1,"id":"string-132","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API possibly used to take screenshots","description":"\".exe\" called \"CreateCompatibleBitmap\" (UID: 00000000-00002840)\n \"BIN.exe\" called \"CreateCompatibleBitmap\" (UID: 00000000-00003200)","origin":"API Call","mitre_attack_id":"T1113","relevance":3,"id":"api-105","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\".exe\" called \"CreateToolhelp32Snapshot\" (UID: 00000000-00002840)\n \"WScript.exe\" called \"CreateToolhelp32Snapshot\" (UID: 00000000-00003644)\n \"cmd.exe\" called \"CreateToolhelp32Snapshot\" (UID: 00000000-00003280)\n \"BIN.exe\" called \"CreateToolhelp32Snapshot\" (UID: 00000000-00003200)\n \"BIN.exe\" called \"CreateToolhelp32Snapshot\" (UID: 00000000-00001172)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API's typically used for searching a directory for a files","description":"$3c","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to access clipboard data (API string)","description":"Observed string: \"GetClipboardData\" [Source: 00000000-00001172.00000000.71169.00400000.00000040.mdmp\n 00000000-00001172.00000001.73090.00400000.00000040.mdmp\n 00000000-00001172.00000002.75012.00400000.00000040.mdmp]\n Observed string: \"OpenClipboard\" [Source: 00000000-00001172.00000000.71169.00400000.00000040.mdmp\n 00000000-00001172.00000001.73090.00400000.00000040.mdmp\n 00000000-00001172.00000002.75012.00400000.00000040.mdmp]","origin":"File/Memory","mitre_attack_id":"T1115","relevance":1,"id":"string-188","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to capture screen (API string)","description":"Observed string: \"GetDC\" [Source: 00000000-00002840-00000C1E-6370751]\n Observed string: \"CreateDCA\" [Source: 00000000-00001172.00000000.71169.00400000.00000040.mdmp\n 00000000-00001172.00000001.73090.00400000.00000040.mdmp\n 00000000-00001172.00000002.75012.00400000.00000040.mdmp]\n Observed string: \"GetDIBits\" [Source: 00000000-00001172.00000000.71169.00400000.00000040.mdmp\n 00000000-00001172.00000001.73090.00400000.00000040.mdmp\n 00000000-00001172.00000002.75012.00400000.00000040.mdmp]\n Observed string: \"CreateCompatibleDC\" [Source: 00000000-00001172.00000000.71169.00400000.00000040.mdmp\n 00000000-00001172.00000001.73090.00400000.00000040.mdmp\n 00000000-00001172.00000002.75012.00400000.00000040.mdmp]\n Observed string: \"CreateCompatibleBitmap\" [Source: 00000000-00001172.00000000.71169.00400000.00000040.mdmp\n 00000000-00001172.00000001.73090.00400000.00000040.mdmp\n 00000000-00001172.00000002.75012.00400000.00000040.mdmp]","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to determine disk drive type (API string)","description":"Observed string: \"GetDriveTypeA\" [Source: 00000000-00001172.00000000.71169.00400000.00000040.mdmp\n 00000000-00001172.00000001.73090.00400000.00000040.mdmp\n 00000000-00001172.00000002.75012.00400000.00000040.mdmp]","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-80","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"Observed string: \"FindFirstFileW\" [Source: 00000000-00001172.00000000.71169.00400000.00000040.mdmp\n 00000000-00001172.00000001.73090.00400000.00000040.mdmp\n 00000000-00001172.00000002.75012.00400000.00000040.mdmp]\n Observed string: \"FindNextFileW\" [Source: 00000000-00001172.00000000.71169.00400000.00000040.mdmp\n 00000000-00001172.00000001.73090.00400000.00000040.mdmp\n 00000000-00001172.00000002.75012.00400000.00000040.mdmp]\n Observed string: \"FindFirstFileA\" [Source: 00000000-00001172.00000000.71169.00400000.00000040.mdmp\n 00000000-00001172.00000001.73090.00400000.00000040.mdmp\n 00000000-00001172.00000002.75012.00400000.00000040.mdmp]\n Observed string: \"FindNextFileA\" [Source: 00000000-00001172.00000000.71169.00400000.00000040.mdmp\n 00000000-00001172.00000001.73090.00400000.00000040.mdmp\n 00000000-00001172.00000002.75012.00400000.00000040.mdmp]","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate processes (API string)","description":"Observed string: \"CreateToolhelp32Snapshot\" [Source: 00000000-00001172.00000000.71169.00400000.00000040.mdmp\n 00000000-00001172.00000001.73090.00400000.00000040.mdmp\n 00000000-00001172.00000002.75012.00400000.00000040.mdmp]\n Observed string: \"Process32NextW\" [Source: 00000000-00001172.00000000.71169.00400000.00000040.mdmp\n 00000000-00001172.00000001.73090.00400000.00000040.mdmp\n 00000000-00001172.00000002.75012.00400000.00000040.mdmp]\n Observed string: \"Process32FirstW\" [Source: 00000000-00001172.00000000.71169.00400000.00000040.mdmp\n 00000000-00001172.00000001.73090.00400000.00000040.mdmp\n 00000000-00001172.00000002.75012.00400000.00000040.mdmp]","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate system network resources (API string)","description":"Observed string: \"GetAdaptersAddresses\" (Indicator: \"GetAdaptersAddresses\") in Source: 00000000-00001172-00000C1E-56794650","origin":"File/Memory","mitre_attack_id":"T1018","relevance":1,"id":"string-313","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to find logical drives of the machine (API string)","description":"Observed string: \"GetLogicalDriveStringsA\" [Source: 00000000-00001172.00000000.71169.00400000.00000040.mdmp\n 00000000-00001172.00000001.73090.00400000.00000040.mdmp\n 00000000-00001172.00000002.75012.00400000.00000040.mdmp]","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-84","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read registry keys (API string)","description":"$3d","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Observed string: \"GetProcAddress\" (Indicator: \"GetProcAddress\") in Source: 00000000-00002840-00000C1E-5930060\n Observed string: \"GetProcAddress\" (Indicator: \"GetProcAddress\") in Source: 00000000-00001172.00000000.71169.00400000.00000040.mdmp\n 00000000-00001172.00000001.73090.00400000.00000040.mdmp\n 00000000-00001172.00000002.75012.00400000.00000040.mdmp","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"$3e","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about operating system (API string)","description":"Observed string: \"25,,RtlGetNtProductType,NTDL\" [Source: 00000000-00001172.00000000.71169.002E0000.00000004.mdmp\n 00000000-00001172.00000001.73090.002E0000.00000004.mdmp\n 00000000-00001172.00000002.75012.002E0000.00000004.mdmp]","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about pressed keystrokes (API string)","description":"Observed string: \"GetKeyboardState\" [Source: 00000000-00001172.00000000.71169.00400000.00000040.mdmp\n 00000000-00001172.00000001.73090.00400000.00000040.mdmp\n 00000000-00001172.00000002.75012.00400000.00000040.mdmp]\n Observed string: \"GetKeyState\" [Source: 00000000-00001172.00000000.71169.00400000.00000040.mdmp\n 00000000-00001172.00000001.73090.00400000.00000040.mdmp\n 00000000-00001172.00000002.75012.00400000.00000040.mdmp]","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-88","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about the current system (API string)","description":"Observed string: \"NtQuerySystemInformation\" [Source: 00000000-00002840-00000C1E-5609102]\n Observed string: \"GetSystemMetrics\" [Source: 00000000-00002840-00000C1E-5915846]\n Observed string: \"ExpandEnvironmentStringsA\" [Source: 00000000-00001172.00000000.71169.00400000.00000040.mdmp\n 00000000-00001172.00000001.73090.00400000.00000040.mdmp\n 00000000-00001172.00000002.75012.00400000.00000040.mdmp]\n Observed string: \"GetNativeSystemInfo\" [Source: 00000000-00001172.00000000.71169.00400000.00000040.mdmp\n 00000000-00001172.00000001.73090.00400000.00000040.mdmp\n 00000000-00001172.00000002.75012.00400000.00000040.mdmp]\n Observed string: \"GetSystemMetrics\" [Source: 00000000-00001172.00000000.71169.00400000.00000040.mdmp\n 00000000-00001172.00000001.73090.00400000.00000040.mdmp\n 00000000-00001172.00000002.75012.00400000.00000040.mdmp]","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about user logon sessions (API string)","description":"Observed string: \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\") in Source: 00000000-00002840-00000C1E-30022283\n Observed string: \"IsUserAnAdmin\" (Indicator: \"IsUserAnAdmin\") in Source: 00000000-00004016-00000C1E-30973296\n Observed string: \"IsUserAnAdmin\" (Indicator: \"IsUserAnAdmin\") in Source: 00000000-00001172.00000000.71169.00400000.00000040.mdmp\n 00000000-00001172.00000001.73090.00400000.00000040.mdmp\n 00000000-00001172.00000002.75012.00400000.00000040.mdmp","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-217","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the NetBIOS name of the local computer (API string)","description":"Observed string: \"GetComputerNameExW\" [Source: 00000000-00004016-00000C1E-30955449]\n Observed string: \"GetComputerNameExW\" [Source: 00000000-00001172.00000000.71169.00400000.00000040.mdmp\n 00000000-00001172.00000001.73090.00400000.00000040.mdmp\n 00000000-00001172.00000002.75012.00400000.00000040.mdmp]","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-122","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Observed string: \"GetModuleFileName\" [Source: 00000000-00004016-00000C1E-10772111]\n Observed string: \"GetModuleFileName\" [Source: 00000000-00001172.00000000.71169.00400000.00000040.mdmp\n 00000000-00001172.00000001.73090.00400000.00000040.mdmp\n 00000000-00001172.00000002.75012.00400000.00000040.mdmp]","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"Observed string: \"GetSystemMetrics\" [Source: 00000000-00002840-00000C1E-5915846]\n Observed string: \"GetSystemMetrics\" [Source: 00000000-00001172.00000000.71169.00400000.00000040.mdmp\n 00000000-00001172.00000001.73090.00400000.00000040.mdmp\n 00000000-00001172.00000002.75012.00400000.00000040.mdmp]","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-131","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Observed string: \"GetTickCount64\" (Indicator: \"GetTickCount\") in Source: 00000000-00002840-00000C1E-19197112\n Observed string: \"GetTickCount64\" (Indicator: \"GetTickCount\") in Source: 00000000-00001172.00000000.71169.00400000.00000040.mdmp\n 00000000-00001172.00000001.73090.00400000.00000040.mdmp\n 00000000-00001172.00000002.75012.00400000.00000040.mdmp\n Observed string: \"GetTickCount\" (Indicator: \"GetTickCount\") in Source: 00000000-00001172.00000000.71169.00400000.00000040.mdmp\n 00000000-00001172.00000001.73090.00400000.00000040.mdmp\n 00000000-00001172.00000002.75012.00400000.00000040.mdmp","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve usernames (API string)","description":"Observed string: \"GetUserNameExW\" [Source: 00000000-00002840-00000C1E-30132256]\n Observed string: \"GetUserNameExA\" [Source: 00000000-00001172-00000C1E-56385508]\n Observed string: \"GetUserNameW\" [Source: 00000000-00001172.00000000.71169.00400000.00000040.mdmp\n 00000000-00001172.00000001.73090.00400000.00000040.mdmp\n 00000000-00001172.00000002.75012.00400000.00000040.mdmp]","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieves the class object from a DLL object handler (API string)","description":"Observed string: \"DllGetClassObject\" [Source: 00000000-00002840-00000C1E-8942630]","origin":"File/Memory","relevance":1,"id":"string-82","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found registry key string for installed applications","description":"\"Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\" (Indicator: \"microsoft\\windows\\currentversion\\uninstall\") in Source: 00000000-00001172.00000000.71169.00400000.00000040.mdmp\n 00000000-00001172.00000001.73090.00400000.00000040.mdmp\n 00000000-00001172.00000002.75012.00400000.00000040.mdmp","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-96","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"References Firefox browser credentials files","description":"Found string \"\\key3.db\" (Indicator: \"key3.db\"; in Source: \"00000000-00001172.00000000.71169.00400000.00000040.mdmp, 00000000-00001172.00000001.73090.00400000.00000040.mdmp, 00000000-00001172.00000002.75012.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1555.003","relevance":1,"id":"string-405","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files (API string)","description":"Observed string: \"DeleteFileA\" (Indicator: \"DeleteFileA\") in Source: 00000000-00001172.00000000.71169.00400000.00000040.mdmp\n 00000000-00001172.00000001.73090.00400000.00000040.mdmp\n 00000000-00001172.00000002.75012.00400000.00000040.mdmp\n Observed string: \"DeleteFileW\" (Indicator: \"DeleteFileW\") in Source: 00000000-00001172.00000000.71169.00400000.00000040.mdmp\n 00000000-00001172.00000001.73090.00400000.00000040.mdmp\n 00000000-00001172.00000002.75012.00400000.00000040.mdmp","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete registry value (API string)","description":"Observed string: \"RegDeleteValueW\" (Indicator: \"RegDeleteValue\") in Source: 00000000-00001172-00000C1E-27526373\n Observed string: \"RegDeleteValueW\" (Indicator: \"RegDeleteValue\") in Source: 00000000-00001172.00000000.71169.00400000.00000040.mdmp\n 00000000-00001172.00000001.73090.00400000.00000040.mdmp\n 00000000-00001172.00000002.75012.00400000.00000040.mdmp","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-230","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"level":"informative","category":"System Security","name":"Contains ability to hook/unhook windows functions (API string)","description":"Observed string: \"UnhookWindowsHookEx\" [Source: 00000000-00001172.00000000.71169.00400000.00000040.mdmp\n 00000000-00001172.00000001.73090.00400000.00000040.mdmp\n 00000000-00001172.00000002.75012.00400000.00000040.mdmp]\n Observed string: \"SetWindowsHookExA\" [Source: 00000000-00001172.00000000.71169.00400000.00000040.mdmp\n 00000000-00001172.00000001.73090.00400000.00000040.mdmp\n 00000000-00001172.00000002.75012.00400000.00000040.mdmp]\n Observed string: \"CallNextHookEx\" [Source: 00000000-00001172.00000000.71169.00400000.00000040.mdmp\n 00000000-00001172.00000001.73090.00400000.00000040.mdmp\n 00000000-00001172.00000002.75012.00400000.00000040.mdmp]","origin":"File/Memory","mitre_attack_id":"T1056.004","relevance":1,"id":"string-91","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"Observed string: \"SeShutdownPrivilege\" [Source: 00000000-00001172.00000000.71169.00400000.00000040.mdmp\n 00000000-00001172.00000001.73090.00400000.00000040.mdmp\n 00000000-00001172.00000002.75012.00400000.00000040.mdmp]\n Observed string: \"LookupPrivilegeValueA\" [Source: 00000000-00001172.00000000.71169.00400000.00000040.mdmp\n 00000000-00001172.00000001.73090.00400000.00000040.mdmp\n 00000000-00001172.00000002.75012.00400000.00000040.mdmp]\n Observed string: \"AdjustTokenPrivileges\" [Source: 00000000-00001172.00000000.71169.00400000.00000040.mdmp\n 00000000-00001172.00000001.73090.00400000.00000040.mdmp\n 00000000-00001172.00000002.75012.00400000.00000040.mdmp]","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Observed string: \"CorExitProcess\" (Indicator: \"ExitProcess\") in Source: 00000000-00001172.00000000.71169.00400000.00000040.mdmp\n 00000000-00001172.00000001.73090.00400000.00000040.mdmp\n 00000000-00001172.00000002.75012.00400000.00000040.mdmp\n Observed string: \"TerminateProcess\" (Indicator: \"TerminateProcess\") in Source: 00000000-00001172.00000000.71169.00400000.00000040.mdmp\n 00000000-00001172.00000001.73090.00400000.00000040.mdmp\n 00000000-00001172.00000002.75012.00400000.00000040.mdmp\n Observed string: \"ExitProcess\" (Indicator: \"ExitProcess\") in Source: 00000000-00001172.00000000.71169.00400000.00000040.mdmp\n 00000000-00001172.00000001.73090.00400000.00000040.mdmp\n 00000000-00001172.00000002.75012.00400000.00000040.mdmp","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"level":"informative","category":"System Security","name":"Contains reference to Hijacked CLSID(s)","description":"Observed string: \"CLSID\\{1299CF18-C4F5-4B6A-BB0F-2299F0398E27}\" (Indicator: \"{1299CF18-C4F5-4B6A-BB0F-2299F0398E27}\") in Source: 00000000-00001172.00000001.73090.00341000.00000004.mdmp\n 00000000-00001172.00000002.75012.0036B000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1546.015","relevance":1,"id":"string-342","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"BIN.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\".exe\" opened \"\\Device\\KsecDD\"\n \"BIN.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to reboot/shutdown the operating system (API string)","description":"Observed string: \"ExitWindowsEx\" [Source: 00000000-00001172.00000000.71169.00400000.00000040.mdmp\n 00000000-00001172.00000001.73090.00400000.00000040.mdmp\n 00000000-00001172.00000002.75012.00400000.00000040.mdmp]","origin":"File/Memory","mitre_attack_id":"T1529","relevance":3,"id":"string-189","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"Observed string: \"CreateMutexA\" (Indicator: \"CreateMutex\") in Source: 00000000-00001172.00000000.71169.00400000.00000040.mdmp\n 00000000-00001172.00000001.73090.00400000.00000040.mdmp\n 00000000-00001172.00000002.75012.00400000.00000040.mdmp\n Observed string: \"OpenMutexA\" (Indicator: \"OpenMutex\") in Source: 00000000-00001172.00000000.71169.00400000.00000040.mdmp\n 00000000-00001172.00000001.73090.00400000.00000040.mdmp\n 00000000-00001172.00000002.75012.00400000.00000040.mdmp","origin":"File/Memory","relevance":1,"id":"string-354","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"Dropped file: \"BIN.exe\" - Location: [%APPDATA%\\BIN\\BIN.exe]- [targetUID: 00000000-00003280]\n Dropped file: \"logs.dat\" - Location: [%APPDATA%\\remcos\\logs.dat]- [targetUID: 00000000-00001172]","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"fc2bcad21d96b3e31b27f0610209f0aa33fb1aa83504e8c346d390ac2da19504.bin\" was detected as \"Microsoft visual C# v7.0 / Basic .NET\"\n \"BIN.exe\" was detected as \"Microsoft visual C# v7.0 / Basic .NET\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries kernel debugger information","description":"\".exe\" at 00000000-00002840-00000105-3076281\n \"BIN.exe\" at 00000000-00003200-00000105-10340103162678844\n \"BIN.exe\" at 00000000-00001172-00000105-8152546","origin":"API Call","mitre_attack_id":"T1622","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)","description":"\"BIN.exe\" (Access type: \"QUERYVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\5.0\\CACHE\"; Key: \"SCAVENGECACHEFILELIMIT\")\n \"BIN.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\5.0\\CACHE\"; Key: \"SCAVENGECACHEFILELIMIT\")\n \"BIN.exe\" (Access type: \"QUERYVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"DISABLECACHINGOFSSLPAGES\")\n \"BIN.exe\" (Access type: \"QUERYVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"BYPASSHTTPNOCACHECHECK\")\n \"BIN.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"BYPASSHTTPNOCACHECHECK\")\n \"BIN.exe\" (Access type: \"QUERYVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"BYPASSSSLNOCACHECHECK\")\n \"BIN.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"BYPASSSSLNOCACHECHECK\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":3,"id":"registry-29","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":".text\n .reloc\n .text\n .reloc with unusual entropies 7.94076032145\n 0.101910425663\n 7.94076032145\n 0.101910425663","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":3,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"level":"suspicious","category":"Environment Awareness","name":"Tries to sleep for a long time (more than two minutes)","description":"\".exe\" sleeping for \"1566804069\" milliseconds\n \"BIN.exe\" sleeping for \"1566804069\" milliseconds","origin":"API Call","mitre_attack_id":"T1497.003","relevance":10,"id":"api-24","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"level":"suspicious","category":"External Systems","name":"Found an IP/URL artifact that was identified as malicious by at least three reputation engines","description":"11/90 reputation engines marked \"http://ucremcz1.ddns.net\" as malicious (12% detection rate)","origin":"External System","relevance":10,"id":"avtest-6","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"25/70 Antivirus vendors marked sample as malicious (35% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"level":"suspicious","category":"General","name":"Reads configuration files (.ini files)","description":"\".exe\" reads file \"C:\\Users\\%OSUSER%\\Searches\\desktop.ini\"\n \".exe\" reads file \"C:\\Users\\%OSUSER%\\Desktop\\desktop.ini\"\n \".exe\" reads file \"C:\\Users\\%OSUSER%\\Videos\\desktop.ini\"\n \".exe\" reads file \"C:\\Users\\%OSUSER%\\Pictures\\desktop.ini\"\n \".exe\" reads file \"C:\\Users\\%OSUSER%\\Contacts\\desktop.ini\"\n \".exe\" reads file \"C:\\Users\\%OSUSER%\\Favorites\\desktop.ini\"\n \".exe\" reads file \"C:\\Users\\%OSUSER%\\Music\\desktop.ini\"","origin":"API Call","mitre_attack_id":"T1083","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"level":"suspicious","category":"General","name":"The analysis extracted a file that was identified as malicious","description":"25/70 Antivirus vendors marked dropped file \"BIN.exe\" as malicious (classified as \"TrojanX\" with 35% detection rate)","origin":"Binary File","mitre_attack_id":"T1204.002","relevance":10,"id":"binary-11","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Modifies auto-execute functionality by setting/creating a value in the registry","description":"\".exe\" (Access type: \"CREATE\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\\\")\n \".exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\"; Key: \"BIN\"; Value: \"\"%APPDATA%\\BIN\\BIN.exe\"\")\n \".exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\\\")\n \".exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\"; Key: \"BIN\"; Value: \"\"%APPDATA%\\BIN\\BIN.exe\"\")\n \"BIN.exe\" (Access type: \"CREATE\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\\\")\n \"BIN.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\"; Key: \"BIN\"; Value: \"\"%APPDATA%\\BIN\\BIN.exe\"\")\n \"BIN.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\\\")\n \"BIN.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\"; Key: \"BIN\"; Value: \"\"%APPDATA%\\BIN\\BIN.exe\"\")","origin":"Registry Access","mitre_attack_id":"T1547.001","relevance":8,"id":"registry-0","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"$3f","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 178.237.33.50 on port 80 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Checks warning level of secure to non-secure traffic redirection","description":"\"BIN.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"WARNONHTTPSTOHTTPREDIRECT\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":7,"id":"registry-9","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used for keylogging","description":"\"BIN.exe\" called \"GetKeyState\"","origin":"API Call","mitre_attack_id":"T1056.001","relevance":10,"id":"api-40","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\".exe\" called \"GetNativeSystemInfo\" (UID: 00000000-00002840)\n \".exe\" called \"GetNativeSystemInfo\" (UID: 00000000-00004016)\n \"WScript.exe\" called \"GetNativeSystemInfo\" (UID: 00000000-00003644)\n \"BIN.exe\" called \"GetNativeSystemInfo\" (UID: 00000000-00003200)","origin":"API Call","mitre_attack_id":"T1082","relevance":5,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Found an instant messenger related domain","description":"\"hotwire.com\" (Indicator: \"wire.com\")\n \"blackberry.com\" (Indicator: \"blackberry.com\")","origin":"File/Memory","relevance":10,"id":"string-61","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Read windows product name from registry","description":"\".exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\"; Key: \"PRODUCTNAME\")\n \"BIN.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\"; Key: \"PRODUCTNAME\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-105","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"WScript.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\install.vbs\" for deletion","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"WScript.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\install.vbs\" with delete access","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"$40","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Detected known bank URL artifact","description":"\"capitalone.com\" (Source: 00000000-00001172.00000001.73090.00341000.00000004.mdmp, 00000000-00001172.00000002.75012.00385000.00000004.mdmp, Indicator: \"capitalone.com\")\n \"www.credit-agricole.fr\" (Source: 00000000-00001172.00000001.73090.00341000.00000004.mdmp, 00000000-00001172.00000002.75012.00385000.00000004.mdmp, Indicator: \"credit-agricole.fr\")","origin":"File/Memory","relevance":10,"id":"string-23","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Dotnet file contains pe file in dotnet resource","description":"fc2bcad21d96b3e31b27f0610209f0aa33fb1aa83504e8c346d390ac2da19504.bin has PE file in resource with name: \"o1\" and filetype: \"PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows\"\n BIN.exe has PE file in resource with name: \"o1\" and filetype: \"PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-109","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Drops script files inside temp directory","description":"Dropped file: \"install.vbs\" - Location: [%TEMP%\\install.vbs]- [targetUID: 00000000-00003644]","origin":"Binary File","mitre_attack_id":"T1105","relevance":5,"id":"binary-35","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"Found string \"GetPixel\" (Source: fc2bcad21d96b3e31b27f0610209f0aa33fb1aa83504e8c346d390ac2da19504.bin, API is part of module: GDI32.DLL)\n Found string \"SetPixel\" (Source: fc2bcad21d96b3e31b27f0610209f0aa33fb1aa83504e8c346d390ac2da19504.bin, API is part of module: GDI32.DLL)\n Found string \"Sleep\" (Source: fc2bcad21d96b3e31b27f0610209f0aa33fb1aa83504e8c346d390ac2da19504.bin, API is part of module: KERNELBASE.DLL)","origin":"File/Memory","mitre_attack_id":"T1106","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"\".exe\" wrote bytes \"e51aa246\" to virtual address \"0x685AF798\" (part of module \"CLR.DLL\")\n \".exe\" wrote bytes \"db4da37200000000\" to virtual address \"0x00B42000\" (part of module \"FC2BCAD21D96B3E31B27F0610209F0AA33FB1AA83504E8C346D390AC2DA19504.EXE\")\n \"BIN.exe\" wrote bytes \"e9cb7466\" to virtual address \"0x67DFF798\" (part of module \"CLR.DLL\")\n \"BIN.exe\" wrote bytes \"db4dec6c00000000\" to virtual address \"0x012F2000\" (part of module \"BIN.EXE\")","origin":"Hook Detection","mitre_attack_id":"T1056.004","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"WScript.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"BIN.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":5,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Creates a process in suspended mode (likely for process injection)","description":"\".exe\" called \"CreateProcessA\" with parameter \"C:\\fc2bcad21d96b3e31b27f0610209f0aa33fb1aa83504e8c346d390ac2da19504.exe\" - (UID: 00000000-00002840)\n \"BIN.exe\" called \"CreateProcessA\" with parameter \"%APPDATA%\\BIN\\BIN.exe\" - (UID: 00000000-00003200)","origin":"API Call","mitre_attack_id":"T1055.012","relevance":10,"id":"api-129","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Writes PE header to memory","description":"\".exe wrote PE header bytes (\"MZ\") to a remote process \"C:\\fc2bcad21d96b3e31b27f0610209f0aa33fb1aa83504e8c346d390ac2da19504.exe\", which might be an injection preparation attempt ..., \"BIN.exe wrote PE header bytes (\"MZ\") to a remote process \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\BIN\\BIN.exe\"\n which might be an injection preparation attempt ...","origin":"API Call","mitre_attack_id":"T1055.002","relevance":7,"id":"api-83","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"25/70 Antivirus vendors marked sample as malicious (35% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted Antivirus engine","description":"No specific details available","origin":"External System","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"level":"malicious","category":"General","name":"Calls an API typically used to execute an application","description":"\".exe\" called \"ShellExecuteW\" with parameter %TEMP%\\install.vbs (UID: 00000000-00004016)","origin":"API Call","mitre_attack_id":"T1106","relevance":10,"id":"api-117","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"level":"malicious","category":"General","name":"The analysis spawned a process that was identified as malicious","description":"25/70 Antivirus vendors marked spawned process \".exe\" (PID: 4016) as malicious (classified as \"TrojanX\" with 35% detection rate)\n 25/70 Antivirus vendors marked spawned process \"BIN.exe\" (PID: 3200) as malicious (classified as \"TrojanX\" with 35% detection rate)\n 25/70 Antivirus vendors marked spawned process \"BIN.exe\" (PID: 1172) as malicious (classified as \"TrojanX\" with 35% detection rate)","origin":"Monitored Target","mitre_attack_id":"T1204.002","relevance":10,"id":"target-58","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"level":"malicious","category":"Installation/Persistence","name":"Allocates virtual memory in a remote process","description":"\"BIN.exe\" allocated memory in \"%APPDATA%\\BIN\\BIN.exe\"","origin":"API Call","mitre_attack_id":"T1055.012","relevance":7,"id":"api-20","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"$41","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"level":"malicious","category":"Network Related","name":"Found a reference to an external IP address lookup service","description":"$42","origin":"File/Memory","mitre_attack_id":"T1016","relevance":6,"id":"string-56","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"level":"malicious","category":"Network Related","name":"Tries to identify its external IP address","description":"\"geoplugin.net\"","origin":"Network Traffic","mitre_attack_id":"T1016","relevance":6,"id":"network-24","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"level":"malicious","category":"Network Related","name":"Uses network protocols on unusual ports","description":"TCP traffic to 45.88.67.110 on port 1823","origin":"Network Traffic","mitre_attack_id":"T1571","relevance":7,"id":"network-7","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"Spawned process \".exe\" (UID: 00000000-00002840)\n Spawned process \".exe\" (UID: 00000000-00004016)\n Spawned process \"WScript.exe\" with commandline \"\"%TEMP%\\\\install.vbs\"\" (UID: 00000000-00003644)\n Spawned process \"cmd.exe\" with commandline \"/c \"%APPDATA%\\\\BIN\\\\BIN.exe\"\" (UID: 00000000-00003280)\n Spawned process \"BIN.exe\" (UID: 00000000-00003200)\n Spawned process \"BIN.exe\" (UID: 00000000-00001172)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]}],"incidents":[{"name":"Spyware","details_count":1,"details":[{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"name":"Persistence","details_count":3,"details":[{"detail":"Modifies auto-execute functionality by setting/creating a value in the registry"},{"detail":"Spawns a lot of processes"},{"detail":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"name":"Fingerprint","details_count":5,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Tries to identify its external IP address"},{"detail":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)"},{"detail":"Queries sensitive IE security settings"},{"detail":"Queries the display settings of system associated file extensions"}],"sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"name":"Evasive","details_count":3,"details":[{"detail":"Tries to sleep for a long time (more than two minutes)"},{"detail":"Marks file for deletion"},{"detail":"Input file contains API references not part of its Import Address Table (IAT)"}],"sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 2 domains and 2 hosts"}],"sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]}]},"activity":{"stats":{"process_count":6,"spawned_processes_count":6,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":6,"imported_dlls_count":110,"dropped_files_count":0,"extracted_files_count":4,"files_written_count":14,"files_deleted_count":0,"registry_keys_created_count":7,"registry_keys_modified_count":0,"registry_keys_deleted_count":4,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":11,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":2,"dns_resolutions_count":2,"contacted_urls_count":1,"http_requests_count":1},"behavior_tags":["commodity","credentialharvesting","criminal","remcos"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"642cc5aec505d6ef1f0bd57a","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"TrojanX","contacted_countries":["MDA","NLD"],"submit_name":"fc2bcad21d96b3e31b27f0610209f0aa33fb1aa83504e8c346d390ac2da19504.exe","analysis_start_time":"2023-04-05T00:49:51+00:00","indicators_count":{"informative":140,"suspicious":42,"malicious":14},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"45.88.67.110","port":1823,"protocol":"TCP","country":"Moldova Republic of","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"address":"178.237.33.50","port":80,"protocol":"TCP","country":"Netherlands","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]}],"dns_resolutions":[{"domain":"geoplugin.net","address":"178.237.33.50","ttl":2281,"country":"Netherlands","registrar_name":"OVH, SAS","registrar_name_servers":"DNS200.ANYCAST.ME","registrar_creation_date":"2006-11-06T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"domain":"ucremcz1.ddns.net","address":"45.88.67.110","ttl":60,"country":"Moldova Republic of","registrar_name":"TLDS LLC. d/b/a SRSPlus","registrar_organization":"No-IP.com","registrar_name_servers":"NF1.NO-IP.COM","registrar_creation_date":"2001-06-28T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]}],"http_requests":[{"host":"geoplugin.net","host_ip":"178.237.33.50:80","url":"/json.gp","method":"GET","header":"GET /json.gp HTTP/1.1\nHost: geoplugin.net\nCache-Control: no-cache","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}],"processes":[{"pid":2840,"ppid":0,"name":"fc2bcad21d96b3e31b27f0610209f0aa33fb1aa83504e8c346d390ac2da19504.exe","command_line":"","sha256":"fc2bcad21d96b3e31b27f0610209f0aa33fb1aa83504e8c346d390ac2da19504","normalized_path":"C:\\fc2bcad21d96b3e31b27f0610209f0aa33fb1aa83504e8c346d390ac2da19504.exe","uid":"00000000-00002840","icon":"$43"},{"pid":4016,"ppid":2840,"name":"fc2bcad21d96b3e31b27f0610209f0aa33fb1aa83504e8c346d390ac2da19504.exe","command_line":"","sha256":"fc2bcad21d96b3e31b27f0610209f0aa33fb1aa83504e8c346d390ac2da19504","normalized_path":"C:\\fc2bcad21d96b3e31b27f0610209f0aa33fb1aa83504e8c346d390ac2da19504.exe","parent_uid":"00000000-00002840","uid":"00000000-00004016"},{"pid":3644,"ppid":4016,"name":"WScript.exe","command_line":"\"%TEMP%\\install.vbs\"","sha256":"2160ba6829909eeb1d272ac4a5f43588750c0b4743477bf2b46952033b5d4b3b","normalized_path":"%WINDIR%\\System32\\WScript.exe","parent_uid":"00000000-00004016","uid":"00000000-00003644"},{"pid":3280,"ppid":3644,"name":"cmd.exe","command_line":"/c \"%APPDATA%\\BIN\\BIN.exe\"","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00000000-00003644","uid":"00000000-00003280"},{"pid":3200,"ppid":3280,"name":"BIN.exe","command_line":"","sha256":"fc2bcad21d96b3e31b27f0610209f0aa33fb1aa83504e8c346d390ac2da19504","normalized_path":"%APPDATA%\\BIN\\BIN.exe","parent_uid":"00000000-00003280","uid":"00000000-00003200"},{"pid":1172,"ppid":3200,"name":"BIN.exe","command_line":"","sha256":"fc2bcad21d96b3e31b27f0610209f0aa33fb1aa83504e8c346d390ac2da19504","normalized_path":"%APPDATA%\\BIN\\BIN.exe","parent_uid":"00000000-00003200","uid":"00000000-00001172"}],"all_imported_dlls":["ole32.dll","nsi.dll","api-ms-win-core-synch-l1-2-0.dll","clr.dll","rpcss.dll","System.Drawing.ni.dll","nlssorting.dll","rsaenh.dll","advapi32.dll","sechost.dll","version.dll","GdiPlus.dll","api-ms-win-downlevel-version-l1-1-0.dll","System.Xml.ni.dll","bcrypt.dll","setupapi.dll","kernel32.dll","ws2_32.dll","psapi.dll","System.Configuration.ni.dll","api-ms-win-downlevel-user32-l1-1-0.dll","secur32.dll","oleaut32.dll","mscorrc.dll","msasn1.dll","propsys.dll","api-ms-win-downlevel-advapi32-l2-1-0.dll","vbscript.dll","mlang.dll","dnsapi.dll","npmproxy.dll","winnsi.dll","System.Windows.Forms.dll","WindowsCodecs.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll","normaliz.dll","gdi32.dll","msctf.dll","ntmarta.dll","wshext.dll","msvcrt.dll","shlwapi.dll","apphelp.dll","ucrtbase_clr0400.dll","System.Windows.Forms.ni.dll","wintrust.dll","ieframe.dll","dhcpcsvc.dll","mscoreei.dll","System.Data.ni.dll","api-ms-win-downlevel-ole32-l1-1-0.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","winmm.dll","wship6.dll","api-ms-win-downlevel-shlwapi-l2-1-0.dll","clrjit.dll","System.Data.dll","crypt32.dll","clbcatq.dll","cfgmgr32.dll","sxs.dll","scrobj.dll","api-ms-win-downlevel-shell32-l1-1-0.dll","lpk.dll","rpcrt4.dll","uxtheme.dll","sspicli.dll","shell32.dll","Wldap32.dll","winbrand.dll","rasadhlp.dll","userenv.dll","devobj.dll","netprofm.dll","FWPUCLNT.DLL","wshqos.dll","KernelBase.dll","Microsoft.VisualBasic.ni.dll","wininet.dll","user32.dll","dwmapi.dll","nlaapi.dll","winhttp.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","imm32.dll","mpr.dll","mswsock.dll","WSHTCPIP.DLL","dhcpcsvc6.dll","fltLib.dll","mscorlib.ni.dll","iertutil.dll","mscoree.dll","cryptsp.dll","api-ms-win-core-xstate-l2-1-0.dll","System.ni.dll","comctl32.dll","urlmon.dll","msisip.dll","scrrun.dll","ntdll.dll","cryptbase.dll","usp10.dll","webio.dll","vcruntime140_clr0400.dll","profapi.dll","System.Core.ni.dll","shdocvw.dll","RpcRtRemote.dll","IPHLPAPI.DLL"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"BIN.exe","sha256":"fc2bcad21d96b3e31b27f0610209f0aa33fb1aa83504e8c346d390ac2da19504","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"name":"install.vbs","sha256":"21ec77c20976c6e9ce64b067745f35486dcb3587d72835fa8414ff4a0d816e24","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"name":"logs.dat","sha256":"5fdf87619ce50ae92e0c9657830d567c7af3bdf9c62cba3c9af4e0aeb8f02823","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"name":"json_1_.json","sha256":"88d410a3c6fcf969d063adb37fd0259aeca6555e2db0f2acd85a6a0daeb998ca","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]}],"files_written":[{"path":"\\DEVICE\\NETBT_TCPIP_{E29AC6C2-7037-11DE-816D-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{FC9EBB92-F38F-4C0F-9BB2-4E5E64704E72}","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\37NU00GP\\json[1].json","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"path":"%APPDATA%\\BIN","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\counters.dat","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"path":"%APPDATA%\\remcos","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"path":"\\FileSystem\\Filters\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\GDIPLUS\\","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\\\","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\\\\","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\\\\","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]}],"keys_modified":null,"keys_deleted":[{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\PROXYBYPASS\\PROXYBYPASS","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\PROXYBYPASS\\PROXYBYPASS","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\INTRANETNAME\\INTRANETNAME","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\INTRANETNAME\\INTRANETNAME","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]}]},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"name":"Rmc-TYHMFA","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Rmc-TYHMFA","sources":[{"report_type":"sandbox","report_id":"642cc5aec505d6ef1f0bd57a"}]}]}},"report_ids":{"sandbox_job_ids":["642cc5aec505d6ef1f0bd57a"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious MSIL/Kryptik_AGeneric.AOH trojan Sample fc2bcad21d96… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample fc2bcad21d96…. Malware family: MSIL/Kryptik_AGeneric.AOH trojan. Threat score 100/100. 3/28 AV engines flagged this file. 12 malicious and 25 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/fc2bcad21d96b3e31b27f0610209f0aa33fb1aa83504e8c346d390ac2da19504"}],["$","meta","4",{"property":"og:title","content":"Malicious MSIL/Kryptik_AGeneric.AOH trojan Sample fc2bcad21d96… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample fc2bcad21d96…. Malware family: MSIL/Kryptik_AGeneric.AOH trojan. Threat score 100/100. 3/28 AV engines flagged this file. 12 malicious and 25 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/fc2bcad21d96b3e31b27f0610209f0aa33fb1aa83504e8c346d390ac2da19504"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious MSIL/Kryptik_AGeneric.AOH trojan Sample fc2bcad21d96… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample fc2bcad21d96…. Malware family: MSIL/Kryptik_AGeneric.AOH trojan. Threat score 100/100. 3/28 AV engines flagged this file. 12 malicious and 25 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L44","11",{}]]