26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 7b:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T428,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Sample fda4866ce778… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample fda4866ce778…. Threat score 100/100. 0/26 AV engines flagged this file. 4 malicious and 23 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/fda4866ce7784c356ebacd24873258507e5cace3f2a0e1f1fabcbb97de1995ea","keywords":["Malicious","malware analysis","sandbox report","threat intelligence","fda4866ce7784c356ebacd24873258507e5cace3f2a0e1f1fabcbb97de1995ea"],"about":{"@type":"SoftwareApplication","name":"Waaake_Setup.exe","applicationCategory":["peexe","executable"],"identifier":"fda4866ce7784c356ebacd24873258507e5cace3f2a0e1f1fabcbb97de1995ea","additionalType":"Malicious sample"},"threatScore":100,"antivirusDetections":{"malicious":0,"total":26},"behavioralIndicators":{"malicious":4,"suspicious":23},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T86c,"Waaake_Setup.exe" called "RemoveDirectoryW" with parameter %TEMP%\nsbD764.tmp\7z-out\locales\ (UID: 00000000-00005000) "Waaake_Setup.exe" called "RemoveDirectoryW" with parameter %TEMP%\nsbD764.tmp\7z-out\resources\app.asar.unpacked\node_modules\@tailwindcss\oxide\node_modules\@t (UID: 00000000-00005000) "Waaake_Setup.exe" called "RemoveDirectoryW" with parameter %TEMP%\nsbD764.tmp\7z-out\resources\app.asar.unpacked\node_modules\@tailwindcss\oxide\node_modules\ (UID: 00000000-00005000) "Waaake_Setup.exe" called "RemoveDirectoryW" with parameter %TEMP%\nsbD764.tmp\7z-out\resources\app.asar.unpacked\node_modules\@tailwindcss\oxide\ (UID: 00000000-00005000) "Waaake_Setup.exe" called "RemoveDirectoryW" with parameter %TEMP%\nsbD764.tmp\7z-out\resources\app.asar.unpacked\node_modules\@tailwindcss\ (UID: 00000000-00005000) "Waaake_Setup.exe" called "RemoveDirectoryW" with parameter %TEMP%\nsbD764.tmp\7z-out\resources\app.asar.unpacked\node_modules\lightningcss\node_modules\lightnin (UID: 00000000-00005000) "Waaake_Setup.exe" called "RemoveDirectoryW" with parameter %TEMP%\nsbD764.tmp\7z-out\resources\app.asar.unpacked\node_modules\lightningcss\node_modules\ (UID: 00000000-00005000) "Waaake_Setup.exe" called "RemoveDirectoryW" with parameter %TEMP%\nsbD764.tmp\7z-out\resources\app.asar.unpacked\node_modules\lightningcss\ (UID: 00000000-00005000) "Waaake_Setup.exe" called "RemoveDirectoryW" with parameter %TEMP%\nsbD764.tmp\7z-out\resources\app.asar.unpacked\node_modules\ (UID: 00000000-00005000) "Waaake_Setup.exe" called "RemoveDirectoryW" with parameter %TEMP%\nsbD764.tmp\7z-out\resources\app.asar.unpacked\resources\ (UID: 00000000-00005000) "Waaake_Setup.exe" called "RemoveDirectoryW" with parameter %TEMP%\nsbD764.tmp\7z-out\resources\app.asar.unpacked\ (UID: 00000000-00005000) "Waaake_Setup.exe" called "RemoveDirectoryW" with parameter %TEMP%\nsbD764.tmp\7z-out\resources\ (UID: 00000000-00005000) "Waaake_Setup.exe" called "RemoveDirectoryW" with parameter %TEMP%\nsbD764.tmp\7z-out\ (UID: 00000000-00005000) "Waaake_Setup.exe" called "RemoveDirectoryW" with parameter %TEMP%\nsbD764.tmp\ (UID: 00000000-00005000)28:T720,Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "Waaake_Setup.exe") Found reference to API "SetTimer" (Indicator: "SetTimer"; File: "Waaake_Setup.exe") file/memory contains long string with (Indicator: "WaitForSingleObject"; File: "nsExec.dll") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00002028.00000000.90115.70CDF000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00002028.00000000.90115.70CDF000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00004796.00000000.91471.DB88A000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00004796.00000000.91471.DB88A000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00004796.00000000.91471.DB88A000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00004796.00000000.91471.DB88A000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00005988.00000000.91480.DB88A000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00005988.00000000.91480.DB88A000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00005988.00000000.91480.DB88A000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00005988.00000000.91480.DB88A000.00000002.mdmp")29:T4bb,Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "Waaake_Setup.exe") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "Waaake_Setup.exe") file/memory contains long string with (Indicator: "FreeLibrary"; File: "System.dll") file/memory contains long string with (Indicator: "LoadLibrary"; File: "System.dll") Found reference to API "!This program cannot be run in DOS mode.Rich.text`.relocFU(Lf;.h5}3SHELL32SHCreateItemFromParsingNameGlobalFreeGetProcAddressLoadLibraryAKERNEL32.DLLCoCreateInstanceOLE32.DLLWinShell.dllSetLnkAUMIUninstAppUserModelIdUninstShortcut1#1)1?1j12@2I2i2" (Indicator: "LoadLibrary"; File: "WinShell.dll") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00004796.00000000.91471.DB88A000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00004796.00000000.91471.DB88A000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00005988.00000000.91480.DB88A000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00005988.00000000.91480.DB88A000.00000002.mdmp")2a:Taee,"Waaake_Setup.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FILEEXTS\.BIN\OPENWITHPROGIDS") "Waaake_Setup.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\LOCAL SETTINGS\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APPMODEL\PACKAGEREPOSITORY\EXTENSIONS\WINDOWS.FILETYPEASSOCIATION\.BIN") "Waaake_Setup.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FILEEXTS\.BIN") "Waaake_Setup.exe" (Access type: "QUERY"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FILEEXTS\.BIN") "Waaake_Setup.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FILEEXTS\.BIN\") "Waaake_Setup.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FILEEXTS\.BIN\USERCHOICE") "Waaake_Setup.exe" (Access type: "OPEN"; Path: "HKCU\*") "Waaake_Setup.exe" (Access type: "OPEN"; Path: "HKCU\*\SHELLEX\PROPERTYHANDLER") "Waaake_Setup.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\*\SHELLEX\PROPERTYHANDLER") "Waaake_Setup.exe" (Access type: "OPEN"; Path: "HKCU\ALLFILESYSTEMOBJECTS\SHELLEX\PROPERTYHANDLER") "Waaake_Setup.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\ALLFILESYSTEMOBJECTS\SHELLEX\PROPERTYHANDLER") "Waaake_Setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\PROPERTYSYSTEM\SYSTEMPROPERTYHANDLERS") "Waaake_Setup.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\PROPERTYSYSTEM\PROPERTYHANDLERS\.JSON") "Waaake_Setup.exe" (Access type: "OPEN"; Path: "HKCU\.JSON\OPENWITHPROGIDS") "Waaake_Setup.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\.JSON\OPENWITHPROGIDS") "Waaake_Setup.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FILEEXTS\.JSON\OPENWITHPROGIDS") "Waaake_Setup.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\LOCAL SETTINGS\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APPMODEL\PACKAGEREPOSITORY\EXTENSIONS\WINDOWS.FILETYPEASSOCIATION\.JSON") "Waaake_Setup.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FILEEXTS\.JSON") "Waaake_Setup.exe" (Access type: "QUERY"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FILEEXTS\.JSON") "Waaake_Setup.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FILEEXTS\.JSON\") "Waaake_Setup.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FILEEXTS\.JSON\USERCHOICE") "Waaake_Setup.exe" (Access type: "OPEN"; Path: "HKCU\UNKNOWN\SHELLEX\PROPERTYHANDLER") "Waaake_Setup.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\UNKNOWN\SHELLEX\PROPERTYHANDLER")2b:T9e9,"Waaake_Setup.exe" queried SystemProcessInformation at 00000000-00005000-00000C15-366332685 [PID: 5000] "Waaake_Setup.exe" queried SystemProcessInformation at 00000000-00005000-00000C15-366341686 [PID: 5000] "Waaake_Setup.exe" queried SystemProcessInformation at 00000000-00005000-00000C15-366506586 [PID: 5000] "Waaake_Setup.exe" queried SystemProcessInformation at 00000000-00005000-00000C15-366515503 [PID: 5000] "Waaake_Setup.exe" queried SystemProcessInformation at 00000000-00005000-00000C15-367553770 [PID: 5000] "Waaake_Setup.exe" queried SystemProcessInformation at 00000000-00005000-00000C15-367564687 [PID: 5000] "Waaake_Setup.exe" queried SystemProcessInformation at 00000000-00005000-00000C15-367867609 [PID: 5000] "Waaake_Setup.exe" queried SystemProcessInformation at 00000000-00005000-00000C15-367877063 [PID: 5000] "Waaake_Setup.exe" queried SystemProcessInformation at 00000000-00005000-00000C15-385570476 [PID: 5000] "Waaake_Setup.exe" queried SystemProcessInformation at 00000000-00005000-00000C15-385578610 [PID: 5000] "cmd.exe" queried SystemProcessInformation at 00000000-00006292-00000C15-368741952 [PID: 6292] "cmd.exe" queried SystemProcessInformation at 00000000-00006292-00000C15-368751075 [PID: 6292] "cmd.exe" queried SystemProcessInformation at 00000000-00006292-00000C15-368948783 [PID: 6292] "cmd.exe" queried SystemProcessInformation at 00000000-00006292-00000C15-368957808 [PID: 6292] "tasklist.exe" queried SystemProcessInformation at 00000000-00007452-00000C15-369549042 [PID: 7452] "tasklist.exe" queried SystemProcessInformation at 00000000-00007452-00000C15-369558286 [PID: 7452] "tasklist.exe" queried SystemProcessInformation at 00000000-00007452-00000C15-369777255 [PID: 7452] "tasklist.exe" queried SystemProcessInformation at 00000000-00007452-00000C15-369786786 [PID: 7452] "tasklist.exe" queried SystemProcessInformation at 00000000-00007452-00000C15-369921240 [PID: 7452] "tasklist.exe" queried SystemProcessInformation at 00000000-00007452-00000C15-369930891 [PID: 7452] "tasklist.exe" queried SystemProcessInformation at 00000000-00007452-00000C15-370219317 [PID: 7452] "tasklist.exe" queried SystemProcessInformation at 00000000-00007452-00000C15-370227500 [PID: 7452] "waaake.exe" queried SystemProcessInformation at 00000000-00006656-00000C15-398735474 [PID: 6656] "waaake.exe" queried SystemProcessInformation at 00000000-00006656-00000C15-398742999 [PID: 6656] "waaake.exe" queried SystemProcessInformation at 00000000-00006656-00000C15-399016955 [PID: 6656]2c:Ta3c,file/memory contains long string with (Indicator: "fromcharcode"; File: "snapshot_blob.bin") Found reference to API "fromCharCodeU" (Indicator: "fromcharcode"; Source: "00000000-00006656.00000000.89710.00020000.00000002.mdmp") Found reference to API "StringFromCharCode" (Indicator: "fromcharcode"; Source: "00000000-00006656.00000000.89710.00100000.00000004.mdmp, 00000000-00006656.00000000.89710.00160000.00000004.mdmp, 00000000-00006656.00000000.89710.00490000.00000004.mdmp, 00000000-00006656.00000000.89710.004DC000.00000004.mdmp, 00000000-00006656.00000000.89710.0054C000.00000004.mdmp, 00000000-00006656.00000000.89710.014B0000.00000004.mdmp, 00000000-00006656.00000000.89710.01548000.00000004.mdmp, 00000000-00006656.00000001.91631.00100000.00000004.mdmp, 00000000-00006656.00000001.91631.00160000.00000004.mdmp, 00000000-00006656.00000001.91631.00490000.00000004.mdmp, 00000000-00006656.00000001.91631.004DC000.00000004.mdmp, 00000000-00006656.00000001.91631.0054C000.00000004.mdmp, 00000000-00006656.00000001.91631.014B0000.00000004.mdmp") Found reference to API "StringFromCharCodeApply" (Indicator: "fromcharcode"; Source: "00000000-00006656.00000000.89710.00100000.00000004.mdmp, 00000000-00006656.00000000.89710.00348000.00000004.mdmp, 00000000-00006656.00000001.91631.00100000.00000004.mdmp, 00000000-00006656.00000001.91631.00348000.00000004.mdmp") Found reference to API "header[i] = decrypt.decryptByte(header[i]);" (Indicator: ".decrypt"; Source: "00000000-00006656.00000000.89710.00100000.00000004.mdmp, 00000000-00006656.00000001.91631.00100000.00000004.mdmp") Found reference to API "vars.decrypt = decrypt;" (Indicator: ".decrypt"; Source: "00000000-00006656.00000000.89710.00100000.00000004.mdmp, 00000000-00006656.00000001.91631.00100000.00000004.mdmp") Found reference to API "if (vars.decrypt)" (Indicator: ".decrypt"; Source: "00000000-00006656.00000000.89710.00100000.00000004.mdmp, 00000000-00006656.00000001.91631.00100000.00000004.mdmp") Found reference to API "stream = stream.pipe(vars.decrypt.stream());" (Indicator: ".decrypt"; Source: "00000000-00006656.00000000.89710.00100000.00000004.mdmp, 00000000-00006656.00000001.91631.00100000.00000004.mdmp") Found reference to API "Decrypt.prototype.decryptByte = function (c) {" (Indicator: ".decrypt"; Source: "00000000-00006656.00000000.89710.00100000.00000004.mdmp, 00000000-00006656.00000001.91631.00100000.00000004.mdmp") Found reference to API "d[i] = self.decryptByte(d[i]);" (Indicator: ".decrypt"; Source: "00000000-00006656.00000000.89710.00100000.00000004.mdmp, 00000000-00006656.00000001.91631.00100000.00000004.mdmp")2d:T1432,Assembly shows XOR instruction xor eax esp in Stream UID: 00000000-00007452-2726-206-0081E5DB Assembly shows XOR instruction xor ecx esp in Stream UID: 00000000-00007452-2726-206-0081E5DB Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007452-2726-207-0081A0F9 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007452-2726-207-0081A0F9 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007452-2726-212-0081DC98 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007452-2726-212-0081DC98 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007452-2726-217-00818EF4 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007452-2726-217-00818EF4 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007452-2726-229-0081D6EB Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007452-2726-229-0081D6EB Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007452-2726-230-0081C9E1 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007452-2726-230-0081C9E1 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007452-2726-234-00819FFA Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007452-2726-234-00819FFA Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007452-2726-237-0081CCFD Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007452-2726-237-0081CCFD Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007452-2726-281-0081B181 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007452-2726-281-0081B181 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007452-2726-284-0081B2E2 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007452-2726-284-0081B2E2 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007452-2726-285-0081B231 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007452-2726-285-0081B231 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007452-2726-303-0081A98D Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007452-2726-303-0081A98D Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007452-2726-306-0081D9E6 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007452-2726-306-0081D9E6 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007452-2726-307-0081D4B9 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007452-2726-307-0081D4B9 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007452-2726-308-0081D16B Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007452-2726-308-0081D16B Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007452-2726-310-0081CF9F Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007452-2726-310-0081CF9F Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007452-2726-311-0081CE5F Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007452-2726-311-0081CE5F Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007452-2726-325-0081BDC6 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007452-2726-325-0081BDC6 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007452-2726-331-008199A8 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007452-2726-331-008199A8 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007452-2726-333-00812642 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007452-2726-333-00812642 Assembly shows XOR instruction xor eax dword ptr [ebp-0Ch] in Stream UID: 00000000-00007452-2726-337-0081F203 Assembly shows XOR instruction xor dword ptr [ebp-04h] eax in Stream UID: 00000000-00007452-2726-337-0081F203 Assembly shows XOR instruction xor eax dword ptr [ebp-04h] in Stream UID: 00000000-00007452-2726-337-0081F203 Assembly shows XOR instruction xor eax ecx in Stream UID: 00000000-00007452-2726-337-0081F203 Assembly shows XOR instruction xor eax dword ptr [ebp-14h] in Stream UID: 00000000-00007452-2726-337-0081F203 Assembly shows XOR instruction xor ecx eax in Stream UID: 00000000-00007452-2726-337-0081F203 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007452-2726-339-00818750 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007452-2726-339-00818750 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007452-2726-341-008166A0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007452-2726-341-008166A0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007452-2726-347-008135D8 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007452-2726-347-008135D8 Assembly shows XOR instruction xor byte ptr [edx-7AF07500h] al in Stream UID: 00000000-00007452-2726-427-0081843A2e:T415,The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Calls an API typically used to performs encryption on the data Matched sigs: Calls an API typically used to import asymmetric cryptographic keys into a CSP Matched sigs: Reads the cryptographic machine GUID Matched sigs: Able to decrypt/decode data Matched sigs: Able to access crypto-related API (String) Matched sigs: Contains XOR operation loops [Stream disassembly] Matched sigs: YARA signature match - AES encryption Matched sigs: Calls an API typically used to import cryptographic keys into a CSP Matched sigs: Dropped file has high entropy (likely encrypted/compressed content) Matched sigs: Drops image files with high entropy (likely encrypted/compressed content) Matched sigs: YARA signature match – cryptographic algorithms Matched sigs: YARA signature match - ChaCha20 encryption algorithm2f:Tb227,Found XOR loop in file "libGLESv2.dll" at offset 1449038; code bytes = 30d0 Found XOR loop in file "libGLESv2.dll" at offset 1450667; code bytes = 30d0 Found XOR loop in file "libGLESv2.dll" at offset 1577877; code bytes = 30d0 Found XOR loop in file "libGLESv2.dll" at offset 1578840; code bytes = 30d0 Found XOR loop in file "libGLESv2.dll" at offset 1847702; code bytes = 30d0 Found XOR loop in file "libGLESv2.dll" at offset 1972694; code bytes = 30d0 Found XOR loop in file "libGLESv2.dll" at offset 1974006; code bytes = 30d0 Found XOR loop in file "libGLESv2.dll" at offset 1975110; code bytes = 30d0 Found XOR loop in file "libGLESv2.dll" at offset 1976214; code bytes = 30d0 Found XOR loop in file "libGLESv2.dll" at offset 1977318; code bytes = 30d0 Found XOR loop in file "libGLESv2.dll" at offset 1979702; code bytes = 30d0 Found XOR loop in file "libGLESv2.dll" at offset 1988410; code bytes = 30d0 Found XOR loop in file "libGLESv2.dll" at offset 1993910; code bytes = 30d0 Found XOR loop in file "libGLESv2.dll" at offset 1995814; code bytes = 30d0 Found XOR loop in file "libGLESv2.dll" at offset 2983068; code bytes = 30d0 Found XOR loop in file "libGLESv2.dll" at offset 3879964; code bytes = 30d0 Found XOR loop in file "libGLESv2.dll" at offset 4100284; code bytes = 30d0 Found XOR loop in file "libGLESv2.dll" at offset 1371596; code bytes = 33c1 Found XOR loop in file "libGLESv2.dll" at offset 2516215; code bytes = 33c1 Found XOR loop in file "libGLESv2.dll" at offset 2559190; code bytes = 33c1 Found XOR loop in file "libGLESv2.dll" at offset 2559775; code bytes = 33c1 Found XOR loop in file "libGLESv2.dll" at offset 2618911; code bytes = 33c1 Found XOR loop in file "libGLESv2.dll" at offset 3315516; code bytes = 33c1 Found XOR loop in file "libGLESv2.dll" at offset 3344202; code bytes = 33c1 Found XOR loop in file "libGLESv2.dll" at offset 3355963; code bytes = 33c1 Found XOR loop in file "libGLESv2.dll" at offset 4693308; code bytes = 33c1 Found XOR loop in file "libGLESv2.dll" at offset 4751596; code bytes = 33c1 Found XOR loop in file "libGLESv2.dll" at offset 4876575; code bytes = 33c1 Found XOR loop in file "libGLESv2.dll" at offset 403527; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 409075; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 460388; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 464747; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 810712; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 810865; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 880294; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 1288787; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 1465568; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 1511240; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 1536068; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 1633797; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 1653884; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 1654709; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 1699917; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 1784838; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 1914647; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 1959744; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 2063714; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 2063744; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 2072233; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 2105020; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 2488536; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 2488919; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 2513873; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 2515174; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 2515693; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 2515937; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3274261; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3294206; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3428245; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3429113; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3429140; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3429170; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3429200; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3429230; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3429260; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3429290; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3429320; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3429350; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3429380; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3429410; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3429440; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3429470; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3429500; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3429530; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3429560; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3490161; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3490192; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3490226; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3490260; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3490294; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3490328; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3490362; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3490396; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3490430; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3490464; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3490498; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3490532; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3490566; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3490600; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3490634; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3490668; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3491690; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3491721; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3491755; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3491789; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3491823; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3491857; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3491891; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3491925; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3491959; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3491993; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3492027; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3492061; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3492095; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3492129; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3492163; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3492197; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3497009; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3518155; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3518182; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3518212; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3518242; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3518272; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3518302; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3518332; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3518362; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3518392; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3518422; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3518452; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3518482; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3518512; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3518542; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3518572; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3518602; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3529301; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3529796; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3529823; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3529853; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3529883; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3529913; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3529943; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3529973; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3530003; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3530033; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3530063; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3530093; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3530123; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3530153; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3530183; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3530213; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3530243; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3531994; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3575245; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3575571; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3961977; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3964267; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 4020140; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 4020454; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 4021625; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 4027796; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 4038649; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 4119549; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 4194547; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 4412324; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 5020960; code bytes = 8030 Found XOR loop in file "waaake.exe" at offset 2122545; code bytes = 30d0 Found XOR loop in file "waaake.exe" at offset 2927676; code bytes = 30d0 Found XOR loop in file "waaake.exe" at offset 4241804; code bytes = 30d0 Found XOR loop in file "waaake.exe" at offset 4698988; code bytes = 30d0 Found XOR loop in file "waaake.exe" at offset 4705180; code bytes = 30d0 Found XOR loop in file "waaake.exe" at offset 4841804; code bytes = 30d0 Found XOR loop in file "waaake.exe" at offset 2212857; code bytes = 33c1 Found XOR loop in file "waaake.exe" at offset 4211280; code bytes = 33c1 Found XOR loop in file "waaake.exe" at offset 4211488; code bytes = 33c1 Found XOR loop in file "waaake.exe" at offset 4211653; code bytes = 33c1 Found XOR loop in file "waaake.exe" at offset 998180; code bytes = 8030 Found XOR loop in file "waaake.exe" at offset 1051937; code bytes = 8030 Found XOR loop in file "waaake.exe" at offset 2280668; code bytes = 8030 Found XOR loop in file "waaake.exe" at offset 2285340; code bytes = 8030 Found XOR loop in file "waaake.exe" at offset 2676656; code bytes = 8030 Found XOR loop in file "waaake.exe" at offset 2966525; code bytes = 8030 Found XOR loop in file "waaake.exe" at offset 2977239; code bytes = 8030 Found XOR loop in file "waaake.exe" at offset 3318268; code bytes = 8030 Found XOR loop in file "waaake.exe" at offset 3359373; code bytes = 8030 Found XOR loop in file "waaake.exe" at offset 3409705; code bytes = 8030 Found XOR loop in file "waaake.exe" at offset 3423112; code bytes = 8030 Found XOR loop in file "waaake.exe" at offset 3604028; code bytes = 8030 Found XOR loop in file "waaake.exe" at offset 4193068; code bytes = 8030 Found XOR loop in file "waaake.exe" at offset 4303744; code bytes = 8030 Found XOR loop in file "waaake.exe" at offset 4507698; code bytes = 8030 Found XOR loop in file "waaake.exe" at offset 4516428; code bytes = 8030 Found XOR loop in file "waaake.exe" at offset 4584592; code bytes = 8030 Found XOR loop in file "waaake.exe" at offset 4611552; code bytes = 8030 Found XOR loop in file "waaake.exe" at offset 4728160; code bytes = 8030 Found XOR loop in file "waaake.exe" at offset 4728338; code bytes = 8030 Found XOR loop in file "waaake.exe" at offset 4742068; code bytes = 8030 Found XOR loop in file "waaake.exe" at offset 5030443; code bytes = 8030 Found XOR loop in file "waaake.exe" at offset 5040162; code bytes = 8030 Found XOR loop in file "waaake.exe" at offset 5046337; code bytes = 8030 Found XOR loop in file "waaake.exe" at offset 5052526; code bytes = 8030 Found XOR loop in file "waaake.exe" at offset 5060485; code bytes = 8030 Found XOR loop in file "waaake.exe" at offset 5068444; code bytes = 8030 Found XOR loop in file "waaake.exe" at offset 5076348; code bytes = 8030 Found XOR loop in file "waaake.exe" at offset 5084307; code bytes = 8030 Found XOR loop in file "waaake.exe" at offset 5092266; code bytes = 8030 Found XOR loop in file "waaake.exe" at offset 5100225; code bytes = 8030 Found XOR loop in file "waaake.exe" at offset 5108129; code bytes = 8030 Found XOR loop in file "waaake.exe" at offset 5116088; code bytes = 8030 Found XOR loop in file "waaake.exe" at offset 5124047; code bytes = 8030 Found XOR loop in file "waaake.exe" at offset 5127999; code bytes = 8030 Found XOR loop in file "waaake.exe" at offset 5136090; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 95155; code bytes = 30d0 Found XOR loop in file "installer.exe" at offset 431034; code bytes = 30d0 Found XOR loop in file "installer.exe" at offset 451892; code bytes = 30d0 Found XOR loop in file "installer.exe" at offset 474907; code bytes = 30d0 Found XOR loop in file "installer.exe" at offset 579091; code bytes = 30d0 Found XOR loop in file "installer.exe" at offset 744330; code bytes = 30d0 Found XOR loop in file "installer.exe" at offset 850415; code bytes = 30d0 Found XOR loop in file "installer.exe" at offset 889637; code bytes = 30d0 Found XOR loop in file "installer.exe" at offset 966219; code bytes = 30d0 Found XOR loop in file "installer.exe" at offset 1057078; code bytes = 30d0 Found XOR loop in file "installer.exe" at offset 1129475; code bytes = 30d0 Found XOR loop in file "installer.exe" at offset 1286766; code bytes = 30d0 Found XOR loop in file "installer.exe" at offset 1320588; code bytes = 30d0 Found XOR loop in file "installer.exe" at offset 1358067; code bytes = 30d0 Found XOR loop in file "installer.exe" at offset 1371279; code bytes = 30d0 Found XOR loop in file "installer.exe" at offset 1426912; code bytes = 30d0 Found XOR loop in file "installer.exe" at offset 1496788; code bytes = 30d0 Found XOR loop in file "installer.exe" at offset 1535894; code bytes = 30d0 Found XOR loop in file "installer.exe" at offset 1539357; code bytes = 30d0 Found XOR loop in file "installer.exe" at offset 1540396; code bytes = 30d0 Found XOR loop in file "installer.exe" at offset 1561150; code bytes = 30d0 Found XOR loop in file "installer.exe" at offset 1600235; code bytes = 30d0 Found XOR loop in file "installer.exe" at offset 1637415; code bytes = 30d0 Found XOR loop in file "installer.exe" at offset 1662615; code bytes = 30d0 Found XOR loop in file "installer.exe" at offset 1785062; code bytes = 30d0 Found XOR loop in file "installer.exe" at offset 1792680; code bytes = 30d0 Found XOR loop in file "installer.exe" at offset 1882966; code bytes = 30d0 Found XOR loop in file "installer.exe" at offset 2015621; code bytes = 30d0 Found XOR loop in file "installer.exe" at offset 2151690; code bytes = 30d0 Found XOR loop in file "installer.exe" at offset 2372531; code bytes = 30d0 Found XOR loop in file "installer.exe" at offset 2403675; code bytes = 30d0 Found XOR loop in file "installer.exe" at offset 2670034; code bytes = 30d0 Found XOR loop in file "installer.exe" at offset 2762053; code bytes = 30d0 Found XOR loop in file "installer.exe" at offset 2904163; code bytes = 30d0 Found XOR loop in file "installer.exe" at offset 2971410; code bytes = 30d0 Found XOR loop in file "installer.exe" at offset 2992424; code bytes = 30d0 Found XOR loop in file "installer.exe" at offset 3086942; code bytes = 30d0 Found XOR loop in file "installer.exe" at offset 3202231; code bytes = 30d0 Found XOR loop in file "installer.exe" at offset 3276629; code bytes = 30d0 Found XOR loop in file "installer.exe" at offset 3284090; code bytes = 30d0 Found XOR loop in file "installer.exe" at offset 3310423; code bytes = 30d0 Found XOR loop in file "installer.exe" at offset 3380698; code bytes = 30d0 Found XOR loop in file "installer.exe" at offset 3398251; code bytes = 30d0 Found XOR loop in file "installer.exe" at offset 3502514; code bytes = 30d0 Found XOR loop in file "installer.exe" at offset 3512345; code bytes = 30d0 Found XOR loop in file "installer.exe" at offset 3588441; code bytes = 30d0 Found XOR loop in file "installer.exe" at offset 3660487; code bytes = 30d0 Found XOR loop in file "installer.exe" at offset 3745259; code bytes = 30d0 Found XOR loop in file "installer.exe" at offset 3754105; code bytes = 30d0 Found XOR loop in file "installer.exe" at offset 3800462; code bytes = 30d0 Found XOR loop in file "installer.exe" at offset 3805994; code bytes = 30d0 Found XOR loop in file "installer.exe" at offset 3843337; code bytes = 30d0 Found XOR loop in file "installer.exe" at offset 3922511; code bytes = 30d0 Found XOR loop in file "installer.exe" at offset 3983782; code bytes = 30d0 Found XOR loop in file "installer.exe" at offset 4007708; code bytes = 30d0 Found XOR loop in file "installer.exe" at offset 4019275; code bytes = 30d0 Found XOR loop in file "installer.exe" at offset 4058647; code bytes = 30d0 Found XOR loop in file "installer.exe" at offset 4098014; code bytes = 30d0 Found XOR loop in file "installer.exe" at offset 4098714; code bytes = 30d0 Found XOR loop in file "installer.exe" at offset 4186075; code bytes = 30d0 Found XOR loop in file "installer.exe" at offset 4223868; code bytes = 30d0 Found XOR loop in file "installer.exe" at offset 4301110; code bytes = 30d0 Found XOR loop in file "installer.exe" at offset 4469385; code bytes = 30d0 Found XOR loop in file "installer.exe" at offset 4843241; code bytes = 30d0 Found XOR loop in file "installer.exe" at offset 4952388; code bytes = 30d0 Found XOR loop in file "installer.exe" at offset 5121712; code bytes = 30d0 Found XOR loop in file "installer.exe" at offset 5176500; code bytes = 30d0 Found XOR loop in file "installer.exe" at offset 86181; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 116001; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 142133; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 164300; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 207754; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 257982; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 262604; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 303728; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 435875; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 563699; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 584522; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 811127; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 841740; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 975194; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 1006018; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 1094850; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 1199067; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 1222335; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 1305818; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 1423456; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 1465531; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 1500222; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 1554560; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 1672334; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 1852377; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 1919027; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 1998025; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 1998484; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 2008937; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 2052561; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 2056616; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 2154029; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 2261305; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 2339822; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 2482099; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 2525139; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 2577623; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 2634767; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 2703230; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 2857557; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 2861567; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 2861628; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 2994059; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 3127667; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 3209024; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 3339674; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 3389467; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 3595988; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 3597008; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 3664568; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 3824652; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 3988399; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 4014024; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 4062783; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 4063066; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 4066688; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 4074361; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 4104385; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 4355615; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 4575655; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 4637948; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 4653970; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 4655810; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 4794099; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 4810028; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 4812505; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 4868842; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 5030655; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 5043218; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 5132165; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 5140004; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 5166373; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 46989; code bytes = 30040e Found XOR loop in file "installer.exe" at offset 4622797; code bytes = 30040e Found XOR loop in file "installer.exe" at offset 160092; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 162487; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 177182; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 370291; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 461479; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 704358; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 800001; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 911072; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 1009371; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 1145509; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 1401863; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 1497362; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 1532172; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 1684593; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 1715000; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 1773403; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 1815194; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 1866660; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 1936579; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 2001427; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 2008800; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 2159108; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 2197536; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 2288987; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 2343058; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 2397168; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 2418669; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 2531908; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 2540956; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 2576693; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 2689547; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 2724319; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 2747593; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 2765954; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 2774341; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 2776198; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 2825305; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 2943673; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 3026855; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 3048932; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 3078605; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 3122753; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 3271929; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 3332211; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 3407224; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 3475161; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 3496982; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 3564979; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 3618860; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 3626278; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 3660486; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 3676542; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 3844295; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 3871410; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 3914126; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 3974966; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 4000833; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 4052274; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 4112058; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 4123608; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 4192603; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 4219789; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 4246823; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 4275414; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 4315925; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 4349892; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 4466369; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 4521971; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 4569663; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 4589694; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 4609568; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 4660429; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 4748599; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 4815896; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 4876331; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 4901529; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 4959706; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 5124670; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 5161610; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 5200856; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 5214951; code bytes = 8030 Found XOR loop in file "vk_swiftshader.dll" at offset 774764; code bytes = 30d0 Found XOR loop in file "vk_swiftshader.dll" at offset 797996; code bytes = 30d0 Found XOR loop in file "vk_swiftshader.dll" at offset 2139148; code bytes = 30d0 Found XOR loop in file "vk_swiftshader.dll" at offset 2195342; code bytes = 30d0 Found XOR loop in file "vk_swiftshader.dll" at offset 2196202; code bytes = 30d0 Found XOR loop in file "vk_swiftshader.dll" at offset 2196527; code bytes = 30d0 Found XOR loop in file "vk_swiftshader.dll" at offset 3633641; code bytes = 30d0 Found XOR loop in file "vk_swiftshader.dll" at offset 3633719; code bytes = 30d0 Found XOR loop in file "vk_swiftshader.dll" at offset 4565240; code bytes = 30d0 Found XOR loop in file "vk_swiftshader.dll" at offset 528651; code bytes = 33c1 Found XOR loop in file "vk_swiftshader.dll" at offset 3992896; code bytes = 33c1 Found XOR loop in file "vk_swiftshader.dll" at offset 4051896; code bytes = 33c1 Found XOR loop in file "vk_swiftshader.dll" at offset 314444; code bytes = 8030 Found XOR loop in file "vk_swiftshader.dll" at offset 730516; code bytes = 8030 Found XOR loop in file "vk_swiftshader.dll" at offset 730569; code bytes = 8030 Found XOR loop in file "vk_swiftshader.dll" at offset 749868; code bytes = 8030 Found XOR loop in file "vk_swiftshader.dll" at offset 1613500; code bytes = 8030 Found XOR loop in file "vk_swiftshader.dll" at offset 1745095; code bytes = 8030 Found XOR loop in file "vk_swiftshader.dll" at offset 1746040; code bytes = 8030 Found XOR loop in file "vk_swiftshader.dll" at offset 1769256; code bytes = 8030 Found XOR loop in file "vk_swiftshader.dll" at offset 1772047; code bytes = 8030 Found XOR loop in file "vk_swiftshader.dll" at offset 1802911; code bytes = 8030 Found XOR loop in file "vk_swiftshader.dll" at offset 2159512; code bytes = 8030 Found XOR loop in file "vk_swiftshader.dll" at offset 2159603; code bytes = 8030 Found XOR loop in file "vk_swiftshader.dll" at offset 2294503; code bytes = 8030 Found XOR loop in file "vk_swiftshader.dll" at offset 2327976; code bytes = 8030 Found XOR loop in file "vk_swiftshader.dll" at offset 2328155; code bytes = 8030 Found XOR loop in file "vk_swiftshader.dll" at offset 2482640; code bytes = 8030 Found XOR loop in file "vk_swiftshader.dll" at offset 2482827; code bytes = 8030 Found XOR loop in file "vk_swiftshader.dll" at offset 2483166; code bytes = 8030 Found XOR loop in file "vk_swiftshader.dll" at offset 2483339; code bytes = 8030 Found XOR loop in file "vk_swiftshader.dll" at offset 2932945; code bytes = 8030 Found XOR loop in file "vk_swiftshader.dll" at offset 2985205; code bytes = 8030 Found XOR loop in file "vk_swiftshader.dll" at offset 2988528; code bytes = 8030 Found XOR loop in file "vk_swiftshader.dll" at offset 2989712; code bytes = 8030 Found XOR loop in file "vk_swiftshader.dll" at offset 3857273; code bytes = 8030 Found XOR loop in file "vk_swiftshader.dll" at offset 4471907; code bytes = 8030 Found XOR loop in file "vk_swiftshader.dll" at offset 4536793; code bytes = 8030 Found XOR loop in file "vk_swiftshader.dll" at offset 4536801; code bytes = 8030 Found XOR loop in file "vk_swiftshader.dll" at offset 4536825; code bytes = 8030 Found XOR loop in file "ffmpeg.dll" at offset 2870907; code bytes = 30d0 Found XOR loop in file "ffmpeg.dll" at offset 2910436; code bytes = 30d0 Found XOR loop in file "ffmpeg.dll" at offset 2937924; code bytes = 30d0 Found XOR loop in file "ffmpeg.dll" at offset 753024; code bytes = 33c1 Found XOR loop in file "ffmpeg.dll" at offset 897988; code bytes = 33c1 Found XOR loop in file "ffmpeg.dll" at offset 928319; code bytes = 33c1 Found XOR loop in file "ffmpeg.dll" at offset 982585; code bytes = 33c1 Found XOR loop in file "ffmpeg.dll" at offset 1140539; code bytes = 33c1 Found XOR loop in file "ffmpeg.dll" at offset 1240416; code bytes = 33c1 Found XOR loop in file "ffmpeg.dll" at offset 1240517; code bytes = 33c1 Found XOR loop in file "ffmpeg.dll" at offset 1240595; code bytes = 33c1 Found XOR loop in file "ffmpeg.dll" at offset 1658564; code bytes = 33c1 Found XOR loop in file "ffmpeg.dll" at offset 1679556; code bytes = 33c1 Found XOR loop in file "ffmpeg.dll" at offset 1683252; code bytes = 33c1 Found XOR loop in file "ffmpeg.dll" at offset 1686948; code bytes = 33c1 Found XOR loop in file "ffmpeg.dll" at offset 1707608; code bytes = 33c1 Found XOR loop in file "ffmpeg.dll" at offset 2113440; code bytes = 33c1 Found XOR loop in file "ffmpeg.dll" at offset 2121664; code bytes = 33c1 Found XOR loop in file "ffmpeg.dll" at offset 2133931; code bytes = 33c1 Found XOR loop in file "ffmpeg.dll" at offset 2970844; code bytes = 33c1 Found XOR loop in file "ffmpeg.dll" at offset 19447; code bytes = 8030 Found XOR loop in file "ffmpeg.dll" at offset 19696; code bytes = 8030 Found XOR loop in file "ffmpeg.dll" at offset 39447; code bytes = 8030 Found XOR loop in file "ffmpeg.dll" at offset 39696; code bytes = 8030 Found XOR loop in file "ffmpeg.dll" at offset 59591; code bytes = 8030 Found XOR loop in file "ffmpeg.dll" at offset 59816; code bytes = 8030 Found XOR loop in file "ffmpeg.dll" at offset 78311; code bytes = 8030 Found XOR loop in file "ffmpeg.dll" at offset 78536; code bytes = 8030 Found XOR loop in file "ffmpeg.dll" at offset 97303; code bytes = 8030 Found XOR loop in file "ffmpeg.dll" at offset 97528; code bytes = 8030 Found XOR loop in file "ffmpeg.dll" at offset 116023; code bytes = 8030 Found XOR loop in file "ffmpeg.dll" at offset 116248; code bytes = 8030 Found XOR loop in file "ffmpeg.dll" at offset 1089546; code bytes = 8030 Found XOR loop in file "ffmpeg.dll" at offset 1425194; code bytes = 8030 Found XOR loop in file "ffmpeg.dll" at offset 1425577; code bytes = 8030 Found XOR loop in file "ffmpeg.dll" at offset 1510707; code bytes = 8030 Found XOR loop in file "ffmpeg.dll" at offset 1674675; code bytes = 8030 Found XOR loop in file "ffmpeg.dll" at offset 1676812; code bytes = 8030 Found XOR loop in file "ffmpeg.dll" at offset 1676867; code bytes = 8030 Found XOR loop in file "ffmpeg.dll" at offset 2451907; code bytes = 8030 Found XOR loop in file "ffmpeg.dll" at offset 2912780; code bytes = 8030 Found XOR loop in file "ffmpeg.dll" at offset 2936076; code bytes = 8030 Found XOR loop in file "vulkan-1.dll" at offset 126524; code bytes = 30d0 Found XOR loop in file "vulkan-1.dll" at offset 872312; code bytes = 30d0 Found XOR loop in file "vulkan-1.dll" at offset 872360; code bytes = 30d0 Found XOR loop in file "vulkan-1.dll" at offset 872528; code bytes = 30d0 Found XOR loop in file "vulkan-1.dll" at offset 884504; code bytes = 30d0 Found XOR loop in file "vulkan-1.dll" at offset 368592; code bytes = 33c1 Found XOR loop in file "vulkan-1.dll" at offset 12929; code bytes = 8030 Found XOR loop in file "vulkan-1.dll" at offset 30529; code bytes = 8030 Found XOR loop in file "vulkan-1.dll" at offset 78603; code bytes = 8030 Found XOR loop in file "vulkan-1.dll" at offset 83474; code bytes = 8030 Found XOR loop in file "vulkan-1.dll" at offset 86898; code bytes = 8030 Found XOR loop in file "vulkan-1.dll" at offset 90322; code bytes = 8030 Found XOR loop in file "vulkan-1.dll" at offset 94146; code bytes = 8030 Found XOR loop in file "vulkan-1.dll" at offset 101346; code bytes = 8030 Found XOR loop in file "vulkan-1.dll" at offset 104850; code bytes = 8030 Found XOR loop in file "vulkan-1.dll" at offset 108274; code bytes = 8030 Found XOR loop in file "vulkan-1.dll" at offset 111698; code bytes = 8030 Found XOR loop in file "vulkan-1.dll" at offset 114770; code bytes = 8030 Found XOR loop in file "vulkan-1.dll" at offset 118018; code bytes = 8030 Found XOR loop in file "vulkan-1.dll" at offset 121442; code bytes = 8030 Found XOR loop in file "vulkan-1.dll" at offset 139158; code bytes = 8030 Found XOR loop in file "vulkan-1.dll" at offset 144469; code bytes = 8030 Found XOR loop in file "vulkan-1.dll" at offset 144609; code bytes = 8030 Found XOR loop in file "vulkan-1.dll" at offset 174504; code bytes = 8030 Found XOR loop in file "vulkan-1.dll" at offset 174738; code bytes = 8030 Found XOR loop in file "vulkan-1.dll" at offset 175029; code bytes = 8030 Found XOR loop in file "vulkan-1.dll" at offset 175632; code bytes = 8030 Found XOR loop in file "vulkan-1.dll" at offset 175758; code bytes = 8030 Found XOR loop in file "vulkan-1.dll" at offset 183194; code bytes = 8030 Found XOR loop in file "vulkan-1.dll" at offset 219554; code bytes = 8030 Found XOR loop in file "vulkan-1.dll" at offset 222626; code bytes = 8030 Found XOR loop in file "vulkan-1.dll" at offset 225602; code bytes = 8030 Found XOR loop in file "vulkan-1.dll" at offset 230002; code bytes = 8030 Found XOR loop in file "vulkan-1.dll" at offset 232594; code bytes = 8030 Found XOR loop in file "vulkan-1.dll" at offset 236338; code bytes = 8030 Found XOR loop in file "vulkan-1.dll" at offset 241498; code bytes = 8030 Found XOR loop in file "vulkan-1.dll" at offset 241826; code bytes = 8030 Found XOR loop in file "libEGL.dll" at offset 374832; code bytes = 30d0 Found XOR loop in file "libEGL.dll" at offset 125472; code bytes = 33c1 Found XOR loop in file "libEGL.dll" at offset 276919; code bytes = 33c1 Found XOR loop in file "nsis7z.dll" at offset 377388; code bytes = 30d0 Found XOR loop in file "nsis7z.dll" at offset 423495; code bytes = 30d0 Found XOR loop in file "nsis7z.dll" at offset 429493; code bytes = 30d0 Found XOR loop in file "nsis7z.dll" at offset 430733; code bytes = 30d0 Found XOR loop in file "nsis7z.dll" at offset 432095; code bytes = 30d0 Found XOR loop in file "nsis7z.dll" at offset 433473; code bytes = 30d0 Found XOR loop in file "nsis7z.dll" at offset 14196; code bytes = 33c1 Found XOR loop in file "nsis7z.dll" at offset 32458; code bytes = 33c1 Found XOR loop in file "nsis7z.dll" at offset 32489; code bytes = 33c1 Found XOR loop in file "nsis7z.dll" at offset 32520; code bytes = 33c1 Found XOR loop in file "nsis7z.dll" at offset 39010; code bytes = 33c1 Found XOR loop in file "nsis7z.dll" at offset 66588; code bytes = 33c1 Found XOR loop in file "nsis7z.dll" at offset 118788; code bytes = 33c1 Found XOR loop in file "nsis7z.dll" at offset 266651; code bytes = 33c1 Found XOR loop in file "nsis7z.dll" at offset 274623; code bytes = 33c1 Found XOR loop in file "nsis7z.dll" at offset 274752; code bytes = 33c1 Found XOR loop in file "nsis7z.dll" at offset 417293; code bytes = 33c1 Found XOR loop in file "nsis7z.dll" at offset 16577; code bytes = 8030 Found XOR loop in file "nsis7z.dll" at offset 423456; code bytes = 8030 Found XOR loop in file "nsis7z.dll" at offset 424610; code bytes = 8030 Found XOR loop in file "nsis7z.dll" at offset 427782; code bytes = 8030 Found XOR loop in file "nsis7z.dll" at offset 428606; code bytes = 8030 Found XOR loop in file "nsis7z.dll" at offset 429474; code bytes = 8030 Found XOR loop in file "nsis7z.dll" at offset 430714; code bytes = 8030 Found XOR loop in file "Uninstall waaake.exe" at offset 91979; code bytes = 30d0 Found XOR loop in file "Uninstall waaake.exe" at offset 83005; code bytes = 33c1 Found XOR loop in file "Uninstall waaake.exe" at offset 112825; code bytes = 33c1 Found XOR loop in file "Uninstall waaake.exe" at offset 134338; code bytes = 33c1 Found XOR loop in file "Uninstall waaake.exe" at offset 46989; code bytes = 30040e Found XOR loop in file "Uninstall waaake.exe" at offset 66541; code bytes = 8030 Found XOR loop in file "elevate.exe" at offset 104839; code bytes = 30d0 Found XOR loop in file "elevate.exe" at offset 9341; code bytes = 8030 Found XOR loop in file "elevate.exe" at offset 38220; code bytes = 8030 Found XOR loop in file "elevate.exe" at offset 38617; code bytes = 8030 Found XOR loop in file "StdUtils.dll" at offset 101399; code bytes = 30d0 Found XOR loop in file "StdUtils.dll" at offset 2707; code bytes = 33c1 Found XOR loop in file "StdUtils.dll" at offset 2896; code bytes = 33c1 Found XOR loop in file "StdUtils.dll" at offset 3088; code bytes = 33c1 Found XOR loop in file "StdUtils.dll" at offset 30152; code bytes = 33c1 Found XOR loop in file "StdUtils.dll" at offset 30569; code bytes = 33c1 Found XOR loop in file "StdUtils.dll" at offset 34552; code bytes = 33c1 Found XOR loop in file "StdUtils.dll" at offset 34557; code bytes = 33c1 Found XOR loop in file "StdUtils.dll" at offset 34719; code bytes = 33c1 Found XOR loop in file "StdUtils.dll" at offset 37953; code bytes = 33c1 Found XOR loop in file "StdUtils.dll" at offset 37960; code bytes = 33c1 Found XOR loop in file "StdUtils.dll" at offset 40217; code bytes = 33c1 Found XOR loop in file "StdUtils.dll" at offset 43107; code bytes = 33c1 Found XOR loop in file "StdUtils.dll" at offset 43120; code bytes = 33c1 Found XOR loop in file "StdUtils.dll" at offset 101360; code bytes = 8030 Found XOR loop in file "SpiderBanner.dll" at offset 3377; code bytes = 8030 Found XOR loop in file "SpiderBanner.dll" at offset 3457; code bytes = 8030 Found XOR loop in file "SpiderBanner.dll" at offset 3642; code bytes = 803030:T5b4,Found string "const mkdir = require('../mkdirs')" (Indicator: "mkdir "; Source: "00000000-00006656.00000000.89710.00100000.00000004.mdmp, 00000000-00006656.00000000.89710.00200000.00000004.mdmp, 00000000-00006656.00000001.91631.00100000.00000004.mdmp") Found string "if (srcStat.isDirectory() && !destStat.isDirectory()) {" (Indicator: "isdirectory()"; Source: "00000000-00006656.00000000.89710.00200000.00000004.mdmp"), Found string "if (!srcStat.isDirectory() && destStat.isDirectory()) {" (Indicator: "isdirectory()"; Source: "00000000-00006656.00000000.89710.00200000.00000004.mdmp"), Found string "if (srcStat.isDirectory() && isSrcSubdir(src, dest)) {" (Indicator: "isdirectory()"; Source: "00000000-00006656.00000000.89710.00200000.00000004.mdmp"), Found string "if (srcStat.isDirectory()) return onDir(srcStat, destStat, src, dest, opts)" (Indicator: "isdirectory()"; Source: "00000000-00006656.00000000.89710.00200000.00000004.mdmp 00000000-00006656.00000001.91631.000E0000.00000004.mdmp"), Found string "if (dirStats.isDirectory()) {" (Indicator: "isdirectory()"; Source: "00000000-00006656.00000000.89710.00200000.00000004.mdmp"), Found string "if (!fs.statSync(dir).isDirectory()) {" (Indicator: "isdirectory()"; Source: "00000000-00006656.00000000.89710.00200000.00000004.mdmp"), Found string "return (stats && stats.isDirectory()) ? 'dir' : 'file'" (Indicator: "isdirectory()"; Source: "00000000-00006656.00000000.89710.00200000.00000004.mdmp")31:T1348,file/memory contains long string with (Indicator: "github.com"; File: "package.json") Found string "// https://github.com/golang/go/blob/master/src/archive/zip/reader.go#L503" (Indicator: "github.com"; Source: "00000000-00006656.00000000.89710.00040000.00000004.mdmp, 00000000-00006656.00000000.89710.00100000.00000004.mdmp, 00000000-00006656.00000001.91631.00100000.00000004.mdmp") Found string ""url": "https://github.com/calvinmetcalf/process-nextick-args.git"" (Indicator: "github.com"; Source: "00000000-00006656.00000000.89710.000BC000.00000004.mdmp, 00000000-00006656.00000001.91631.00098000.00000004.mdmp") Found string ""homepage": "https://github.com/calvinmetcalf/process-nextick-args"," (Indicator: "github.com"; Source: "00000000-00006656.00000000.89710.000BC000.00000004.mdmp, 00000000-00006656.00000001.91631.00098000.00000004.mdmp") Found string ""url": "git://github.com/TooTallNate/util-deprecate.git"" (Indicator: "github.com"; Source: "00000000-00006656.00000000.89710.000BC000.00000004.mdmp, 00000000-00006656.00000001.91631.00098000.00000004.mdmp") Found string ""homepage": "https://github.com/TooTallNate/util-deprecate"" (Indicator: "github.com"; Source: "00000000-00006656.00000000.89710.000BC000.00000004.mdmp, 00000000-00006656.00000001.91631.00098000.00000004.mdmp") Found string ""url": "git@github.com:jprichardson/node-jsonfile.git"" (Indicator: "github.com"; Source: "00000000-00006656.00000000.89710.000F4000.00000004.mdmp, 00000000-00006656.00000001.91631.000F4000.00000004.mdmp") Found string "https://github.com/nodejs/node/issues" (Indicator: "github.com"; Source: "00000000-00006656.00000000.89710.00100000.00000004.mdmp, 00000000-00006656.00000001.91631.00100000.00000004.mdmp") Found string ""homepage": "https://github.com/feross/safe-buffer"," (Indicator: "github.com"; Source: "00000000-00006656.00000000.89710.0010C000.00000004.mdmp, 00000000-00006656.00000001.91631.0010C000.00000004.mdmp") Found string ""url": "git://github.com/feross/safe-buffer.git"" (Indicator: "github.com"; Source: "00000000-00006656.00000000.89710.0010C000.00000004.mdmp, 00000000-00006656.00000001.91631.0010C000.00000004.mdmp") Found string ""url": "git://github.com/nodejs/readable-stream"" (Indicator: "github.com"; Source: "00000000-00006656.00000000.89710.0010C000.00000004.mdmp, 00000000-00006656.00000000.89710.0054C000.00000004.mdmp, 00000000-00006656.00000001.91631.0010C000.00000004.mdmp, 00000000-00006656.00000001.91631.0054C000.00000004.mdmp") Found string ""url": "http://github.com/broofa/node-int64"," (Indicator: "github.com"; Source: "00000000-00006656.00000000.89710.00130000.00000004.mdmp, 00000000-00006656.00000001.91631.00130000.00000004.mdmp") Found string ""url": "https://github.com/broofa/node-int64"" (Indicator: "github.com"; Source: "00000000-00006656.00000000.89710.00130000.00000004.mdmp, 00000000-00006656.00000001.91631.00130000.00000004.mdmp") Found string ""homepage": "https://github.com/felixge/node-combined-stream"," (Indicator: "github.com"; Source: "00000000-00006656.00000000.89710.00140000.00000004.mdmp, 00000000-00006656.00000001.91631.00140000.00000004.mdmp") Found string ""url": "git://github.com/felixge/node-combined-stream.git"" (Indicator: "github.com"; Source: "00000000-00006656.00000000.89710.00140000.00000004.mdmp, 00000000-00006656.00000001.91631.00140000.00000004.mdmp") Found string ""homepage": "https://github.com/felixge/node-delayed-stream"," (Indicator: "github.com"; Source: "00000000-00006656.00000000.89710.00140000.00000004.mdmp, 00000000-00006656.00000001.91631.00140000.00000004.mdmp") Found string ""url": "git://github.com/felixge/node-delayed-stream.git"" (Indicator: "github.com"; Source: "00000000-00006656.00000000.89710.00140000.00000004.mdmp, 00000000-00006656.00000001.91631.00140000.00000004.mdmp") Found string ""url": "https://github.com/Rob--W/proxy-from-env.git"" (Indicator: "github.com"; Source: "00000000-00006656.00000000.89710.00140000.00000004.mdmp, 00000000-00006656.00000001.91631.00140000.00000004.mdmp") Found string ""homepage": "https://github.com/Rob--W/proxy-from-env#readme"," (Indicator: "github.com"; Source: "00000000-00006656.00000000.89710.00140000.00000004.mdmp, 00000000-00006656.00000001.91631.00140000.00000004.mdmp") Found string ""homepage": "https://github.com/RyanZim/universalify#readme"," (Indicator: "github.com"; Source: "00000000-00006656.00000000.89710.00140000.00000004.mdmp, 00000000-00006656.00000001.91631.00140000.00000004.mdmp") Found string ""url": "git+https://github.com/RyanZim/universalify.git"" (Indicator: "github.com"; Source: "00000000-00006656.00000000.89710.00140000.00000004.mdmp, 00000000-00006656.00000001.91631.00140000.00000004.mdmp") Found string ""url": "https://github.com/isaacs/node-graceful-fs"" (Indicator: "github.com"; Source: "00000000-00006656.00000000.89710.00140000.00000004.mdmp, 00000000-00006656.00000001.91631.00140000.00000004.mdmp")32:T728,Found reference to API "SendMessageW" (Indicator: "sendmessage"; File: "Waaake_Setup.exe") Found reference to API "FindWindowExW" (Indicator: "findwindow"; File: "Waaake_Setup.exe") Found reference to API "SendMessageTimeoutW" (Indicator: "sendmessage"; File: "Waaake_Setup.exe") file/memory contains long string with (Indicator: "sendmessage"; File: "nsis7z.dll") file/memory contains long string with (Indicator: "sendmessage"; File: "Uninstall waaake.exe") file/memory contains long string with (Indicator: "sendmessage"; File: "SpiderBanner.dll") file/memory contains long string with (Indicator: "sendmessage"; File: "nsExec.dll") Found reference to API "PostMessageW" (Indicator: "postmessage"; Source: "00000000-00006656-00000C2C-400011003") Found reference to API "EnumWindows" (Indicator: "enumwindows"; Source: "00000000-00006656-00000C2C-407125537") Found reference to API "EnumWindowsW" (Indicator: "enumwindows"; Source: "00000000-00004796-00000C2C-434932659") Found reference to API "postMessageToThread" (Indicator: "postmessage"; Source: "00000000-00006656.00000000.89710.004A8000.00000004.mdmp, 00000000-00006656.00000000.89710.004B4000.00000004.mdmp, 00000000-00006656.00000000.89710.004CC000.00000004.mdmp, 00000000-00006656.00000000.89710.004DC000.00000004.mdmp, 00000000-00006656.00000001.91631.004A8000.00000004.mdmp, 00000000-00006656.00000001.91631.004B4000.00000004.mdmp, 00000000-00006656.00000001.91631.004CC000.00000004.mdmp, 00000000-00006656.00000001.91631.004DC000.00000004.mdmp") Found reference to API "sendMessageToWorker" (Indicator: "sendmessage"; Source: "00000000-00006656.00000000.89710.004B4000.00000004.mdmp, 00000000-00006656.00000000.89710.004DC000.00000004.mdmp, 00000000-00006656.00000001.91631.004B4000.00000004.mdmp, 00000000-00006656.00000001.91631.004DC000.00000004.mdmp")33:T31ae,"Waaake_Setup.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005000) "Waaake_Setup.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005000) "Waaake_Setup.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000002f0116e1a57420f22f0118f22f0124f22f010200000080f6f97330f22f01aaeca5740200000000000000e4474d72b6eca574db3ef91b68f22f017de0a57464e0a574833ef91be4474d7205000000f09d4d720000000075e24d7286e24d72e8f22f01802ba8748b8a646efeffffff74f22f01e0dfa57420024f7284f22f0149d94e72c064517220024f7290f22f0163d94e7220024f72b4f22f01fa9d4d72010000000100000037060a77010000000b2ea67406000000dad84e72f8f22f01eecf4e72c4dc4e72e2cf4e72fc2b5477010000000100000000000000352c46dd18000000f4f22f0132ba0c77a068517200000000000000000000000008f32f01 (UID: 00000000-00005000) "Waaake_Setup.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000ffff0000000010d02f0138cf0b77bc393e037cd02f010100000070393e03bc393e0370393e03040000000400000000e00474001000007cd02f010100000070393e03cd970b779c970b770d0c46ddb50ffb7370393e0300000b77000000007c12d5720000000080ee0174010000001b800800f8e2047400000000040000000000000048400374f8e2047480d02f0180e8527410a03e0380e852747cd02f010000000080e85274a8d02f011b80080030d12f0158060000d0d72f01642a7173affb111af30b0000faffffffe8d72f010000000018000000000000008b8789d60000000000000000ffffffff000000000000000000000000becf4003d4cf4003 (UID: 00000000-00005000) "Waaake_Setup.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000002f0130d12f011b800800cc565c00fc01000000000000000000000000000010d12f011b80080098d12f015806000038d82f01180000008b8789d6fc010000000000009f575c72fc010000fc010000000000000000000000002f0100000000000000001800000038d82f0198d12f011b800800338789d6a8cf2f019f575c72c0d02f01a0185e72f3a1f9a5feffffffd0d02f01222a7173fc010000000000000000000000000000a8d02f011b80080030d12f0158060000d0d72f01642a7173affb111af30b0000faffffffe8d72f010000000018000000000000008b8789d60000000000000000ffffffff000000000000000000000000becf4003d6cf4003 (UID: 00000000-00005000) "Waaake_Setup.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000002f0130d12f011b800800cc565c00fc01000000000000000000000000000010d12f011b80080098d12f015806000038d82f01180000008b8789d6fc010000000000009f575c72fc010000fc010000000000000000000000002f0100000000000000001800000038d82f0198d12f011b800800338789d6a8cf2f019f575c72c0d02f01a0185e72f3a1f9a5feffffffd0d02f01222a7173fc010000000000000000000000000000a8d02f011b80080030d12f0158060000d0d72f01642a7173affb111af30b0000faffffffe8d72f010000000018000000000000008b8789d60000000000000000ffffffff000000000000000000000000be3c4103d23c4103 (UID: 00000000-00005000) "Waaake_Setup.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000002f0130d12f011b800800cc565c00fc01000000000000000000000000000010d12f011b80080098d12f015806000038d82f01180000008b8789d6fc010000000000009f575c72fc010000fc010000000000000000000000002f0100000000000000001800000038d82f0198d12f011b800800338789d6a8cf2f019f575c72c0d02f01a0185e72f3a1f9a5feffffffd0d02f01222a7173fc010000000000000000000000000000a8d02f011b80080030d12f0158060000d0d72f01642a7173affb111af30b0000faffffffe8d72f010000000018000000000000008b8789d60000000000000000ffffffff000000000000000000000000de414103f6414103 (UID: 00000000-00005000) "Waaake_Setup.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000002f0130d12f011b800800cc565c00fc01000000000000000000000000000010d12f011b80080098d12f015806000038d82f01180000008b8789d6fc010000000000009f575c72fc010000fc010000000000000000000000002f0100000000000000001800000038d82f0198d12f011b800800338789d6a8cf2f019f575c72c0d02f01a0185e72f3a1f9a5feffffffd0d02f01222a7173fc010000000000000000000000000000a8d02f011b80080030d12f0158060000d0d72f01642a7173affb111af30b0000faffffffe8d72f010000000018000000000000008b8789d60000000000000000ffffffff000000000000000000000000decc4003f4cc4003 (UID: 00000000-00005000) "Waaake_Setup.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000002f0130d12f011b800800cc565c00fc01000000000000000000000000000010d12f011b80080098d12f015806000038d82f01180000008b8789d6fc010000000000009f575c72fc010000fc010000000000000000000000002f0100000000000000001800000038d82f0198d12f011b800800338789d6a8cf2f019f575c72c0d02f01a0185e72f3a1f9a5feffffffd0d02f01222a7173fc010000000000000000000000000000a8d02f011b80080030d12f0158060000d0d72f01642a7173affb111af30b0000faffffffe8d72f010000000018000000000000008b8789d60000000000000000ffffffff000000000000000000000000fe40410316414103 (UID: 00000000-00005000) "Waaake_Setup.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000002f0130d12f011b800800cc565c00fc01000000000000000000000000000010d12f011b80080098d12f015806000038d82f01180000008b8789d6fc010000000000009f575c72fc010000fc010000000000000000000000002f0100000000000000001800000038d82f0198d12f011b800800338789d6a8cf2f019f575c72c0d02f01a0185e72f3a1f9a5feffffffd0d02f01222a7173fc010000000000000000000000000000a8d02f011b80080030d12f0158060000d0d72f01642a7173affb111af30b0000faffffffe8d72f010000000018000000000000008b8789d60000000000000000ffffffff000000000000000000000000564c41036e4c4103 (UID: 00000000-00005000) "Waaake_Setup.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000002f0170bcec04c000ec04c06fbf7278bcec0478f12f0160f12f01d06fbf7294bcec04a74dbf720000000078bcec04b74dbf7265cfee7a4ebcc27200000000f0133e03b4f12f0194f12f01c06fbf7278bcec04ccf12f01000000000000000094bcec04a74dbf72000000008c58fb7400000000a5cfee7a20f22f01512f46dd70bcec040240008000f22f01506a0e77f12b7fabfeffffff10f22f0100160b7508f83f0354b0ce7223870b77e1860b77812c46dd000000008c58fb7470bcec040000000008f83f030400000000160b75d8f12f0170bcec04b04d06751c8645d700000000f0133e0370bcec0413e6c1720000b9722c53ce7204f22f0180ee0174 (UID: 00000000-00005000) "Waaake_Setup.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005000) "Waaake_Setup.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f000002000000000000003cf24707c590f371409cf57178f247079f73f371020000008f73f37163579528140000005822f47115000000000000004cf247070000000018f34707302bf3711391275efeffffff8f73f3716676f37194f247078cf2470798f24707a8f24707acf2470702000000020000002ee8ef71b0f24707d975f3710099f571f21cf471bcf24707ca15f371f21cf471c8f24707ee15f371f21cf471e8f247070e11ef71f21cf4710978f3710100000001000000010000006b15f37128f347074b17f371000000000117f371335695280100000001000000000000001800000000000000f8f247074008000068f34707302bf3718395275efeffffff38f34707 (UID: 00000000-00005000) "Waaake_Setup.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000034db470752430e774300000088db470773f6f873cadb47075c00000000000000fdfeff7f82f8f87300000000fc857d01feffffff00000000000000000000000005000000d855ca0502000000020000000a000000c855ca05d855ca05000000001760ca45d0dd4707ddf3f873c4db470700000000c855ca050a000000f8f3f873c855ca05 (UID: 00000000-00005000) "Waaake_Setup.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000420300000000e7c0507400000000dce70d77cc565c72fc01000000000000000000000000000018db47071b800800a0db47075806000050e2470718000000838de1d0fc010000000000009f575c72d0ca4503fc010000000000000000000018db47070000000000000000e02cec0450e24707a0db47071b800800d0ca45000000000000000000807f5774b485577400000000000000000000000000000000b8ca450310ec450310444003e02cec0410df4707ecde470781f12374e02cec0428e44707b8e04707c5f1237402000000000000000000000018df47071c6020740400000010df47075c834774d82cec04a090277400000000f3a1f9a5feffffff (UID: 00000000-00005000) "Waaake_Setup.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000470740345f72010000007cdb4707a54f5c720000b30600000000003cf873c9505c72000000000000000081001000000000000000000000000000e02cec0407000000538ce1d048da47070000000000000000000000000000f9a5feffffff70db4707222a7173fc01000000000000000000000000000048db470734db470752430e774300000088db470773f6f873cadb47075c00000000000000fdfeff7f82f8f873000000005c857d01feffffff000000000000000000000000050000007856ca0502000000020000000a0000006856ca057856ca05000000001760ca45d0dd4707ddf3f873c4db4707000000006856ca050a000000f8f3f8736856ca05 (UID: 00000000-00005000) "Waaake_Setup.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000010000010000000000000001cf6d010000000000000050da4707854a5f74df8757749d67c2c610444003b8ec4503d0ca4503a4cf4674a4cf46746b8de1d00000000000000000ecdd4707a0185e7293a1f9a5feffffff00004707881af973b31af9731044400300000000e02cec0400000000f8dd47078b845774330000000000000000000000807f5774b485577448db47070000000000000000f9a5dc01b8ca4503b8ec450310444003e02cec0410df4707ecde470781f12374e02cec0428e44707b8e04707c5f12374020000000000470740345f7218df47071c6020740400000010df47075c834774d82cec04a0902774000000000000000081001000 (UID: 00000000-00005000) "Waaake_Setup.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000b80000000000000000000000170000000200000000003e03ac00000000000000a53a2edb30e447071e000000f4e4470740e4470700000000e02cec044c48077713b3e1d088e34707f4e4470700000000000000000000f9a5feffffffb0e44707222a7173fc01000000000000000000000000000088e4470774e4470752430e7743000000c8e4470773f6f8730ae547075c00000000000000fdfeff7f82f8f873000000005cdd0004feffffff00000000000000000000000005000000b807470302000000020000000a000000a8074703b807470300000000575fca4510e74707ddf3f87304e5470700000000a80747030a000000f8f3f873a8074703 (UID: 00000000-00005000) "Waaake_Setup.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000a89fd205bc9fd205 (UID: 00000000-00005000) "Waaake_Setup.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000010000010000000000000001cf6d010000000000000090e34707854a5f74df8757745d5ec2c610444003b0b546033019d505a4cf4674a4cf46742bb4e1d000000000000000002ce74707a0185e7293a1f9a5feffffff00004707881af973b31af9731044400300000000e02cec040000000038e747078b845774330000000000000000000000807f5774b485577488e447070000000000000000f9a5dc011819d505b0b5460310444003e02cec0450e847072ce8470781f12374e02cec0468ed4707f8e94707c5f1237402000000b21a2474b800000058e847071c6020740400000050e847075c834774d82cec04a09027740000000030e447071e000000 (UID: 00000000-00005000)34:T5e8,"Waaake_Setup.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000000000a009f9000000000078f02f0159160b7701000000080000000100000000003e0300000000100000000000000000000000020000000200000000003e0301000000080000000000000098f02f01ee130b7701000000ee130b770800000000000000080000005b57a6d7d0f22f01ad9c477200003e030800000001000000 (UID: 00000000-00005000) "powershell.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f0000020000000000730079007300740065006d00330032005c00770069006e0064006f007700730070006f007700650072007300680065006c006c005c00760031002e0030005c0070006f007700650072007300680065006c006c002e0065007800650000005c006d0061006300680069006e0065002e0063000400000437390000b0330473 (UID: 00000000-00004796) "powershell.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f0000020000000000730079007300740065006d00330032005c00770069006e0064006f007700730070006f007700650072007300680065006c006c005c00760031002e0030005c0070006f007700650072007300680065006c006c002e0065007800650000005c006d0061006300680069006e0065002e0063000500000556820000b03319ff (UID: 00000000-00008116) "powershell.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f0000020000000000730079007300740065006d00330032005c00770069006e0064006f007700730070006f007700650072007300680065006c006c005c00760031002e0030005c0070006f007700650072007300680065006c006c002e0065007800650000005c006d0061006300680069006e0065002e00630004000004d7620000b033b5b1 (UID: 00000000-00005988)35:T40c,"Waaake_Setup.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "Waaake_Setup.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "tasklist.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "waaake.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "waaake.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "reg.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED")36:T5cf,Found reference to API "GetVersion" (Indicator: "GetVersion"; File: "Waaake_Setup.exe") file/memory contains long string with (Indicator: "GetVersion"; File: "nsExec.dll") Found reference to API "VerSetConditionMask" (Indicator: "VerSetConditionMask"; Source: "00000000-00004796.00000000.91471.DB88A000.00000002.mdmp") Found reference to API "VerifyVersionInfoW" (Indicator: "VerifyVersionInfo"; Source: "00000000-00004796.00000000.91471.DB88A000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; Source: "00000000-00004796.00000000.91471.DB88A000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; Source: "00000000-00004796.00000000.91471.DB88A000.00000002.mdmp") Found reference to API "10304910370,6452,3024,,RtlGetVersion,NTDLL.dll,"00:23:49.328",RX=0,PX=0" (Indicator: "GetVersion"; Source: "00000000-00005988.00000000.91480.B1B50000.00000004.mdmp") Found reference to API "VerSetConditionMask" (Indicator: "VerSetConditionMask"; Source: "00000000-00005988.00000000.91480.DB88A000.00000002.mdmp") Found reference to API "VerifyVersionInfoW" (Indicator: "VerifyVersionInfo"; Source: "00000000-00005988.00000000.91480.DB88A000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; Source: "00000000-00005988.00000000.91480.DB88A000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; Source: "00000000-00005988.00000000.91480.DB88A000.00000002.mdmp")37:T6f8,"waaake.exe" (Access type: "QUERY"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES"; Key: ""; Value: "") "waaake.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "waaake.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "REGISTRATIONENABLED"; Value: "") "waaake.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "REGISTERADAPTERNAME"; Value: "") "waaake.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DOMAIN"; Value: "") "waaake.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DHCPDOMAIN"; Value: "") "waaake.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "waaake.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "waaake.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "waaake.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "")38:Tf02,"waaake.exe" queries volume information of "C:\" at 00000000-00006656-00000C17-400694895 "waaake.exe" queries volume information of "C:\Users" at 00000000-00006656-00000C17-400695173 "waaake.exe" queries volume information of "C:\Users\%OSUSER%" at 00000000-00006656-00000C17-400695475 "waaake.exe" queries volume information of "C:\Users\%OSUSER%\AppData" at 00000000-00006656-00000C17-400695687 "waaake.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local" at 00000000-00006656-00000C17-400695910 "waaake.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Programs" at 00000000-00006656-00000C17-400696176 "waaake.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Programs\waaake" at 00000000-00006656-00000C17-400696473 "waaake.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Programs\waaake\resources" at 00000000-00006656-00000C17-400696791 "waaake.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Programs\waaake\resources\app.asar" at 00000000-00006656-00000C17-400697328 "waaake.exe" queries volume information of "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" at 00000000-00006656-00000C17-402255512 "waaake.exe" queries volume information of "C:\Windows\System32\drivers\etc\hosts" at 00000000-00006656-00000C17-402762740 "waaake.exe" queries volume information of "C:\Windows\Fonts\msgothic.ttc" at 00000000-00006656-00000C17-406482591 "waaake.exe" queries volume information of "C:\Windows\Fonts\msjh.ttc" at 00000000-00006656-00000C17-406505954 "waaake.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Programs\waaake\resources\app.asar.unpacked\resources\icon.png" at 00000000-00006656-00000C17-418497184 "waaake.exe" queries volume information of "C:\Windows\System32\spool\drivers\color\sRGB Color Space Profile.icm" at 00000000-00006656-00000C17-418558022 "cmd.exe" queries volume information of "C:\" at 00000000-00000580-00000C17-404481717 "waaake.exe" queries volume information of "C:\Windows\System32\drivers\etc\hosts" at 00000000-00007804-00000C17-425008312 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00004796-00000C17-437202921 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll" at 00000000-00004796-00000C17-438144675 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00004796-00000C17-438492214 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00004796-00000C17-440378875 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00008116-00000C17-439702781 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00008116-00000C17-440217768 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll" at 00000000-00008116-00000C17-440609644 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00005988-00000C17-43937486239:Ta03,"powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CRLS"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CTLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE"; Key: "")3a:T4e1,"waaake.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43"; Key: "BLOB") "waaake.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\0E9612411A0A4ABD15B84FFACBA6DB3166916E75"; Key: "BLOB") "waaake.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\18F7C1FCC3090203FD5BAA2F861A754976C8DD25"; Key: "BLOB") "waaake.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\245C97DF7514E7CF2DF8BE72AE957B9E04741E85"; Key: "BLOB") "waaake.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\3B1EFD3A66EA28B16697394703A72CA340A05BD5"; Key: "BLOB") "waaake.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25"; Key: "BLOB") "waaake.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\7F88CD7223F3C813818C994614A89C99FA3B5247"; Key: "BLOB") "waaake.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\8F43288AD272F3103B6FB1428485EA3014C0BCFE"; Key: "BLOB") "waaake.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\92B46C76E13054E104F230517E6E504D43AB10B5"; Key: "BLOB")3b:T427,"Waaake_Setup.exe" called "CreateDirectoryW" with parameter %TEMP%\ (UID: 00000000-00005000) "Waaake_Setup.exe" called "CreateDirectoryW" with parameter C:\Users (UID: 00000000-00005000) "Waaake_Setup.exe" called "CreateDirectoryW" with parameter C:\Users\%OSUSER% (UID: 00000000-00005000) "Waaake_Setup.exe" called "CreateDirectoryW" with parameter %USERPROFILE%\AppData (UID: 00000000-00005000) "Waaake_Setup.exe" called "CreateDirectoryW" with parameter %USERPROFILE%\AppData\Local (UID: 00000000-00005000) "Waaake_Setup.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Temp (UID: 00000000-00005000) "Waaake_Setup.exe" called "CreateDirectoryW" with parameter %TEMP%\nsbD764.tmp (UID: 00000000-00005000) "Waaake_Setup.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Programs (UID: 00000000-00005000) "Waaake_Setup.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Programs\waaake (UID: 00000000-00005000) "Waaake_Setup.exe" called "CreateDirectoryW" with parameter %TEMP%\nsbD764.tmp\7z-out (UID: 00000000-00005000)3c:T755,"Waaake_Setup.exe" called "CreateProcessW" with parameter ""%WINDIR%\system32\cmd.exe" /c tasklist /FI "USERNAME eq %USERNAME%" /FI "IMAGENAME eq waaake.exe" /FO csv | "%WINDIR%\system3" - (UID: 00000000-00005000), "cmd.exe" called "CreateProcessW" with parameter "tasklist /FI "USERNAME eq %OSUSER%" /FI "IMAGENAME eq waaake.exe" /FO csv" - (UID: 00000000-00006292), "cmd.exe" called "CreateProcessW" with parameter ""%WINDIR%\system32\find.exe" "waaake.exe"" - (UID: 00000000-00006292), "waaake.exe" called "CreateProcessW" with parameter "%WINDIR%\system32\cmd.exe /d /s /c "chcp"" - (UID: 00000000-00006656), "waaake.exe" called "CreateProcessW" with parameter "%WINDIR%\system32\cmd.exe /d /s /c "%windir%\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v Machin" - (UID: 00000000-00006656) "waaake.exe" called "CreateProcessW" with parameter "%WINDIR%\system32\cmd.exe /d /s /c "reg query "HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0" /v FeatureSet"" - (UID: 00000000-00006656) "waaake.exe" called "CreateProcessW" with parameter ""%LOCALAPPDATA%\Programs\waaake\waaake.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=" - (UID: 00000000-00006656) "waaake.exe" called "CreateProcessW" with parameter "%WINDIR%\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestrict" - (UID: 00000000-00006656) "cmd.exe" called "CreateProcessW" with parameter "chcp" - (UID: 00000000-00007836) "cmd.exe" called "CreateProcessW" with parameter "%WINDIR%\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid" - (UID: 00000000-00000580) "cmd.exe" called "CreateProcessW" with parameter "reg query "HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0" /v FeatureSet" - (UID: 00000000-00002856)3d:T93e6,"Waaake_Setup.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005000) "Waaake_Setup.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005000) "Waaake_Setup.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005000) "Waaake_Setup.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005000) "Waaake_Setup.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\UXTHEME.dll (UID: 00000000-00005000) "Waaake_Setup.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\USERENV.dll (UID: 00000000-00005000) "Waaake_Setup.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\SETUPAPI.dll (UID: 00000000-00005000) "Waaake_Setup.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\APPHELP.dll (UID: 00000000-00005000) "Waaake_Setup.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\PROPSYS.dll (UID: 00000000-00005000) "Waaake_Setup.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\DWMAPI.dll (UID: 00000000-00005000) "Waaake_Setup.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\CRYPTBASE.dll (UID: 00000000-00005000) "Waaake_Setup.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\OLEACC.dll (UID: 00000000-00005000) "Waaake_Setup.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\CLBCATQ.dll (UID: 00000000-00005000) "Waaake_Setup.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\NTMARTA.dll (UID: 00000000-00005000) "Waaake_Setup.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\VERSION.dll (UID: 00000000-00005000) "Waaake_Setup.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\SHFOLDER.dll (UID: 00000000-00005000) "Waaake_Setup.exe" called "LoadLibrary" with a parameter %TEMP%\nsbD764.tmp\System.dll (UID: 00000000-00005000) "Waaake_Setup.exe" called "LoadLibrary" with a parameter %TEMP%\nsbD764.tmp\StdUtils.dll (UID: 00000000-00005000) "Waaake_Setup.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\RichEd20.dll (UID: 00000000-00005000) "Waaake_Setup.exe" called "LoadLibrary" with a parameter %TEMP%\nsbD764.tmp\SpiderBanner.dll (UID: 00000000-00005000) "Waaake_Setup.exe" called "LoadLibrary" with a parameter psapi (UID: 00000000-00005000) "Waaake_Setup.exe" called "LoadLibrary" with a parameter %TEMP%\nsbD764.tmp\nsExec.dll (UID: 00000000-00005000) "Waaake_Setup.exe" called "LoadLibrary" with a parameter %TEMP%\nsbD764.tmp\nsis7z.dll (UID: 00000000-00005000) "Waaake_Setup.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00005000) "Waaake_Setup.exe" called "LoadLibrary" with a parameter %TEMP%\nsbD764.tmp\WinShell.dll (UID: 00000000-00005000) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006292) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006292) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006292) "cmd.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006292) "tasklist.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007452) "tasklist.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007452) "tasklist.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007452) "tasklist.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007452) "tasklist.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\Winsta.dll (UID: 00000000-00007452) "waaake.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006656) "waaake.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006656) "waaake.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006656) "waaake.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006656) "waaake.exe" called "LoadLibrary" with a parameter bcryptprimitives.dll (UID: 00000000-00006656) "waaake.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00006656) "waaake.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00006656) "waaake.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00006656) "waaake.exe" called "LoadLibrary" with a parameter powrprof.dll (UID: 00000000-00006656) "waaake.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00006656) "waaake.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00006656) "waaake.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-shell32-l1-1-0.dll (UID: 00000000-00006656) "waaake.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00006656) "waaake.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00006656) "waaake.exe" called "LoadLibrary" with a parameter api-ms-win-shcore-scaling-l1-1-1.dll (UID: 00000000-00006656) "waaake.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00006656) "waaake.exe" called "LoadLibrary" with a parameter Kernel32.dll (UID: 00000000-00006656) "waaake.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00006656) "waaake.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00006656) "waaake.exe" called "LoadLibrary" with a parameter COMCTL32.dll (UID: 00000000-00006656) "waaake.exe" called "LoadLibrary" with a parameter GDI32.dll (UID: 00000000-00006656) "waaake.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00006656) "waaake.exe" called "LoadLibrary" with a parameter WTSAPI32.dll (UID: 00000000-00006656) "waaake.exe" called "LoadLibrary" with a parameter dwmapi.dll (UID: 00000000-00006656) "waaake.exe" called "LoadLibrary" with a parameter api-ms-win-power-base-l1-1-0.dll (UID: 00000000-00006656) "waaake.exe" called "LoadLibrary" with a parameter atlthunk.dll (UID: 00000000-00006656) "waaake.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00006656) "waaake.exe" called "LoadLibrary" with a parameter OLEACC.dll (UID: 00000000-00006656) "waaake.exe" called "LoadLibrary" with a parameter bcryptprimitives (UID: 00000000-00006656) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007836) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007836) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007836) "cmd.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007836) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00000580) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00000580) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00000580) "cmd.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00000580) "reg.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002028) "reg.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002028) "reg.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002028) "reg.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002028) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002856) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002856) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002856) "cmd.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002856) "reg.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007184) "reg.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007184) "reg.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007184) "reg.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007184) "waaake.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007804) "waaake.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007804) "waaake.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007804) "waaake.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007804) "waaake.exe" called "LoadLibrary" with a parameter bcryptprimitives.dll (UID: 00000000-00007804) "waaake.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00007804) "waaake.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00007804) "waaake.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00007804) "waaake.exe" called "LoadLibrary" with a parameter powrprof.dll (UID: 00000000-00007804) "waaake.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00007804) "waaake.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00007804) "waaake.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-shell32-l1-1-0.dll (UID: 00000000-00007804) "waaake.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00007804) "waaake.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00007804) "waaake.exe" called "LoadLibrary" with a parameter bcryptprimitives (UID: 00000000-00007804) "waaake.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00007804) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004796) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004796) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004796) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004796) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00004796) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00004796) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00004796) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00004796) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00004796) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00004796) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00004796) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00004796) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00004796) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00004796) "powershell.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00004796) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00004796) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00004796) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll (UID: 00000000-00004796) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00004796) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00004796) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00004796) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00004796) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00004796) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00004796) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll (UID: 00000000-00004796) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll (UID: 00000000-00004796) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\b5ba37e1558ced178a99011a1d659b52\Microsoft.PowerShell.ConsoleH (UID: 00000000-00004796) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll (UID: 00000000-00004796) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00004796) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\6da01910c256231d1c50ad0aacee5941\System.Management.Automation. (UID: 00000000-00004796) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00004796) "powershell.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00004796) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00004796) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00004796) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00004796) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00004796) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00004796) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00004796) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00004796) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00004796) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00004796) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00004796) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00004796) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00004796) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00004796) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00004796) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll (UID: 00000000-00004796) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll (UID: 00000000-00004796) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll (UID: 00000000-00004796) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00004796) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00004796) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00004796) "powershell.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00004796) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Mf49f6405#\7b1f35fb0c2d6955ce5af2bd372c65f2\Microsoft.Management.Infrastr (UID: 00000000-00004796) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll (UID: 00000000-00004796) "powershell.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00004796) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Management\b221af81285c1305324612e6dc9c88ff\System.Management.ni.dll (UID: 00000000-00004796) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Dired13b18a9#\8ad4c0af5b3d51a0f3a4dac0d44d85d4\System.DirectoryServices.ni.d (UID: 00000000-00004796) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\5ee35debfc22f727e70e4479ddcbc045\System.Xml.ni.dll (UID: 00000000-00004796) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\VERSION.dll (UID: 00000000-00004796) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Data\7bed49c46de9295a8453db205c60a028\System.Data.ni.dll (UID: 00000000-00004796) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00004796) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00004796) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00004796) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll (UID: 00000000-00004796) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P6f792626#\7ff5199e757cb8af9ad949453f698d09\Microsoft.PowerShell.Security (UID: 00000000-00004796) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Transactions\604272b0faec2e09d53d38e03bc89c6c\System.Transactions.ni.dll (UID: 00000000-00004796) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Configuration\4beb1eeca20b27d4bd1bb9880f03cc2a\System.Configuration.ni.dll (UID: 00000000-00004796) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00004796) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00004796) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00004796) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00008116) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00008116) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00008116) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00008116) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00008116) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00008116) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00008116) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00008116) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00008116) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00008116) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00008116) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00008116) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00008116) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00008116) "powershell.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00008116) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00008116) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00008116) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll (UID: 00000000-00008116) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00008116) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00008116) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00008116) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00008116) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00008116) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00008116) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll (UID: 00000000-00008116) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll (UID: 00000000-00008116) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\b5ba37e1558ced178a99011a1d659b52\Microsoft.PowerShell.ConsoleH (UID: 00000000-00008116) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll (UID: 00000000-00008116) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00008116) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\6da01910c256231d1c50ad0aacee5941\System.Management.Automation. (UID: 00000000-00008116) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00008116) "powershell.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00008116) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00008116) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00008116) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00008116) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00008116) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00008116) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00008116) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00008116) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00008116) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00008116) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00008116) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00008116) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00008116) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll (UID: 00000000-00008116) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll (UID: 00000000-00008116) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00008116) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00008116) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll (UID: 00000000-00008116) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00008116) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00008116) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00008116) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Mf49f6405#\7b1f35fb0c2d6955ce5af2bd372c65f2\Microsoft.Management.Infrastr (UID: 00000000-00008116) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00008116) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Management\b221af81285c1305324612e6dc9c88ff\System.Management.ni.dll (UID: 00000000-00008116) "powershell.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00008116) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Data\7bed49c46de9295a8453db205c60a028\System.Data.ni.dll (UID: 00000000-00008116) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll (UID: 00000000-00008116) "powershell.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00008116) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Dired13b18a9#\8ad4c0af5b3d51a0f3a4dac0d44d85d4\System.DirectoryServices.ni.d (UID: 00000000-00008116) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00008116) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\5ee35debfc22f727e70e4479ddcbc045\System.Xml.ni.dll (UID: 00000000-00008116) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\VERSION.dll (UID: 00000000-00008116) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00008116) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll (UID: 00000000-00008116) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P6f792626#\7ff5199e757cb8af9ad949453f698d09\Microsoft.PowerShell.Security (UID: 00000000-00008116) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005988) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005988) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005988) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005988) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00005988) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00005988) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00005988) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00005988) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00005988) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00005988) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00005988) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00005988) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00005988) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00005988) "powershell.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00005988) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00005988) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00005988) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll (UID: 00000000-00005988) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00005988) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00005988) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00005988) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00005988) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00005988) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00005988) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll (UID: 00000000-00005988) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll (UID: 00000000-00005988) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\b5ba37e1558ced178a99011a1d659b52\Microsoft.PowerShell.ConsoleH (UID: 00000000-00005988) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll (UID: 00000000-00005988) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00005988) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\6da01910c256231d1c50ad0aacee5941\System.Management.Automation. (UID: 00000000-00005988) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00005988) "powershell.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00005988) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00005988) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00005988) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00005988) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00005988) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00005988) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00005988) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00005988) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00005988) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00005988) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00005988) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00005988) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00005988) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00005988) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll (UID: 00000000-00005988) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll (UID: 00000000-00005988) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll (UID: 00000000-00005988) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00005988) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00005988) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00005988) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Mf49f6405#\7b1f35fb0c2d6955ce5af2bd372c65f2\Microsoft.Management.Infrastr (UID: 00000000-00005988) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00005988) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Management\b221af81285c1305324612e6dc9c88ff\System.Management.ni.dll (UID: 00000000-00005988) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00005988) "powershell.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00005988) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Dired13b18a9#\8ad4c0af5b3d51a0f3a4dac0d44d85d4\System.DirectoryServices.ni.d (UID: 00000000-00005988) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll (UID: 00000000-00005988) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\5ee35debfc22f727e70e4479ddcbc045\System.Xml.ni.dll (UID: 00000000-00005988) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Data\7bed49c46de9295a8453db205c60a028\System.Data.ni.dll (UID: 00000000-00005988) "powershell.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00005988) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00005988) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\VERSION.dll (UID: 00000000-00005988) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00005988) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll (UID: 00000000-00005988) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P6f792626#\7ff5199e757cb8af9ad949453f698d09\Microsoft.PowerShell.Security (UID: 00000000-00005988)3e:T697,"waaake.exe" called "MoveFileW" with parameter %APPDATA%\WAAAKE\Code Cache\js\index-dir\the-real-index & %APPDATA%\WAAAKE\Code Cache\js\index-dir\todelete_a77a12fcc757a425 (UID: 00000000-00006656) "waaake.exe" called "MoveFileW" with parameter %APPDATA%\WAAAKE\Code Cache\wasm\index-dir\the-real-index & %APPDATA%\WAAAKE\Code Cache\wasm\index-dir\todelete_0d6d220397879a5e (UID: 00000000-00006656) "waaake.exe" called "MoveFileW" with parameter %APPDATA%\WAAAKE\Code Cache\wasm\index-dir\temp-index & %APPDATA%\WAAAKE\Code Cache\wasm\index-dir\the-real-index (UID: 00000000-00006656) "waaake.exe" called "MoveFileW" with parameter %APPDATA%\WAAAKE\Code Cache\js\index-dir\temp-index & %APPDATA%\WAAAKE\Code Cache\js\index-dir\the-real-index (UID: 00000000-00006656) "waaake.exe" called "MoveFileW" with parameter %APPDATA%\WAAAKE\Local Storage\leveldb/000001.dbtmp & %APPDATA%\WAAAKE\Local Storage\leveldb/CURRENT (UID: 00000000-00006656) "waaake.exe" called "MoveFileW" with parameter %APPDATA%\WAAAKE\54e1c8c6-4a74-4f48-95d1-b9535578e335.tmp & %APPDATA%\WAAAKE\Preferences (UID: 00000000-00006656) "waaake.exe" called "MoveFileW" with parameter %APPDATA%\WAAAKE\26d3604e-d8c1-4e21-94af-0903e7f9ba69.tmp & %APPDATA%\WAAAKE\Local State (UID: 00000000-00006656) "waaake.exe" called "MoveFileW" with parameter %APPDATA%\WAAAKE\Shared Dictionary\cache\index-dir\the-real-index & %APPDATA%\WAAAKE\Shared Dictionary\cache\index-dir\todelete_583d0b189383c873 (UID: 00000000-00007804) "waaake.exe" called "MoveFileW" with parameter %APPDATA%\WAAAKE\Shared Dictionary\cache\index-dir\temp-index & %APPDATA%\WAAAKE\Shared Dictionary\cache\index-dir\the-real-index (UID: 00000000-00007804)3f:T9d65,Found reference to API (Indicator: "MulDiv"; File: "Waaake_Setup.exe") Found reference to API (Indicator: "DeleteFileW"; File: "Waaake_Setup.exe") Found reference to API (Indicator: "FindFirstFileW"; File: "Waaake_Setup.exe") Found reference to API (Indicator: "FindNextFileW"; File: "Waaake_Setup.exe") Found reference to API (Indicator: "FindClose"; File: "Waaake_Setup.exe") Found reference to API (Indicator: "SetFilePointer"; File: "Waaake_Setup.exe") Found reference to API (Indicator: "ReadFile"; File: "Waaake_Setup.exe") Found reference to API (Indicator: "MultiByteToWideChar"; File: "Waaake_Setup.exe") Found reference to API (Indicator: "lstrlenA"; File: "Waaake_Setup.exe") Found reference to API (Indicator: "WideCharToMultiByte"; File: "Waaake_Setup.exe") Found reference to API (Indicator: "GetPrivateProfileStringW"; File: "Waaake_Setup.exe") Found reference to API (Indicator: "WritePrivateProfileStringW"; File: "Waaake_Setup.exe") Found reference to API (Indicator: "FreeLibrary"; File: "Waaake_Setup.exe") Found reference to API (Indicator: "LoadLibraryExW"; File: "Waaake_Setup.exe") Found reference to API (Indicator: "GetModuleHandleW"; File: "Waaake_Setup.exe") Found reference to API (Indicator: "GlobalAlloc"; File: "Waaake_Setup.exe") Found reference to API (Indicator: "GlobalFree"; File: "Waaake_Setup.exe") Found reference to API (Indicator: "ExpandEnvironmentStringsW"; File: "Waaake_Setup.exe") Found reference to API (Indicator: "lstrcmpW"; File: "Waaake_Setup.exe") Found reference to API (Indicator: "lstrcmpiW"; File: "Waaake_Setup.exe") Found reference to API (Indicator: "CloseHandle"; File: "Waaake_Setup.exe") Found reference to API (Indicator: "SetFileTime"; File: "Waaake_Setup.exe") Found reference to API (Indicator: "CompareFileTime"; File: "Waaake_Setup.exe") Found reference to API (Indicator: "SearchPathW"; File: "Waaake_Setup.exe") Found reference to API (Indicator: "GetShortPathNameW"; File: "Waaake_Setup.exe") Found reference to API (Indicator: "GetFullPathNameW"; File: "Waaake_Setup.exe") Found reference to API (Indicator: "MoveFileW"; File: "Waaake_Setup.exe") Found reference to API (Indicator: "SetCurrentDirectoryW"; File: "Waaake_Setup.exe") Found reference to API (Indicator: "GetFileAttributesW"; File: "Waaake_Setup.exe") Found reference to API (Indicator: "SetFileAttributesW"; File: "Waaake_Setup.exe") Found reference to API (Indicator: "Sleep"; File: "Waaake_Setup.exe") Found reference to API (Indicator: "GetTickCount"; File: "Waaake_Setup.exe") Found reference to API (Indicator: "GetFileSize"; File: "Waaake_Setup.exe") Found reference to API (Indicator: "GetModuleFileNameW"; File: "Waaake_Setup.exe") Found reference to API (Indicator: "GetCurrentProcess"; File: "Waaake_Setup.exe") Found reference to API (Indicator: "CopyFileW"; File: "Waaake_Setup.exe") Found reference to API (Indicator: "ExitProcess"; File: "Waaake_Setup.exe") Found reference to API (Indicator: "SetEnvironmentVariableW"; File: "Waaake_Setup.exe") Found reference to API (Indicator: "GetWindowsDirectoryW"; File: "Waaake_Setup.exe") Found reference to API (Indicator: "GetTempPathW"; File: "Waaake_Setup.exe") Found reference to API (Indicator: "GetCommandLineW"; File: "Waaake_Setup.exe") Found reference to API (Indicator: "GetVersion"; File: "Waaake_Setup.exe") Found reference to API (Indicator: "SetErrorMode"; File: "Waaake_Setup.exe") Found reference to API (Indicator: "lstrlenW"; File: "Waaake_Setup.exe") Found reference to API (Indicator: "lstrcpynW"; File: "Waaake_Setup.exe") Found reference to API (Indicator: "GetDiskFreeSpaceW"; File: "Waaake_Setup.exe") Found reference to API (Indicator: "GlobalUnlock"; File: "Waaake_Setup.exe") Found reference to API (Indicator: "GlobalLock"; File: "Waaake_Setup.exe") Found reference to API (Indicator: "CreateThread"; File: "Waaake_Setup.exe") Found reference to API (Indicator: "GetLastError"; File: "Waaake_Setup.exe") Found reference to API (Indicator: "CreateDirectoryW"; File: "Waaake_Setup.exe") Found reference to API (Indicator: "CreateProcessW"; File: "Waaake_Setup.exe") Found reference to API (Indicator: "RemoveDirectoryW"; File: "Waaake_Setup.exe") Found reference to API (Indicator: "lstrcmpiA"; File: "Waaake_Setup.exe") Found reference to API (Indicator: "CreateFileW"; File: "Waaake_Setup.exe") Found reference to API (Indicator: "GetTempFileNameW"; File: "Waaake_Setup.exe") Found reference to API (Indicator: "WriteFile"; File: "Waaake_Setup.exe") Found reference to API (Indicator: "lstrcpyA"; File: "Waaake_Setup.exe") Found reference to API (Indicator: "MoveFileExW"; File: "Waaake_Setup.exe") Found reference to API (Indicator: "lstrcatW"; File: "Waaake_Setup.exe") Found reference to API (Indicator: "GetSystemDirectoryW"; File: "Waaake_Setup.exe") Found reference to API (Indicator: "GetProcAddress"; File: "Waaake_Setup.exe") Found reference to API (Indicator: "GetModuleHandleA"; File: "Waaake_Setup.exe") Found reference to API (Indicator: "GetExitCodeProcess"; File: "Waaake_Setup.exe") Found reference to API (Indicator: "WaitForSingleObject"; File: "Waaake_Setup.exe") Found reference to API (Indicator: "FillRect"; File: "Waaake_Setup.exe") Found reference to API (Indicator: "GetClientRect"; File: "Waaake_Setup.exe") Found reference to API (Indicator: "BeginPaint"; File: "Waaake_Setup.exe") Found reference to API (Indicator: "DefWindowProcW"; File: "Waaake_Setup.exe") Found reference to API (Indicator: "InvalidateRect"; File: "Waaake_Setup.exe") Found reference to API (Indicator: "EnableWindow"; File: "Waaake_Setup.exe") Found reference to API (Indicator: "ReleaseDC"; File: "Waaake_Setup.exe") Found reference to API (Indicator: "GetDC"; File: "Waaake_Setup.exe") Found reference to API (Indicator: "LoadImageW"; File: "Waaake_Setup.exe") Found reference to API (Indicator: "IsWindow"; File: "Waaake_Setup.exe") Found reference to API (Indicator: "wsprintfW"; File: "Waaake_Setup.exe") Found reference to API (Indicator: "ShowWindow"; File: "Waaake_Setup.exe") Found reference to API (Indicator: "SetForegroundWindow"; File: "Waaake_Setup.exe") Found reference to API (Indicator: "PostQuitMessage"; File: "Waaake_Setup.exe") Found reference to API (Indicator: "SetWindowTextW"; File: "Waaake_Setup.exe") Found reference to API (Indicator: "SetTimer"; File: "Waaake_Setup.exe") Found reference to API (Indicator: "DestroyWindow"; File: "Waaake_Setup.exe") Found reference to API (Indicator: "ExitWindowsEx"; File: "Waaake_Setup.exe") Found reference to API (Indicator: "CharNextW"; File: "Waaake_Setup.exe") Found reference to API (Indicator: "CreateWindowExW"; File: "Waaake_Setup.exe") Found reference to API (Indicator: "SystemParametersInfoW"; File: "Waaake_Setup.exe") Found reference to API (Indicator: "RegisterClassW"; File: "Waaake_Setup.exe") Found reference to API (Indicator: "ScreenToClient"; File: "Waaake_Setup.exe") Found reference to API (Indicator: "GetWindowRect"; File: "Waaake_Setup.exe") Found reference to API (Indicator: "EnableMenuItem"; File: "Waaake_Setup.exe") Found reference to API (Indicator: "GetSystemMenu"; File: "Waaake_Setup.exe") Found reference to API (Indicator: "IsWindowEnabled"; File: "Waaake_Setup.exe") Found reference to API (Indicator: "SetWindowPos"; File: "Waaake_Setup.exe") Found reference to API (Indicator: "GetSysColor"; File: "Waaake_Setup.exe") Found reference to API (Indicator: "SetCursor"; File: "Waaake_Setup.exe") Found reference to API (Indicator: "LoadCursorW"; File: "Waaake_Setup.exe") Found reference to API (Indicator: "IsWindowVisible"; File: "Waaake_Setup.exe") Found reference to API (Indicator: "CloseClipboard"; File: "Waaake_Setup.exe") Found reference to API (Indicator: "SetClipboardData"; File: "Waaake_Setup.exe") Found reference to API (Indicator: "EmptyClipboard"; File: "Waaake_Setup.exe") Found reference to API (Indicator: "OpenClipboard"; File: "Waaake_Setup.exe") Found reference to API (Indicator: "TrackPopupMenu"; File: "Waaake_Setup.exe") Found reference to API (Indicator: "AppendMenuW"; File: "Waaake_Setup.exe") Found reference to API (Indicator: "CreatePopupMenu"; File: "Waaake_Setup.exe") Found reference to API (Indicator: "GetSystemMetrics"; File: "Waaake_Setup.exe") Found reference to API (Indicator: "CharPrevW"; File: "Waaake_Setup.exe") Found reference to API (Indicator: "CharNextA"; File: "Waaake_Setup.exe") Found reference to API (Indicator: "wsprintfA"; File: "Waaake_Setup.exe") Found reference to API (Indicator: "DispatchMessageW"; File: "Waaake_Setup.exe") Found reference to API (Indicator: "PeekMessageW"; File: "Waaake_Setup.exe") Found reference to API (Indicator: "SelectObject"; File: "Waaake_Setup.exe") Found reference to API (Indicator: "CreateFontIndirectW"; File: "Waaake_Setup.exe") Found reference to API (Indicator: "DeleteObject"; File: "Waaake_Setup.exe") Found reference to API (Indicator: "GetDeviceCaps"; File: "Waaake_Setup.exe") Found reference to API (Indicator: "SHFileOperationW"; File: "Waaake_Setup.exe") Found reference to API (Indicator: "SHGetFileInfoW"; File: "Waaake_Setup.exe") Found reference to API (Indicator: "SHBrowseForFolderW"; File: "Waaake_Setup.exe") Found reference to API (Indicator: "SHGetPathFromIDListW"; File: "Waaake_Setup.exe") Found reference to API (Indicator: "ShellExecuteExW"; File: "Waaake_Setup.exe") Found reference to API (Indicator: "SHGetSpecialFolderLocation"; File: "Waaake_Setup.exe") Found reference to API (Indicator: "RegEnumValueW"; File: "Waaake_Setup.exe") Found reference to API (Indicator: "RegEnumKeyW"; File: "Waaake_Setup.exe") Found reference to API (Indicator: "RegQueryValueExW"; File: "Waaake_Setup.exe") Found reference to API (Indicator: "RegSetValueExW"; File: "Waaake_Setup.exe") Found reference to API (Indicator: "RegCloseKey"; File: "Waaake_Setup.exe") Found reference to API (Indicator: "RegDeleteValueW"; File: "Waaake_Setup.exe") Found reference to API (Indicator: "RegDeleteKeyW"; File: "Waaake_Setup.exe") Found reference to API (Indicator: "AdjustTokenPrivileges"; File: "Waaake_Setup.exe") Found reference to API (Indicator: "LookupPrivilegeValueW"; File: "Waaake_Setup.exe") Found reference to API (Indicator: "OpenProcessToken"; File: "Waaake_Setup.exe") Found reference to API (Indicator: "SetFileSecurityW"; File: "Waaake_Setup.exe") Found reference to API (Indicator: "RegOpenKeyExW"; File: "Waaake_Setup.exe") Found reference to API (Indicator: "RegCreateKeyExW"; File: "Waaake_Setup.exe") Found reference to API (Indicator: "CoCreateInstance"; File: "Waaake_Setup.exe") Found reference to API (Indicator: "OleUninitialize"; File: "Waaake_Setup.exe") Found reference to API (Indicator: "OleInitialize"; File: "Waaake_Setup.exe") Found reference to API (Indicator: "CoTaskMemFree"; File: "Waaake_Setup.exe") Found reference to API (Indicator: "VerQueryValueW"; File: "Waaake_Setup.exe") Found reference to API (Indicator: "GetFileVersionInfoW"; File: "Waaake_Setup.exe") Found reference to API (Indicator: "GetFileVersionInfoSizeW"; File: "Waaake_Setup.exe") Found reference to API (Indicator: "SHGetFolderPathW"; File: "Waaake_Setup.exe") Found reference to API (Indicator: "RegDeleteKeyExW"; File: "Waaake_Setup.exe") Found reference to API (Indicator: "GetUserDefaultUILanguage"; File: "Waaake_Setup.exe") Found reference to API (Indicator: "GetDiskFreeSpaceExW"; File: "Waaake_Setup.exe") Found reference to API (Indicator: "SetDefaultDllDirectories"; File: "Waaake_Setup.exe") Found reference to API (Indicator: "SeShutdownPrivilege"; File: "Waaake_Setup.exe") Found reference to API (Indicator: "WinStationFreeMemory"; File: "00000000-00007452.00000000.87841.00811000.00000020.mdmp") Found reference to API (Indicator: "WinStationCloseServer"; File: "00000000-00007452.00000000.87841.00811000.00000020.mdmp") Found reference to API (Indicator: "WinStationOpenServerW"; File: "00000000-00007452.00000000.87841.00811000.00000020.mdmp") Found reference to API (Indicator: "SeDebugPrivilege"; File: "00000000-00007452.00000000.87841.00811000.00000020.mdmp") Found reference to API (Indicator: "RegQueryValueExW"; Source: "00000000-00002028.00000000.90115.70CDF000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00002028.00000000.90115.70CDF000.00000002.mdmp") Found reference to API (Indicator: "GetTempPathW"; Source: "00000000-00002028.00000000.90115.70CDF000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00002028.00000000.90115.70CDF000.00000002.mdmp") Found reference to API (Indicator: "DeleteFileW"; Source: "00000000-00002028.00000000.90115.70CDF000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00002028.00000000.90115.70CDF000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00002028.00000000.90115.70CDF000.00000002.mdmp") Found reference to API (Indicator: "GetTempFileNameW"; Source: "00000000-00002028.00000000.90115.70CDF000.00000002.mdmp") Found reference to API (Indicator: "RegEnumValueW"; Source: "00000000-00002028.00000000.90115.70CDF000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExW"; Source: "00000000-00002028.00000000.90115.70CDF000.00000002.mdmp") Found reference to API (Indicator: "RegSetValueExW"; Source: "00000000-00002028.00000000.90115.70CDF000.00000002.mdmp") Found reference to API (Indicator: "RegEnumKeyExW"; Source: "00000000-00002028.00000000.90115.70CDF000.00000002.mdmp") Found reference to API (Indicator: "RegCreateKeyExW"; Source: "00000000-00002028.00000000.90115.70CDF000.00000002.mdmp") Found reference to API (Indicator: "RegQueryInfoKeyW"; Source: "00000000-00002028.00000000.90115.70CDF000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00002028.00000000.90115.70CDF000.00000002.mdmp") Found reference to API (Indicator: "RegRestoreKeyW"; Source: "00000000-00002028.00000000.90115.70CDF000.00000002.mdmp") Found reference to API (Indicator: "RegLoadKeyW"; Source: "00000000-00002028.00000000.90115.70CDF000.00000002.mdmp") Found reference to API (Indicator: "RegUnLoadKeyW"; Source: "00000000-00002028.00000000.90115.70CDF000.00000002.mdmp") Found reference to API (Indicator: "OpenProcessToken"; Source: "00000000-00002028.00000000.90115.70CDF000.00000002.mdmp") Found reference to API (Indicator: "RegSaveKeyExW"; Source: "00000000-00002028.00000000.90115.70CDF000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00002028.00000000.90115.70CDF000.00000002.mdmp") Found reference to API (Indicator: "CopyFileW"; Source: "00000000-00002028.00000000.90115.70CDF000.00000002.mdmp") Found reference to API (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00002028.00000000.90115.70CDF000.00000002.mdmp") Found reference to API (Indicator: "LookupPrivilegeValueW"; Source: "00000000-00002028.00000000.90115.70CDF000.00000002.mdmp") Found reference to API (Indicator: "RegGetValueW"; Source: "00000000-00002028.00000000.90115.70CDF000.00000002.mdmp") Found reference to API (Indicator: "RegDeleteValueW"; Source: "00000000-00002028.00000000.90115.70CDF000.00000002.mdmp") Found reference to API (Indicator: "RegDeleteKeyExW"; Source: "00000000-00002028.00000000.90115.70CDF000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00002028.00000000.90115.70CDF000.00000002.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00002028.00000000.90115.70CDF000.00000002.mdmp") Found reference to API (Indicator: "SearchPathW"; Source: "00000000-00002028.00000000.90115.70CDF000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00002028.00000000.90115.70CDF000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointer"; Source: "00000000-00002028.00000000.90115.70CDF000.00000002.mdmp") Found reference to API (Indicator: "LocalAlloc"; Source: "00000000-00002028.00000000.90115.70CDF000.00000002.mdmp") Found reference to API (Indicator: "RegSetValueExA"; Source: "00000000-00002028.00000000.90115.70CDF000.00000002.mdmp") Found reference to API (Indicator: "CharNextW"; Source: "00000000-00002028.00000000.90115.70CDF000.00000002.mdmp") Found reference to API (Indicator: "IsCharAlphaNumericW"; Source: "00000000-00002028.00000000.90115.70CDF000.00000002.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00002028.00000000.90115.70CDF000.00000002.mdmp") Found reference to API (Indicator: "OutputDebugStringW"; Source: "00000000-00002028.00000000.90115.70CDF000.00000002.mdmp") Found reference to API (Indicator: "RegFlushKey"; Source: "00000000-00002028.00000000.90115.70CDF000.00000002.mdmp") Found reference to API (Indicator: "GetFileSize"; Source: "00000000-00002028.00000000.90115.70CDF000.00000002.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00002028.00000000.90115.70CDF000.00000002.mdmp") Found reference to API (Indicator: "LocalReAlloc"; Source: "00000000-00002028.00000000.90115.70CDF000.00000002.mdmp") Found reference to API (Indicator: "CharUpperW"; Source: "00000000-00002028.00000000.90115.70CDF000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00002028.00000000.90115.70CDF000.00000002.mdmp") Found reference to API (Indicator: "RtlCaptureContext"; Source: "00000000-00002028.00000000.90115.70CDF000.00000002.mdmp") Found reference to API (Indicator: "RtlLookupFunctionEntry"; Source: "00000000-00002028.00000000.90115.70CDF000.00000002.mdmp") Found reference to API (Indicator: "RtlVirtualUnwind"; Source: "00000000-00002028.00000000.90115.70CDF000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00002028.00000000.90115.70CDF000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00002028.00000000.90115.70CDF000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00002028.00000000.90115.70CDF000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00002028.00000000.90115.70CDF000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00002028.00000000.90115.70CDF000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00002028.00000000.90115.70CDF000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00002028.00000000.90115.70CDF000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00002028.00000000.90115.70CDF000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00002028.00000000.90115.70CDF000.00000002.mdmp") Found reference to API (Indicator: "RegConnectRegistryW"; Source: "00000000-00002028.00000000.90115.70CDF000.00000002.mdmp") Found reference to API (Indicator: "RegSaveKeyW"; Source: "00000000-00002028.00000000.90115.70CDF000.00000002.mdmp") Found reference to API (Indicator: "RegEnumKeyW"; Source: "00000000-00002028.00000000.90115.70CDF000.00000002.mdmp") Found reference to API (Indicator: "lstrcmpW"; Source: "00000000-00002028.00000000.90115.70CDF000.00000002.mdmp") Found reference to API (Indicator: "NtQueryKey"; Source: "00000000-00002028.00000000.90115.70CDF000.00000002.mdmp") Found reference to API (Indicator: "SetThreadUILanguage"; Source: "00000000-00002028.00000000.90115.70CDF000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00002028.00000000.90115.70CDF000.00000002.mdmp") Found reference to API (Indicator: "LoadStringW"; Source: "00000000-00002028.00000000.90115.70CDF000.00000002.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00002028.00000000.90115.70CDF000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleMode"; Source: "00000000-00002028.00000000.90115.70CDF000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00002028.00000000.90115.70CDF000.00000002.mdmp") Found reference to API (Indicator: "CompareStringW"; Source: "00000000-00002028.00000000.90115.70CDF000.00000002.mdmp") Found reference to API (Indicator: "GetThreadLocale"; Source: "00000000-00002028.00000000.90115.70CDF000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00002028.00000000.90115.70CDF000.00000002.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00002028.00000000.90115.70CDF000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleOutputCP"; Source: "00000000-00002028.00000000.90115.70CDF000.00000002.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00002028.00000000.90115.70CDF000.00000002.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00002028.00000000.90115.70CDF000.00000002.mdmp") Found reference to API (Indicator: "HeapValidate"; Source: "00000000-00002028.00000000.90115.70CDF000.00000002.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00002028.00000000.90115.70CDF000.00000002.mdmp") Found reference to API (Indicator: "HeapReAlloc"; Source: "00000000-00002028.00000000.90115.70CDF000.00000002.mdmp") Found reference to API (Indicator: "HeapSize"; Source: "00000000-00002028.00000000.90115.70CDF000.00000002.mdmp") Found reference to API (Indicator: "StrStrIW"; Source: "00000000-00002028.00000000.90115.70CDF000.00000002.mdmp") Found reference to API (Indicator: "lstrlenW"; Source: "00000000-00002028.00000000.90115.70CDF000.00000002.mdmp") Found reference to API (Indicator: "InitializeConditionVariable"; Source: "00000000-00004796.00000000.91471.DB88A000.00000002.mdmp") Found reference to API (Indicator: "SleepConditionVariableCS"; Source: "00000000-00004796.00000000.91471.DB88A000.00000002.mdmp") Found reference to API (Indicator: "WakeAllConditionVariable"; Source: "00000000-00004796.00000000.91471.DB88A000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00004796.00000000.91471.DB88A000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileW"; Source: "00000000-00004796.00000000.91471.DB88A000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExW"; Source: "00000000-00004796.00000000.91471.DB88A000.00000002.mdmp") Found reference to API (Indicator: "CoInitialize"; Source: "00000000-00004796.00000000.91471.DB88A000.00000002.mdmp") Found reference to API (Indicator: "CompareStringW"; Source: "00000000-00004796.00000000.91471.DB88A000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00004796.00000000.91471.DB88A000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemAlloc"; Source: "00000000-00004796.00000000.91471.DB88A000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00004796.00000000.91471.DB88A000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00004796.00000000.91471.DB88A000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00004796.00000000.91471.DB88A000.00000002.mdmp") Found reference to API (Indicator: "ExpandEnvironmentStringsW"; Source: "00000000-00004796.00000000.91471.DB88A000.00000002.mdmp") Found reference to API (Indicator: "CoUninitialize"; Source: "00000000-00004796.00000000.91471.DB88A000.00000002.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00004796.00000000.91471.DB88A000.00000002.mdmp") Found reference to API (Indicator: "SetThreadUILanguage"; Source: "00000000-00004796.00000000.91471.DB88A000.00000002.mdmp") Found reference to API (Indicator: "RegGetValueW"; Source: "00000000-00004796.00000000.91471.DB88A000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExW"; Source: "00000000-00004796.00000000.91471.DB88A000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00004796.00000000.91471.DB88A000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00004796.00000000.91471.DB88A000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesW"; Source: "00000000-00004796.00000000.91471.DB88A000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00004796.00000000.91471.DB88A000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00004796.00000000.91471.DB88A000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00004796.00000000.91471.DB88A000.00000002.mdmp") Found reference to API (Indicator: "LoadStringW"; Source: "00000000-00004796.00000000.91471.DB88A000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00004796.00000000.91471.DB88A000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00004796.00000000.91471.DB88A000.00000002.mdmp") Found reference to API (Indicator: "VerSetConditionMask"; Source: "00000000-00004796.00000000.91471.DB88A000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00004796.00000000.91471.DB88A000.00000002.mdmp") Found reference to API (Indicator: "CoInitializeEx"; Source: "00000000-00004796.00000000.91471.DB88A000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00004796.00000000.91471.DB88A000.00000002.mdmp") Found reference to API (Indicator: "VerifyVersionInfoW"; Source: "00000000-00004796.00000000.91471.DB88A000.00000002.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00004796.00000000.91471.DB88A000.00000002.mdmp") Found reference to API (Indicator: "SetConsoleTitleW"; Source: "00000000-00004796.00000000.91471.DB88A000.00000002.mdmp") Found reference to API (Indicator: "IsWow64Process"; Source: "00000000-00004796.00000000.91471.DB88A000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00004796.00000000.91471.DB88A000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00004796.00000000.91471.DB88A000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00004796.00000000.91471.DB88A000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00004796.00000000.91471.DB88A000.00000002.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00004796.00000000.91471.DB88A000.00000002.mdmp") Found reference to API (Indicator: "ResetEvent"; Source: "00000000-00004796.00000000.91471.DB88A000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00004796.00000000.91471.DB88A000.00000002.mdmp") Found reference to API (Indicator: "CreateEventW"; Source: "00000000-00004796.00000000.91471.DB88A000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00004796.00000000.91471.DB88A000.00000002.mdmp") Found reference to API (Indicator: "RtlCaptureContext"; Source: "00000000-00004796.00000000.91471.DB88A000.00000002.mdmp") Found reference to API (Indicator: "RtlLookupFunctionEntry"; Source: "00000000-00004796.00000000.91471.DB88A000.00000002.mdmp") Found reference to API (Indicator: "RtlVirtualUnwind"; Source: "00000000-00004796.00000000.91471.DB88A000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00004796.00000000.91471.DB88A000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00004796.00000000.91471.DB88A000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00004796.00000000.91471.DB88A000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00004796.00000000.91471.DB88A000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00004796.00000000.91471.DB88A000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00004796.00000000.91471.DB88A000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00004796.00000000.91471.DB88A000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00004796.00000000.91471.DB88A000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00004796.00000000.91471.DB88A000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00004796.00000000.91471.DB88A000.00000002.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00004796.00000000.91471.DB88A000.00000002.mdmp") Found reference to API (Indicator: "SearchPathW"; Source: "00000000-00004796.00000000.91471.DB88A000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDefaultUILanguage"; Source: "00000000-00004796.00000000.91471.DB88A000.00000002.mdmp") Found reference to API (Indicator: "GetUserDefaultUILanguage"; Source: "00000000-00004796.00000000.91471.DB88A000.00000002.mdmp") Found reference to API (Indicator: "GetLocaleInfoW"; Source: "00000000-00004796.00000000.91471.DB88A000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExW"; Source: "00000000-00004796.00000000.91471.DB88A000.00000002.mdmp") Found reference to API (Indicator: "UnmapViewOfFile"; Source: "00000000-00004796.00000000.91471.DB88A000.00000002.mdmp") Found reference to API (Indicator: "FindResourceExW"; Source: "00000000-00004796.00000000.91471.DB88A000.00000002.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00004796.00000000.91471.DB88A000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00004796.00000000.91471.DB88A000.00000002.mdmp") Found reference to API (Indicator: "CreateFileMappingW"; Source: "00000000-00004796.00000000.91471.DB88A000.00000002.mdmp") Found reference to API (Indicator: "MapViewOfFile"; Source: "00000000-00004796.00000000.91471.DB88A000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00004796.00000000.91471.DB88A000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00004796.00000000.91471.DB88A000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00004796.00000000.91471.DB88A000.00000002.mdmp") Found reference to API (Indicator: "SetErrorMode"; Source: "00000000-00004796.00000000.91471.DB88A000.00000002.mdmp") Found reference to API (Indicator: "RegEnumKeyExW"; Source: "00000000-00004796.00000000.91471.DB88A000.00000002.mdmp") Found reference to API (Indicator: "InitializeConditionVariable"; Source: "00000000-00005988.00000000.91480.DB88A000.00000002.mdmp") Found reference to API (Indicator: "SleepConditionVariableCS"; Source: "00000000-00005988.00000000.91480.DB88A000.00000002.mdmp") Found reference to API (Indicator: "WakeAllConditionVariable"; Source: "00000000-00005988.00000000.91480.DB88A000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00005988.00000000.91480.DB88A000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileW"; Source: "00000000-00005988.00000000.91480.DB88A000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExW"; Source: "00000000-00005988.00000000.91480.DB88A000.00000002.mdmp") Found reference to API (Indicator: "CoInitialize"; Source: "00000000-00005988.00000000.91480.DB88A000.00000002.mdmp") Found reference to API (Indicator: "CompareStringW"; Source: "00000000-00005988.00000000.91480.DB88A000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00005988.00000000.91480.DB88A000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemAlloc"; Source: "00000000-00005988.00000000.91480.DB88A000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00005988.00000000.91480.DB88A000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00005988.00000000.91480.DB88A000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00005988.00000000.91480.DB88A000.00000002.mdmp") Found reference to API (Indicator: "ExpandEnvironmentStringsW"; Source: "00000000-00005988.00000000.91480.DB88A000.00000002.mdmp") Found reference to API (Indicator: "CoUninitialize"; Source: "00000000-00005988.00000000.91480.DB88A000.00000002.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00005988.00000000.91480.DB88A000.00000002.mdmp") Found reference to API (Indicator: "SetThreadUILanguage"; Source: "00000000-00005988.00000000.91480.DB88A000.00000002.mdmp") Found reference to API (Indicator: "RegGetValueW"; Source: "00000000-00005988.00000000.91480.DB88A000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExW"; Source: "00000000-00005988.00000000.91480.DB88A000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00005988.00000000.91480.DB88A000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00005988.00000000.91480.DB88A000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesW"; Source: "00000000-00005988.00000000.91480.DB88A000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00005988.00000000.91480.DB88A000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00005988.00000000.91480.DB88A000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00005988.00000000.91480.DB88A000.00000002.mdmp") Found reference to API (Indicator: "LoadStringW"; Source: "00000000-00005988.00000000.91480.DB88A000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00005988.00000000.91480.DB88A000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00005988.00000000.91480.DB88A000.00000002.mdmp") Found reference to API (Indicator: "VerSetConditionMask"; Source: "00000000-00005988.00000000.91480.DB88A000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00005988.00000000.91480.DB88A000.00000002.mdmp") Found reference to API (Indicator: "CoInitializeEx"; Source: "00000000-00005988.00000000.91480.DB88A000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00005988.00000000.91480.DB88A000.00000002.mdmp") Found reference to API (Indicator: "VerifyVersionInfoW"; Source: "00000000-00005988.00000000.91480.DB88A000.00000002.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00005988.00000000.91480.DB88A000.00000002.mdmp") Found reference to API (Indicator: "SetConsoleTitleW"; Source: "00000000-00005988.00000000.91480.DB88A000.00000002.mdmp") Found reference to API (Indicator: "IsWow64Process"; Source: "00000000-00005988.00000000.91480.DB88A000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00005988.00000000.91480.DB88A000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00005988.00000000.91480.DB88A000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00005988.00000000.91480.DB88A000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00005988.00000000.91480.DB88A000.00000002.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00005988.00000000.91480.DB88A000.00000002.mdmp") Found reference to API (Indicator: "ResetEvent"; Source: "00000000-00005988.00000000.91480.DB88A000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00005988.00000000.91480.DB88A000.00000002.mdmp") Found reference to API (Indicator: "CreateEventW"; Source: "00000000-00005988.00000000.91480.DB88A000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00005988.00000000.91480.DB88A000.00000002.mdmp") Found reference to API (Indicator: "RtlCaptureContext"; Source: "00000000-00005988.00000000.91480.DB88A000.00000002.mdmp") Found reference to API (Indicator: "RtlLookupFunctionEntry"; Source: "00000000-00005988.00000000.91480.DB88A000.00000002.mdmp") Found reference to API (Indicator: "RtlVirtualUnwind"; Source: "00000000-00005988.00000000.91480.DB88A000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00005988.00000000.91480.DB88A000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00005988.00000000.91480.DB88A000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00005988.00000000.91480.DB88A000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00005988.00000000.91480.DB88A000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00005988.00000000.91480.DB88A000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00005988.00000000.91480.DB88A000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00005988.00000000.91480.DB88A000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00005988.00000000.91480.DB88A000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00005988.00000000.91480.DB88A000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00005988.00000000.91480.DB88A000.00000002.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00005988.00000000.91480.DB88A000.00000002.mdmp") Found reference to API (Indicator: "SearchPathW"; Source: "00000000-00005988.00000000.91480.DB88A000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDefaultUILanguage"; Source: "00000000-00005988.00000000.91480.DB88A000.00000002.mdmp") Found reference to API (Indicator: "GetUserDefaultUILanguage"; Source: "00000000-00005988.00000000.91480.DB88A000.00000002.mdmp") Found reference to API (Indicator: "GetLocaleInfoW"; Source: "00000000-00005988.00000000.91480.DB88A000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExW"; Source: "00000000-00005988.00000000.91480.DB88A000.00000002.mdmp") Found reference to API (Indicator: "UnmapViewOfFile"; Source: "00000000-00005988.00000000.91480.DB88A000.00000002.mdmp") Found reference to API (Indicator: "FindResourceExW"; Source: "00000000-00005988.00000000.91480.DB88A000.00000002.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00005988.00000000.91480.DB88A000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00005988.00000000.91480.DB88A000.00000002.mdmp") Found reference to API (Indicator: "CreateFileMappingW"; Source: "00000000-00005988.00000000.91480.DB88A000.00000002.mdmp") Found reference to API (Indicator: "MapViewOfFile"; Source: "00000000-00005988.00000000.91480.DB88A000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00005988.00000000.91480.DB88A000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00005988.00000000.91480.DB88A000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00005988.00000000.91480.DB88A000.00000002.mdmp") Found reference to API (Indicator: "SetErrorMode"; Source: "00000000-00005988.00000000.91480.DB88A000.00000002.mdmp") Found reference to API (Indicator: "RegEnumKeyExW"; Source: "00000000-00005988.00000000.91480.DB88A000.00000002.mdmp")40:T480,Found reference to API "GetLastError" (Indicator: "GetLastError"; File: "Waaake_Setup.exe") file/memory contains long string with (Indicator: "GetLastError"; File: "System.dll") Found reference to API "REGEDIT: CreateFile failed, GetLastError() = %d" (Indicator: "GetLastError"; Source: "00000000-00002028.00000000.90115.70CDF000.00000002.mdmp") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00002028.00000000.90115.70CDF000.00000002.mdmp") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00002028.00000000.90115.70CDF000.00000002.mdmp") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00004796.00000000.91471.DB88A000.00000002.mdmp") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00004796.00000000.91471.DB88A000.00000002.mdmp") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00005988.00000000.91480.DB88A000.00000002.mdmp") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00005988.00000000.91480.DB88A000.00000002.mdmp")41:Td03,"Software\Microsoft\Windows\CurrentVersion" in Source: Waaake_Setup.exe "%WINDIR%\system32\cmd.exe /d /s /c "%windir%\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v Machin" in Source: 00000000-00006656-00000C47-10011468488, "%WINDIR%\system32\cmd.exe /d /s /c "reg query "HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0" /v FeatureSet"" in Source: 00000000-00006656-00000C47-48285959060, "%WINDIR%\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid" in Source: 00000000-00000580-00000C47-2908361530, "reg query "HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0" /v FeatureSet" in Source: 00000000-00002856-00000C47-2626615688, "/d /s /c "%windir%\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid"" in Source: cmd.exe, "QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid" in Source: reg.exe, "/d /s /c "reg query "HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0" /v FeatureSet"" in Source: cmd.exe, "Software\Microsoft\Windows\CurrentVersion\Policies\System" in Source: 00000000-00002028.00000000.90115.70CDF000.00000002.mdmp, "HKEY_LOCAL_MACHINE\SOFTWARE" in Source: 00000000-00002028.00000000.90115.70CDF000.00000002.mdmp, "C:\WINDOWS\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid" in Source: 00000000-00002028.00000000.90115.C9470000.00000004.mdmp, "KEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography" in Source: 00000000-00002028.00000000.90115.C9470000.00000004.mdmp, "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography" in Source: 00000000-00002028.00000000.90115.C9470000.00000004.mdmp, 00000000-00002028.00000000.90115.C9750000.00000004.mdmp, "SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 00000000-00004796.00000000.91471.DB88A000.00000002.mdmp, "SOFTWARE\Microsoft\PowerShell" in Source: 00000000-00004796.00000000.91471.DB88A000.00000002.mdmp, "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 00000000-00004796.00000000.91471.DB88A000.00000002.mdmp, "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 00000000-00004796.00000000.91471.DB88A000.00000002.mdmp, "SOFTWARE\Microsoft\PowerShell\3" in Source: 00000000-00004796.00000000.91471.DB88A000.00000002.mdmp, "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00004796.00000000.91471.DB88A000.00000002.mdmp, "SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 00000000-00005988.00000000.91480.DB88A000.00000002.mdmp, "SOFTWARE\Microsoft\PowerShell" in Source: 00000000-00005988.00000000.91480.DB88A000.00000002.mdmp, "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 00000000-00005988.00000000.91480.DB88A000.00000002.mdmp, "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 00000000-00005988.00000000.91480.DB88A000.00000002.mdmp, "SOFTWARE\Microsoft\PowerShell\3" in Source: 00000000-00005988.00000000.91480.DB88A000.00000002.mdmp, "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00005988.00000000.91480.DB88A000.00000002.mdmp, "e QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid"" in Source: 00000000-00006656.00000000.89710.00004000.00000004.mdmp42:T931,Process Waaake_Setup.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:5000:64:WilError_01" Process Waaake_Setup.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:5000:168:WilStaging_02" Process Waaake_Setup.exe created mutex with name "\BaseNamedObjects\SyncRootManager" Process Waaake_Setup.exe created mutex with name "Local\SM0:5000:64:WilError_01" Process Waaake_Setup.exe created mutex with name "Local\SM0:5000:168:WilStaging_02" Process Waaake_Setup.exe created mutex with name "SM0:5000:64:WilError_01" Process Waaake_Setup.exe created mutex with name "1aa323d8-1af7-575c-aa21-ff3f6189d55f" Process Waaake_Setup.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:5000:64:WilError_01" Process Waaake_Setup.exe created mutex with name "\Sessions\1\BaseNamedObjects\1aa323d8-1af7-575c-aa21-ff3f6189d55f" Process tasklist.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:7452:168:WilStaging_02" Process tasklist.exe created mutex with name "SM0:7452:168:WilStaging_02" Process waaake.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:6656:304:WilStaging_02" Process waaake.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:6656:304:WilStaging_02" Process waaake.exe created mutex with name "Local\SM0:6656:304:WilStaging_02" Process waaake.exe created mutex with name "SM0:6656:304:WilStaging_02" Process waaake.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:7804:304:WilStaging_02" Process waaake.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:7804:304:WilStaging_02" Process waaake.exe created mutex with name "Local\SM0:7804:304:WilStaging_02" Process waaake.exe created mutex with name "SM0:7804:304:WilStaging_02" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:4796:304:WilStaging_02" Process powershell.exe created mutex with name "SM0:4796:304:WilStaging_02" Process powershell.exe created mutex with name "Local\SM0:4796:304:WilStaging_02" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:4796:304:WilStaging_02" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:8116:304:WilStaging_02" Process powershell.exe created mutex with name "SM0:8116:304:WilStaging_02"43:Ta21,Antivirus vendors marked dropped file "installer.exe" as clean (type is "PE32 executable for MS Windows 4.00 (GUI) Intel i386 Nullsoft Installer self-extracting archive 5 sections"), Antivirus vendors marked dropped file "vk_swiftshader.dll" as clean (type is "PE32+ executable for MS Windows 10.00 (DLL) x86-64 10 sections"), Antivirus vendors marked dropped file "ffmpeg.dll" as clean (type is "PE32+ executable for MS Windows 10.00 (DLL) x86-64 9 sections"), Antivirus vendors marked dropped file "vulkan-1.dll" as clean (type is "PE32+ executable for MS Windows 10.00 (DLL) x86-64 10 sections"), Antivirus vendors marked dropped file "v8_context_snapshot.bin" as clean (type is "Unknown"), Antivirus vendors marked dropped file "libEGL.dll" as clean (type is "PE32+ executable for MS Windows 10.00 (DLL) x86-64 10 sections"), Antivirus vendors marked dropped file "nsis7z.dll" as clean (type is "PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections"), Antivirus vendors marked dropped file "snapshot_blob.bin" as clean (type is "Unknown"), Antivirus vendors marked dropped file "Uninstall waaake.exe" as clean (type is "PE32 executable for MS Windows 4.00 (GUI) Intel i386 Nullsoft Installer self-extracting archive 5 sections"), Antivirus vendors marked dropped file "elevate.exe" as clean (type is "PE32 executable for MS Windows 6.00 (console) Intel i386 6 sections"), Antivirus vendors marked dropped file "StdUtils.dll" as clean (type is "PE32 executable for MS Windows 5.00 (DLL) Intel i386 5 sections"), Antivirus vendors marked dropped file "System.dll" as clean (type is "PE32 executable for MS Windows 4.00 (DLL) Intel i386 4 sections"), Antivirus vendors marked dropped file "SpiderBanner.dll" as clean (type is "PE32 executable for MS Windows 5.00 (DLL) Intel i386 5 sections"), Antivirus vendors marked dropped file "WAAAKE.lnk" as clean (type is "MS Windows shortcut Item id list present Points to a file or directory Has Description string Has Relative path Has Working directory Icon number=0 Unicoded HasExpIcon "%USERPROFILE%\AppData\Local\Programs\waaake\waaake.exe" MachineID arrqsue2q5eee6x KnownFolderID F3CE0F7C-4901-4ACC-8648-D5D44B04EF8F Archive ctime=Wed Feb 25 01:52:09 2026 atime=Wed Feb 25 01:52:09 2026 mtime=Sun Jun 29 22:58:16 2025 length=199170048 window=normal IDListSize 0x021c Root folder "59031A47-3F72-44A7-89C5-5595FE6B30EE" LocalBasePath "C:\Users\HAPUBWS\AppData\Local\Programs\waaake\waaake.exe""), Antivirus vendors marked dropped file "libGLESv2.dll" as clean (type is "PE32+ executable for MS Windows 10.00 (DLL) x86-64 10 sections")44:T9fe,"powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\VERSION.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll" - [base:0; Status:c0000135]45:T56a,"ffmpeg.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "vulkan-1.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "libEGL.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "nsis7z.dll" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "elevate.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "StdUtils.dll" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "System.dll" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "SpiderBanner.dll" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "nsExec.dll" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE46:T1314,"Software\Microsoft\Windows\CurrentVersion\Policies\System" in Source: 00000000-00002028.00000000.90115.70CDF000.00000002.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE" in Source: 00000000-00002028.00000000.90115.70CDF000.00000002.mdmp "C:\WINDOWS\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid" in Source: 00000000-00002028.00000000.90115.C9470000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography" in Source: 00000000-00002028.00000000.90115.C9470000.00000004.mdmp "KEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography" in Source: 00000000-00002028.00000000.90115.C9470000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography" in Source: 00000000-00002028.00000000.90115.C9750000.00000004.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 00000000-00004796.00000000.91471.DB88A000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell" in Source: 00000000-00004796.00000000.91471.DB88A000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 00000000-00004796.00000000.91471.DB88A000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 00000000-00004796.00000000.91471.DB88A000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\3" in Source: 00000000-00004796.00000000.91471.DB88A000.00000002.mdmp "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00004796.00000000.91471.DB88A000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 00000000-00005988.00000000.91480.DB88A000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell" in Source: 00000000-00005988.00000000.91480.DB88A000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 00000000-00005988.00000000.91480.DB88A000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 00000000-00005988.00000000.91480.DB88A000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\3" in Source: 00000000-00005988.00000000.91480.DB88A000.00000002.mdmp "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00005988.00000000.91480.DB88A000.00000002.mdmp "e QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid"" in Source: 00000000-00006656.00000000.89710.00004000.00000004.mdmp, "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00006656.00000000.89710.4FC00000.00000004.mdmp, "\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{D63B10C5-BB46-4990" in Source: 00000000-00006656.00000000.89710.4FC00000.00000004.mdmp, "y\Machine\Software\Classes\CLSID\{2B46E70F-CDA7-473E-89F6-DC9630A2390B}\Instance" in Source: 00000000-00006656.00000000.89710.4FC00000.00000004.mdmp, "ne\Software\Classes\AppID\waaake.exe" in Source: 00000000-00006656.00000000.89710.4FC00000.00000004.mdmp, "574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{BCDE0395-E52F-467C-8E3D-C45792916" in Source: 00000000-00006656.00000000.89710.4FC00000.00000004.mdmp, "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v Machi" in Source: 00000000-00006656.00000001.91631.00004000.00000004.mdmp, "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography" in Source: 00000000-00006656.00000001.91631.00028000.00000004.mdmp, "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00006656.00000001.91631.4FC00000.00000004.mdmp, "\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{D63B10C5-BB46-4990" in Source: 00000000-00006656.00000001.91631.4FC00000.00000004.mdmp, "Software\Classes\CLSID\{000003" in Source: 00000000-00006656.00000001.91631.4FC8C000.00000004.mdmp, "y\Machine\Software\Classes\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00006656.00000001.91631.4FC8C000.00000004.mdmp, "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{7" in Source: 00000000-00006656.00000001.91631.93800000.00000004.mdmp, "reg query "HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0" /v FeatureSet" in Source: 00000000-00007184.00000000.91127.90A70000.00000004.mdmp, "HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0" in Source: 00000000-00007184.00000000.91127.90A70000.00000004.mdmp, "KEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0" in Source: 00000000-00007184.00000000.91127.90A70000.00000004.mdmp, "x3d1b3dff_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0" in Source: 00000000-00007184.00000000.91127.90CE0000.00000004.mdmp, "HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0" in Source: 00000000-00007184.00000000.91127.90CE0000.00000004.mdmp, "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00007452.00000000.87841.02FE0000.00000004.mdmp47:T4bf2,"Waaake_Setup.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 73ea0000 "Waaake_Setup.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 73ea0000 "Waaake_Setup.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 73ea0000 "Waaake_Setup.exe" loaded module "KERNEL32" at base 74bf0000 "Waaake_Setup.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 72560000 "Waaake_Setup.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73540000 "Waaake_Setup.exe" loaded module "%WINDIR%\SYSTEM32\USERENV.DLL" at base 72530000 "Waaake_Setup.exe" loaded module "%WINDIR%\SYSTEM32\SETUPAPI.DLL" at base 76bc0000 "Waaake_Setup.exe" loaded module "NTDLL.DLL" at base 77070000 "Waaake_Setup.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 739e0000 "Waaake_Setup.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 72fe0000 "Waaake_Setup.exe" loaded module "%WINDIR%\SYSTEM32\DWMAPI.DLL" at base 72630000 "Waaake_Setup.exe" loaded module "%WINDIR%\SYSTEM32\CRYPTBASE.DLL" at base 73a80000 "Waaake_Setup.exe" loaded module "%WINDIR%\SYSTEM32\OLEACC.DLL" at base 724d0000 "Waaake_Setup.exe" loaded module "%WINDIR%\SYSTEM32\CLBCATQ.DLL" at base 74f20000 "Waaake_Setup.exe" loaded module "%WINDIR%\SYSTEM32\NTMARTA.DLL" at base 72a20000 "Waaake_Setup.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 73930000 "Waaake_Setup.exe" loaded module "%WINDIR%\SYSTEM32\SHFOLDER.DLL" at base 724c0000 "Waaake_Setup.exe" loaded module "KERNEL32.DLL" at base 74bf0000 "Waaake_Setup.exe" loaded module "%WINDIR%\SYSTEM32\ICONCODECSERVICE.DLL" at base 72b80000 "Waaake_Setup.exe" loaded module "%TEMP%\NSBD764.TMP\SYSTEM.DLL" at base 724b0000 "Waaake_Setup.exe" loaded module "%TEMP%\NSBD764.TMP\STDUTILS.DLL" at base 72490000 "Waaake_Setup.exe" loaded module "%WINDIR%\SYSTEM32\RICHED20.DLL" at base 72410000 "Waaake_Setup.exe" loaded module "COMCTL32.DLL" at base 72d00000 "Waaake_Setup.exe" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 73ad0000 "Waaake_Setup.exe" loaded module "%TEMP%\NSBD764.TMP\SPIDERBANNER.DLL" at base 723a0000 "Waaake_Setup.exe" loaded module "PSAPI" at base 74b50000 "Waaake_Setup.exe" loaded module "%TEMP%\NSBD764.TMP\NSEXEC.DLL" at base 72390000 "Waaake_Setup.exe" loaded module "OLEAUT32.DLL" at base 73e00000 "Waaake_Setup.exe" loaded module "RPCRT4.DLL" at base 73d00000 "Waaake_Setup.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-WINDOW-EXT-L1-1-0.DLL" at base 76a30000 "Waaake_Setup.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-INTEGRATION-L1-1-0.DLL" at base 76a30000 "Waaake_Setup.exe" loaded module "API-MS-WIN-CORE-COM-L1-1-0.DLL" at base 74fb0000 "Waaake_Setup.exe" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 74310000 "Waaake_Setup.exe" loaded module "%TEMP%\NSBD764.TMP\NSIS7Z.DLL" at base 71ef0000 "Waaake_Setup.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 77060000 "Waaake_Setup.exe" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 75650000 "Waaake_Setup.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 74410000 "Waaake_Setup.exe" loaded module "%WINDIR%\SYSWOW64\\WINDOWS.STATEREPOSITORYPS.DLL" at base 726f0000 "Waaake_Setup.exe" loaded module "%WINDIR%\SYSWOW64\SHELL32.DLL" at base 75650000 "Waaake_Setup.exe" loaded module "SHELL32.DLL" at base 75650000 "Waaake_Setup.exe" loaded module "%WINDIR%\SYSWOW64\WINTYPES.DLL" at base 71f70000 "Waaake_Setup.exe" loaded module "%WINDIR%\SYSTEM32\NTSHRUI.DLL" at base 71ea0000 "Waaake_Setup.exe" loaded module "%WINDIR%\SYSWOW64\WINDOWS.STORAGE.DLL" at base 74410000 "Waaake_Setup.exe" loaded module "CSCAPI.DLL" at base 72930000 "Waaake_Setup.exe" loaded module "%TEMP%\NSBD764.TMP\WINSHELL.DLL" at base 10000000 "Waaake_Setup.exe" loaded module "%WINDIR%\SYSWOW64\OLEAUT32.DLL" at base 73e00000 "Waaake_Setup.exe" loaded module "OLEAUT32" at base 73e00000 "Waaake_Setup.exe" loaded module "%WINDIR%\SYSWOW64\ONECORECOMMONPROXYSTUB.DLL" at base 71db0000 "Waaake_Setup.exe" loaded module "%WINDIR%\SYSWOW64\ONECOREUAPCOMMONPROXYSTUB.DLL" at base 71ad0000 "cmd.exe" loaded module "KERNEL32" at base 74bf0000 "cmd.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 73ea0000 "cmd.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 73ea0000 "cmd.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 73ea0000 "cmd.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 742e0000 "cmd.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 73ea0000 "cmd.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 73ea0000 "cmd.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 73ea0000 "cmd.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 72560000 "cmd.exe" loaded module "KERNEL32.DLL" at base 74bf0000 "cmd.exe" loaded module "NTDLL.DLL" at base 77070000 "tasklist.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 73ea0000 "tasklist.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 73ea0000 "tasklist.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 73ea0000 "tasklist.exe" loaded module "KERNEL32" at base 74bf0000 "tasklist.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 72560000 "tasklist.exe" loaded module "RPCRT4.DLL" at base 73d00000 "tasklist.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 73ea0000 "tasklist.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMPROX.DLL" at base 71d30000 "tasklist.exe" loaded module "%WINDIR%\SYSTEM32\WINSTA.DLL" at base 729c0000 "tasklist.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMSVC.DLL" at base 71cb0000 "tasklist.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\FASTPROX.DLL" at base 71bf0000 "tasklist.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL" at base 73ea0000 "tasklist.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-1-0.DLL" at base 73ea0000 "waaake.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 7ff822890000 "waaake.exe" loaded module "KERNEL32.DLL" at base 7ff821170000 "waaake.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ff81f4e0000 "waaake.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ff81f4e0000 "waaake.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ff81f4e0000 "waaake.exe" loaded module "KERNEL32" at base 7ff821170000 "waaake.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ff812c90000 "waaake.exe" loaded module "BCRYPTPRIMITIVES.DLL" at base 7ff81f460000 "waaake.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 7ff81f4e0000 "waaake.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 7ff81f4e0000 "waaake.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 7ff81f4e0000 "waaake.exe" loaded module "POWRPROF.DLL" at base 7ff81ec60000 "waaake.exe" loaded module "USER32.DLL" at base 22a500f0000 "waaake.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7ff81d280000 "waaake.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 7ff81e470000 "waaake.exe" loaded module "SHELL32.DLL" at base 7ff821220000 "waaake.exe" loaded module "API-MS-WIN-DOWNLEVEL-SHELL32-L1-1-0.DLL" at base 7ff8226d0000 "waaake.exe" loaded module "ADVAPI32.DLL" at base 7ff820220000 "waaake.exe" loaded module "KBDUS.DLL" at base 7ff809dc0000 "waaake.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 7ff820ab0000 "waaake.exe" loaded module "API-MS-WIN-SHCORE-SCALING-L1-1-1.DLL" at base 7ff8226d0000 "waaake.exe" loaded module "OLE32.DLL" at base 7ff81ff00000 "waaake.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 7ff81ecd0000 "waaake.exe" loaded module "NTDLL.DLL" at base 7ff8228f0000 "waaake.exe" loaded module "COMCTL32.DLL" at base 7ff80e870000 "waaake.exe" loaded module "RPCRT4.DLL" at base 7ff8203a0000 "waaake.exe" loaded module "%WINDIR%\SYSTEM32\NLAAPI.DLL" at base 7ff81a8c0000 "waaake.exe" loaded module "GDI32.DLL" at base 7ff822780000 "waaake.exe" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 7ff820e60000 "waaake.exe" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 7ff81ff00000 "waaake.exe" loaded module "API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 7ff820ab0000 "waaake.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.UI.DLL" at base 7ff810c00000 "waaake.exe" loaded module "WTSAPI32.DLL" at base 7ff81ad30000 "waaake.exe" loaded module "%WINDIR%\SYSTEM32\MMDEVAPI.DLL" at base 7ff8197a0000 "waaake.exe" loaded module "CFGMGR32.DLL" at base 7ff81f8f0000 "waaake.exe" loaded module "MSCMS.DLL" at base 7ff807260000 "waaake.exe" loaded module "%WINDIR%\SYSTEM32\ICONCODECSERVICE.DLL" at base 7ff801d30000 "waaake.exe" loaded module "DWMAPI.DLL" at base 7ff81d4f0000 "waaake.exe" loaded module "API-MS-WIN-POWER-BASE-L1-1-0.DLL" at base 7ff81ec60000 "waaake.exe" loaded module "%WINDIR%\SYSTEM32\DATAEXCHANGE.DLL" at base 7ff8087a0000 "waaake.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.GLOBALIZATION.DLL" at base 7ff80ebc0000 "waaake.exe" loaded module "%WINDIR%\SYSTEM32\TWINAPI.DLL" at base 7ff809080000 "waaake.exe" loaded module "ATLTHUNK.DLL" at base 7ff8024a0000 "waaake.exe" loaded module "SHLWAPI.DLL" at base 7ff822660000 "waaake.exe" loaded module "%WINDIR%\SYSTEM32\MSSPELLCHECKINGFACILITY.DLL" at base 7ff80c040000 "waaake.exe" loaded module "%WINDIR%\SYSTEM32\ONECOREUAPCOMMONPROXYSTUB.DLL" at base 7ff818b60000 "waaake.exe" loaded module "OLEACC.DLL" at base 7ff8087f0000 "waaake.exe" loaded module "OLEAUT32.DLL" at base 7ff8202d0000 "waaake.exe" loaded module "%WINDIR%\SYSTEM32\DIRECTMANIPULATION.DLL" at base 7ff80eb20000 "waaake.exe" loaded module "BCRYPTPRIMITIVES" at base 7ff81f460000 "waaake.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 7ff81e080000 "cmd.exe" loaded module "KERNEL32" at base 7ff821170000 "cmd.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 7ff81f4e0000 "cmd.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 7ff81f4e0000 "cmd.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 7ff81f4e0000 "cmd.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 7ff822890000 "cmd.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ff81f4e0000 "cmd.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ff81f4e0000 "cmd.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ff81f4e0000 "cmd.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ff812c90000 "cmd.exe" loaded module "KERNEL32.DLL" at base 7ff821170000 "cmd.exe" loaded module "NTDLL.DLL" at base 7ff8228f0000 "reg.exe" loaded module "KERNEL32" at base 7ff821170000 "reg.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 7ff81f4e0000 "reg.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 7ff81f4e0000 "reg.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 7ff81f4e0000 "reg.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 7ff822890000 "reg.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ff81f4e0000 "reg.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ff81f4e0000 "reg.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ff81f4e0000 "reg.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ff812c90000 "reg.exe" loaded module "KERNEL32.DLL" at base 7ff821170000 "waaake.exe" loaded module "USER32.DLL" at base 1418bf20000 "waaake.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 7ff817e60000 "powershell.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ff81f4e0000 "powershell.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ff81f4e0000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ff81f4e0000 "powershell.exe" loaded module "KERNEL32" at base 7ff821170000 "powershell.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ff812c90000 "powershell.exe" loaded module "KERNEL32.DLL" at base 7ff821170000 "powershell.exe" loaded module "ADVAPI32.DLL" at base 7ff820220000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSCOREEI.DLL" at base 7ff816ac0000 "powershell.exe" loaded module "SHLWAPI.DLL" at base 7ff822660000 "powershell.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 7ff81ecd0000 "powershell.exe" loaded module "VERSION.DLL" at base 7ff8179a0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLR.DLL" at base 7ffffa010000 "powershell.exe" loaded module "USER32.DLL" at base 7ff820fe0000 "powershell.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 7ff81f4e0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSCOREE.DLL" at base 0 "powershell.exe" loaded module "MSCOREE.DLL" at base 7ff817070000 "powershell.exe" loaded module "NTDLL" at base 7ff8228f0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 7ff820ab0000 "powershell.exe" loaded module "PSAPI.DLL" at base 1e074ae0000 "powershell.exe" loaded module "RPCRT4.DLL" at base 7ff8203a0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MSCORLIB\FE2524177EB3088C77BE666722039F52\MSCORLIB.NI.DLL" at base 7fffefc20000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\OLE32.DLL" at base 0 "powershell.exe" loaded module "OLE32.DLL" at base 7ff81ff00000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 0 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 7ff820ab0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\OLEAUT32.DLL" at base 0 "powershell.exe" loaded module "OLEAUT32.DLL" at base 7ff8202d0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM\E43DD9C73AB5615E461BF5109C3FACD6\SYSTEM.NI.DLL" at base 7ffff93a0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CORE\0D59B0E237D7519417DE10CD84BDA4E7\SYSTEM.CORE.NI.DLL" at base 7fffef1a0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.PB378EC07#\B5BA37E1558CED178A99011A1D659B52\MICROSOFT.POWERSHELL.CONSOLEHOST.NI.DLL" at base 7ff80c7c0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 7ff81e080000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 7ff81f460000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\OLEAUT32.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.MANAA57FC8CC#\6DA01910C256231D1C50AD0AACEE5941\SYSTEM.MANAGEMENT.AUTOMATION.NI.DLL" at base 7fffed130000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\COMBASE.DLL" at base 0 "powershell.exe" loaded module "COMBASE.DLL" at base 7ff820ab0000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 7ff820ab0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 0 "powershell.exe" loaded module "NTDLL.DLL" at base 7ff8228f0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\SHELL32.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\PSAPI.DLL" at base 0 "powershell.exe" loaded module "SHELL32.DLL" at base 7ff821220000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\NTDLL.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.MANAGEMENT.AUTOMATION\V4.0_3.0.0.0__31BF3856AD364E35\WINTRUST.DLL" at base 0 "powershell.exe" loaded module "WINTRUST.DLL" at base 7ff81f9e0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.MANAGEMENT.AUTOMATION\V4.0_3.0.0.0__31BF3856AD364E35\AMSI.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WINTRUST.DLL" at base 7ff81f9e0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 7ff81fb40000 "powershell.exe" loaded module "AMSI.DLL" at base 7ff8169e0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 7ff8179a0000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\MPOAV.DLL" at base 7ff814630000 "powershell.exe" loaded module "CRYPT32.DLL" at base 7ff81fb40000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\CRYPT32.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\GY3205HL.DLL" at base 7ff80c770000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.MF49F6405#\7B1F35FB0C2D6955CE5AF2BD372C65F2\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NI.DLL" at base 7ff80bfa0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CRYPT32.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.MANAGEMENT\B221AF81285C1305324612E6DC9C88FF\SYSTEM.MANAGEMENT.NI.DLL" at base 7ff8017b0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DIRED13B18A9#\8AD4C0AF5B3D51A0F3A4DAC0D44D85D4\SYSTEM.DIRECTORYSERVICES.NI.DLL" at base 7ff801640000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.XML\5EE35DEBFC22F727E70E4479DDCBC045\SYSTEM.XML.NI.DLL" at base 7fffec880000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\VERSION.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DATA\7BED49C46DE9295A8453DB205C60A028\SYSTEM.DATA.NI.DLL" at base 7fffebf10000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\SYSTEM.DATA\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.DATA.DLL" at base 7fffebba0000 "powershell.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 7ff81f4e0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLRJIT.DLL" at base 7ff8014f0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.P6F792626#\7FF5199E757CB8AF9AD949453F698D09\MICROSOFT.POWERSHELL.SECURITY.NI.DLL" at base 7ff80a240000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.TRANSACTIONS\604272B0FAEC2E09D53D38E03BC89C6C\SYSTEM.TRANSACTIONS.NI.DLL" at base 7ffffb780000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFIGURATION\4BEB1EECA20B27D4BD1BB9880F03CC2A\SYSTEM.CONFIGURATION.NI.DLL" at base 7ffff2360000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\SYSTEM.TRANSACTIONS\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.TRANSACTIONS.DLL" at base 7ff80a1f0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\SECUR32.DLL" at base 0 "powershell.exe" loaded module "SECUR32.DLL" at base 7ff815120000 "powershell.exe" loaded module "PSAPI.DLL" at base 1e681450000 "powershell.exe" loaded module "USER32.DLL" at base 18fb1c50000 "powershell.exe" loaded module "PSAPI.DLL" at base 7ff820fd000048:T6f9,"Waaake_Setup.exe" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "Waaake_Setup.exe" was detected as "Microsoft Linker" and name: "Linker" "ffmpeg.dll" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "ffmpeg.dll" was detected as "Microsoft Linker" and name: "Linker" "vulkan-1.dll" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "vulkan-1.dll" was detected as "Microsoft Linker" and name: "Linker" "libEGL.dll" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "libEGL.dll" was detected as "Microsoft Linker" and name: "Linker" "nsis7z.dll" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "nsis7z.dll" was detected as "Microsoft Linker" and name: "Linker" "elevate.exe" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "elevate.exe" was detected as "Microsoft Linker" and name: "Linker" "StdUtils.dll" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "StdUtils.dll" was detected as "Microsoft Linker" and name: "Linker" "System.dll" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "System.dll" was detected as "Microsoft Linker" and name: "Linker" "SpiderBanner.dll" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "SpiderBanner.dll" was detected as "Microsoft Linker" and name: "Linker" "nsExec.dll" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "nsExec.dll" was detected as "Microsoft Linker" and name: "Linker" "WinShell.dll" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "WinShell.dll" was detected as "Microsoft Linker" and name: "Linker"49:T11e4,"Waaake_Setup.exe" touched "ShellItemArray Shell Namespace helper" (Path: "HKCU\WOW6432NODE\CLSID\{CDC82860-468D-4D4E-B7E7-C298FF23AB2C}\TREATAS") "Waaake_Setup.exe" touched "Sync root manager" (Path: "HKCU\WOW6432NODE\CLSID\{F324E4F9-8496-40B2-A1FF-9617C1C9AFFE}\TREATAS") "Waaake_Setup.exe" touched "Property System Both Class Factory" (Path: "HKCU\WOW6432NODE\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\PROGID") "Waaake_Setup.exe" touched "ShellItem Shell Namespace helper" (Path: "HKCU\WOW6432NODE\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}\TREATAS") "Waaake_Setup.exe" touched "IPropertyStore Handler for Images" (Path: "HKCU\WOW6432NODE\CLSID\{A38B883C-1682-497E-97B0-0A3A9E801682}\OVERRIDEFILESYSTEMPROPERTIES") "Waaake_Setup.exe" touched "Shell Copy Hook" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{217FC9C0-3AEA-1069-A2DB-08002B30309D}\INPROCSERVER32") "Waaake_Setup.exe" touched "Shell extensions for sharing" (Path: "HKCU\WOW6432NODE\CLSID\{40DD6E20-7C17-11CE-A804-00AA003CA9F6}\INSTANCE") "Waaake_Setup.exe" touched "UsersFiles" (Path: "HKCU\WOW6432NODE\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\SHELLFOLDER") "Waaake_Setup.exe" touched "delegate folder that appears in Users Files Folder" (Path: "HKCU\WOW6432NODE\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\INSTANCE") "Waaake_Setup.exe" touched "Shell File System Folder" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{0E5AAE11-A475-4C5B-AB00-C66DE400274E}\INPROCSERVER32") "Waaake_Setup.exe" touched "Known Folder Manager" (Path: "HKCU\WOW6432NODE\CLSID\{4DF0C730-DF9D-4AE3-9153-AA6B82E9795A}\TREATAS") "Waaake_Setup.exe" touched "Shortcut" (Path: "HKCU\WOW6432NODE\CLSID\{00021401-0000-0000-C000-000000000046}\TREATAS") "Waaake_Setup.exe" touched "Property Store over folder final" (Path: "HKCU\WOW6432NODE\CLSID\{0340F119-A598-4ED9-B0AC-6F6A12D3E755}\TREATAS") "Waaake_Setup.exe" touched "Computer" (Path: "HKCU\WOW6432NODE\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "Waaake_Setup.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\WOW6432NODE\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\TREATAS") "Waaake_Setup.exe" touched "Ptype_PSFactory" (Path: "HKCU\WOW6432NODE\CLSID\{11659A23-5884-4D1B-9CF6-67D6F4F90B36}\TREATAS") "Waaake_Setup.exe" touched "Application Registration" (Path: "HKCU\WOW6432NODE\CLSID\{591209C7-767B-42B2-9FBA-44EE4615F2C7}\TREATAS") "Waaake_Setup.exe" touched "Search Gatherer Notification" (Path: "HKCU\WOW6432NODE\CLSID\{9E175B6D-F52A-11D8-B9A5-505054503030}\TREATAS") "Waaake_Setup.exe" touched "ShellWindows" (Path: "HKCU\WOW6432NODE\CLSID\{9BA05972-F6A8-11CF-A442-00A0C90A8F39}\TREATAS") "Waaake_Setup.exe" touched "PSOAInterface" (Path: "HKCU\WOW6432NODE\CLSID\{00020424-0000-0000-C000-000000000046}\TREATAS") "Waaake_Setup.exe" touched "PSDispatch" (Path: "HKCU\WOW6432NODE\CLSID\{00020420-0000-0000-C000-000000000046}\TREATAS") "tasklist.exe" touched "WBEM Locator" (Path: "HKCU\WOW6432NODE\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}") "tasklist.exe" touched "Windows Management and Instrumentation" (Path: "HKCU\WOW6432NODE\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\TREATAS") "tasklist.exe" touched "PSFactoryBuffer" (Path: "HKCU\WOW6432NODE\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\TREATAS") "tasklist.exe" touched "Microsoft WBEM Call Context" (Path: "HKCU\WOW6432NODE\CLSID\{674B6698-EE92-11D0-AD71-00C04FD8FDFF}\TREATAS") "tasklist.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemServices" (Path: "HKCU\WOW6432NODE\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\TREATAS") "tasklist.exe" touched "Microsoft WBEM (non)Standard Marshaling for IEnumWbemClassObject" (Path: "HKCU\WOW6432NODE\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\TREATAS") "waaake.exe" touched "TF_InputProcessorProfiles" (Path: "HKCU\CLSID\{33C53A50-F456-4884-B049-85FD643ECFED}") "waaake.exe" touched "TF_ThreadMgr" (Path: "HKCU\CLSID\{529A9E6B-6587-4F23-AB9E-9C7D683E3C50}\TREATAS") "waaake.exe" touched "TF_CategoryMgr" (Path: "HKCU\CLSID\{A4B544A1-438D-4B41-9325-869523E2D6C7}\TREATAS") "waaake.exe" touched "TF_DisplayAttributeMgr" (Path: "HKCU\CLSID\{3CE74DE4-53D3-4D74-8B83-431B3828BA53}\TREATAS") "waaake.exe" touched "MMDeviceEnumerator class" (Path: "HKCU\CLSID\{BCDE0395-E52F-467C-8E3D-C4579291692E}\TREATAS") "waaake.exe" touched "Microsoft Spell Checker Factory Class" (Path: "HKCU\CLSID\{7AB36653-1796-484B-BDFA-E74F1DB7C1DC}\TREATAS") "powershell.exe" touched "Windows Defender IOfficeAntiVirus implementation" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{2781761E-28E0-4109-99FE-B9D127C57AFE}\INPROCSERVER32")4a:Tac8,Observed system executable string:"%WINDIR%\SysWOW64\cmd.exe" [Source: 00000000-00005000-00000BC0-368321265] Observed system executable string:""%WINDIR%\system32\cmd.exe" /c tasklist /FI "USERNAME eq %USERNAME%" /FI "IMAGENAME eq waaake.exe" /FO csv | "%WINDIR%\system3" [Source: 00000000-00005000-00000C47-5493745780], Observed system executable string:"%WINDIR%\SysWOW64\tasklist.exe" [Source: 00000000-00006292-00000BC0-369053153], Observed system executable string:"%WINDIR%\SysWOW64\find.exe" [Source: 00000000-00006292-00000BC0-369109882], Observed system executable string:"%WINDIR%\system32\tasklist.exe" [Source: 00000000-00006292-00000C47-1213820850], Observed system executable string:"%WINDIR%\system32\find.exe" [Source: 00000000-00006292-00000C47-1348880948], Observed system executable string:""%WINDIR%\system32\find.exe" "waaake.exe"" [Source: 00000000-00006292-00000C47-1348880948], Observed system executable string:"%WINDIR%\System32\cmd.exe" [Source: 00000000-00006656-00000BC0-400948743], Observed system executable string:"%WINDIR%\System32\WindowsPowerShell\v1.0\powershell.exe" [Source: 00000000-00006656-00000BC0-425745854], Observed system executable string:"%WINDIR%\system32\cmd.exe" [Source: 00000000-00006656-00000C47-5796263212], Observed system executable string:"%WINDIR%\system32\cmd.exe /d /s /c "chcp"" [Source: 00000000-00006656-00000C47-5796263212], Observed system executable string:"%WINDIR%\system32\cmd.exe /d /s /c "%windir%\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v Machin" [Source: 00000000-00006656-00000C47-10011468488] Observed system executable string:"%WINDIR%\system32\cmd.exe /d /s /c "reg query "HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0" /v FeatureSet"" [Source: 00000000-00006656-00000C47-48285959060] Observed system executable string:"%WINDIR%\system32\WindowsPowerShell\v1.0\powershell.exe" [Source: 00000000-00006656-00000C47-65306843114] Observed system executable string:"%WINDIR%\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestrict" [Source: 00000000-00006656-00000C47-65306843114] Observed system executable string:"%WINDIR%\System32\reg.exe" [Source: 00000000-00000580-00000BC0-404534481] Observed system executable string:"%WINDIR%\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid" [Source: 00000000-00000580-00000C47-2908361530] Observed system executable string:"%WINDIR%\system32\reg.exe" [Source: 00000000-00002856-00000C47-2626615688] Observed system executable string:"/c tasklist /FI "USERNAME eq %USERNAME%" /FI "IMAGENAME eq waaake.exe" /FO csv | "%WINDIR%\system32\find.exe" "waaake.exe"" [Source: cmd.exe]4b:T97a,Process "cmd.exe" (UID: 00000000-00006292) was launched with new environment variables: "USERDNSDOMAIN="DESKTOP-FVVF82A"" Process "cmd.exe" (UID: 00000000-00006292) was launched with modified environment variables: "NUMBER_OF_PROCESSORS" Process "waaake.exe" (UID: 00000000-00006656) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, PSModulePath, CommonProgramFiles, Path, PATHEXT, ProgramFiles, NUMBER_OF_PROCESSORS" Process "waaake.exe" (UID: 00000000-00006656) was launched with missing environment variables: "PROMPT, PROCESSOR_ARCHITEW6432" Process "cmd.exe" (UID: 00000000-00007836) was launched with new environment variables: "LANG="en_US.UTF-8", ORIGINAL_XDG_CURRENT_DESKTOP="undefined"" Process "chcp.com" (UID: 00000000-00004500) was launched with new environment variables: "PROMPT="$P$G"" Process "chcp.com" (UID: 00000000-00004500) was launched with modified environment variables: "NUMBER_OF_PROCESSORS" Process "cmd.exe" (UID: 00000000-00000580) was launched with modified environment variables: "NUMBER_OF_PROCESSORS" Process "cmd.exe" (UID: 00000000-00000580) was launched with missing environment variables: "PROMPT, LANG" Process "reg.exe" (UID: 00000000-00002028) was launched with new environment variables: "PROMPT="$P$G"" Process "reg.exe" (UID: 00000000-00002028) was launched with modified environment variables: "NUMBER_OF_PROCESSORS" Process "cmd.exe" (UID: 00000000-00002856) was launched with new environment variables: "LANG="en_US.UTF-8"" Process "cmd.exe" (UID: 00000000-00002856) was launched with modified environment variables: "NUMBER_OF_PROCESSORS" Process "cmd.exe" (UID: 00000000-00002856) was launched with missing environment variables: "PROMPT" Process "waaake.exe" (UID: 00000000-00001552) was launched with modified environment variables: "NUMBER_OF_PROCESSORS" Process "waaake.exe" (UID: 00000000-00001552) was launched with missing environment variables: "LANG" Process "reg.exe" (UID: 00000000-00007184) was launched with new environment variables: "PROMPT="$P$G", LANG="en_US.UTF-8"" Process "waaake.exe" (UID: 00000000-00007804) was launched with missing environment variables: "PROMPT, LANG" Process "powershell.exe" (UID: 00000000-00004796) was launched with new environment variables: "LANG="en_US.UTF-8"" Process "powershell.exe" (UID: 00000000-00004796) was launched with modified environment variables: "NUMBER_OF_PROCESSORS"4c:T5ed,"Waaake_Setup.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "Waaake_Setup.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "Waaake_Setup.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "Waaake_Setup.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "cmd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "cmd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "cmd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "cmd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "tasklist.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "tasklist.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "tasklist.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "tasklist.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN") "tasklist.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN") "waaake.exe" (Path: "HKCU\CONTROL PANEL\INTERNATIONAL\GEO"; Key: "NATION") "waaake.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "waaake.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "waaake.exe" (Path: "HKCU\CONTROL PANEL\INTERNATIONAL\USER PROFILE"; Key: "LANGUAGES")4d:Tcf6,Observed system executable string:"%WINDIR%\system32\UXTHEME.dll" [Source: 00000000-00005000-00000C2B-366398413] Observed system executable string:"%WINDIR%\system32\USERENV.dll" [Source: 00000000-00005000-00000C2B-366441635] Observed system executable string:"%WINDIR%\system32\SETUPAPI.dll" [Source: 00000000-00005000-00000C2B-366479236] Observed system executable string:"%WINDIR%\system32\APPHELP.dll" [Source: 00000000-00005000-00000C2B-366570860] Observed system executable string:"%WINDIR%\system32\PROPSYS.dll" [Source: 00000000-00005000-00000C2B-366602935] Observed system executable string:"%WINDIR%\system32\DWMAPI.dll" [Source: 00000000-00005000-00000C2B-366631850] Observed system executable string:"%WINDIR%\system32\CRYPTBASE.dll" [Source: 00000000-00005000-00000C2B-366657946] Observed system executable string:"%WINDIR%\system32\OLEACC.dll" [Source: 00000000-00005000-00000C2B-366690983] Observed system executable string:"%WINDIR%\system32\CLBCATQ.dll" [Source: 00000000-00005000-00000C2B-366718621] Observed system executable string:"%WINDIR%\system32\NTMARTA.dll" [Source: 00000000-00005000-00000C2B-366748736] Observed system executable string:"%WINDIR%\system32\VERSION.dll" [Source: 00000000-00005000-00000C2B-366776389] Observed system executable string:"%WINDIR%\system32\SHFOLDER.dll" [Source: 00000000-00005000-00000C2B-366806713] Observed system executable string:"%WINDIR%\system32\RichEd20.dll" [Source: 00000000-00005000-00000C2B-367634220] Observed system executable string:"%WINDIR%\system32\Winsta.dll" [Source: 00000000-00007452-00000C2B-369892973] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" [Source: 00000000-00004796-00000C2B-428249761] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll" [Source: 00000000-00004796-00000C2B-429053937] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" [Source: 00000000-00004796-00000C2B-429440419] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00004796-00000C2B-429804699] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll" [Source: 00000000-00004796-00000C2B-430456337] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" [Source: 00000000-00004796-00000C2B-430627295] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" [Source: 00000000-00004796-00000C2B-430744583] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" [Source: 00000000-00004796-00000C2B-430930807] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll" [Source: 00000000-00004796-00000C2B-431184076] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll" [Source: 00000000-00004796-00000C2B-431285317] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll" [Source: 00000000-00004796-00000C2B-431522431]4e:T73a,Spawned process "cmd.exe" with commandline "/c tasklist /FI "USERNAME eq %USERNAME%" /FI "IMAGENAME eq waaak ..." (UID: 00000000-00006292), Spawned process "tasklist.exe" with commandline "tasklist /FI "USERNAME eq %OSUSER%" /FI "IMAGENAME eq waaake.ex ..." (UID: 00000000-00007452) Spawned process "find.exe" with commandline ""waaake.exe"" (UID: 00000000-00007680) Spawned process "waaake.exe" (UID: 00000000-00006656) Spawned process "cmd.exe" with commandline "/d /s /c "chcp"" (UID: 00000000-00007836) Spawned process "chcp.com" (UID: 00000000-00004500) Spawned process "cmd.exe" with commandline "/d /s /c "%windir%\\System32\\REG.exe QUERY HKEY_LOCAL_MACHINE\\ ..." (UID: 00000000-00000580), Spawned process "reg.exe" with commandline "QUERY HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Cryptography /v M ..." (UID: 00000000-00002028), Spawned process "cmd.exe" with commandline "/d /s /c "reg query "HKEY_LOCAL_MACHINE\\HARDWARE\\DESCRIPTION\\ ..." (UID: 00000000-00002856), Spawned process "waaake.exe" with commandline ""%APPDATA%\\WAAAKE" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAA ..." (UID: 00000000-00001552), Spawned process "reg.exe" with commandline "reg query "HKEY_LOCAL_MACHINE\\HARDWARE\\DESCRIPTION\\System\\C ..." (UID: 00000000-00007184) Spawned process "waaake.exe" with commandline ""%APPDATA%\\WAAAKE" --field-trial-handle=1676,i,1824697623952387 ..." (UID: 00000000-00007804) Spawned process "powershell.exe" with commandline "-NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Un ..." (UID: 00000000-00004796) Spawned process "powershell.exe" with commandline "-NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Un ..." (UID: 00000000-00008116) Spawned process "powershell.exe" with commandline "-NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Un ..." (UID: 00000000-00005988)4f:T73a,Spawned process "cmd.exe" with commandline "/c tasklist /FI "USERNAME eq %USERNAME%" /FI "IMAGENAME eq waaak ..." (UID: 00000000-00006292), Spawned process "tasklist.exe" with commandline "tasklist /FI "USERNAME eq %OSUSER%" /FI "IMAGENAME eq waaake.ex ..." (UID: 00000000-00007452) Spawned process "find.exe" with commandline ""waaake.exe"" (UID: 00000000-00007680) Spawned process "waaake.exe" (UID: 00000000-00006656) Spawned process "cmd.exe" with commandline "/d /s /c "chcp"" (UID: 00000000-00007836) Spawned process "chcp.com" (UID: 00000000-00004500) Spawned process "cmd.exe" with commandline "/d /s /c "%windir%\\System32\\REG.exe QUERY HKEY_LOCAL_MACHINE\\ ..." (UID: 00000000-00000580), Spawned process "reg.exe" with commandline "QUERY HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Cryptography /v M ..." (UID: 00000000-00002028), Spawned process "cmd.exe" with commandline "/d /s /c "reg query "HKEY_LOCAL_MACHINE\\HARDWARE\\DESCRIPTION\\ ..." (UID: 00000000-00002856), Spawned process "waaake.exe" with commandline ""%APPDATA%\\WAAAKE" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAA ..." (UID: 00000000-00001552), Spawned process "reg.exe" with commandline "reg query "HKEY_LOCAL_MACHINE\\HARDWARE\\DESCRIPTION\\System\\C ..." (UID: 00000000-00007184) Spawned process "waaake.exe" with commandline ""%APPDATA%\\WAAAKE" --field-trial-handle=1676,i,1824697623952387 ..." (UID: 00000000-00007804) Spawned process "powershell.exe" with commandline "-NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Un ..." (UID: 00000000-00004796) Spawned process "powershell.exe" with commandline "-NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Un ..." (UID: 00000000-00008116) Spawned process "powershell.exe" with commandline "-NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Un ..." (UID: 00000000-00005988)50:T7b62,"libGLESv2.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 10 sections"- Location: [%TEMP%\nsbD764.tmp\7z-out\libGLESv2.dll]- [targetUID: 00000000-00005000] "waaake.exe" has type "PE32+ executable for MS Windows 10.00 (GUI) x86-64 15 sections"- Location: [%LOCALAPPDATA%\Programs\waaake\waaake.exe]- [targetUID: 00000000-00007804] "installer.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 Nullsoft Installer self-extracting archive 5 sections"- Location: [%LOCALAPPDATA%\waaake-updater\installer.exe]- [targetUID: 00000000-00005000] "vk_swiftshader.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 10 sections"- Location: [%TEMP%\nsbD764.tmp\7z-out\vk_swiftshader.dll]- [targetUID: 00000000-00005000] "ffmpeg.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 9 sections"- Location: [%TEMP%\nsbD764.tmp\7z-out\ffmpeg.dll]- [targetUID: 00000000-00005000] "vulkan-1.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 10 sections"- Location: [%TEMP%\nsbD764.tmp\7z-out\vulkan-1.dll]- [targetUID: 00000000-00005000] "v8_context_snapshot.bin" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\waaake\v8_context_snapshot.bin]- [targetUID: 00000000-00007804] "libEGL.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 10 sections"- Location: [%LOCALAPPDATA%\Programs\waaake\libEGL.dll]- [targetUID: 00000000-00005000] "nsis7z.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\nsbD764.tmp\nsis7z.dll]- [targetUID: 00000000-00005000] "snapshot_blob.bin" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\waaake\snapshot_blob.bin]- [targetUID: 00000000-00005000] "Uninstall waaake.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 Nullsoft Installer self-extracting archive 5 sections"- Location: [%LOCALAPPDATA%\Programs\waaake\Uninstall waaake.exe]- [targetUID: 00000000-00005000] "elevate.exe" has type "PE32 executable for MS Windows 6.00 (console) Intel i386 6 sections"- Location: [%TEMP%\nsbD764.tmp\7z-out\resources\elevate.exe]- [targetUID: 00000000-00005000] "StdUtils.dll" has type "PE32 executable for MS Windows 5.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\nsbD764.tmp\StdUtils.dll]- [targetUID: 00000000-00005000] "System.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 4 sections"- Location: [%TEMP%\nsbD764.tmp\System.dll]- [targetUID: 00000000-00005988] "SpiderBanner.dll" has type "PE32 executable for MS Windows 5.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\nsbD764.tmp\SpiderBanner.dll]- [targetUID: 00000000-00005000] "nsExec.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 4 sections"- Location: [%TEMP%\nsbD764.tmp\nsExec.dll]- [targetUID: 00000000-00005000] "WinShell.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 2 sections"- Location: [%TEMP%\nsbD764.tmp\WinShell.dll]- [targetUID: 00000000-00005000] "WAAAKE.lnk" has type "MS Windows shortcut Item id list present Points to a file or directory Has Description string Has Relative path Has Working directory Icon number=0 Unicoded HasExpIcon "%USERPROFILE%\AppData\Local\Programs\waaake\waaake.exe" MachineID arrqsue2q5eee6x KnownFolderID F3CE0F7C-4901-4ACC-8648-D5D44B04EF8F Archive ctime=Wed Feb 25 01:52:09 2026 atime=Wed Feb 25 01:52:09 2026 mtime=Sun Jun 29 22:58:16 2025 length=199170048 window=normal IDListSize 0x021c Root folder "59031A47-3F72-44A7-89C5-5595FE6B30EE" LocalBasePath "C:\Users\HAPUBWS\AppData\Local\Programs\waaake\waaake.exe""- Location: [%APPDATA%\Microsoft\Windows\Start Menu\Programs\WAAAKE.lnk]- [targetUID: 00000000-00005000] "WAAAKE.lnk" has type "MS Windows shortcut Item id list present Points to a file or directory Has Description string Has Relative path Has Working directory Icon number=0 Unicoded HasExpIcon "%USERPROFILE%\AppData\Local\Programs\waaake\waaake.exe" MachineID arrqsue2q5eee6x KnownFolderID F3CE0F7C-4901-4ACC-8648-D5D44B04EF8F Archive ctime=Wed Feb 25 01:52:09 2026 atime=Wed Feb 25 01:52:09 2026 mtime=Sun Jun 29 22:58:16 2025 length=199170048 window=normal IDListSize 0x021c Root folder "59031A47-3F72-44A7-89C5-5595FE6B30EE" LocalBasePath "C:\Users\HAPUBWS\AppData\Local\Programs\waaake\waaake.exe""- Location: [%USERPROFILE%\Desktop\WAAAKE.lnk]- [targetUID: 00000000-00005000] "app-64.7z" has type "7-zip archive data version 0.4"- Location: [%TEMP%\nsbD764.tmp\app-64.7z]- [targetUID: 00000000-00005000] "lightningcss.linux-x64-gnu.node" has type "ELF 64-bit LSB shared object x86-64 version 1 (SYSV) dynamically linked missing section headers at 9145072"- Location: [%LOCALAPPDATA%\Programs\waaake\resources\app.asar.unpacked\node_modules\lightningcss\node_modules\lightningcss-linux-x64-gnu\lightningcss.linux-x64-gnu.node]- [targetUID: 00000000-00005000] "icudtl.dat" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\waaake\icudtl.dat]- [targetUID: 00000000-00007804] "lightningcss.linux-x64-musl.node" has type "ELF 64-bit LSB shared object x86-64 version 1 (SYSV) dynamically linked missing section headers at 9140776"- Location: [%LOCALAPPDATA%\Programs\waaake\resources\app.asar.unpacked\node_modules\lightningcss\node_modules\lightningcss-linux-x64-musl\lightningcss.linux-x64-musl.node]- [targetUID: 00000000-00005000] "app.asar" has type "Unknown"- Location: [%TEMP%\nsbD764.tmp\7z-out\resources\app.asar]- [targetUID: 00000000-00006656] "resources.pak" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\waaake\resources.pak]- [targetUID: 00000000-00007804] "LICENSES.chromium.html" has type "HTML document text HTML document ASCII text"- Location: [%TEMP%\nsbD764.tmp\7z-out\LICENSES.chromium.html]- [targetUID: 00000000-00005000] "tailwindcss-oxide.linux-x64-gnu.node" has type "ELF 64-bit LSB shared object x86-64 version 1 (SYSV) dynamically linked stripped"- Location: [%TEMP%\nsbD764.tmp\7z-out\resources\app.asar.unpacked\node_modules\@tailwindcss\oxide\node_modules\@tailwindcss\oxide-linux-x64-gnu\tailwindcss-oxide.linux-x64-gnu.node]- [targetUID: 00000000-00005000] "tailwindcss-oxide.linux-x64-musl.node" has type "ELF 64-bit LSB shared object x86-64 version 1 (SYSV) dynamically linked BuildID[sha1]=f0b840cfae4d7cc022fa76c1b56687ce5bf95c01 stripped"- Location: [%TEMP%\nsbD764.tmp\7z-out\resources\app.asar.unpacked\node_modules\@tailwindcss\oxide\node_modules\@tailwindcss\oxide-linux-x64-musl\tailwindcss-oxide.linux-x64-musl.node]- [targetUID: 00000000-00005000] "ml.pak" has type "Unknown"- Location: [%TEMP%\nsbD764.tmp\7z-out\locales\ml.pak]- [targetUID: 00000000-00005000] "ta.pak" has type "Unknown"- Location: [%TEMP%\nsbD764.tmp\7z-out\locales\ta.pak]- [targetUID: 00000000-00005000] "kn.pak" has type "Unknown"- Location: [%TEMP%\nsbD764.tmp\7z-out\locales\kn.pak]- [targetUID: 00000000-00005000] "te.pak" has type "Unknown"- Location: [%TEMP%\nsbD764.tmp\7z-out\locales\te.pak]- [targetUID: 00000000-00005000] "hi.pak" has type "Unknown"- Location: [%TEMP%\nsbD764.tmp\7z-out\locales\hi.pak]- [targetUID: 00000000-00005000] "bn.pak" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\waaake\locales\bn.pak]- [targetUID: 00000000-00005000] "gu.pak" has type "Unknown"- Location: [%TEMP%\nsbD764.tmp\7z-out\locales\gu.pak]- [targetUID: 00000000-00005000] "mr.pak" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\waaake\locales\mr.pak]- [targetUID: 00000000-00005000] "th.pak" has type "Unknown"- Location: [%TEMP%\nsbD764.tmp\7z-out\locales\th.pak]- [targetUID: 00000000-00005000] "el.pak" has type "Unknown"- Location: [%TEMP%\nsbD764.tmp\7z-out\locales\el.pak]- [targetUID: 00000000-00005000] "uk.pak" has type "Unknown"- Location: [%TEMP%\nsbD764.tmp\7z-out\locales\uk.pak]- [targetUID: 00000000-00005000] "ru.pak" has type "Unknown"- Location: [%TEMP%\nsbD764.tmp\7z-out\locales\ru.pak]- [targetUID: 00000000-00005000] "bg.pak" has type "Unknown"- Location: [%TEMP%\nsbD764.tmp\7z-out\locales\bg.pak]- [targetUID: 00000000-00005000] "ar.pak" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\waaake\locales\ar.pak]- [targetUID: 00000000-00005000] "sr.pak" has type "Unknown"- Location: [%TEMP%\nsbD764.tmp\7z-out\locales\sr.pak]- [targetUID: 00000000-00005000] "fa.pak" has type "Unknown"- Location: [%TEMP%\nsbD764.tmp\7z-out\locales\fa.pak]- [targetUID: 00000000-00005000] "ur.pak" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\waaake\locales\ur.pak]- [targetUID: 00000000-00005000] "am.pak" has type "Unknown"- Location: [%TEMP%\nsbD764.tmp\7z-out\locales\am.pak]- [targetUID: 00000000-00005000] "he.pak" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\waaake\locales\he.pak]- [targetUID: 00000000-00005000] "ja.pak" has type "Unknown"- Location: [%TEMP%\nsbD764.tmp\7z-out\locales\ja.pak]- [targetUID: 00000000-00005000] "vi.pak" has type "Unknown"- Location: [%TEMP%\nsbD764.tmp\7z-out\locales\vi.pak]- [targetUID: 00000000-00005000] "lt.pak" has type "Unknown"- Location: [%TEMP%\nsbD764.tmp\7z-out\locales\lt.pak]- [targetUID: 00000000-00005000] "lv.pak" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\waaake\locales\lv.pak]- [targetUID: 00000000-00005000] "hu.pak" has type "Unknown"- Location: [%TEMP%\nsbD764.tmp\7z-out\locales\hu.pak]- [targetUID: 00000000-00005000] "fr.pak" has type "Unknown"- Location: [%TEMP%\nsbD764.tmp\7z-out\locales\fr.pak]- [targetUID: 00000000-00005000] "sk.pak" has type "Unknown"- Location: [%TEMP%\nsbD764.tmp\7z-out\locales\sk.pak]- [targetUID: 00000000-00005000] "fil.pak" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\waaake\locales\fil.pak]- [targetUID: 00000000-00005000] "pl.pak" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\waaake\locales\pl.pak]- [targetUID: 00000000-00005000] "cs.pak" has type "Unknown"- Location: [%TEMP%\nsbD764.tmp\7z-out\locales\cs.pak]- [targetUID: 00000000-00005000] "ro.pak" has type "Unknown"- Location: [%TEMP%\nsbD764.tmp\7z-out\locales\ro.pak]- [targetUID: 00000000-00005000] "sl.pak" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\waaake\locales\sl.pak]- [targetUID: 00000000-00005000] "ca.pak" has type "Unknown"- Location: [%TEMP%\nsbD764.tmp\7z-out\locales\ca.pak]- [targetUID: 00000000-00005000] "ko.pak" has type "Unknown"- Location: [%TEMP%\nsbD764.tmp\7z-out\locales\ko.pak]- [targetUID: 00000000-00005000] "de.pak" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\waaake\locales\de.pak]- [targetUID: 00000000-00005000] "hr.pak" has type "Unknown"- Location: [%TEMP%\nsbD764.tmp\7z-out\locales\hr.pak]- [targetUID: 00000000-00005000] "es-419.pak" has type "Unknown"- Location: [%TEMP%\nsbD764.tmp\7z-out\locales\es-419.pak]- [targetUID: 00000000-00005000] "es.pak" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\waaake\locales\es.pak]- [targetUID: 00000000-00005000] "pt-PT.pak" has type "Unknown"- Location: [%TEMP%\nsbD764.tmp\7z-out\locales\pt-PT.pak]- [targetUID: 00000000-00005000] "it.pak" has type "Unknown"- Location: [%TEMP%\nsbD764.tmp\7z-out\locales\it.pak]- [targetUID: 00000000-00005000] "pt-BR.pak" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\waaake\locales\pt-BR.pak]- [targetUID: 00000000-00005000] "tr.pak" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\waaake\locales\tr.pak]- [targetUID: 00000000-00005000] "sw.pak" has type "Unknown"- Location: [%TEMP%\nsbD764.tmp\7z-out\locales\sw.pak]- [targetUID: 00000000-00005000] "da.pak" has type "Unknown"- Location: [%TEMP%\nsbD764.tmp\7z-out\locales\da.pak]- [targetUID: 00000000-00005000] "nl.pak" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\waaake\locales\nl.pak]- [targetUID: 00000000-00005000] "ms.pak" has type "Unknown"- Location: [%TEMP%\nsbD764.tmp\7z-out\locales\ms.pak]- [targetUID: 00000000-00005000] "fi.pak" has type "Unknown"- Location: [%TEMP%\nsbD764.tmp\7z-out\locales\fi.pak]- [targetUID: 00000000-00005000] "sv.pak" has type "Unknown"- Location: [%TEMP%\nsbD764.tmp\7z-out\locales\sv.pak]- [targetUID: 00000000-00005000] "et.pak" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\waaake\locales\et.pak]- [targetUID: 00000000-00005000] "nb.pak" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\waaake\locales\nb.pak]- [targetUID: 00000000-00005000] "af.pak" has type "Unknown"- Location: [%TEMP%\nsbD764.tmp\7z-out\locales\af.pak]- [targetUID: 00000000-00005000] "id.pak" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\waaake\locales\id.pak]- [targetUID: 00000000-00005000] "index" has type "Unknown"- [targetUID: 00000000-00007804] "zh-CN.pak" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\waaake\locales\zh-CN.pak]- [targetUID: 00000000-00005000] "en-US.pak" has type "Unknown"- Location: [%TEMP%\nsbD764.tmp\7z-out\locales\en-US.pak]- [targetUID: 00000000-00007804] "zh-TW.pak" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\waaake\locales\zh-TW.pak]- [targetUID: 00000000-00005000] "en-GB.pak" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\waaake\locales\en-GB.pak]- [targetUID: 00000000-00005000] "index" has type "Unknown"- Location: [%APPDATA%\WAAAKE\GPUCache\index]- [targetUID: 00000000-00007804] "index" has type "Unknown"- Location: [%APPDATA%\WAAAKE\DawnWebGPUCache\index]- [targetUID: 00000000-00007804] "index" has type "Unknown"- Location: [%APPDATA%\WAAAKE\DawnGraphiteCache\index]- [targetUID: 00000000-00007804] "chrome_200_percent.pak" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\waaake\chrome_200_percent.pak]- [targetUID: 00000000-00007804] "chrome_100_percent.pak" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\waaake\chrome_100_percent.pak]- [targetUID: 00000000-00007804] "icon.png" has type "PNG image data 512 x 512 8-bit/color RGBA non-interlaced"- Location: [%LOCALAPPDATA%\Programs\waaake\resources\app.asar.unpacked\resources\icon.png]- [targetUID: 00000000-00006656] "f_000001" has type "Unknown"- [targetUID: N/A] "LICENSE" has type "Unknown"- Location: [%TEMP%\nsbD764.tmp\7z-out\resources\app.asar.unpacked\node_modules\lightningcss\node_modules\lightningcss-linux-x64-musl\LICENSE]- [targetUID: 00000000-00005000] "data_2" has type "Unknown"- Location: [%APPDATA%\WAAAKE\GPUCache\data_2]- [targetUID: 00000000-00006656] "data_3" has type "Unknown"- Location: [%APPDATA%\WAAAKE\GPUCache\data_3]- [targetUID: 00000000-00006656] "data_1" has type "Unknown"- Location: [%APPDATA%\WAAAKE\DawnWebGPUCache\data_1]- [targetUID: 00000000-00006656] "data_0" has type "Unknown"- Location: [%APPDATA%\WAAAKE\GPUCache\data_0]- [targetUID: 00000000-00006656] "LICENSE.electron.txt" has type "Unknown"- Location: [%TEMP%\nsbD764.tmp\7z-out\LICENSE.electron.txt]- [targetUID: 00000000-00005000] "LICENSE" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\waaake\resources\app.asar.unpacked\node_modules\@tailwindcss\oxide\node_modules\@tailwindcss\oxide-linux-x64-musl\LICENSE]- [targetUID: 00000000-00005000] "package.json" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\waaake\resources\app.asar.unpacked\node_modules\lightningcss\node_modules\lightningcss-linux-x64-musl\package.json]- [targetUID: 00000000-00005000] "package.json" has type "Unknown"- Location: [%TEMP%\nsbD764.tmp\7z-out\resources\app.asar.unpacked\node_modules\lightningcss\node_modules\lightningcss-linux-x64-gnu\package.json]- [targetUID: 00000000-00005000] "48df6f2f-4fa5-485b-80da-81c590e32d6b.tmp" has type "Unknown"- [targetUID: N/A] "package.json" has type "Unknown"- Location: [%TEMP%\nsbD764.tmp\7z-out\resources\app.asar.unpacked\node_modules\@tailwindcss\oxide\node_modules\@tailwindcss\oxide-linux-x64-musl\package.json]- [targetUID: 00000000-00005000] "package.json" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\waaake\resources\app.asar.unpacked\node_modules\@tailwindcss\oxide\node_modules\@tailwindcss\oxide-linux-x64-gnu\package.json]- [targetUID: 00000000-00005000] "SharedStorage-journal" has type "SQLite Rollback Journal"- [targetUID: N/A] "DIPS-journal" has type "SQLite Rollback Journal"- Location: [%APPDATA%\WAAAKE\DIPS-journal]- [targetUID: 00000000-00006656] "26d3604e-d8c1-4e21-94af-0903e7f9ba69.tmp" has type "Unknown"- Location: [%APPDATA%\WAAAKE\26d3604e-d8c1-4e21-94af-0903e7f9ba69.tmp]- [targetUID: 00000000-00006656] "cefbffe5-fa68-4346-b355-80f3284cce92.tmp" has type "Unknown"- [targetUID: N/A] "54e1c8c6-4a74-4f48-95d1-b9535578e335.tmp" has type "Unknown"- Location: [%APPDATA%\WAAAKE\54e1c8c6-4a74-4f48-95d1-b9535578e335.tmp]- [targetUID: 00000000-00006656] "temp-index" has type "Unknown"- Location: [%APPDATA%\WAAAKE\Code Cache\wasm\index-dir\temp-index]- [targetUID: 00000000-00007804] "temp-index" has type "Unknown"- Location: [%APPDATA%\WAAAKE\Shared Dictionary\cache\index-dir\temp-index]- [targetUID: 00000000-00007804] "MANIFEST-000001" has type "Unknown"- Location: [%APPDATA%\WAAAKE\Local Storage\leveldb\MANIFEST-000001]- [targetUID: 00000000-00006656] "installer.exe%3AZone.Identifier" has type "Unknown"- [targetUID: N/A] "index" has type "Unknown"- Location: [%APPDATA%\WAAAKE\Code Cache\js\index]- [targetUID: 00000000-00007804] "000001.dbtmp" has type "Unknown"- Location: [%APPDATA%\WAAAKE\Local Storage\leveldb\000001.dbtmp]- [targetUID: 00000000-00006656] "libGLESv2.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 10 sections"- Location: [%LOCALAPPDATA%\Programs\waaake\libGLESv2.dll]- [targetUID: 00000000-00005000] "waaake.exe" has type "PE32+ executable for MS Windows 10.00 (GUI) x86-64 15 sections"- Location: [%TEMP%\nsbD764.tmp\7z-out\waaake.exe]- [targetUID: 00000000-00007804] "vk_swiftshader.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 10 sections"- Location: [%LOCALAPPDATA%\Programs\waaake\vk_swiftshader.dll]- [targetUID: 00000000-00005000] "ffmpeg.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 9 sections"- Location: [%LOCALAPPDATA%\Programs\waaake\ffmpeg.dll]- [targetUID: 00000000-00005000] "vulkan-1.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 10 sections"- Location: [%LOCALAPPDATA%\Programs\waaake\vulkan-1.dll]- [targetUID: 00000000-00005000] "v8_context_snapshot.bin" has type "Unknown"- Location: [%TEMP%\nsbD764.tmp\7z-out\v8_context_snapshot.bin]- [targetUID: 00000000-00007804] "libEGL.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 10 sections"- Location: [%TEMP%\nsbD764.tmp\7z-out\libEGL.dll]- [targetUID: 00000000-00005000] "snapshot_blob.bin" has type "Unknown"- Location: [%TEMP%\nsbD764.tmp\7z-out\snapshot_blob.bin]- [targetUID: 00000000-00005000] "elevate.exe" has type "PE32 executable for MS Windows 6.00 (console) Intel i386 6 sections"- Location: [%LOCALAPPDATA%\Programs\waaake\resources\elevate.exe]- [targetUID: 00000000-00005000] "lightningcss.linux-x64-musl.node" has type "ELF 64-bit LSB shared object x86-64 version 1 (SYSV) dynamically linked missing section headers at 9140776"- Location: [%TEMP%\nsbD764.tmp\7z-out\resources\app.asar.unpacked\node_modules\lightningcss\node_modules\lightningcss-linux-x64-musl\lightningcss.linux-x64-musl.node]- [targetUID: 00000000-00005000] "resources.pak" has type "Unknown"- Location: [%TEMP%\nsbD764.tmp\7z-out\resources.pak]- [targetUID: 00000000-00007804] "LICENSES.chromium.html" has type "HTML document text HTML document ASCII text"- Location: [%LOCALAPPDATA%\Programs\waaake\LICENSES.chromium.html]- [targetUID: 00000000-00005000] "lightningcss.linux-x64-gnu.node" has type "ELF 64-bit LSB shared object x86-64 version 1 (SYSV) dynamically linked missing section headers at 9145072"- Location: [%TEMP%\nsbD764.tmp\7z-out\resources\app.asar.unpacked\node_modules\lightningcss\node_modules\lightningcss-linux-x64-gnu\lightningcss.linux-x64-gnu.node]- [targetUID: 00000000-00005000] "icudtl.dat" has type "Unknown"- Location: [%TEMP%\nsbD764.tmp\7z-out\icudtl.dat]- [targetUID: 00000000-00007804] "app.asar" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\waaake\resources\app.asar]- [targetUID: 00000000-00006656] "tailwindcss-oxide.linux-x64-gnu.node" has type "ELF 64-bit LSB shared object x86-64 version 1 (SYSV) dynamically linked stripped"- Location: [%LOCALAPPDATA%\Programs\waaake\resources\app.asar.unpacked\node_modules\@tailwindcss\oxide\node_modules\@tailwindcss\oxide-linux-x64-gnu\tailwindcss-oxide.linux-x64-gnu.node]- [targetUID: 00000000-00005000] "tailwindcss-oxide.linux-x64-musl.node" has type "ELF 64-bit LSB shared object x86-64 version 1 (SYSV) dynamically linked BuildID[sha1]=f0b840cfae4d7cc022fa76c1b56687ce5bf95c01 stripped"- Location: [%LOCALAPPDATA%\Programs\waaake\resources\app.asar.unpacked\node_modules\@tailwindcss\oxide\node_modules\@tailwindcss\oxide-linux-x64-musl\tailwindcss-oxide.linux-x64-musl.node]- [targetUID: 00000000-00005000] "ml.pak" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\waaake\locales\ml.pak]- [targetUID: 00000000-00005000] "ta.pak" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\waaake\locales\ta.pak]- [targetUID: 00000000-00005000] "kn.pak" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\waaake\locales\kn.pak]- [targetUID: 00000000-00005000] "te.pak" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\waaake\locales\te.pak]- [targetUID: 00000000-00005000] "hi.pak" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\waaake\locales\hi.pak]- [targetUID: 00000000-00005000] "bn.pak" has type "Unknown"- Location: [%TEMP%\nsbD764.tmp\7z-out\locales\bn.pak]- [targetUID: 00000000-00005000] "gu.pak" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\waaake\locales\gu.pak]- [targetUID: 00000000-00005000] "mr.pak" has type "Unknown"- Location: [%TEMP%\nsbD764.tmp\7z-out\locales\mr.pak]- [targetUID: 00000000-00005000] "th.pak" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\waaake\locales\th.pak]- [targetUID: 00000000-00005000] "el.pak" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\waaake\locales\el.pak]- [targetUID: 00000000-00005000] "uk.pak" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\waaake\locales\uk.pak]- [targetUID: 00000000-00005000] "ru.pak" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\waaake\locales\ru.pak]- [targetUID: 00000000-00005000] "bg.pak" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\waaake\locales\bg.pak]- [targetUID: 00000000-00005000] "ar.pak" has type "Unknown"- Location: [%TEMP%\nsbD764.tmp\7z-out\locales\ar.pak]- [targetUID: 00000000-00005000] "sr.pak" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\waaake\locales\sr.pak]- [targetUID: 00000000-00005000] "fa.pak" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\waaake\locales\fa.pak]- [targetUID: 00000000-00005000] "ur.pak" has type "Unknown"- Location: [%TEMP%\nsbD764.tmp\7z-out\locales\ur.pak]- [targetUID: 00000000-00005000] "am.pak" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\waaake\locales\am.pak]- [targetUID: 00000000-00005000] "he.pak" has type "Unknown"- Location: [%TEMP%\nsbD764.tmp\7z-out\locales\he.pak]- [targetUID: 00000000-00005000] "ja.pak" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\waaake\locales\ja.pak]- [targetUID: 00000000-00005000] "vi.pak" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\waaake\locales\vi.pak]- [targetUID: 00000000-00005000] "lt.pak" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\waaake\locales\lt.pak]- [targetUID: 00000000-00005000] "lv.pak" has type "Unknown"- Location: [%TEMP%\nsbD764.tmp\7z-out\locales\lv.pak]- [targetUID: 00000000-00005000] "hu.pak" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\waaake\locales\hu.pak]- [targetUID: 00000000-00005000] "fr.pak" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\waaake\locales\fr.pak]- [targetUID: 00000000-00005000] "sk.pak" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\waaake\locales\sk.pak]- [targetUID: 00000000-00005000] "fil.pak" has type "Unknown"- Location: [%TEMP%\nsbD764.tmp\7z-out\locales\fil.pak]- [targetUID: 00000000-00005000] "pl.pak" has type "Unknown"- Location: [%TEMP%\nsbD764.tmp\7z-out\locales\pl.pak]- [targetUID: 00000000-00005000] "cs.pak" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\waaake\locales\cs.pak]- [targetUID: 00000000-00005000] "ro.pak" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\waaake\locales\ro.pak]- [targetUID: 00000000-00005000] "sl.pak" has type "Unknown"- Location: [%TEMP%\nsbD764.tmp\7z-out\locales\sl.pak]- [targetUID: 00000000-00005000] "ca.pak" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\waaake\locales\ca.pak]- [targetUID: 00000000-00005000] "ko.pak" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\waaake\locales\ko.pak]- [targetUID: 00000000-00005000] "de.pak" has type "Unknown"- Location: [%TEMP%\nsbD764.tmp\7z-out\locales\de.pak]- [targetUID: 00000000-00005000] "hr.pak" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\waaake\locales\hr.pak]- [targetUID: 00000000-00005000] "es-419.pak" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\waaake\locales\es-419.pak]- [targetUID: 00000000-00005000] "es.pak" has type "Unknown"- Location: [%TEMP%\nsbD764.tmp\7z-out\locales\es.pak]- [targetUID: 00000000-00005000] "pt-PT.pak" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\waaake\locales\pt-PT.pak]- [targetUID: 00000000-00005000] "it.pak" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\waaake\locales\it.pak]- [targetUID: 00000000-00005000] "pt-BR.pak" has type "Unknown"- Location: [%TEMP%\nsbD764.tmp\7z-out\locales\pt-BR.pak]- [targetUID: 00000000-00005000] "tr.pak" has type "Unknown"- Location: [%TEMP%\nsbD764.tmp\7z-out\locales\tr.pak]- [targetUID: 00000000-00005000] "sw.pak" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\waaake\locales\sw.pak]- [targetUID: 00000000-00005000] "da.pak" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\waaake\locales\da.pak]- [targetUID: 00000000-00005000] "nl.pak" has type "Unknown"- Location: [%TEMP%\nsbD764.tmp\7z-out\locales\nl.pak]- [targetUID: 00000000-00005000] "ms.pak" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\waaake\locales\ms.pak]- [targetUID: 00000000-00005000] "fi.pak" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\waaake\locales\fi.pak]- [targetUID: 00000000-00005000] "sv.pak" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\waaake\locales\sv.pak]- [targetUID: 00000000-00005000] "et.pak" has type "Unknown"- Location: [%TEMP%\nsbD764.tmp\7z-out\locales\et.pak]- [targetUID: 00000000-00005000] "nb.pak" has type "Unknown"- Location: [%TEMP%\nsbD764.tmp\7z-out\locales\nb.pak]- [targetUID: 00000000-00005000] "af.pak" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\waaake\locales\af.pak]- [targetUID: 00000000-00005000] "id.pak" has type "Unknown"- Location: [%TEMP%\nsbD764.tmp\7z-out\locales\id.pak]- [targetUID: 00000000-00005000] "zh-CN.pak" has type "Unknown"- Location: [%TEMP%\nsbD764.tmp\7z-out\locales\zh-CN.pak]- [targetUID: 00000000-00005000] "en-US.pak" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\waaake\locales\en-US.pak]- [targetUID: 00000000-00007804] "zh-TW.pak" has type "Unknown"- Location: [%TEMP%\nsbD764.tmp\7z-out\locales\zh-TW.pak]- [targetUID: 00000000-00005000] "en-GB.pak" has type "Unknown"- Location: [%TEMP%\nsbD764.tmp\7z-out\locales\en-GB.pak]- [targetUID: 00000000-00005000] "chrome_200_percent.pak" has type "Unknown"- Location: [%TEMP%\nsbD764.tmp\7z-out\chrome_200_percent.pak]- [targetUID: 00000000-00007804] "chrome_100_percent.pak" has type "Unknown"- Location: [%TEMP%\nsbD764.tmp\7z-out\chrome_100_percent.pak]- [targetUID: 00000000-00007804] "icon.png" has type "PNG image data 512 x 512 8-bit/color RGBA non-interlaced"- Location: [%TEMP%\nsbD764.tmp\7z-out\resources\app.asar.unpacked\resources\icon.png]- [targetUID: 00000000-00006656] "LICENSE" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\waaake\resources\app.asar.unpacked\node_modules\lightningcss\node_modules\lightningcss-linux-x64-musl\LICENSE]- [targetUID: 00000000-00005000] "LICENSE" has type "Unknown"- Location: [%TEMP%\nsbD764.tmp\7z-out\resources\app.asar.unpacked\node_modules\lightningcss\node_modules\lightningcss-linux-x64-gnu\LICENSE]- [targetUID: 00000000-00005000] "LICENSE" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\waaake\resources\app.asar.unpacked\node_modules\lightningcss\node_modules\lightningcss-linux-x64-gnu\LICENSE]- [targetUID: 00000000-00005000] "data_3" has type "Unknown"- [targetUID: 00000000-00006656] "data_1" has type "Unknown"- Location: [%APPDATA%\WAAAKE\GPUCache\data_1]- [targetUID: 00000000-00006656] "data_3" has type "Unknown"- Location: [%APPDATA%\WAAAKE\DawnGraphiteCache\data_3]- [targetUID: 00000000-00006656] "data_2" has type "Unknown"- Location: [%APPDATA%\WAAAKE\DawnGraphiteCache\data_2]- [targetUID: 00000000-00006656] "data_0" has type "Unknown"- [targetUID: 00000000-00006656] "data_2" has type "Unknown"- Location: [%APPDATA%\WAAAKE\DawnWebGPUCache\data_2]- [targetUID: 00000000-00006656] "data_1" has type "Unknown"- [targetUID: 00000000-00006656] "data_0" has type "Unknown"- Location: [%APPDATA%\WAAAKE\DawnWebGPUCache\data_0]- [targetUID: 00000000-00006656] "data_2" has type "Unknown"- [targetUID: 00000000-00006656] "data_0" has type "Unknown"- Location: [%APPDATA%\WAAAKE\DawnGraphiteCache\data_0]- [targetUID: 00000000-00006656] "data_3" has type "Unknown"- Location: [%APPDATA%\WAAAKE\DawnWebGPUCache\data_3]- [targetUID: 00000000-00006656] "data_1" has type "Unknown"- Location: [%APPDATA%\WAAAKE\DawnGraphiteCache\data_1]- [targetUID: 00000000-00006656] "LICENSE.electron.txt" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\waaake\LICENSE.electron.txt]- [targetUID: 00000000-00005000] "LICENSE" has type "Unknown"- Location: [%TEMP%\nsbD764.tmp\7z-out\resources\app.asar.unpacked\node_modules\@tailwindcss\oxide\node_modules\@tailwindcss\oxide-linux-x64-gnu\LICENSE]- [targetUID: 00000000-00005000] "LICENSE" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\waaake\resources\app.asar.unpacked\node_modules\@tailwindcss\oxide\node_modules\@tailwindcss\oxide-linux-x64-gnu\LICENSE]- [targetUID: 00000000-00005000] "LICENSE" has type "Unknown"- Location: [%TEMP%\nsbD764.tmp\7z-out\resources\app.asar.unpacked\node_modules\@tailwindcss\oxide\node_modules\@tailwindcss\oxide-linux-x64-musl\LICENSE]- [targetUID: 00000000-00005000] "package.json" has type "Unknown"- Location: [%TEMP%\nsbD764.tmp\7z-out\resources\app.asar.unpacked\node_modules\lightningcss\node_modules\lightningcss-linux-x64-musl\package.json]- [targetUID: 00000000-00005000] "package.json" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\waaake\resources\app.asar.unpacked\node_modules\lightningcss\node_modules\lightningcss-linux-x64-gnu\package.json]- [targetUID: 00000000-00005000] "package.json" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\waaake\resources\app.asar.unpacked\node_modules\@tailwindcss\oxide\node_modules\@tailwindcss\oxide-linux-x64-musl\package.json]- [targetUID: 00000000-00005000] "package.json" has type "Unknown"- Location: [%TEMP%\nsbD764.tmp\7z-out\resources\app.asar.unpacked\node_modules\@tailwindcss\oxide\node_modules\@tailwindcss\oxide-linux-x64-gnu\package.json]- [targetUID: 00000000-00005000] "temp-index" has type "Unknown"- Location: [%APPDATA%\WAAAKE\Code Cache\js\index-dir\temp-index]- [targetUID: 00000000-00007804] "index" has type "Unknown"- Location: [%APPDATA%\WAAAKE\Code Cache\wasm\index]- [targetUID: 00000000-00007804] "index" has type "Unknown"- Location: [%APPDATA%\WAAAKE\Shared Dictionary\cache\index]- [targetUID: 00000000-00007804]51:Tac5,"Waaake_Setup.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\1AA323D8-1AF7-575C-AA21-FF3F6189D55F"; Key: ""; Value: "") "Waaake_Setup.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS"; Key: ""; Value: "") "Waaake_Setup.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{A77F5D77-2E2B-44C3-A6A2-ABA601054A51}"; Key: ""; Value: "") "Waaake_Setup.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{A77F5D77-2E2B-44C3-A6A2-ABA601054A51}\PROPERTYBAG"; Key: ""; Value: "") "Waaake_Setup.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SESSIONINFO\1"; Key: ""; Value: "") "Waaake_Setup.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SESSIONINFO\1\KNOWNFOLDERS"; Key: ""; Value: "") "Waaake_Setup.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\USER SHELL FOLDERS"; Key: ""; Value: "") "Waaake_Setup.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\CMD.EXE"; Key: ""; Value: "") "Waaake_Setup.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86\XTAJIT"; Key: ""; Value: "") "Waaake_Setup.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: ""; Value: "") "Waaake_Setup.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\BAM"; Key: ""; Value: "") "Waaake_Setup.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\APPCERTDLLS"; Key: ""; Value: "") "Waaake_Setup.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "Waaake_Setup.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "Waaake_Setup.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "Waaake_Setup.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: ""; Value: "") "Waaake_Setup.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION"; Key: ""; Value: "") "Waaake_Setup.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\LAYERS"; Key: ""; Value: "") "Waaake_Setup.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: ""; Value: "")52:Tad9,"libGLESv2.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 10 sections"- Location: [%TEMP%\nsbD764.tmp\7z-out\libGLESv2.dll]- [targetUID: 00000000-00005000] "vk_swiftshader.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 10 sections"- Location: [%TEMP%\nsbD764.tmp\7z-out\vk_swiftshader.dll]- [targetUID: 00000000-00005000] "ffmpeg.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 9 sections"- Location: [%TEMP%\nsbD764.tmp\7z-out\ffmpeg.dll]- [targetUID: 00000000-00005000] "vulkan-1.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 10 sections"- Location: [%TEMP%\nsbD764.tmp\7z-out\vulkan-1.dll]- [targetUID: 00000000-00005000] "libEGL.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 10 sections"- Location: [%LOCALAPPDATA%\Programs\waaake\libEGL.dll]- [targetUID: 00000000-00005000] "nsis7z.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\nsbD764.tmp\nsis7z.dll]- [targetUID: 00000000-00005000] "StdUtils.dll" has type "PE32 executable for MS Windows 5.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\nsbD764.tmp\StdUtils.dll]- [targetUID: 00000000-00005000] "System.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 4 sections"- Location: [%TEMP%\nsbD764.tmp\System.dll]- [targetUID: 00000000-00005988] "SpiderBanner.dll" has type "PE32 executable for MS Windows 5.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\nsbD764.tmp\SpiderBanner.dll]- [targetUID: 00000000-00005000] "nsExec.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 4 sections"- Location: [%TEMP%\nsbD764.tmp\nsExec.dll]- [targetUID: 00000000-00005000] "WinShell.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 2 sections"- Location: [%TEMP%\nsbD764.tmp\WinShell.dll]- [targetUID: 00000000-00005000] "libGLESv2.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 10 sections"- Location: [%LOCALAPPDATA%\Programs\waaake\libGLESv2.dll]- [targetUID: 00000000-00005000] "vk_swiftshader.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 10 sections"- Location: [%LOCALAPPDATA%\Programs\waaake\vk_swiftshader.dll]- [targetUID: 00000000-00005000] "ffmpeg.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 9 sections"- Location: [%LOCALAPPDATA%\Programs\waaake\ffmpeg.dll]- [targetUID: 00000000-00005000] "vulkan-1.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 10 sections"- Location: [%LOCALAPPDATA%\Programs\waaake\vulkan-1.dll]- [targetUID: 00000000-00005000] "libEGL.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 10 sections"- Location: [%TEMP%\nsbD764.tmp\7z-out\libEGL.dll]- [targetUID: 00000000-00005000]53:T12e1,"Waaake_Setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{A77F5D77-2E2B-44C3-A6A2-ABA601054A51}"; Key: "CATEGORY"; Value: "") "Waaake_Setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{A77F5D77-2E2B-44C3-A6A2-ABA601054A51}"; Key: "NAME"; Value: "") "Waaake_Setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{A77F5D77-2E2B-44C3-A6A2-ABA601054A51}"; Key: "PARENTFOLDER"; Value: "") "Waaake_Setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{A77F5D77-2E2B-44C3-A6A2-ABA601054A51}"; Key: "DESCRIPTION"; Value: "") "Waaake_Setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{A77F5D77-2E2B-44C3-A6A2-ABA601054A51}"; Key: "RELATIVEPATH"; Value: "") "Waaake_Setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{A77F5D77-2E2B-44C3-A6A2-ABA601054A51}"; Key: "PARSINGNAME"; Value: "") "Waaake_Setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{A77F5D77-2E2B-44C3-A6A2-ABA601054A51}"; Key: "INFOTIP"; Value: "") "Waaake_Setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{A77F5D77-2E2B-44C3-A6A2-ABA601054A51}"; Key: "LOCALIZEDNAME"; Value: "") "Waaake_Setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{A77F5D77-2E2B-44C3-A6A2-ABA601054A51}"; Key: "ICON"; Value: "") "Waaake_Setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{A77F5D77-2E2B-44C3-A6A2-ABA601054A51}"; Key: "SECURITY"; Value: "") "Waaake_Setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{A77F5D77-2E2B-44C3-A6A2-ABA601054A51}"; Key: "STREAMRESOURCE"; Value: "") "Waaake_Setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{A77F5D77-2E2B-44C3-A6A2-ABA601054A51}"; Key: "STREAMRESOURCETYPE"; Value: "") "Waaake_Setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{A77F5D77-2E2B-44C3-A6A2-ABA601054A51}"; Key: "LOCALREDIRECTONLY"; Value: "") "Waaake_Setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{A77F5D77-2E2B-44C3-A6A2-ABA601054A51}"; Key: "ROAMABLE"; Value: "") "Waaake_Setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{A77F5D77-2E2B-44C3-A6A2-ABA601054A51}"; Key: "PRECREATE"; Value: "") "Waaake_Setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{A77F5D77-2E2B-44C3-A6A2-ABA601054A51}"; Key: "STREAM"; Value: "") "Waaake_Setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{A77F5D77-2E2B-44C3-A6A2-ABA601054A51}"; Key: "PUBLISHEXPANDEDPATH"; Value: "") "Waaake_Setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{A77F5D77-2E2B-44C3-A6A2-ABA601054A51}"; Key: "DEFINITIONFLAGS"; Value: "") "Waaake_Setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{A77F5D77-2E2B-44C3-A6A2-ABA601054A51}"; Key: "ATTRIBUTES"; Value: "") "Waaake_Setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{A77F5D77-2E2B-44C3-A6A2-ABA601054A51}"; Key: "FOLDERTYPEID"; Value: "") "Waaake_Setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{A77F5D77-2E2B-44C3-A6A2-ABA601054A51}"; Key: "INITFOLDERHANDLER"; Value: "") "Waaake_Setup.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\USER SHELL FOLDERS"; Key: "PROGRAMS"; Value: "") "Waaake_Setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSWOW64\CMD.EXE"; Value: "")54:T41c,The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string) Matched sigs: Able to identify virtual environment by using user activity (API string) Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string) Matched sigs: Contains ability to detect virtual environment Matched sigs: Triggers a burst of requests to the same API (API Hammering) Matched sigs: Makes a code branch decision directly after an API that is environment aware Matched sigs: Contains ability to detect virtual environment (API) Matched sigs: Able to identify virtual environment by using API string Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques Matched sigs: Contains ability to delay the execution of current thread Matched sigs: Observed a high volume of repeated registry API calls (API Hammering)55:T94a,"Waaake_Setup.exe" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL" "Waaake_Setup.exe" trying to access non-existent file "C:\FLTLIB.DLL" "Waaake_Setup.exe" trying to access non-existent file "C:\CRYPTSP.DLL" "Waaake_Setup.exe" trying to access non-existent file "C:\Windows\SysWOW64\RPCSS.DLL" "Waaake_Setup.exe" trying to access non-existent file "C:\WINDOWS\system32\rpcss.dll" "Waaake_Setup.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\nsbD764.tmp\SYSTEM.DLL" "Waaake_Setup.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\nsbD764.tmp\System.dll" "Waaake_Setup.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\nsbD764.tmp\STDUTILS.DLL" "Waaake_Setup.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\nsbD764.tmp\StdUtils.dll" "Waaake_Setup.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\nsbD764.tmp\SPIDERBANNER.DLL" "Waaake_Setup.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\nsbD764.tmp\SpiderBanner.dll" "Waaake_Setup.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\nsbD764.tmp\NSEXEC.DLL" "Waaake_Setup.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\nsbD764.tmp\nsExec.dll" "Waaake_Setup.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\nsbD764.tmp\NSIS7Z.DLL" "Waaake_Setup.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\nsbD764.tmp\nsis7z.dll" "Waaake_Setup.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\waaake-updater\installer.exe" "Waaake_Setup.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Programs\waaake\Uninstall waaake.exe" "Waaake_Setup.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\nsbD764.tmp\WinShell.dll" "cmd.exe" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL" "tasklist.exe" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL" "tasklist.exe" trying to access non-existent file "C:\Windows\SysWOW64\RPCSS.DLL" "tasklist.exe" trying to access non-existent file "C:\WINDOWS\system32\rpcss.dll" "tasklist.exe" trying to access non-existent file "C:\Windows\SysWOW64\wbem\WBEMCOMN.DLL"56:T632,"Waaake_Setup.exe" trying to access non-existent file "C:\WAAAKE_SETUP.EXE.LOCAL" "Waaake_Setup.exe" trying to access non-existent file "C:\Waaake_Setup.exe.Local\" "Waaake_Setup.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\nsbD764.tmp\APP-64.7Z" "Waaake_Setup.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\nsbD764.tmp\app-64.7z" "Waaake_Setup.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WAAAKE.lnk" "Waaake_Setup.exe" trying to access non-existent file "C:\Users\%OSUSER%\Desktop\WAAAKE.lnk" "waaake.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Programs\waaake\WINSPOOL.DRV" "waaake.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\WAAAKE" "waaake.exe" trying to access non-existent file "C:\Users\HUSnbkF\AppData\Roaming\WAAAKE" "waaake.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\WAAAKE\LOCAL STATE" "waaake.exe" trying to access non-existent file "C:\Users\HUSnbkF\AppData\Roaming\WAAAKE\Local State" "waaake.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Programs\waaake\WAAAKE.EXE.LOCAL" "waaake.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Programs\waaake\waaake.exe.Local\" "waaake.exe" trying to access non-existent file "\DEVICE\NETBT_TCPIP_{D27478B9-2058-11E8-B41F-806E6F6E6963}" "waaake.exe" trying to access non-existent file "\DEVICE\NETBT_TCPIP_{3FC98E00-C370-43D9-A2DC-B067CC06FAD9}"57:Tff8,Found reference to API "GetHostNameW" (Indicator: "gethostname"; Source: "00000000-00006656-00000C2C-399678991") Found reference to API "Cannot copy a socket file" (Indicator: " socket "; Source: "00000000-00006656.00000000.89710.00100000.00000004.mdmp, 00000000-00006656.00000000.89710.00434000.00000004.mdmp, 00000000-00006656.00000001.91631.00100000.00000004.mdmp, 00000000-00006656.00000001.91631.00434000.00000004.mdmp") Found reference to API ":authority header is required for CONNECT requests" (Indicator: " connect "; Source: "00000000-00006656.00000000.89710.00100000.00000004.mdmp, 00000000-00006656.00000000.89710.00434000.00000004.mdmp, 00000000-00006656.00000001.91631.00100000.00000004.mdmp, 00000000-00006656.00000001.91631.00434000.00000004.mdmp") Found reference to API "The :path header is forbidden for CONNECT requests" (Indicator: " connect "; Source: "00000000-00006656.00000000.89710.00100000.00000004.mdmp, 00000000-00006656.00000000.89710.00434000.00000004.mdmp, 00000000-00006656.00000001.91631.00100000.00000004.mdmp, 00000000-00006656.00000001.91631.00434000.00000004.mdmp") Found reference to API "The :scheme header is forbidden for CONNECT requestsU" (Indicator: " connect "; Source: "00000000-00006656.00000000.89710.00100000.00000004.mdmp, 00000000-00006656.00000001.91631.00100000.00000004.mdmp") Found reference to API "The socket is already bound to an Http2Session" (Indicator: " socket "; Source: "00000000-00006656.00000000.89710.00100000.00000004.mdmp, 00000000-00006656.00000000.89710.00434000.00000004.mdmp, 00000000-00006656.00000001.91631.00100000.00000004.mdmp, 00000000-00006656.00000001.91631.00434000.00000004.mdmp") Found reference to API "The socket has been disconnected from the Http2Session" (Indicator: " socket "; Source: "00000000-00006656.00000000.89710.00100000.00000004.mdmp, 00000000-00006656.00000000.89710.00434000.00000004.mdmp, 00000000-00006656.00000001.91631.00100000.00000004.mdmp, 00000000-00006656.00000001.91631.00434000.00000004.mdmp") Found reference to API "Changing the socket encoding is not allowed per RFC7230 Section 3." (Indicator: " socket "; Source: "00000000-00006656.00000000.89710.00100000.00000004.mdmp, 00000000-00006656.00000000.89710.00434000.00000004.mdmp, 00000000-00006656.00000001.91631.00100000.00000004.mdmp, 00000000-00006656.00000001.91631.00434000.00000004.mdmp") Found reference to API "Bad socket type specified. Valid types are: udp4, udp6" (Indicator: " socket "; Source: "00000000-00006656.00000000.89710.00100000.00000004.mdmp, 00000000-00006656.00000000.89710.00434000.00000004.mdmp, 00000000-00006656.00000001.91631.00100000.00000004.mdmp, 00000000-00006656.00000001.91631.00434000.00000004.mdmp") Found reference to API "TLS socket connection must be securely established" (Indicator: " socket "; Source: "00000000-00006656.00000000.89710.00100000.00000004.mdmp, 00000000-00006656.00000000.89710.00434000.00000004.mdmp, 00000000-00006656.00000001.91631.00100000.00000004.mdmp, 00000000-00006656.00000001.91631.00434000.00000004.mdmp") Found reference to API "getHostname" (Indicator: "gethostname"; Source: "00000000-00006656.00000000.89710.001CC000.00000004.mdmp, 00000000-00006656.00000000.89710.00204000.00000004.mdmp, 00000000-00006656.00000000.89710.005A0000.00000004.mdmp, 00000000-00006656.00000001.91631.001CC000.00000004.mdmp, 00000000-00006656.00000001.91631.005A0000.00000004.mdmp") Found reference to API "else if (srcStat.isSocket()) throw new Error(`Cannot copy a socket file: ${src}`)" (Indicator: " socket "; Source: "00000000-00006656.00000000.89710.00200000.00000004.mdmp") Found reference to API "if (srcStat.isSocket()) throw new Error(`Cannot copy a socket file: ${src}`)" (Indicator: " socket "; Source: "00000000-00006656.00000000.89710.00200000.00000004.mdmp, 00000000-00006656.00000001.91631.000E0000.00000004.mdmp") Found reference to API "The :scheme header is forbidden for CONNECT requests" (Indicator: " connect "; Source: "00000000-00006656.00000000.89710.00434000.00000004.mdmp, 00000000-00006656.00000001.91631.00434000.00000004.mdmp")58:T1a2b,Heuristic match: ")ua.hm" Pattern match: "http://nsis.sf.net/nsis_error" Pattern match: "https://mozilla.org/mpl/2.0/.if" Pattern match: "https://opencollective.com/parcel" Pattern match: "https://fonts.googleapis.com,supports_spdy:true},{alternative_service:[{advertised_alpns:[h3],expiration:13419049996737472,port:443,protocol_str:quic}],anonymization:[],network_stats:{srtt:55667},server:https://fonts.gstatic.com" Pattern match: "https://github.com/tailwindlabs/tailwindcss.git" Heuristic match: "fonts.googleapis.com" Heuristic match: "fonts.gstatic.com" Heuristic match: "%windir%\system32\chcp.com" Heuristic match: "ws\microsoft.net" Pattern match: "microsoft.net/framework64/v4.0.30319/" Heuristic match: "ext=.com" Pattern match: "http://schemas.microsoft.com/smi/2016/windowssettings" Heuristic match: ".wsh;.ms" Heuristic match: "string.prototype.at" Heuristic match: "%typedarray%.prototype.at" Pattern match: "http://goo.gl/mqrfmx\u000a\u000a.replace" Pattern match: "http://goo.gl/mqrfmx\u000a" Pattern match: "https://pkware.cachefly.net/webdocs/casestudies/appnote.txt" Pattern match: "https://github.com/golang/go/blob/master/src/archive/zip/reader.go#l503" Pattern match: "https://nodejs.org/download/release/v22.14.0/win-x64/node.lib" Pattern match: "https://nodejs.org/download/release/v22.14.0/node-v22.14.0.tar.gz" Pattern match: "https://nodejs.org/download/release/v22.14.0/node-v22.14.0-headers.tar.gz" Pattern match: "https://github.com/calvinmetcalf/process-nextick-args.git" Pattern match: "https://github.com/calvinmetcalf/process-nextick-args" Pattern match: "github.com/tootallnate/util-deprecate.git" Pattern match: "http://n8.io/" Pattern match: "https://github.com/tootallnate/util-deprecate" Heuristic match: "$migration_guide.md" Heuristic match: "readme.md" Heuristic match: "history.md" Pattern match: "https://github.com/nodejs/node/issues" Pattern match: "http://opensource.org/licenses/mit-license.php" Pattern match: "http://en.wikipedia.org/wiki/double_precision_floating-point_format" Pattern match: "http://en.wikipedia.org/wiki/two's_complement" Pattern match: "app.asar/node_modules/unzipper/node_modules/fs-extra/lib/index.js" Pattern match: "http://goo.gl/rrqmuw" Heuristic match: "contributing.md" Heuristic match: "governance.md" Pattern match: "http://feross.org" Pattern match: "https://github.com/feross/safe-buffer" Pattern match: "github.com/feross/safe-buffer.git" Pattern match: "github.com/nodejs/readable-stream" Heuristic match: "blink.net" Pattern match: "http://github.com/broofa/node-int64" Pattern match: "https://github.com/broofa/node-int64" Pattern match: "http://debuggable.com/" Pattern match: "https://github.com/felixge/node-combined-stream" Pattern match: "github.com/felixge/node-combined-stream.git" Pattern match: "https://github.com/felixge/node-delayed-stream" Pattern match: "github.com/felixge/node-delayed-stream.git" Pattern match: "https://github.com/rob--w/proxy-from-env.git" Pattern match: "https://robwu.nl/" Pattern match: "https://github.com/rob--w/proxy-from-env#readme" Pattern match: "https://github.com/ryanzim/universalify#readme" Pattern match: "https://github.com/ryanzim/universalify.git" Pattern match: "https://github.com/isaacs/node-graceful-fs" Pattern match: "http://www.fknsrs.biz/" Pattern match: "github.com/isaacs/inherits" Heuristic match: "rd.ga" Pattern match: "https://github.com/alexindigo/asynckit.git" Pattern match: "https://github.com/alexindigo/asynckit#readme" Pattern match: "github.com/follow-redirects/follow-redirects.git" Pattern match: "https://github.com/follow-redirects/follow-redirects" Pattern match: "https://ruben.verborgh.org/" Pattern match: "https://github.com/sponsors/rubenverborgh" Pattern match: "https://plus-innovations.com" Pattern match: "https://systeminformation.io" Pattern match: "https://github.com/sebhildebrandt/systeminformation.git" Pattern match: "https://www.buymeacoffee.com/systeminfo" Pattern match: "https://github.com/zjonsson/node-unzipper.git" Pattern match: "github.com/juliangruber/isarray.git" Pattern match: "https://github.com/juliangruber/isarray" Pattern match: "http://juliangruber.com" Pattern match: "https://github.com/jprichardson/node-fs-extra/issues/269" Pattern match: "https://nodejs.org/api/fs.html#fs_stat_time_values" Pattern match: "https://github.com/isaacs/node-graceful-fs/issues/4" Pattern match: "https://github.com/sindresorhus/make-dir" Pattern match: "https://github.com/nodejs/node/issues/8987" Pattern match: "https://github.com/libuv/libuv/pull/1088" Pattern match: "https://github.com/ljharb/es-object-atoms.git" Pattern match: "https://github.com/ljharb/es-object-atoms#readme" Pattern match: "https://github.com/ljharb/get-proto.git" Pattern match: "https://github.com/ljharb/get-proto#readme" Pattern match: "https://github.com/es-shims/dunder-proto.git" Pattern match: "https://github.com/es-shims/dunder-proto#readme" Pattern match: "https://github.com/inspect-js/hasown.git" Pattern match: "https://github.com/inspect-js/hasown#readme" Heuristic match: "e.net" Pattern match: "https://github.com/automation-stack/node-machine-id#readme" Pattern match: "https://github.com/alex8088" Pattern match: "https://github.com/alex8088/electron-toolkit.git" Pattern match: "https://github.com/alex8088/electron-toolkit/tree/master/packages/utils#readme" Pattern match: "github.com/form-data/form-data.git" Pattern match: "https://github.com/ljharb/es-errors.git" Pattern match: "https://github.com/ljharb/es-errors#readme" Pattern match: "https://github.com/ljharb/gopd.git" Pattern match: "https://github.com/sponsors/ljharb" Pattern match: "https://github.com/ljharb/gopd#readme" Pattern match: "https://github.com/ljharb/es-define-property.git" Pattern match: "https://github.com/ljharb/es-define-property#readme" Pattern match: "https://github.com/raynos/function-bind.git" Pattern match: "https://github.com/raynos/function-bind" Pattern match: "https://github.com/petkaantonov/bluebird" Pattern match: "github.com/petkaantonov/bluebird.git" Pattern match: "http://github.com/petkaantonov/" Pattern match: "https://github.com/es-shims/es-set-tostringtag.git" Pattern match: "https://github.com/es-shims/es-set-tostringtag#readme" Heuristic match: "rc.jo" Heuristic match: "performanceentry.name" Pattern match: "http://ljharb.codes" Pattern match: "https://github.com/inspect-js/has-tostringtag.git" Pattern match: "https://github.com/inspect-js/has-tostringtag#readme" Pattern match: "https://github.com/jprichardson/node-fs-extra" Heuristic match: "guide.md" Heuristic match: "license.md"59:T7a7c,Found URL "http://goo.gl/mqrfmx\u000a\u000a" - Source: "00000000-00006656.00000000.89710.00028000.00000004.mdmp") Found URL "http://goo.gl/mqrfmx\u000a" - Source: "00000000-00006656.00000000.89710.00028000.00000004.mdmp") Found URL "https://pkware.cachefly.net/webdocs/casestudies/appnote.txtfunction" - Source: "00000000-00006656.00000000.89710.00040000.00000004.mdmp") Found URL "https://github.com/golang/go/blob/master/src/archive/zip/reader.go" - Source: "00000000-00006656.00000000.89710.00040000.00000004.mdmp") Found URL "https://nodejs.org/download/release/v22.14.0/win-x64/node.lib--debug-portactivate" - Source: "00000000-00006656.00000000.89710.0004C000.00000004.mdmp") Found URL "https://nodejs.org/download/release/v22.14.0/node-v22.14.0.tar.gzhttps://nodejs.org/download/release/v22.14.0/node-v22.14.0-headers.tar.gzactivate" - Source: "00000000-00006656.00000000.89710.00070000.00000004.mdmp") Found URL "https://github.com/calvinmetcalf/process-nextick-args.git" - Source: "00000000-00006656.00000000.89710.000BC000.00000004.mdmp") Found URL "https://github.com/calvinmetcalf/process-nextick-args" - Source: "00000000-00006656.00000000.89710.000BC000.00000004.mdmp") Found URL "http://n8.io/)" - Source: "00000000-00006656.00000000.89710.000BC000.00000004.mdmp") Found URL "https://github.com/tootallnate/util-deprecate" - Source: "00000000-00006656.00000000.89710.000BC000.00000004.mdmp") Found URL "http://goo.gl/mqrfmx\u000a" - Source: "00000000-00006656.00000000.89710.000EC000.00000004.mdmp") Found URL "https://github.com/nodejs/node/issueserr_invalid_address_familyaddresstypeerr_invalid_arg_typeuexpectedu'name'" - Source: "00000000-00006656.00000000.89710.00100000.00000004.mdmp") Found URL "https://pkware.cachefly.net/webdocs/casestudies/appnote.txtfunction" - Source: "00000000-00006656.00000000.89710.00100000.00000004.mdmp") Found URL "https://github.com/golang/go/blob/master/src/archive/zip/reader.go" - Source: "00000000-00006656.00000000.89710.00100000.00000004.mdmp") Found URL "http://opensource.org/licenses/mit-license.php" - Source: "00000000-00006656.00000000.89710.00100000.00000004.mdmp") Found URL "http://en.wikipedia.org/wiki/double_precision_floating-point_format//" - Source: "00000000-00006656.00000000.89710.00100000.00000004.mdmp") Found URL "http://en.wikipedia.org/wiki/two's_complement" - Source: "00000000-00006656.00000000.89710.00100000.00000004.mdmp") Found URL "http://goo.gl/mqrfmx\u000a" - Source: "00000000-00006656.00000000.89710.00100000.00000004.mdmp") Found URL "http://goo.gl/rrqmuw" - Source: "00000000-00006656.00000000.89710.00100000.00000004.mdmp") Found URL "http://feross.org" - Source: "00000000-00006656.00000000.89710.0010C000.00000004.mdmp") Found URL "https://github.com/feross/safe-buffer" - Source: "00000000-00006656.00000000.89710.0010C000.00000004.mdmp") Found URL "http://github.com/broofa/node-int64" - Source: "00000000-00006656.00000000.89710.00130000.00000004.mdmp") Found URL "https://github.com/broofa/node-int64" - Source: "00000000-00006656.00000000.89710.00130000.00000004.mdmp") Found URL "http://debuggable.com/)" - Source: "00000000-00006656.00000000.89710.00140000.00000004.mdmp") Found URL "https://github.com/felixge/node-combined-stream" - Source: "00000000-00006656.00000000.89710.00140000.00000004.mdmp") Found URL "https://github.com/felixge/node-delayed-stream" - Source: "00000000-00006656.00000000.89710.00140000.00000004.mdmp") Found URL "https://github.com/rob--w/proxy-from-env.git" - Source: "00000000-00006656.00000000.89710.00140000.00000004.mdmp") Found URL "https://robwu.nl/)" - Source: "00000000-00006656.00000000.89710.00140000.00000004.mdmp") Found URL "https://github.com/rob--w/proxy-from-env" - Source: "00000000-00006656.00000000.89710.00140000.00000004.mdmp") Found URL "https://github.com/ryanzim/universalify" - Source: "00000000-00006656.00000000.89710.00140000.00000004.mdmp") Found URL "https://github.com/ryanzim/universalify.git" - Source: "00000000-00006656.00000000.89710.00140000.00000004.mdmp") Found URL "https://github.com/isaacs/node-graceful-fs" - Source: "00000000-00006656.00000000.89710.00140000.00000004.mdmp") Found URL "http://www.fknsrs.biz/)" - Source: "00000000-00006656.00000000.89710.00160000.00000004.mdmp") Found URL "http://goo.gl/mqrfmx\u000a" - Source: "00000000-00006656.00000000.89710.0018C000.00000004.mdmp") Found URL "https://github.com/alexindigo/asynckit.git" - Source: "00000000-00006656.00000000.89710.001F4000.00000004.mdmp") Found URL "https://github.com/alexindigo/asynckit" - Source: "00000000-00006656.00000000.89710.001F4000.00000004.mdmp") Found URL "https://github.com/follow-redirects/follow-redirects" - Source: "00000000-00006656.00000000.89710.001F4000.00000004.mdmp") Found URL "https://ruben.verborgh.org/)" - Source: "00000000-00006656.00000000.89710.001F4000.00000004.mdmp") Found URL "https://github.com/sponsors/rubenverborgh" - Source: "00000000-00006656.00000000.89710.001F4000.00000004.mdmp") Found URL "https://plus-innovations.com)" - Source: "00000000-00006656.00000000.89710.001F4000.00000004.mdmp") Found URL "https://systeminformation.io" - Source: "00000000-00006656.00000000.89710.001F4000.00000004.mdmp") Found URL "https://github.com/sebhildebrandt/systeminformation.git" - Source: "00000000-00006656.00000000.89710.001F4000.00000004.mdmp") Found URL "https://www.buymeacoffee.com/systeminfo" - Source: "00000000-00006656.00000000.89710.001F4000.00000004.mdmp") Found URL "https://github.com/zjonsson/node-unzipper.git" - Source: "00000000-00006656.00000000.89710.001F4000.00000004.mdmp") Found URL "https://github.com/juliangruber/isarray" - Source: "00000000-00006656.00000000.89710.001F4000.00000004.mdmp") Found URL "http://juliangruber.com" - Source: "00000000-00006656.00000000.89710.001F4000.00000004.mdmp") Found URL "https://github.com/jprichardson/node-fs-extra/issues/269'," - Source: "00000000-00006656.00000000.89710.00200000.00000004.mdmp") Found URL "https://nodejs.org/api/fs.html" - Source: "00000000-00006656.00000000.89710.00200000.00000004.mdmp") Found URL "https://github.com/isaacs/node-graceful-fs/issues/4" - Source: "00000000-00006656.00000000.89710.00200000.00000004.mdmp") Found URL "https://github.com/sindresorhus/make-dir//" - Source: "00000000-00006656.00000000.89710.00200000.00000004.mdmp") Found URL "https://github.com/nodejs/node/issues/8987//" - Source: "00000000-00006656.00000000.89710.00200000.00000004.mdmp") Found URL "https://github.com/libuv/libuv/pull/1088module.exports.checkpath" - Source: "00000000-00006656.00000000.89710.00200000.00000004.mdmp") Found URL "https://github.com/ljharb/es-object-atoms.git" - Source: "00000000-00006656.00000000.89710.00204000.00000004.mdmp") Found URL "https://github.com/ljharb/es-object-atoms" - Source: "00000000-00006656.00000000.89710.00204000.00000004.mdmp") Found URL "https://github.com/ljharb/get-proto.git" - Source: "00000000-00006656.00000000.89710.00204000.00000004.mdmp") Found URL "https://github.com/ljharb/get-proto" - Source: "00000000-00006656.00000000.89710.00204000.00000004.mdmp") Found URL "https://github.com/es-shims/dunder-proto.git" - Source: "00000000-00006656.00000000.89710.00204000.00000004.mdmp") Found URL "https://github.com/es-shims/dunder-proto" - Source: "00000000-00006656.00000000.89710.00204000.00000004.mdmp") Found URL "https://github.com/inspect-js/hasown.git" - Source: "00000000-00006656.00000000.89710.00204000.00000004.mdmp") Found URL "https://github.com/inspect-js/hasown" - Source: "00000000-00006656.00000000.89710.00204000.00000004.mdmp") Found URL "http://goo.gl/mqrfmx\u000a" - Source: "00000000-00006656.00000000.89710.00230000.00000004.mdmp") Found URL "https://github.com/automation-stack/node-machine-id" - Source: "00000000-00006656.00000000.89710.003CC000.00000004.mdmp") Found URL "https://github.com/alex8088>" - Source: "00000000-00006656.00000000.89710.00484000.00000004.mdmp") Found URL "https://github.com/alex8088/electron-toolkit.git" - Source: "00000000-00006656.00000000.89710.00484000.00000004.mdmp") Found URL "https://github.com/alex8088/electron-toolkit/tree/master/packages/utils" - Source: "00000000-00006656.00000000.89710.00484000.00000004.mdmp") Found URL "http://debuggable.com/)" - Source: "00000000-00006656.00000000.89710.004A8000.00000004.mdmp") Found URL "https://github.com/ljharb/es-errors.git" - Source: "00000000-00006656.00000000.89710.004A8000.00000004.mdmp") Found URL "https://github.com/ljharb/es-errors" - Source: "00000000-00006656.00000000.89710.004A8000.00000004.mdmp") Found URL "https://github.com/ljharb/gopd.git" - Source: "00000000-00006656.00000000.89710.004A8000.00000004.mdmp") Found URL "https://github.com/sponsors/ljharb" - Source: "00000000-00006656.00000000.89710.004A8000.00000004.mdmp") Found URL "https://github.com/ljharb/gopd" - Source: "00000000-00006656.00000000.89710.004A8000.00000004.mdmp") Found URL "https://github.com/ljharb/es-define-property.git" - Source: "00000000-00006656.00000000.89710.004A8000.00000004.mdmp") Found URL "https://github.com/ljharb/es-define-property" - Source: "00000000-00006656.00000000.89710.004A8000.00000004.mdmp") Found URL "https://github.com/raynos/function-bind.git" - Source: "00000000-00006656.00000000.89710.004A8000.00000004.mdmp") Found URL "https://github.com/raynos/function-bind" - Source: "00000000-00006656.00000000.89710.004A8000.00000004.mdmp") Found URL "https://github.com/petkaantonov/bluebird" - Source: "00000000-00006656.00000000.89710.004A8000.00000004.mdmp") Found URL "http://github.com/petkaantonov/" - Source: "00000000-00006656.00000000.89710.004A8000.00000004.mdmp") Found URL "https://github.com/es-shims/es-set-tostringtag.git" - Source: "00000000-00006656.00000000.89710.004DC000.00000004.mdmp") Found URL "https://github.com/es-shims/es-set-tostringtag" - Source: "00000000-00006656.00000000.89710.004DC000.00000004.mdmp") Found URL "http://ljharb.codes" - Source: "00000000-00006656.00000000.89710.00504000.00000004.mdmp") Found URL "https://github.com/sponsors/ljharb" - Source: "00000000-00006656.00000000.89710.00504000.00000004.mdmp") Found URL "https://github.com/inspect-js/has-tostringtag.git" - Source: "00000000-00006656.00000000.89710.00504000.00000004.mdmp") Found URL "https://github.com/inspect-js/has-tostringtag" - Source: "00000000-00006656.00000000.89710.00504000.00000004.mdmp") Found URL "https://github.com/jprichardson/node-fs-extra" - Source: "00000000-00006656.00000000.89710.0054C000.00000004.mdmp") Found URL "https://github.com/es-shims/math-intrinsics.git" - Source: "00000000-00006656.00000000.89710.01584000.00000004.mdmp") Found URL "https://github.com/es-shims/math-intrinsics" - Source: "00000000-00006656.00000000.89710.01584000.00000004.mdmp") Found URL "https://chromewebstore.google.com/internal/file*internal/error_serdesinternal/workerworker_threadsconstants&internal/fs/streams_)g7_)gnod_)" - Source: "00000000-00006656.00000000.89710.0159C000.00000004.mdmp") Found URL "https://clients2.google.com/service/update2/crxthreadpoolsinglethreadcomstasharedbackgroundblocking0crbrowsermain:chrome" - Source: "00000000-00006656.00000000.89710.016CC000.00000004.mdmp") Found URL "https://fs.microsoft.com/fs/windows/config.json02/24" - Source: "00000000-00006656.00000000.89710.4FD10000.00000002.mdmp") Found URL "https://fs.microsoft.com/fs/windows/config.json,config,002/24" - Source: "00000000-00006656.00000000.89710.4FD10000.00000002.mdmp") Found URL "http://goo.gl/mqrfmx\u000a\u000a" - Source: "00000000-00006656.00000001.91631.00028000.00000004.mdmp") Found URL "http://goo.gl/mqrfmx\u000a" - Source: "00000000-00006656.00000001.91631.00028000.00000004.mdmp") Found URL "https://nodejs.org/download/release/v22.14.0/win-x64/node.lib--debug-portactivate" - Source: "00000000-00006656.00000001.91631.0004C000.00000004.mdmp") Found URL "https://nodejs.org/download/release/v22.14.0/node-v22.14.0.tar.gzhttps://nodejs.org/download/release/v22.14.0/node-v22.14.0-headers.tar.gzactivate" - Source: "00000000-00006656.00000001.91631.00070000.00000004.mdmp") Found URL "https://github.com/calvinmetcalf/process-nextick-args.git" - Source: "00000000-00006656.00000001.91631.00098000.00000004.mdmp") Found URL "https://github.com/calvinmetcalf/process-nextick-args" - Source: "00000000-00006656.00000001.91631.00098000.00000004.mdmp") Found URL "http://n8.io/)" - Source: "00000000-00006656.00000001.91631.00098000.00000004.mdmp") Found URL "https://github.com/tootallnate/util-deprecate" - Source: "00000000-00006656.00000001.91631.00098000.00000004.mdmp") Found URL "https://github.com/jprichardson/node-fs-extra/issues/269'," - Source: "00000000-00006656.00000001.91631.000E0000.00000004.mdmp") Found URL "https://nodejs.org/api/fs.html" - Source: "00000000-00006656.00000001.91631.000E0000.00000004.mdmp") Found URL "https://github.com/nodejs/node/issueserr_invalid_address_familyaddresstypeerr_invalid_arg_typeuexpectedu'name'" - Source: "00000000-00006656.00000001.91631.00100000.00000004.mdmp") Found URL "https://pkware.cachefly.net/webdocs/casestudies/appnote.txtfunction" - Source: "00000000-00006656.00000001.91631.00100000.00000004.mdmp") Found URL "https://github.com/golang/go/blob/master/src/archive/zip/reader.go" - Source: "00000000-00006656.00000001.91631.00100000.00000004.mdmp") Found URL "http://opensource.org/licenses/mit-license.php" - Source: "00000000-00006656.00000001.91631.00100000.00000004.mdmp") Found URL "http://en.wikipedia.org/wiki/double_precision_floating-point_format//" - Source: "00000000-00006656.00000001.91631.00100000.00000004.mdmp") Found URL "http://en.wikipedia.org/wiki/two's_complement" - Source: "00000000-00006656.00000001.91631.00100000.00000004.mdmp") Found URL "http://goo.gl/mqrfmx\u000a" - Source: "00000000-00006656.00000001.91631.00100000.00000004.mdmp") Found URL "http://goo.gl/rrqmuw" - Source: "00000000-00006656.00000001.91631.00100000.00000004.mdmp") Found URL "http://feross.org" - Source: "00000000-00006656.00000001.91631.0010C000.00000004.mdmp") Found URL "https://github.com/feross/safe-buffer" - Source: "00000000-00006656.00000001.91631.0010C000.00000004.mdmp") Found URL "http://github.com/broofa/node-int64" - Source: "00000000-00006656.00000001.91631.00130000.00000004.mdmp") Found URL "https://github.com/broofa/node-int64" - Source: "00000000-00006656.00000001.91631.00130000.00000004.mdmp") Found URL "http://debuggable.com/)" - Source: "00000000-00006656.00000001.91631.00140000.00000004.mdmp") Found URL "https://github.com/felixge/node-combined-stream" - Source: "00000000-00006656.00000001.91631.00140000.00000004.mdmp") Found URL "https://github.com/felixge/node-delayed-stream" - Source: "00000000-00006656.00000001.91631.00140000.00000004.mdmp") Found URL "https://github.com/rob--w/proxy-from-env.git" - Source: "00000000-00006656.00000001.91631.00140000.00000004.mdmp") Found URL "https://robwu.nl/)" - Source: "00000000-00006656.00000001.91631.00140000.00000004.mdmp") Found URL "https://github.com/rob--w/proxy-from-env" - Source: "00000000-00006656.00000001.91631.00140000.00000004.mdmp") Found URL "https://github.com/ryanzim/universalify" - Source: "00000000-00006656.00000001.91631.00140000.00000004.mdmp") Found URL "https://github.com/ryanzim/universalify.git" - Source: "00000000-00006656.00000001.91631.00140000.00000004.mdmp") Found URL "https://github.com/isaacs/node-graceful-fs" - Source: "00000000-00006656.00000001.91631.00140000.00000004.mdmp") Found URL "http://www.fknsrs.biz/)" - Source: "00000000-00006656.00000001.91631.00160000.00000004.mdmp") Found URL "https://github.com/alexindigo/asynckit.git" - Source: "00000000-00006656.00000001.91631.001F4000.00000004.mdmp") Found URL "https://github.com/alexindigo/asynckit" - Source: "00000000-00006656.00000001.91631.001F4000.00000004.mdmp") Found URL "https://github.com/follow-redirects/follow-redirects" - Source: "00000000-00006656.00000001.91631.001F4000.00000004.mdmp") Found URL "https://ruben.verborgh.org/)" - Source: "00000000-00006656.00000001.91631.001F4000.00000004.mdmp") Found URL "https://github.com/sponsors/rubenverborgh" - Source: "00000000-00006656.00000001.91631.001F4000.00000004.mdmp") Found URL "https://plus-innovations.com)" - Source: "00000000-00006656.00000001.91631.001F4000.00000004.mdmp") Found URL "https://systeminformation.io" - Source: "00000000-00006656.00000001.91631.001F4000.00000004.mdmp") Found URL "https://github.com/sebhildebrandt/systeminformation.git" - Source: "00000000-00006656.00000001.91631.001F4000.00000004.mdmp") Found URL "https://www.buymeacoffee.com/systeminfo" - Source: "00000000-00006656.00000001.91631.001F4000.00000004.mdmp") Found URL "https://github.com/zjonsson/node-unzipper.git" - Source: "00000000-00006656.00000001.91631.001F4000.00000004.mdmp") Found URL "https://github.com/juliangruber/isarray" - Source: "00000000-00006656.00000001.91631.001F4000.00000004.mdmp") Found URL "http://juliangruber.com" - Source: "00000000-00006656.00000001.91631.001F4000.00000004.mdmp") Found URL "https://github.com/ljharb/es-object-atoms.git" - Source: "00000000-00006656.00000001.91631.00204000.00000004.mdmp") Found URL "https://github.com/ljharb/es-object-atoms" - Source: "00000000-00006656.00000001.91631.00204000.00000004.mdmp") Found URL "https://github.com/ljharb/get-proto.git" - Source: "00000000-00006656.00000001.91631.00204000.00000004.mdmp") Found URL "https://github.com/ljharb/get-proto" - Source: "00000000-00006656.00000001.91631.00204000.00000004.mdmp") Found URL "https://github.com/es-shims/dunder-proto.git" - Source: "00000000-00006656.00000001.91631.00204000.00000004.mdmp") Found URL "https://github.com/es-shims/dunder-proto" - Source: "00000000-00006656.00000001.91631.00204000.00000004.mdmp") Found URL "https://github.com/inspect-js/hasown.git" - Source: "00000000-00006656.00000001.91631.00204000.00000004.mdmp") Found URL "https://github.com/inspect-js/hasown" - Source: "00000000-00006656.00000001.91631.00204000.00000004.mdmp") Found URL "http://goo.gl/mqrfmx\u000a" - Source: "00000000-00006656.00000001.91631.00230000.00000004.mdmp") Found URL "https://github.com/automation-stack/node-machine-id" - Source: "00000000-00006656.00000001.91631.003CC000.00000004.mdmp") Found URL "https://github.com/ljharb/get-intrinsic.git" - Source: "00000000-00006656.00000001.91631.003DC000.00000004.mdmp") Found URL "https://github.com/sponsors/ljharb" - Source: "00000000-00006656.00000001.91631.003DC000.00000004.mdmp") Found URL "https://github.com/ljharb/get-intrinsic" - Source: "00000000-00006656.00000001.91631.003DC000.00000004.mdmp") Found URL "http://ljharb.codes" - Source: "00000000-00006656.00000001.91631.003DC000.00000004.mdmp") Found URL "https://github.com/ljharb/has-symbols" - Source: "00000000-00006656.00000001.91631.003DC000.00000004.mdmp") Found URL "https://github.com/ljharb/call-bind-apply-helpers.git" - Source: "00000000-00006656.00000001.91631.003DC000.00000004.mdmp") Found URL "https://github.com/ljharb/call-bind-apply-helpers" - Source: "00000000-00006656.00000001.91631.003DC000.00000004.mdmp") Found URL "https://github.com/automation-stack/node-machine-id" - Source: "00000000-00006656.00000001.91631.003DC000.00000004.mdmp") Found URL "https://github.com/alex8088>" - Source: "00000000-00006656.00000001.91631.00484000.00000004.mdmp") Found URL "https://github.com/alex8088/electron-toolkit.git" - Source: "00000000-00006656.00000001.91631.00484000.00000004.mdmp") Found URL "https://github.com/alex8088/electron-toolkit/tree/master/packages/utils" - Source: "00000000-00006656.00000001.91631.00484000.00000004.mdmp") Found URL "http://debuggable.com/)" - Source: "00000000-00006656.00000001.91631.004A8000.00000004.mdmp") Found URL "https://github.com/ljharb/es-errors.git" - Source: "00000000-00006656.00000001.91631.004A8000.00000004.mdmp") Found URL "https://github.com/ljharb/es-errors" - Source: "00000000-00006656.00000001.91631.004A8000.00000004.mdmp") Found URL "https://github.com/ljharb/gopd.git" - Source: "00000000-00006656.00000001.91631.004A8000.00000004.mdmp") Found URL "https://github.com/sponsors/ljharb" - Source: "00000000-00006656.00000001.91631.004A8000.00000004.mdmp") Found URL "https://github.com/ljharb/gopd" - Source: "00000000-00006656.00000001.91631.004A8000.00000004.mdmp") Found URL "https://github.com/ljharb/es-define-property.git" - Source: "00000000-00006656.00000001.91631.004A8000.00000004.mdmp") Found URL "https://github.com/ljharb/es-define-property" - Source: "00000000-00006656.00000001.91631.004A8000.00000004.mdmp") Found URL "https://github.com/raynos/function-bind.git" - Source: "00000000-00006656.00000001.91631.004A8000.00000004.mdmp") Found URL "https://github.com/raynos/function-bind" - Source: "00000000-00006656.00000001.91631.004A8000.00000004.mdmp") Found URL "https://github.com/petkaantonov/bluebird" - Source: "00000000-00006656.00000001.91631.004A8000.00000004.mdmp") Found URL "http://github.com/petkaantonov/" - Source: "00000000-00006656.00000001.91631.004A8000.00000004.mdmp") Found URL "https://github.com/es-shims/es-set-tostringtag.git" - Source: "00000000-00006656.00000001.91631.004DC000.00000004.mdmp") Found URL "https://github.com/es-shims/es-set-tostringtag" - Source: "00000000-00006656.00000001.91631.004DC000.00000004.mdmp") Found URL "http://www.iec.chiec.chgb" - Source: "00000000-00006656.00000001.91631.004DC000.00000004.mdmp") Found URL "http://www.iec.chiec" - Source: "00000000-00006656.00000001.91631.004DC000.00000004.mdmp") Found URL "http://www.iec.chdesc.iec" - Source: "00000000-00006656.00000001.91631.004DC000.00000004.mdmp") Found URL "https://github.com/axios/axios.git" - Source: "00000000-00006656.00000001.91631.0051C000.00000004.mdmp") Found URL "https://axios-http.com" - Source: "00000000-00006656.00000001.91631.0051C000.00000004.mdmp") Found URL "https://github.com/jprichardson/node-fs-extra" - Source: "00000000-00006656.00000001.91631.0054C000.00000004.mdmp") Found URL "https://github.com/es-shims/math-intrinsics.git" - Source: "00000000-00006656.00000001.91631.01584000.00000004.mdmp") Found URL "https://github.com/es-shims/math-intrinsics" - Source: "00000000-00006656.00000001.91631.01584000.00000004.mdmp") Found URL "https://clients2.google.com/service/update2/crxthreadpoolsinglethreadcomstasharedbackgroundblocking0crbrowsermain:chrome" - Source: "00000000-00006656.00000001.91631.016CC000.00000004.mdmp") Found URL "http://unisolated.invalid/981305c579be57e2fbafdadfc7232682@y" - Source: "00000000-00006656.00000001.91631.01818000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00006656.00000001.91631.4FC8C000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00006656.00000001.91631.4FC8C000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00006656.00000001.91631.4FC8C000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00006656.00000001.91631.4FC8C000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00006656.00000001.91631.4FC8C000.00000004.mdmp") Found URL "https://fs.microsoft.com/fs/windows/config.json02/24" - Source: "00000000-00006656.00000001.91631.4FD10000.00000002.mdmp") Found URL "https://fs.microsoft.com/fs/windows/config.json,config,002/24" - Source: "00000000-00006656.00000001.91631.4FD10000.00000002.mdmp") Found URL "https://chrome.google.com/webstore?hl=enctrl$1+$2press" - Source: "00000000-00006656.00000001.91631.92CA0000.00000002.mdmp") Found URL "http://'" - Source: "00000000-00006656.00000001.91631.92CA0000.00000002.mdmp") Found URL "https://'" - Source: "00000000-00006656.00000001.91631.92CA0000.00000002.mdmp") Found URL "https://myactivity.google.com/" - Source: "00000000-00006656.00000001.91631.92CA0000.00000002.mdmp") Found URL "https://policies.google.com/" - Source: "00000000-00006656.00000001.91631.92CA0000.00000002.mdmp") Found URL "https://support.google.com/chromebook?p=app_intent" - Source: "00000000-00006656.00000001.91631.92CA0000.00000002.mdmp") Found URL "https://chrome.google.com/webstore/category/extensions" - Source: "00000000-00006656.00000001.91631.92CA0000.00000002.mdmp") Found URL "https://www.example.comurl" - Source: "00000000-00006656.00000001.91631.92CA0000.00000002.mdmp") Found URL "https://www.google.com/chrome/privacy/eula_text.htmlh&elpmanaged" - Source: "00000000-00006656.00000001.91631.92CA0000.00000002.mdmp") Found URL "https://chromeenterprise.google/policies/" - Source: "00000000-00006656.00000001.91631.92CA0000.00000002.mdmp") Found URL "http://," - Source: "00000000-00006656.00000001.91631.92CA0000.00000002.mdmp") Found URL "https://," - Source: "00000000-00006656.00000001.91631.92CA0000.00000002.mdmp") Found URL "https://passwords.google.comgoogle" - Source: "00000000-00006656.00000001.91631.92CA0000.00000002.mdmp") Found URL "https://chrome.google.com/webstore?hl=en&category=theme81https://myactivity.google.com/myactivity/?utm_source=chrome_nhttps://myactivity.google.com/myactivity/?utm_source=chrome_h-p" - Source: "00000000-00006656.00000001.91631.92CA0000.00000002.mdmp") Found URL "https://chromestatus.com/features" - Source: "00000000-00006656.00000001.91631.92CA0000.00000002.mdmp") Found URL "https://support.google.com/chrome/a/?p=browser_profile_details" - Source: "00000000-00006656.00000001.91631.92CA0000.00000002.mdmp") Found URL "http://example.com" - Source: "00000000-00006656.00000001.91631.92CA0000.00000002.mdmp") Found URL "https://example.com.use" - Source: "00000000-00006656.00000001.91631.92CA0000.00000002.mdmp") Found URL "https://support.google.com/chrome/a/answer/9122284" - Source: "00000000-00006656.00000001.91631.92CA0000.00000002.mdmp") Found URL "http://.

" - Source: "00000000-00006656.00000001.91631.92CA0000.00000002.mdmp") Found URL "http://," - Source: "00000000-00006656.00000001.91631.92CA0000.00000002.mdmp") Found URL "http://example.com." - Source: "00000000-00006656.00000001.91631.92CA0000.00000002.mdmp") Found URL "https://support.google.com/chrome/answer/6098869" - Source: "00000000-00006656.00000001.91631.92CA0000.00000002.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00006656.00000001.91631.93800000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00006656.00000001.91631.93800000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl040n64;l64/g644s66vf" - Source: "00000000-00006656.00000001.91631.93800000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00006656.00000001.91631.93800000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00006656.00000001.91631.93800000.00000004.mdmp") Found URL "http://crl.global710/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00006656.00000001.91631.93800000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00006656.00000001.91631.93800000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.9iqmgvw,czcthawte," - Source: "00000000-00006656.00000001.91631.93800000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?e46" - Source: "00000000-00006656.00000001.91631.93800000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00006656.00000001.91631.93800000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00006656.00000001.91631.93800000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00006656.00000001.91631.93800000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00006656.00000001.91631.93800000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00006656.00000001.91631.93800000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;4sh6addtrust" - Source: "00000000-00006656.00000001.91631.93800000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00006656.00000001.91631.93800000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00006656.00000001.91631.93800000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00006656.00000001.91631.93800000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00006656.00000001.91631.93800000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/certs/microoceraut201120531151137z0<" - Source: "00000000-00006656.00000001.91631.93800000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http:5" - Source: "00000000-00006656.00000001.91631.93800000.00000004.mdmp") Found URL "http://crt.usertrust.com/usertrustrsaadd" - Source: "00000000-00006656.00000001.91631.93800000.00000004.mdmp") Found URL "https://nodejs.org/download/release/v22.14.0/win-x64/node.lib--debug-portactivate" - Source: "00000000-00007804.00000000.91268.0004C000.00000004.mdmp") Found URL "https://nodejs.org/download/release/v22.14.0/node-v22.14.0.tar.gzhttps://nodejs.org/download/release/v22.14.0/node-v22.14.0-headers.tar.gzactivate" - Source: "00000000-00007804.00000000.91268.00070000.00000004.mdmp") Found URL "http://wpad/wpad.datp,y<@,y= 12.0.0" }, "files": [ "lightningcss.linux-x64-musl.node" ], "resolutions": { "lightningcss": "link:." }, "os": [ "linux" ], "cpu": [ "x64" ], "libc": [ "musl"" (Indicator: "github.com") ""name": "lightningcss-linux-x64-gnu", "version": "1.29.2", "license": "MPL-2.0", "description": "A CSS parser transformer and minifier written in Rust", "main": "lightningcss.linux-x64-gnu.node", "browserslist": "last 2 versions not dead", "publishConfig": { "access": "public" }, "funding": { "type": "opencollective", "url": "https://opencollective.com/parcel" }, "repository": { "type": "git", "url": "https://github.com/parcel-bundler/lightningcss.git" }, "engines": { "node": ">= 12.0.0" }, "files": [ "lightningcss.linux-x64-gnu.node" ], "resolutions": { "lightningcss": "link:." }, "os": [ "linux" ], "cpu": [ "x64" ], "libc": [ "glibc"" (Indicator: "github.com") ""name": "@tailwindcss/oxide-linux-x64-musl", "version": "4.1.5", "repository": { "type": "git", "url": "git+https://github.com/tailwindlabs/tailwindcss.git", "directory": "crates/node/npm/linux-x64-musl" }, "os": [ "linux" ], "cpu": [ "x64" ], "main": "tailwindcss-oxide.linux-x64-musl.node", "files": [ "tailwindcss-oxide.linux-x64-musl.node" ], "publishConfig": { "provenance": true, "access": "public" }, "license": "MIT", "engines": { "node": ">= 10" }, "libc": [ "musl"" (Indicator: "github.com") ""name": "@tailwindcss/oxide-linux-x64-gnu", "version": "4.1.5", "repository": { "type": "git", "url": "git+https://github.com/tailwindlabs/tailwindcss.git", "directory": "crates/node/npm/linux-x64-gnu" }, "os": [ "linux" ], "cpu": [ "x64" ], "main": "tailwindcss-oxide.linux-x64-gnu.node", "files": [ "tailwindcss-oxide.linux-x64-gnu.node" ], "publishConfig": { "provenance": true, "access": "public" }, "license": "MIT", "engines": { "node": ">= 10" }, "libc": [ "glibc"" (Indicator: "github.com") ""homepage": "https://github.com/petkaantonov/bluebird"," (Indicator: "github.com") ""url": "git://github.com/petkaantonov/bluebird.git"" (Indicator: "github.com") ""url": "http://github.com/petkaantonov/"" (Indicator: "github.com") ""url": "https://github.com/calvinmetcalf/process-nextick-args.git"" (Indicator: "github.com") ""homepage": "https://github.com/calvinmetcalf/process-nextick-args"," (Indicator: "github.com") ""url": "git://github.com/TooTallNate/util-deprecate.git"" (Indicator: "github.com") ""homepage": "https://github.com/TooTallNate/util-deprecate"" (Indicator: "github.com") ""url": "git@github.com:jprichardson/node-jsonfile.git"" (Indicator: "github.com")72:T1c57,"Waaake_Setup.exe" file has an entrypoint instructions - "sub esp, 0x2d4,push ebx,push esi,push edi,push 0x20,pop edi,xor ebx, ebx,push 0x8001,mov dword ptr [esp + 0x14], ebx,mov dword ptr [esp + 0x10], 0x40a2e0,mov dword ptr [esp + 0x1c], ebx,call dword ptr [0x4080a8],call dword ptr [0x4080a4],and eax, 0xbfffffff,cmp ax, 6,mov dword ptr [0x47aeec], eax,je 0x4033df,push ebx,call 0x406694,cmp eax, ebx,je 0x4033df,push 0xc00,call eax,mov esi, 0x4082b0,push esi,call 0x406624,push esi,call dword ptr [0x408150]," "ffmpeg.dll" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x20,mov rdi, r8,mov ebx, edx,mov rsi, rcx,cmp edx, 1,jne 0x1800b88f1,call 0x1800b8910,mov r8, rdi,mov edx, ebx,mov rcx, rsi,mov rbx, qword ptr [rsp + 0x30],mov rsi, qword ptr [rsp + 0x38],add rsp, 0x20,pop rdi,jmp 0x1800b8790,int3 ,int3 ,int3 ,mov qword ptr [rsp + 0x18], rbx,push rbp,mov rbp, rsp,sub rsp, 0x30,mov rax, qword ptr [rip + 0x21271c],movabs rbx, 0x2b992ddfa232,cmp rax, rbx,jne 0x1800b89a7," "vulkan-1.dll" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x20,mov rdi, r8,mov ebx, edx,mov rsi, rcx,cmp edx, 1,jne 0x18005ab41,call 0x18005ab60,mov r8, rdi,mov edx, ebx,mov rcx, rsi,mov rbx, qword ptr [rsp + 0x30],mov rsi, qword ptr [rsp + 0x38],add rsp, 0x20,pop rdi,jmp 0x18005a9e0,int3 ,int3 ,int3 ,mov qword ptr [rsp + 0x18], rbx,push rbp,mov rbp, rsp,sub rsp, 0x30,mov rax, qword ptr [rip + 0x774cc],movabs rbx, 0x2b992ddfa232,cmp rax, rbx,jne 0x18005abf7," "libEGL.dll" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x20,mov rdi, r8,mov ebx, edx,mov rsi, rcx,cmp edx, 1,jne 0x18001f591,call 0x18001f5b0,mov r8, rdi,mov edx, ebx,mov rcx, rsi,mov rbx, qword ptr [rsp + 0x30],mov rsi, qword ptr [rsp + 0x38],add rsp, 0x20,pop rdi,jmp 0x18001f430,int3 ,int3 ,int3 ,mov qword ptr [rsp + 0x18], rbx,push rbp,mov rbp, rsp,sub rsp, 0x30,mov rax, qword ptr [rip + 0x50a7c],movabs rbx, 0x2b992ddfa232,cmp rax, rbx,jne 0x18001f647," "nsis7z.dll" file has an entrypoint instructions - "push ebp,mov ebp, esp,cmp dword ptr [ebp + 0xc], 1,jne 0x10041926,call 0x10041d9f,push dword ptr [ebp + 0x10],push dword ptr [ebp + 0xc],push dword ptr [ebp + 8],call 0x100417e7,add esp, 0xc,pop ebp,ret 0xc,int3 ,int3 ,int3 ,int3 ,int3 ,push ecx,lea ecx, [esp + 4],sub ecx, eax,sbb eax, eax,not eax,and ecx, eax,mov eax, esp,and eax, 0xfffff000,cmp ecx, eax,bnd jb 0x10041964,mov eax, ecx,pop ecx,xchg esp, eax,mov eax, dword ptr [eax],mov dword ptr [esp], eax,bnd ret ,sub eax, 0x1000,test dword ptr [eax], eax,jmp 0x10041954,jmp 0x10045e26,push ebp,mov ebp, esp,push esi,push dword ptr [ebp + 8],mov esi, ecx," "Uninstall waaake.exe" file has an entrypoint instructions - "sub esp, 0x2d4,push ebx,push esi,push edi,push 0x20,pop edi,xor ebx, ebx,push 0x8001,mov dword ptr [esp + 0x14], ebx,mov dword ptr [esp + 0x10], 0x40a2e0,mov dword ptr [esp + 0x1c], ebx,call dword ptr [0x4080a8],call dword ptr [0x4080a4],and eax, 0xbfffffff,cmp ax, 6,mov dword ptr [0x47aeec], eax,je 0x4033df,push ebx,call 0x406694,cmp eax, ebx,je 0x4033df,push 0xc00,call eax,mov esi, 0x4082b0,push esi,call 0x406624,push esi,call dword ptr [0x408150]," "elevate.exe" file has an entrypoint instructions - "call 0x401e04,jmp 0x4018f0,push ebp,mov ebp, esp,push 0,call dword ptr [0x413020],push dword ptr [ebp + 8],call dword ptr [0x41301c],push 0xc0000409,call dword ptr [0x413024],push eax,call dword ptr [0x413028],pop ebp,ret ,push ebp,mov ebp, esp,sub esp, 0x324,push 0x17,call 0x410fd4,test eax, eax,je 0x401ab7,push 2,pop ecx,int 0x29,mov dword ptr [0x41a8f0], eax,mov dword ptr [0x41a8ec], ecx,mov dword ptr [0x41a8e8], edx,mov dword ptr [0x41a8e4], ebx," "StdUtils.dll" file has an entrypoint instructions - "cmp dword ptr [esp + 8], 1,jne 0x1000eae7,push 0x10019550,call dword ptr [0x10014044],mov eax, dword ptr [esp + 4],mov dword ptr [0x1001959c], 0,mov byte ptr [0x10019582], 0,mov dword ptr [0x10019598], eax,jmp 0x1000eafe,cmp dword ptr [esp + 8], 0,jne 0x1000eafe,call 0x10005968,push 0x10019550,call dword ptr [0x10014078],xor eax, eax,inc eax,ret 0xc,cmp dword ptr [esp + 4], 0,jl 0x1000eb12,cmp dword ptr [esp + 4], 1,jle 0x1000eb1d,push 0x10014398,call dword ptr [0x1001403c]," "System.dll" file has an entrypoint instructions - "mov eax, dword ptr [esp + 4],cmp dword ptr [esp + 8], 1,mov dword ptr [0x10005048], eax,jne 0x100029e3,push 0x1000504c,push 0x40,push 4,push 0x1000505c,call dword ptr [0x10004038],xor eax, eax,mov byte ptr [0x1000505c], 0xc2,mov dword ptr [0x1000504c], eax,mov dword ptr [0x10005054], eax,mov dword ptr [0x10005068], eax,mov dword ptr [0x10005058], eax,mov dword ptr [0x10005050], eax,mov dword ptr [0x10005060], eax,mov byte ptr [0x1000505e], al,xor eax, eax,inc eax,ret 0xc,mov eax, 0x10000,ret ,mov eax, dword ptr [esp + 4]," "SpiderBanner.dll" file has an entrypoint instructions - "cmp dword ptr [esp + 8], 0,mov eax, dword ptr [esp + 4],mov dword ptr [0x10004008], eax,mov dword ptr [0x10004050], 0,jne 0x1000218f,call 0x10001fd0,mov eax, 1,ret 0xc,mov eax, dword ptr [0x10004078],push esi,test eax, eax,je 0x100021d0,mov esi, dword ptr [eax],test esi, esi,je 0x100021d0,cmp dword ptr [esp + 8], 0,je 0x100021c1,lea eax, [esi + 4],push eax,push dword ptr [esp + 0xc],call dword ptr [0x10003028],mov eax, dword ptr [0x10004078],mov ecx, dword ptr [esi],push esi,mov dword ptr [eax], ecx,call dword ptr [0x10003044],xor eax, eax,jmp 0x100021d3,xor eax, eax,inc eax,pop esi," "nsExec.dll" file has an entrypoint instructions - "mov eax, dword ptr [esp + 4],mov dword ptr [0x10003cbc], eax,xor eax, eax,inc eax,ret 0xc,push ebp,mov ebp, esp,push ecx,push esi,push 0x10003014,push 0x10003000,call dword ptr [0x1000200c],push eax,call dword ptr [0x10002050],mov esi, eax,test esi, esi,je 0x100010ce,lea eax, [ebp - 4],push eax,call dword ptr [0x10002060],push eax,call esi,test eax, eax,je 0x100010ce,mov eax, dword ptr [ebp - 4],jmp 0x100010d0,xor eax, eax,pop esi,leave ,ret ,push ebp,mov ebp, esp,push esi,mov esi, dword ptr [ebp + 0x10],push edi,xor edi, edi,push dword ptr [ebp + 8],mov word ptr [esi], di,call dword ptr [0x10002014]," "WinShell.dll" file has an entrypoint instructions - "xor eax, eax,inc eax,ret 0xc,int3 ,int3 ,int3 ,inc esp,adc eax, dword ptr [eax],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [ebx + edx + 0x10000000], cl,add byte ptr [eax], al,push esp,adc eax, dword ptr [eax],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [esi + 0x10000013], ch,adc byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [edx + 0x13], ch,add byte ptr [eax], al,jl 0x1000135d,add byte ptr [eax], al,pop esp,adc eax, dword ptr [eax],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [edx + 0x13], bl,add byte ptr [eax], al,add dh, cl,add byte ptr [edi + 0x6c], al,outsd dx, dword ptr [esi],"73:T185f,"Waaake_Setup.exe" called "NtWriteVirtualMemory" with parameters {"ProcessHandle": "892" "BaseAddress": "0029F1E8" "Buffer": "06B8E950" "NumberOfBytesToWrite": "00000004" "$name": "C:\\Windows\\SysWOW64\\cmd.exe"} "cmd.exe" called "NtWriteVirtualMemory" with parameters {"ProcessHandle": "432" "BaseAddress": "006F31E8" "Buffer": "0058ED70" "NumberOfBytesToWrite": "00000004" "$name": "C:\\Windows\\SysWOW64\\tasklist.exe"} "cmd.exe" called "NtWriteVirtualMemory" with parameters {"ProcessHandle": "428" "BaseAddress": "007831E8" "Buffer": "0058ED70" "NumberOfBytesToWrite": "00000004" "$name": "C:\\Windows\\SysWOW64\\find.exe"} "waaake.exe" called "NtWriteVirtualMemory" with parameters {"ProcessHandle": "1140" "BaseAddress": "000002387F9E0000" "Buffer": "00000218DC32B0A0" "NumberOfBytesToWrite": "00000FB8" "$name": "C:\\Windows\\System32\\cmd.exe"} "waaake.exe" called "NtWriteVirtualMemory" with parameters {"ProcessHandle": "1140" "BaseAddress": "000000EEC57C92D8" "Buffer": "00000060E7DFBD38" "NumberOfBytesToWrite": "00000008" "$name": "C:\\Windows\\System32\\cmd.exe"} "waaake.exe" called "NtWriteVirtualMemory" with parameters {"ProcessHandle": "1768" "BaseAddress": "0000015545300000" "Buffer": "00000218DC38B790" "NumberOfBytesToWrite": "00000FB8" "$name": "C:\\Windows\\System32\\cmd.exe"} "waaake.exe" called "NtWriteVirtualMemory" with parameters {"ProcessHandle": "1768" "BaseAddress": "00000040BF8352D8" "Buffer": "00000060E7DFBDA8" "NumberOfBytesToWrite": "00000008" "$name": "C:\\Windows\\System32\\cmd.exe"} "waaake.exe" called "NtWriteVirtualMemory" with parameters {"ProcessHandle": "2640" "BaseAddress": "0000015F12400000" "Buffer": "0000021920092710" "NumberOfBytesToWrite": "00000FB8" "$name": "C:\\Windows\\System32\\cmd.exe"} "waaake.exe" called "NtWriteVirtualMemory" with parameters {"ProcessHandle": "2640" "BaseAddress": "0000005D737072D8" "Buffer": "00000060E7DFB1A8" "NumberOfBytesToWrite": "00000008" "$name": "C:\\Windows\\System32\\cmd.exe"} "waaake.exe" called "NtWriteVirtualMemory" with parameters {"ProcessHandle": "2920" "BaseAddress": "000001A688EF0000" "Buffer": "00000219200AA740" "NumberOfBytesToWrite": "00000FB8" "$name": "C:\\Users\\%OSUSER%\\AppData\\Local\\Programs\\waaake\\waaake.exe"} "waaake.exe" called "NtWriteVirtualMemory" with parameters {"ProcessHandle": "2920" "BaseAddress": "00000001003982D8" "Buffer": "00000060F45FE8B8" "NumberOfBytesToWrite": "00000008" "$name": "C:\\Users\\%OSUSER%\\AppData\\Local\\Programs\\waaake\\waaake.exe"} "waaake.exe" called "NtWriteVirtualMemory" with parameters {"ProcessHandle": "2912" "BaseAddress": "000001E5FFCE0000" "Buffer": "00000219200AA740" "NumberOfBytesToWrite": "00000FB8" "$name": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe"} "waaake.exe" called "NtWriteVirtualMemory" with parameters {"ProcessHandle": "2912" "BaseAddress": "000000451C9ED2D8" "Buffer": "00000060E7DFB398" "NumberOfBytesToWrite": "00000008" "$name": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe"} "waaake.exe" called "NtWriteVirtualMemory" with parameters {"ProcessHandle": "2956" "BaseAddress": "0000022E13290000" "Buffer": "00000219200AA740" "NumberOfBytesToWrite": "00000FB8" "$name": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe"} "waaake.exe" called "NtWriteVirtualMemory" with parameters {"ProcessHandle": "2956" "BaseAddress": "00000088A705C2D8" "Buffer": "00000060E7DFB398" "NumberOfBytesToWrite": "00000008" "$name": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe"} "waaake.exe" called "NtWriteVirtualMemory" with parameters {"ProcessHandle": "2984" "BaseAddress": "000001CEA5CF0000" "Buffer": "00000219200AA740" "NumberOfBytesToWrite": "00000FB8" "$name": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe"} "waaake.exe" called "NtWriteVirtualMemory" with parameters {"ProcessHandle": "2984" "BaseAddress": "0000009CCCDD52D8" "Buffer": "00000060E7DFB398" "NumberOfBytesToWrite": "00000008" "$name": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe"} "waaake.exe" called "NtWriteVirtualMemory" with parameters {"ProcessHandle": "2996" "BaseAddress": "00000135429A0000" "Buffer": "00000219200AA740" "NumberOfBytesToWrite": "00000FB8" "$name": "C:\\Users\\%OSUSER%\\AppData\\Local\\Programs\\waaake\\waaake.exe"} "waaake.exe" called "NtWriteVirtualMemory" with parameters {"ProcessHandle": "2996" "BaseAddress": "000000010024A2D8" "Buffer": "00000060F35FD7F8" "NumberOfBytesToWrite": "00000008" "$name": "C:\\Users\\%OSUSER%\\AppData\\Local\\Programs\\waaake\\waaake.exe"} "waaake.exe" called "NtWriteVirtualMemory" with parameters {"ProcessHandle": "3060" "BaseAddress": "000001A861760000" "Buffer": "00000219200832A0" "NumberOfBytesToWrite": "00000FB8" "$name": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe"} "waaake.exe" called "NtWriteVirtualMemory" with parameters {"ProcessHandle": "3060" "BaseAddress": "00000006E58382D8" "Buffer": "00000060E7DFADE8" "NumberOfBytesToWrite": "00000008" "$name": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe"} "waaake.exe" called "NtWriteVirtualMemory" with parameters {"ProcessHandle": "2964" "BaseAddress": "000001B34C7A0000" "Buffer": "00000218DC39DA50" "NumberOfBytesToWrite": "00000FB8" "$name": "C:\\Users\\%OSUSER%\\AppData\\Local\\Programs\\waaake\\waaake.exe"} "waaake.exe" called "NtWriteVirtualMemory" with parameters {"ProcessHandle": "2964" "BaseAddress": "0000008248D2D2D8" "Buffer": "00000060F35FD7F8" "NumberOfBytesToWrite": "00000008" "$name": "C:\\Users\\%OSUSER%\\AppData\\Local\\Programs\\waaake\\waaake.exe"} "waaake.exe" called "NtWriteVirtualMemory" with parameters {"ProcessHandle": "2920" "BaseAddress": "000001A688F00000" "Buffer": "000068D40192CB00" "NumberOfBytesToWrite": "00000068" "$name": "C:\\Users\\%OSUSER%\\AppData\\Local\\Programs\\waaake\\waaake.exe"} "waaake.exe" called "NtWriteVirtualMemory" with parameters {"ProcessHandle": "2920" "BaseAddress": "000001A688F19C20" "Buffer": "000068D401714B40" "NumberOfBytesToWrite": "00000020" "$name": "C:\\Users\\%OSUSER%\\AppData\\Local\\Programs\\waaake\\waaake.exe"}74:T4ba,YARA signature to detect medium entropy file file "vk_swiftshader.dll" YARA signature to detect medium entropy file process "00000000-00006360" YARA signature to detect medium entropy file file "lightningcss.linux-x64-musl.node" YARA signature to detect medium entropy file file "vulkan-1.dll" YARA signature to detect medium entropy file file "lightningcss.linux-x64-gnu.node" YARA signature to detect medium entropy file process "00000000-00002420" YARA signature to detect medium entropy file file "elevate.exe" YARA signature to detect medium entropy file file "waaake.exe" YARA signature to detect medium entropy file file "tailwindcss-oxide.linux-x64-musl.node" YARA signature to detect medium entropy file file "nsis7z.dll" YARA signature to detect medium entropy file file "tailwindcss-oxide.linux-x64-gnu.node" YARA signature to detect medium entropy file process "00000000-00003448" YARA signature to detect medium entropy file file "libGLESv2.dll" YARA signature to detect medium entropy file file "00000000-00006504.00000000.295707.726A1000.00000020.mdmp" YARA signature to detect medium entropy file file "ffmpeg.dll" YARA signature to detect medium entropy file file "StdUtils.dll"75:T561,YARA signature for RC4 encryption matched on file "vk_swiftshader.dll" YARA signature for RC4 encryption matched on file "lightningcss.linux-x64-musl.node" YARA signature for RC4 encryption matched on process "00000000-00006360" YARA signature for RC4 encryption matched on file "vulkan-1.dll" YARA signature for RC4 encryption matched on file "lightningcss.linux-x64-gnu.node" YARA signature for RC4 encryption matched on file "elevate.exe" YARA signature for RC4 encryption matched on file "sample.bin" YARA signature for RC4 encryption matched on file "installer.exe" YARA signature for RC4 encryption matched on file "waaake.exe" YARA signature for RC4 encryption matched on process "00000000-00002420" YARA signature for RC4 encryption matched on file "tailwindcss-oxide.linux-x64-musl.node" YARA signature for RC4 encryption matched on process "00000000-00008580" YARA signature for RC4 encryption matched on process "00000000-00009076" YARA signature for RC4 encryption matched on file "nsis7z.dll" YARA signature for RC4 encryption matched on file "tailwindcss-oxide.linux-x64-gnu.node" YARA signature for RC4 encryption matched on file "libGLESv2.dll" YARA signature for RC4 encryption matched on file "Uninstall waaake.exe" YARA signature for RC4 encryption matched on file "ffmpeg.dll" YARA signature for RC4 encryption matched on file "libEGL.dll"76:Tc3d,Found string "let wincommand = 'Get-CimInstance Win32_Service';" (Indicator: "Get-CimInstance"; Source: "00000000-00002420.00000000.291187.00040000.00000004.mdmp, 00000000-00002420.00000001.293106.00040000.00000004.mdmp, 00000000-00002420.00000002.295027.00040000.00000004.mdmp") file/memory contains long string with (Indicator: "Get-CimInstance"; Source: "00000000-00002420.00000000.291187.00040000.00000004.mdmp, 00000000-00002420.00000001.293106.00040000.00000004.mdmp, 00000000-00002420.00000002.295027.00040000.00000004.mdmp") Found string "util.powerShell('Get-CimInstance Win32_Process | select ProcessId,Caption,UserModeTime,KernelModeTime,WorkingSetSize | fl').then((stdout, error) => {" (Indicator: "Get-CimInstance"; Source: "00000000-00002420.00000000.291187.00040000.00000004.mdmp, 00000000-00002420.00000001.293106.00040000.00000004.mdmp, 00000000-00002420.00000002.295027.00040000.00000004.mdmp") Found string "let cmd = 'Get-CimInstance Win32_LogonSession | select LogonId,@{n="StartTime";e={$_.StartTime.ToString("yyyy-MM-dd HH:mm:ss")}} | fl' + '; echo \'#-#-#-#\';';" (Indicator: "Get-CimInstance"; Source: "00000000-00002420.00000000.291187.00040000.00000004.mdmp, 00000000-00002420.00000001.293106.00040000.00000004.mdmp, 00000000-00002420.00000002.295027.00040000.00000004.mdmp") Found string "cmd += 'Get-CimInstance Win32_LoggedOnUser | select antecedent,dependent | fl ' + '; echo \'#-#-#-#\';';" (Indicator: "Get-CimInstance"; Source: "00000000-00002420.00000000.291187.00040000.00000004.mdmp, 00000000-00002420.00000001.293106.00040000.00000004.mdmp, 00000000-00002420.00000002.295027.00040000.00000004.mdmp") Found string "util.powerShell('Get-CimInstance Win32_Printer | select PrinterStatus,Name,DriverName,Local,Default,Shared | fl').then((stdout, error) => {" (Indicator: "Get-CimInstance"; Source: "00000000-00002420.00000000.291187.00040000.00000004.mdmp, 00000000-00002420.00000001.293106.00040000.00000004.mdmp, 00000000-00002420.00000002.295027.00040000.00000004.mdmp") Found string "util.powerShell('Get-CimInstance CIM_LogicalDevice | where { $_.Description -match "USB"} | select Name,CreationClassName,DeviceId,Manufacturer | fl').then((stdout, error) => {" (Indicator: "Get-CimInstance"; Source: "00000000-00002420.00000000.291187.00040000.00000004.mdmp, 00000000-00002420.00000001.293106.00040000.00000004.mdmp, 00000000-00002420.00000002.295027.00040000.00000004.mdmp") Found string "util.powerShell('Get-CimInstance Win32_SoundDevice | select DeviceID,StatusInfo,Name,Manufacturer | fl').then((stdout, error) => {" (Indicator: "Get-CimInstance"; Source: "00000000-00002420.00000000.291187.00040000.00000004.mdmp, 00000000-00002420.00000001.293106.00040000.00000004.mdmp, 00000000-00002420.00000002.295027.00040000.00000004.mdmp") Found string "util.powerShell('Get-CimInstance Win32_PNPEntity | select PNPClass, Name, Manufacturer | fl').then((stdout, error) => {" (Indicator: "Get-CimInstance"; Source: "00000000-00002420.00000000.291187.00040000.00000004.mdmp, 00000000-00002420.00000001.293106.00040000.00000004.mdmp, 00000000-00002420.00000002.295027.00040000.00000004.mdmp")77:T7b6,Found string "safewebsockethandle" (Indicator: "safeweb"; Source: "00000000-00008260.00000000.294793.17120000.00000004.mdmp") Found string "iface," (Indicator: "iface"; Source: "00000000-00002420.00000000.291187.00040000.00000004.mdmp, 00000000-00002420.00000000.291187.00200000.00000004.mdmp, 00000000-00002420.00000001.293106.00040000.00000004.mdmp, 00000000-00002420.00000001.293106.00200000.00000004.mdmp, 00000000-00002420.00000002.295027.00040000.00000004.mdmp, 00000000-00002420.00000002.295027.00200000.00000004.mdmp") Found string "iface = element.split(' ')[0];" (Indicator: "iface"; Source: "00000000-00002420.00000000.291187.00040000.00000004.mdmp, 00000000-00002420.00000001.293106.00040000.00000004.mdmp, 00000000-00002420.00000002.295027.00040000.00000004.mdmp") Found string "ifaceSanitized = ifaceSanitized + s[i];" (Indicator: "iface"; Source: "00000000-00002420.00000000.291187.00040000.00000004.mdmp, 00000000-00002420.00000000.291187.00200000.00000004.mdmp, 00000000-00002420.00000001.293106.00040000.00000004.mdmp, 00000000-00002420.00000001.293106.00200000.00000004.mdmp, 00000000-00002420.00000002.295027.00040000.00000004.mdmp, 00000000-00002420.00000002.295027.00200000.00000004.mdmp") Found string "ifaces.forEach(ifaceDetail => {" (Indicator: "iface"; Source: "00000000-00002420.00000000.291187.00040000.00000004.mdmp, 00000000-00002420.00000001.293106.00040000.00000004.mdmp, 00000000-00002420.00000002.295027.00040000.00000004.mdmp") Found string "iface: ifaceDetail.iface," (Indicator: "iface"; Source: "00000000-00002420.00000000.291187.00040000.00000004.mdmp, 00000000-00002420.00000001.293106.00040000.00000004.mdmp, 00000000-00002420.00000002.295027.00040000.00000004.mdmp") Found string "iface: networkWifiObj.interface || ''," (Indicator: "iface"; Source: "00000000-00002420.00000000.291187.00040000.00000004.mdmp, 00000000-00002420.00000001.293106.00040000.00000004.mdmp, 00000000-00002420.00000002.295027.00040000.00000004.mdmp")78:T465,Observed import api "SetFileSecurityW" which can "set the security of a file or directory object" [Source: Waaake_Setup.exe] Observed import api "GetSidSubAuthority" which can "return a pointer to a specified subauthority in a security identifier (SID)" [Source: vulkan-1.dll] Observed import api "GetSidSubAuthorityCount" which can "return a pointer to the member in a security identifier (SID) structure that contains the subauthority count" [Source: vulkan-1.dll] Observed import api "GetTokenInformation" which can "retrieve a specified type of information about an access token" [Source: vulkan-1.dll] Observed import api "SetFileSecurityW" which can "set the security of a file or directory object" [Source: nsis7z.dll] Observed import api "SetFileSecurityW" which can "set the security of a file or directory object" [Source: Uninstall waaake.exe] Observed import api "InitializeSecurityDescriptor" which can "initialize a new security descriptor" [Source: nsExec.dll] Observed import api "SetSecurityDescriptorDacl" which can "set information in a discretionary access control list (DACL)" [Source: nsExec.dll]79:T48c,"Waaake_Setup.exe" has section name .text with entropy "6.450282348506287" "Waaake_Setup.exe" has section name .rsrc with entropy "6.691677906681226" "ffmpeg.dll" has section name .text with entropy "6.7202936634869035" "ffmpeg.dll" has section name .pdata with entropy "6.028351158160656" "vulkan-1.dll" has section name .text with entropy "6.4663718717219885" "libEGL.dll" has section name .text with entropy "6.488266321747546" "nsis7z.dll" has section name .text with entropy "6.660019021748915" "nsis7z.dll" has section name .reloc with entropy "6.436643454233115" "Uninstall waaake.exe" has section name .text with entropy "6.450282348506287" "Uninstall waaake.exe" has section name .rsrc with entropy "6.691439841479211" "elevate.exe" has section name .text with entropy "6.629085472534192" "elevate.exe" has section name .reloc with entropy "6.435085499700611" "StdUtils.dll" has section name .text with entropy "6.7699973903274" "StdUtils.dll" has section name .data with entropy "6.300665669595389" "StdUtils.dll" has section name .reloc with entropy "6.045162629779809" "System.dll" has section name .text with entropy "6.258082503916542"7a:T7b4,"let wincommand = 'Get-CimInstance Win32_Service';" (Indicator: " win32_service"; Source: "00000000-00002420.00000000.291187.00040000.00000004.mdmp, 00000000-00002420.00000001.293106.00040000.00000004.mdmp, 00000000-00002420.00000002.295027.00040000.00000004.mdmp") "util.powerShell('Get-CimInstance Win32_Process | select-Object ProcessId,ParentProcessId,ExecutionState,Caption,CommandLine,ExecutablePath,UserModeTime,KernelModeTime,WorkingSetSize,Priority,PageFileUsage, @{n="CreationDate";e={$_.CreationDate.ToString("yyyy-MM-dd HH:mm:ss")}} | fl').then((stdout, error) => {" (Indicator: " win32_process"; Source: "00000000-00002420.00000000.291187.00040000.00000004.mdmp, 00000000-00002420.00000001.293106.00040000.00000004.mdmp, 00000000-00002420.00000002.295027.00040000.00000004.mdmp") "util.powerShell('Get-CimInstance Win32_Process | select ProcessId,Caption,UserModeTime,KernelModeTime,WorkingSetSize | fl').then((stdout, error) => {" (Indicator: " win32_process"; Source: "00000000-00002420.00000000.291187.00040000.00000004.mdmp, 00000000-00002420.00000001.293106.00040000.00000004.mdmp, 00000000-00002420.00000002.295027.00040000.00000004.mdmp") "cmd += '$process = (Get-CimInstance Win32_Process -Filter "name = \'explorer.exe\'"); Invoke-CimMethod -InputObject $process[0] -MethodName GetOwner | select user, domain | fl; get-process -name explorer | select-object sessionid | fl; echo \'#-#-#-#\';';" (Indicator: " win32_process"; Source: "00000000-00002420.00000000.291187.00040000.00000004.mdmp, 00000000-00002420.00000001.293106.00040000.00000004.mdmp, 00000000-00002420.00000002.295027.00040000.00000004.mdmp") "util.powerShell('Get-CimInstance Win32_PNPEntity | select PNPClass, Name, Manufacturer | fl').then((stdout, error) => {" (Indicator: " win32_pnpentity"; Source: "00000000-00002420.00000000.291187.00040000.00000004.mdmp, 00000000-00002420.00000001.293106.00040000.00000004.mdmp, 00000000-00002420.00000002.295027.00040000.00000004.mdmp")1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"fda4866ce7784c356ebacd24873258507e5cace3f2a0e1f1fabcbb97de1995ea","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1793230358674,"unified_at":"2026-10-28T23:32:38.674Z","metadata":{"hashes":{"sha256":"fda4866ce7784c356ebacd24873258507e5cace3f2a0e1f1fabcbb97de1995ea","sha1":"6cd150ee8788cdc752807d7ff28bb6fa2046b8f6","md5":"458ff12b4aaa49444c38c7b51571c7bc","sha512":"8476e02222a2d1b721e382a41ffe743407a793c2377c9beda80a5dac20c09fc25976855e0319ff336e9289f0f6d3736a3d2e82f30747238f510303095be5ff3d","ssdeep":"1572864:y7M0d+mzc4V0UTyzT0zeY7jvpxkkTiCUYBuXcOYpEwYqKBzHjMP0TBhf+Ta5rChb:yYI+CVjqYC0vpyMkYBueijqKBzHjMPym","ssdeep_chunks":["1572864:y7M0d+m","1572864:7M0d+mz","1572864:M0d+mzc","1572864:0d+mzc4","1572864:d+mzc4V","1572864:+mzc4V0","1572864:mzc4V0U","1572864:zc4V0UT","1572864:c4V0UTy","1572864:4V0UTyz","1572864:V0UTyzT","1572864:0UTyzT0","1572864:UTyzT0z","1572864:TyzT0ze","1572864:yzT0zeY","1572864:zT0zeY7","1572864:T0zeY7j","1572864:0zeY7jv","1572864:zeY7jvp","1572864:eY7jvpx","1572864:Y7jvpxk","1572864:7jvpxkk","1572864:jvpxkkT","1572864:vpxkkTi","1572864:pxkkTiC","1572864:xkkTiCU","1572864:kkTiCUY","1572864:kTiCUYB","1572864:TiCUYBu","1572864:iCUYBuX","1572864:CUYBuXc","1572864:UYBuXcO","1572864:YBuXcOY","1572864:BuXcOYp","1572864:uXcOYpE","1572864:XcOYpEw","1572864:cOYpEwY","1572864:OYpEwYq","1572864:YpEwYqK","1572864:pEwYqKB","1572864:EwYqKBz","1572864:wYqKBzH","1572864:YqKBzHj","1572864:qKBzHjM","1572864:KBzHjMP","1572864:BzHjMP0","1572864:zHjMP0T","1572864:HjMP0TB","1572864:jMP0TBh","1572864:MP0TBhf","1572864:P0TBhf+","1572864:0TBhf+T","1572864:TBhf+Ta","1572864:Bhf+Ta5","1572864:hf+Ta5r","1572864:f+Ta5rC","1572864:+Ta5rCh","1572864:Ta5rChb","3145728:y7M0d+m","3145728:7M0d+mz","3145728:M0d+mzc","3145728:0d+mzc4","3145728:d+mzc4V","3145728:+mzc4V0","3145728:mzc4V0U","3145728:zc4V0UT","3145728:c4V0UTy","3145728:4V0UTyz","3145728:V0UTyzT","3145728:0UTyzT0","3145728:UTyzT0z","3145728:TyzT0ze","3145728:yzT0zeY","3145728:zT0zeY7","3145728:T0zeY7j","3145728:0zeY7jv","3145728:zeY7jvp","3145728:eY7jvpx","3145728:Y7jvpxk","3145728:7jvpxkk","3145728:jvpxkkT","3145728:vpxkkTi","3145728:pxkkTiC","3145728:xkkTiCU","3145728:kkTiCUY","3145728:kTiCUYB","3145728:TiCUYBu","3145728:iCUYBuX","3145728:CUYBuXc","3145728:UYBuXcO","3145728:YBuXcOY","3145728:BuXcOYp","3145728:uXcOYpE","3145728:XcOYpEw","3145728:cOYpEwY","3145728:OYpEwYq","3145728:YpEwYqK","3145728:pEwYqKB","3145728:EwYqKBz","3145728:wYqKBzH","3145728:YqKBzHj","3145728:qKBzHjM","3145728:KBzHjMP","3145728:BzHjMP0","3145728:zHjMP0T","3145728:HjMP0TB","3145728:jMP0TBh","3145728:MP0TBhf","3145728:P0TBhf+","3145728:0TBhf+T","3145728:TBhf+Ta","3145728:Bhf+Ta5","3145728:hf+Ta5r","3145728:f+Ta5rC","3145728:+Ta5rCh","3145728:Ta5rChb","1572864:yYI+CVj","1572864:YI+CVjq","1572864:I+CVjqY","1572864:+CVjqYC","1572864:CVjqYC0","1572864:VjqYC0v","1572864:jqYC0vp","1572864:qYC0vpy","1572864:YC0vpyM","1572864:C0vpyMk","1572864:0vpyMkY","1572864:vpyMkYB","1572864:pyMkYBu","1572864:yMkYBue","1572864:MkYBuei","1572864:kYBueij","1572864:YBueijq","1572864:BueijqK","1572864:ueijqKB","1572864:eijqKBz","1572864:ijqKBzH","1572864:jqKBzHj","1572864:BzHjMPy","1572864:zHjMPym"],"imphash":"Unknown"},"file_info":{"file_name":"Waaake_Setup.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":95670025,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1754445718000,"last_seen":1771955472000,"last_multi_scan":1771955472000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["evasive"]},"stats":{"av":{"malicious_count":0,"suspicious_count":0,"total_engines":26},"attributions":{"malware_families_count":0,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":105},"sandbox_signatures":{"informative_count":280,"suspicious_count":23,"malicious_count":4,"total":307},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{},"mitre_attacks":[{"tactic":"Reconnaissance","technique":"Gather Victim Network Information","attack_id":"T1590","attack_id_wiki":"https://attack.mitre.org/techniques/T1590","identifiers":[{"type":"informative","value":"Able to access user sensitive domain"}],"sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"tactic":"Resource Development","technique":"Domains","attack_id":"T1583.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1583/001","identifiers":[{"type":"informative","value":"Short-term SSL certificate detected"}],"sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Calls an API typically used to find a resource in a module"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Contains ability to dynamically load libraries"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"suspicious","value":"Contains native function calls"},{"type":"informative","value":"Input file contains API references not part of its Import Address Table (IAT)"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"suspicious","value":"Imports suspicious APIs"}],"sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"},{"type":"informative","value":"Able to import GetCommandLine API, which retrieves the command line string for the current process"},{"type":"informative","value":"Able to retrieve command line parameters of the running process"}],"sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Contains ability to create/connect to a named pipe (API string)"},{"type":"informative","value":"Found named pipe like strings"}],"sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"suspicious","value":"Contains references to WMI/WMIC"},{"type":"informative","value":"Executes WMI queries"},{"type":"suspicious","value":"Found a reference to a WMI query string known to be used for VM detection"},{"type":"suspicious","value":"Executes WMI queries known to be used for VM detection"},{"type":"informative","value":"Contains reference to WMI activity (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Loads the .NET runtime environment"},{"type":"informative","value":"Fails to load modules at runtime"},{"type":"informative","value":"Loads rich edit control libraries"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Loads modules at runtime"}],"sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"tactic":"Execution","technique":"PowerShell","attack_id":"T1059.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/001","identifiers":[{"type":"informative","value":"Executes powershell with commandline"}],"sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"tactic":"Persistence","technique":"Account Manipulation","attack_id":"T1098","attack_id_wiki":"https://attack.mitre.org/techniques/T1098","identifiers":[{"type":"informative","value":"Contains ability to modify the user configuration/privilege (API string)"}],"sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Contains ability to modify registry key/value (API string)"},{"type":"informative","value":"Able to create/load registry keys (API string)"},{"type":"informative","value":"Writes registry keys"},{"type":"informative","value":"Able to delete registry key/value (API string)"},{"type":"informative","value":"Accesses System Certificates Settings"}],"sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Creates or modifies windows services"},{"type":"informative","value":"Contains ability to create/control drivers (API string)"}],"sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","identifiers":[{"type":"suspicious","value":"Tries to save executable or command in registry"}],"sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"tactic":"Persistence","technique":"Shortcut Modification","attack_id":"T1547.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/009","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"tactic":"Persistence","technique":"DLL","attack_id":"T1574.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/001","identifiers":[{"type":"informative","value":"Possible DLL sideloading"},{"type":"informative","value":"Potential hijacking of DLL execution flow detected"}],"sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"tactic":"Persistence","technique":"Registry Run Keys / Startup Folder","attack_id":"T1547.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/001","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"},{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"},{"type":"informative","value":"Imports system security related APIs"}],"sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"tactic":"Privilege Escalation","technique":"Abuse Elevation Control Mechanism","attack_id":"T1548","attack_id_wiki":"https://attack.mitre.org/techniques/T1548","identifiers":[{"type":"informative","value":"Contains ability to use security policy setting (API string)"}],"sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Calls an API typically used to enable or disable privileges in the specified access token"},{"type":"informative","value":"Contains ability to modify access token privileges (API string)"}],"sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Able to inject code into another process (API string)"},{"type":"informative","value":"Found PE header in memory"},{"type":"malicious","value":"Writes data to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"tactic":"Privilege Escalation","technique":"Make and Impersonate Token","attack_id":"T1134.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/003","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"}]},{"tactic":"Defense Evasion","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)"},{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"},{"type":"informative","value":"Contains ability to check debugger is running (API string)"}],"sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"suspicious","value":"YARA signature match - ChaCha20 256-bit algorithm"},{"type":"informative","value":"PE file contains zero-sized sections"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"YARA signature match - AES encryption"},{"type":"suspicious","value":"CRC value set in PE header does not match actual value"},{"type":"informative","value":"Contains ability to perform AES/RC4 encryption (API string)"},{"type":"informative","value":"Found XOR operators (encryption/decryption)"},{"type":"informative","value":"YARA signature match - RC4 Encryption"},{"type":"suspicious","value":"YARA signature match - ChaCha20 encryption algorithm"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"suspicious","value":"YARA signature match - ChaCha20 128-bit algorithm"}],"sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to query local/system time as file time"},{"type":"informative","value":"Contains ability to set file time (API string)"},{"type":"informative","value":"Contains ability to retrieve file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"},{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"informative","value":"Contains ability to delay the execution of current thread"}],"sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to show a graphical window (API string)"},{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"tactic":"Defense Evasion","technique":"Direct Volume Access","attack_id":"T1006","attack_id_wiki":"https://attack.mitre.org/techniques/T1006","identifiers":[{"type":"informative","value":"Attempts to read volume data via DOS device path"}],"sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"}]},{"tactic":"Defense Evasion","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Found virtual disk drive like strings"},{"type":"informative","value":"Contains reference to method used by Windows shell items (API string)"},{"type":"informative","value":"Spawns Windows crash diagnostic and reporting process"}],"sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Creates mutants"},{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Contains ability to delete files/directories (API string)"},{"type":"suspicious","value":"Opens file with deletion access rights"},{"type":"suspicious","value":"Marks file for deletion"},{"type":"informative","value":"Calls an API typically used to remove a directory"}],"sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Renames files"},{"type":"informative","value":"Drops files inside appdata directory"}],"sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Contains ability to detect virtual environment (API)"},{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"},{"type":"informative","value":"Observed a high volume of repeated registry API calls (API Hammering)"},{"type":"suspicious","value":"Contains ability to detect virtual environment"},{"type":"informative","value":"Triggers a burst of requests to the same API (API Hammering)"},{"type":"informative","value":"Makes a code branch decision directly after an API that is environment aware"}],"sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"tactic":"Defense Evasion","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"informative","value":"Found anti-virus related strings names"},{"type":"suspicious","value":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)"},{"type":"informative","value":"Loads the AMSI (Antimalware Scan Interface) DLL"},{"type":"informative","value":"Contains strings related to AMSI (Anti Malware Scan Interface)"},{"type":"informative","value":"Contains ability to disable Windows Defender using PowerShell"}],"sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"tactic":"Defense Evasion","technique":"Reflective Code Loading","attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Loads the CLR Loader DLL"}],"sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Contains ability to perform decryption (API string)"},{"type":"informative","value":"Able to decrypt/decode data"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using API string"}],"sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"tactic":"Defense Evasion","technique":"Web Session Cookie","attack_id":"T1550.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1550/004","identifiers":[{"type":"informative","value":"Able to access web session cookie"}],"sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"},{"type":"informative","value":"XOR operations in executable file detected"}],"sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"tactic":"Defense Evasion","technique":"Compression","attack_id":"T1027.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/015","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"tactic":"Defense Evasion","technique":"Encrypted/Encoded File","attack_id":"T1027.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/013","identifiers":[{"type":"informative","value":"YARA signature match - High entropy File"},{"type":"suspicious","value":"YARA signature match – cryptographic algorithms"},{"type":"informative","value":"YARA signature match - Medium entropy File"}],"sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"tactic":"Credential Access","technique":"Credential API Hooking","attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Able to access file/directory"},{"type":"informative","value":"Contains references to file movement (imports API)"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Calls an API typically used for searching a directory for files"},{"type":"informative","value":"Contains ability to retrieve path in which Windows is installed (API string)"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Able to rename or move file/directory (API string)"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"},{"type":"informative","value":"Tries to access LNK files (Windows shortcut)"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"suspicious","value":"Reads configuration files (.ini files)"},{"type":"informative","value":"Contains ability to read files (API string)"}],"sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Able to retrieve geographical location information"},{"type":"informative","value":"Found system command-related strings"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Able to discover operating system information (API string)"},{"type":"informative","value":"References to WMI query strings used for information discovery"},{"type":"informative","value":"Contains ability to retrieve system configuration"},{"type":"informative","value":"Contains ability to enumerate objects (Powershell command string)"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Tries to enumerate windows environment variables"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Contains ability to retrieve windows environment variables"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"suspicious","value":"Attempts to retrieve geographical location information"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Contains ability to retrieve data about the local computer (API string)"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Queries volume information of an entire harddrive"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Reads system-defined device setup information from registry"},{"type":"informative","value":"Calls an API typically used to retrieve computer name"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Able to query volume/memory size (API string)"},{"type":"informative","value":"Found registry location string related to processor"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"}],"sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Calls an API typically used to get active windows title"},{"type":"informative","value":"Contains ability to find open windows (API string)"},{"type":"informative","value":"Calls an API typically used to enumerate active windows"},{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"},{"type":"informative","value":"Calls an API typically used to get handle of currently active window"},{"type":"informative","value":"Scanning for window names"}],"sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Reads Windows Trust Settings"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Uses REG.EXE to query registry keys"},{"type":"informative","value":"Able to query registry keys (API string)"},{"type":"informative","value":"Accesses Software Policy Settings"},{"type":"informative","value":"Queries TCP/IP interface details"},{"type":"informative","value":"Found registry location strings in memory"}],"sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Contains ability to enumerate running processes using Tasklist"},{"type":"informative","value":"Process launched with changed environment"},{"type":"malicious","value":"Tries to gather information about running processes on a system"},{"type":"malicious","value":"Spawns a lot of processes"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Contains ability to retrieve processes (Powershell command string)"},{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Able to enumerate system processes using native API"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"malicious","value":"Opens a handle of credential dumping utility"},{"type":"informative","value":"Contains ability to retrieve/open a process"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Contains ability to retrieve/open a process (API string)"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"References to WMI query strings used for process discovery"},{"type":"informative","value":"Calls an APIs used to retrieve process information"}],"sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Able to query security token membership for user discovery (API string)"},{"type":"informative","value":"Contains ability to lookup the windows account name"},{"type":"informative","value":"Contains ability to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve account information for specified SID"},{"type":"informative","value":"Contains ability to retrieve the current user information"},{"type":"informative","value":"Calls an API typically used to retrieve user name"}],"sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve local language"},{"type":"informative","value":"Contains ability to query the system locale"},{"type":"informative","value":"Able to query system locale information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to query machine time"},{"type":"informative","value":"Contains ability to retrieve machine time (API string)"},{"type":"informative","value":"Contains ability to retrieve machine timezone (API string)"},{"type":"informative","value":"Able to retrieve date formats supported by the local system (API string)"}],"sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"tactic":"Discovery","technique":"Device Driver Discovery","attack_id":"T1652","attack_id_wiki":"https://attack.mitre.org/techniques/T1652","identifiers":[{"type":"informative","value":"Tries to retrieve device driver information"}],"sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"tactic":"Discovery","technique":"Remote System Discovery","attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","identifiers":[{"type":"informative","value":"Loads the debugger/analysis tool module"},{"type":"informative","value":"Contains ability to retrieve instances of WMI objects (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"tactic":"Discovery","technique":"System Network Connections Discovery","attack_id":"T1049","attack_id_wiki":"https://attack.mitre.org/techniques/T1049","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Able to retrieve system language (API string)"},{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Contains ability to retrieve the local name for a socket (API string)"}],"sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"tactic":"Discovery","technique":"Network Share Discovery","attack_id":"T1135","attack_id_wiki":"https://attack.mitre.org/techniques/T1135","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Contains ability to move file or directory (API string)"},{"type":"informative","value":"Calls an API typically used to create an instance of a named pipe"},{"type":"informative","value":"Calls an API typically used to create a named pipe"},{"type":"informative","value":"Calls an API typically used to move file or directory"}],"sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Calls an API typically used to create a directory"},{"type":"informative","value":"Contains ability to create directories (API string)"},{"type":"informative","value":"Writes log files"},{"type":"informative","value":"Creates directory on disk"}],"sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Contains ability to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Contains SQL queries"}],"sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"informative","value":"Found E-Mail address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"Writes files in a temp directory"}],"sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"tactic":"Collection","technique":"Archive Collected Data","attack_id":"T1560","attack_id_wiki":"https://attack.mitre.org/techniques/T1560","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"tactic":"Collection","technique":"Clipboard Data","attack_id":"T1115","attack_id_wiki":"https://attack.mitre.org/techniques/T1115","identifiers":[{"type":"informative","value":"Contains ability to access clipboard data (API string)"}],"sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"tactic":"Collection","technique":"Data Staged","attack_id":"T1074","attack_id_wiki":"https://attack.mitre.org/techniques/T1074","identifiers":[{"type":"informative","value":"Able to aggregate collected data, possibly for exfiltration"}],"sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Contacts server"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Found potential IP address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"tactic":"Command and Control","technique":"Web Service","attack_id":"T1102","attack_id_wiki":"https://attack.mitre.org/techniques/T1102","identifiers":[{"type":"informative","value":"Found domain strings related to cloud services(possible C&C communication)"}],"sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Drops files with image extension"},{"type":"informative","value":"Drops temp files"},{"type":"suspicious","value":"Writes a PE file header to disc"},{"type":"suspicious","value":"Drops executable files"},{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Drops executable files inside temp directory"}],"sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"tactic":"Command and Control","technique":"Mail Protocols","attack_id":"T1071.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/003","identifiers":[{"type":"informative","value":"Found mail related domain names"}],"sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"},{"type":"informative","value":"Found string related to HTTP headers"}],"sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","identifiers":[{"type":"informative","value":"Contains reference to OpenSSL library string"},{"type":"informative","value":"Contains ability to perform encryption/decryption using RSA algorithm"}],"sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Uses HTTPS for communication"},{"type":"informative","value":"Makes HTTPS connections using secure TLS/SSL version"}],"sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"suspicious","value":"Sends UDP traffic"}],"sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"tactic":"Command and Control","technique":"Domain Generation Algorithms","attack_id":"T1568.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1568/002","identifiers":[{"type":"informative","value":"High entropy domain detected"}],"sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"tactic":"Command and Control","technique":"Steganography","attack_id":"T1001.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1001/002","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over Web Service","attack_id":"T1567","attack_id_wiki":"https://attack.mitre.org/techniques/T1567","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to shutdown system"},{"type":"informative","value":"Contains ability to reboot/shutdown the operating system (API string)"}],"sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Contains ability to terminate a process (API string)"},{"type":"informative","value":"Calls an API used to open a process handle"}],"sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains possible references to Golang crypto modules"},{"type":"informative","value":"Contains reference to cryptographic keys"},{"type":"informative","value":"Imports crypto-related APIs"},{"type":"informative","value":"Able to access crypto-related API (String)"},{"type":"informative","value":"Contains ability to perform encryption (API string)"}],"sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"tactic":"Impact","technique":"Data Manipulation","attack_id":"T1565","attack_id_wiki":"https://attack.mitre.org/techniques/T1565","identifiers":[{"type":"informative","value":"References hosts file in file/memory"}],"sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"tactic":"Privilege Escalation","technique":"Portable Executable Injection","attack_id":"T1055.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/002","identifiers":[{"type":"informative","value":"Attempts remote code execution into another process memory space"}],"sources":[{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"tactic":"Privilege Escalation","technique":"Thread Local Storage","attack_id":"T1055.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/005","sources":[{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"tactic":"Defense Evasion","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"suspicious","value":"Section contains high entropy"}],"sources":[{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"tactic":"Defense Evasion","technique":"Dynamic API Resolution","attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","identifiers":[{"type":"informative","value":"Contains ability to dynamically determine API calls"}],"sources":[{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"tactic":"Credential Access","technique":"Steal or Forge Kerberos Tickets","attack_id":"T1558","attack_id_wiki":"https://attack.mitre.org/techniques/T1558","identifiers":[{"type":"informative","value":"Able to access credential file using Kerberos"}],"sources":[{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"tactic":"Discovery","technique":"Account Discovery","attack_id":"T1087","attack_id_wiki":"https://attack.mitre.org/techniques/T1087","sources":[{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"Waaake_Setup.exe\")\n file/memory contains long string with (Indicator: \"VirtualAlloc\"; File: \"System.dll\")\n file/memory contains long string with (Indicator: \"VirtualFree\"; File: \"System.dll\")\n Found reference to API \"WinStationFreeMemory\" (Indicator: \"FreeMemory\"; File: \"00000000-00007452.00000000.87841.00811000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to find a resource in a module","description":"\"waaake.exe\" called \"FindResourceW\" with parameter \"380\" - (UID: 00000000-00006656)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-140","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to remove a directory","description":"$27","origin":"API Call","mitre_attack_id":"T1070.004","relevance":3,"id":"api-121","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"$28","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to impersonate access tokens (API string)","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; File: \"Waaake_Setup.exe\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00002028.00000000.90115.70CDF000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-306","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"$29","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify registry key/value (API string)","description":"Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; File: \"Waaake_Setup.exe\")\n Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; Source: \"00000000-00002028.00000000.90115.70CDF000.00000002.mdmp\")\n Found reference to API \"RegRestoreKeyW\" (Indicator: \"RegRestoreKey\"; Source: \"00000000-00002028.00000000.90115.70CDF000.00000002.mdmp\")\n Found reference to API \"RegSetValueExA\" (Indicator: \"RegSetValue\"; Source: \"00000000-00002028.00000000.90115.70CDF000.00000002.mdmp\")\n Found reference to API \"RegFlushKey\" (Indicator: \"RegFlushKey\"; Source: \"00000000-00002028.00000000.90115.70CDF000.00000002.mdmp\")\n Found reference to API \"RegSetValueW\" (Indicator: \"RegSetValue\"; Source: \"00000000-00002028.00000000.90115.70CDF000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-304","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to pass information to a window procedure (API string)","description":"Found reference to API \"CallWindowProcW\" (Indicator: \"CallWindowProc\"; File: \"Waaake_Setup.exe\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to set file time (API string)","description":"Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; File: \"Waaake_Setup.exe\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-409","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"Found reference to \"HashAlgorithm\" (Indicator: \"HashAlgorithm\"; Source: \"00000000-00004796-00000BC0-430478504\")\n Found reference to \"mgf1HashAlgorithm\" (Indicator: \"HashAlgorithm\"; Source: \"00000000-00006656.00000000.89710.00100000.00000004.mdmp, 00000000-00006656.00000001.91631.00100000.00000004.mdmp\")\n Found reference to \"SHA384\" (Indicator: \"SHA384\"; Source: \"00000000-00006656.00000000.89710.00160000.00000004.mdmp, 00000000-00006656.00000001.91631.00160000.00000004.mdmp\")\n Found reference to \"SHA512\" (Indicator: \"SHA512\"; Source: \"00000000-00006656.00000000.89710.00160000.00000004.mdmp, 00000000-00006656.00000001.91631.00160000.00000004.mdmp\")\n Found reference to \"SHA512-256\" (Indicator: \"SHA512\"; Source: \"00000000-00006656.00000000.89710.00160000.00000004.mdmp, 00000000-00006656.00000001.91631.00160000.00000004.mdmp\")\n Found reference to \"HKDFJob\" (Indicator: \"HKDF\"; Source: \"00000000-00006656.00000000.89710.0050C000.00000004.mdmp, 00000000-00006656.00000001.91631.0050C000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found virtual disk drive like strings","description":"Found string - var thisAssignmentPattern = /this\\s*\\.\\s*\\S+\\s*=/;; Source: \"00000000-00006656.00000000.89710.00100000.00000004.mdmp, 00000000-00006656.00000001.91631.00100000.00000004.mdmp\")\n Found string - \\\\.\\nul; Source: \"00000000-00006656.00000000.89710.005A0000.00000004.mdmp, 00000000-00006656.00000001.91631.005A0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-145","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Loads the debugger/analysis tool module","description":"\"tasklist.exe\" loaded module \"%WINDIR%\\SysWOW64\\dbghelp.dll\" at 71D60000\n \"waaake.exe\" loaded module \"%WINDIR%\\System32\\dbghelp.dll\" at 15C30000","origin":"Loaded Module","mitre_attack_id":"T1518.001","relevance":3,"id":"module-16","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"$2a","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"$2b","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Renames files","description":"\"waaake.exe\" renamed original file\"C:\\Users\\%OSUSER%\\AppData\\Roaming\\WAAAKE\\Code Cache\\wasm\\index-dir\\temp-index\" to \"%APPDATA%\\WAAAKE\\Code Cache\\wasm\\index-dir\\the-real-index\"\n \"waaake.exe\" renamed original file\"C:\\Users\\%OSUSER%\\AppData\\Roaming\\WAAAKE\\Code Cache\\js\\index-dir\\temp-index\" to \"%APPDATA%\\WAAAKE\\Code Cache\\js\\index-dir\\the-real-index\"\n \"waaake.exe\" renamed original file\"C:\\Users\\%OSUSER%\\AppData\\Roaming\\WAAAKE\\Local Storage\\leveldb\\000001.dbtmp\" to \"%APPDATA%\\WAAAKE\\Local Storage\\leveldb\\CURRENT\"\n \"waaake.exe\" renamed original file\"C:\\Users\\%OSUSER%\\AppData\\Roaming\\WAAAKE\\54e1c8c6-4a74-4f48-95d1-b9535578e335.tmp\" to \"%APPDATA%\\WAAAKE\\Preferences\"\n \"waaake.exe\" renamed original file\"C:\\Users\\%OSUSER%\\AppData\\Roaming\\WAAAKE\\26d3604e-d8c1-4e21-94af-0903e7f9ba69.tmp\" to \"%APPDATA%\\WAAAKE\\Local State\"\n \"waaake.exe\" renamed original file\"C:\\Users\\%OSUSER%\\AppData\\Roaming\\WAAAKE\\Shared Dictionary\\cache\\index-dir\\temp-index\" to \"%APPDATA%\\WAAAKE\\Shared Dictionary\\cache\\index-dir\\the-real-index\"","origin":"API Call","mitre_attack_id":"T1036","relevance":1,"id":"api-162","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Triggers a burst of requests to the same API (API Hammering)","description":"\"waaake.exe\" obfuscates its traffic by mimicking legitimate API call","origin":"API Call","mitre_attack_id":"T1497","relevance":5,"id":"api-289","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"Waaake_Setup.exe\")\n file/memory contains long string with (Indicator: \"GetTickCount\"; File: \"nsExec.dll\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00007452-2726-141-0081EFF0\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00007452-2726-146-0081EDA4","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1622","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to access crypto-related API (String)","description":"file/memory contains long string with (Indicator: \"CryptProtectData\"; File: \"StdUtils.dll\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-920","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to decrypt/decode data","description":"$2c","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-356","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"$2d","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: YARA signature match - AES encryption","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"$2e","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: YARA signature match - AES encryption","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$2f","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"Environment Awareness","name":"Able to access file/directory","description":"$30","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-779","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"}]},{"level":"informative","category":"Environment Awareness","name":"Able to access user sensitive domain","description":"$31","origin":"File/Memory","mitre_attack_id":"T1590","relevance":1,"id":"string-761","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate system processes using native API","description":"Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00006656-00000C2C-399478984\")\n Found reference to API \"NtQuerySystemInformationW\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00004796-00000C2C-435073157\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-907","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00006656-00000C2C-399478984\")\n Found string \"NtQuerySystemInformationW\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00004796-00000C2C-435073157\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"Waaake_Setup.exe\")\n file/memory contains long string with (Indicator: \"GetCommandLine\"; File: \"nsis7z.dll\")\n file/memory contains long string with (Indicator: \"GetCommandLine\"; File: \"Uninstall waaake.exe\")\n file/memory contains long string with (Indicator: \"GetCommandLine\"; File: \"elevate.exe\")\n file/memory contains long string with (Indicator: \"GetCommandLine\"; File: \"StdUtils.dll\")\n file/memory contains long string with (Indicator: \"GetCommandLine\"; File: \"nsExec.dll\")\n Found string \"GetCursorPos\" (Indicator: \"GetCursorPos\"; Source: \"00000000-00006656-00000C2C-418472610\")\n Found string \"getCursorPos\" (Indicator: \"GetCursorPos\"; Source: \"00000000-00006656.00000000.89710.004F4000.00000004.mdmp, 00000000-00006656.00000001.91631.004F4000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; Source: \"00000000-00004796-00000C2C-429803191\")\n Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; Source: \"00000000-00004796-00000C2C-429803824\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00004796-00000C2C-437391247\")\n Found reference to API \"CheckTokenMembershipW\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00004796-00000C2C-437391283\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00004796.00000000.91471.DB88A000.00000002.mdmp\")\n Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00005988.00000000.91480.DB88A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query volume/memory size (API string)","description":"Found reference to API \"GetDiskFreeSpaceW\" (Indicator: \"GetDiskFreeSpace\"; File: \"Waaake_Setup.exe\")\n Found reference to API \"GetDiskFreeSpaceExW\" (Indicator: \"GetDiskFreeSpace\"; File: \"Waaake_Setup.exe\")\n Found reference to API \"GetDiskFreeSpaceExW\" (Indicator: \"GetDiskFreeSpaceEx\"; File: \"Waaake_Setup.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-193","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve geographical location information","description":"Found reference to API \"GETADDRINFOREQWRAP\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00006656.00000000.89710.00100000.00000004.mdmp, 00000000-00006656.00000001.91631.00100000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-739","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"Found system information discovery API: \"ExpandEnvironmentStringsW\" in file \"Waaake_Setup.exe\"\n Found system information discovery API: \"ExpandEnvironmentStringsW\" in \"00000000-00004796.00000000.91471.DB88A000.00000002.mdmp\"\n Found system information discovery API: \"ExpandEnvironmentStringsW\" in \"00000000-00005988.00000000.91480.DB88A000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve system language (API string)","description":"Found reference to API \"GetUserDefaultUILanguage\" (Indicator: \"GetUserDefaultUILanguage\"; File: \"Waaake_Setup.exe\")\n Found reference to API \"GetSystemDefaultUILanguage\" (Indicator: \"GetSystemDefaultUILanguage\"; Source: \"00000000-00004796.00000000.91471.DB88A000.00000002.mdmp\")\n Found reference to API \"GetUserDefaultUILanguage\" (Indicator: \"GetUserDefaultUILanguage\"; Source: \"00000000-00004796.00000000.91471.DB88A000.00000002.mdmp\")\n Found reference to API \"GetSystemDefaultUILanguage\" (Indicator: \"GetSystemDefaultUILanguage\"; Source: \"00000000-00005988.00000000.91480.DB88A000.00000002.mdmp\")\n Found reference to API \"GetUserDefaultUILanguage\" (Indicator: \"GetUserDefaultUILanguage\"; Source: \"00000000-00005988.00000000.91480.DB88A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"$32","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"Waaake_Setup.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00005000)","origin":"API Call","mitre_attack_id":"T1497","relevance":3,"id":"api-296","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"Waaake_Setup.exe\" called \"GlobalMemoryStatusEx\" with parameters (UID: 00000000-00005000)\n \"Waaake_Setup.exe\" called \"GetSystemMetrics\" with parameters (UID: 00000000-00005000)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"Waaake_Setup.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00005000)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"Waaake_Setup.exe\" called \"IsWow64Process\" with parameter \"5000\" - (UID: 00000000-00005000)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to enumerate active windows","description":"\"waaake.exe\" called \"EnumWindows\" with parameter \"0\" - (UID: 00000000-00006656)\n \"waaake.exe\" called \"EnumWindows\" with parameter \"1007140467120\" - (UID: 00000000-00006656)\n \"powershell.exe\" called \"EnumWindows\" with parameter \"0\" - (UID: 00000000-00004796)\n \"powershell.exe\" called \"EnumWindows\" with parameter \"0\" - (UID: 00000000-00008116)\n \"powershell.exe\" called \"EnumWindows\" with parameter \"0\" - (UID: 00000000-00005988)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-152","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get active windows title","description":"\"Waaake_Setup.exe\" called \"GetWindowTextW\" with parameter \"&Close\" - (UID: 00000000-00005000)\n \"Waaake_Setup.exe\" called \"GetWindowTextW\" with parameter \"Cancel\" - (UID: 00000000-00005000)\n \"Waaake_Setup.exe\" called \"GetWindowTextW\" with parameter \"WAAAKE 1.2.5\" - (UID: 00000000-00005000)\n \"Waaake_Setup.exe\" called \"GetWindowTextW\" with parameter \"Installing\" - (UID: 00000000-00005000)\n \"Waaake_Setup.exe\" called \"GetWindowTextW\" with parameter \"Please wait while WAAAKE is being installed.\" - (UID: 00000000-00005000)\n \"Waaake_Setup.exe\" called \"GetWindowTextW\" with parameter \"Installing, Please Wait...\" - (UID: 00000000-00005000)\n \"Waaake_Setup.exe\" called \"GetWindowTextW\" with parameter \"Installing, please wait...\" - (UID: 00000000-00005000)\n \"Waaake_Setup.exe\" called \"GetWindowTextW\" (UID: 00000000-00005000)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-151","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get handle of currently active window","description":"\"Waaake_Setup.exe\" called \"GetActiveWindow\" (UID: 00000000-00005000)\n \"waaake.exe\" called \"GetActiveWindow\" (UID: 00000000-00006656)","origin":"API Call","mitre_attack_id":"T1010","relevance":5,"id":"api-150","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"Waaake_Setup.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00005000)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$33","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"$34","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve account information for specified SID","description":"\"powershell.exe\" called \"LookupAccountSidW\" with param Name NETWORK SERVICE (UID: 00000000-00004796)\n \"powershell.exe\" called \"LookupAccountSidW\" with param Name NETWORK SERVICE (UID: 00000000-00008116)\n \"powershell.exe\" called \"LookupAccountSidW\" with param Name NETWORK SERVICE (UID: 00000000-00005988)","origin":"API Call","mitre_attack_id":"T1033","relevance":3,"id":"api-148","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"tasklist.exe\" called \"GetLocaleInfoW\" with parameter \"1024\" - (UID: 00000000-00007452)\n \"powershell.exe\" called \"GetLocaleInfoW\" with parameter \"9\" - (UID: 00000000-00004796)\n \"powershell.exe\" called \"GetLocaleInfoW\" with parameter \"9\" - (UID: 00000000-00008116)\n \"powershell.exe\" called \"GetLocaleInfoW\" with parameter \"9\" - (UID: 00000000-00005988)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to detect virtual environment (API)","description":"GetTickCount@KERNEL32.DLL at 00000000-00007452-2726-337-0081F203","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497","relevance":3,"id":"stream-87","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to determine if process is running under WOW64 (API string)","description":"file/memory contains long string with (Indicator: \"IsWow64Process\"; File: \"nsExec.dll\")\n Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00004796.00000000.91471.DB88A000.00000002.mdmp\")\n Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00005988.00000000.91480.DB88A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-450","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to find open windows (API string)","description":"Found reference to API \"FindWindowExW\" (Indicator: \"FindWindowExW\"; File: \"Waaake_Setup.exe\")\n file/memory contains long string with (Indicator: \"FindWindowExW\"; File: \"nsExec.dll\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-413","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform scheduled transfer (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00002028.00000000.90115.70CDF000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00004796.00000000.91471.DB88A000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00005988.00000000.91480.DB88A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query local/system time as file time","description":"FileTimeToSystemTime@KERNEL32.DLL at 00000000-00007452-2726-220-00818E8B\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00007452-2726-337-0081F203","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1070.006","relevance":1,"id":"stream-71","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00007452-2726-337-0081F203","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1124","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the system locale","description":"GetLocaleInfoW@KERNEL32.DLL at 00000000-00007452-2726-332-0081218B","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1614","relevance":1,"id":"stream-49","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"$35","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00002028.00000000.90115.70CDF000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00004796.00000000.91471.DB88A000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00005988.00000000.91480.DB88A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00002028.00000000.90115.70CDF000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00004796.00000000.91471.DB88A000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00005988.00000000.91480.DB88A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"Found reference to API \"FindWindowExW\" (Indicator: \"FindWindow\"; File: \"Waaake_Setup.exe\")\n file/memory contains long string with (Indicator: \"FindWindow\"; File: \"nsExec.dll\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve path in which Windows is installed (API string)","description":"Found reference to API \"GetWindowsDirectoryW\" (Indicator: \"GetWindowsDirectory\"; File: \"Waaake_Setup.exe\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-312","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve system configuration","description":"Found string \"\"name\": \"systeminformation\",\" (Indicator: \"\"systeminfo\"; Source: \"00000000-00006656.00000000.89710.001F4000.00000004.mdmp, 00000000-00006656.00000001.91631.001F4000.00000004.mdmp\")\n Found string \"\"systeminformation\": \"lib/cli.js\"\" (Indicator: \"\"systeminfo\"; Source: \"00000000-00006656.00000000.89710.001F4000.00000004.mdmp, 00000000-00006656.00000001.91631.001F4000.00000004.mdmp\")\n Found string \"\"systeminformation\": \"^5.25.11\",\" (Indicator: \"\"systeminfo\"; Source: \"00000000-00006656.00000000.89710.0044C000.00000004.mdmp\")\n Found string \"\"systeminformation\" (Indicator: \"\"systeminfo\"; Source: \"00000000-00006656.00000000.89710.0044C000.00000004.mdmp, 00000000-00006656.00000000.89710.0046C000.00000004.mdmp, 00000000-00006656.00000000.89710.00C14000.00000004.mdmp, 00000000-00006656.00000001.91631.0046C000.00000004.mdmp, 00000000-00006656.00000001.91631.00C14000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-359","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"$36","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"file/memory contains long string with (Indicator: \"GetStartupInfo\"; File: \"nsExec.dll\")","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-167","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve windows environment variables","description":"Found string \"\"%WINDIR%\\system32\\cmd.exe\" /c tasklist /FI \"USERNAME eq %USERNAME%\" /FI \"IMAGENAME eq waaake.exe\" /FO csv | \"%WINDIR%\\system3\" (Indicator: \"%username%\"; Source: \"00000000-00005000-00000C47-5493745780\"), Found string \"/c tasklist /FI \"USERNAME eq %USERNAME%\" /FI \"IMAGENAME eq waaake.exe\" /FO csv | \"%WINDIR%\\system32\\find.exe\" \"waaake.exe\"\" (Indicator: \"%username%\"; File: \"cmd.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-557","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve/open a process","description":"GetProcessHeap@KERNEL32.DLL at 00000000-00007452-2726-153-00818A9A\n GetProcessHeap@KERNEL32.DLL at 00000000-00007452-2726-154-0081AE24\n GetProcessHeap@KERNEL32.DLL at 00000000-00007452-2726-155-0081AC6D\n GetProcessHeap@KERNEL32.DLL at 00000000-00007452-2726-170-0081ACA8\n GetProcessHeap@KERNEL32.DLL at 00000000-00007452-2726-189-0081AD48\n OpenProcess@KERNEL32.DLL at 00000000-00007452-2726-255-00814BC2\n OpenProcess@KERNEL32.DLL at 00000000-00007452-2726-267-008149CC\n OpenProcessToken@ADVAPI32.DLL at 00000000-00007452-2726-333-00812642","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1057","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"}]},{"level":"informative","category":"Environment Awareness","name":"Executes WMI queries","description":"\"tasklist.exe\" issued a query \"SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'WAAAKE.EXE'\"","origin":"API Call","mitre_attack_id":"T1047","relevance":10,"id":"api-56","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"Environment Awareness","name":"Found registry location string related to processor","description":"Observed string: \"%WINDIR%\\system32\\cmd.exe /d /s /c \"reg query \"HKEY_LOCAL_MACHINE\\HARDWARE\\DESCRIPTION\\System\\CentralProcessor\\0\" /v FeatureSet\"\" (Indicator: \"hardware\\description\\system\\centralprocessor\") in Source: 00000000-00006656-00000C47-48285959060\n Observed string: \"reg query \"HKEY_LOCAL_MACHINE\\HARDWARE\\DESCRIPTION\\System\\CentralProcessor\\0\" /v FeatureSet\" (Indicator: \"hardware\\description\\system\\centralprocessor\") in Source: 00000000-00002856-00000C47-2626615688\n Observed string: \"/d /s /c \"reg query \"HKEY_LOCAL_MACHINE\\HARDWARE\\DESCRIPTION\\System\\CentralProcessor\\0\" /v FeatureSet\"\" (Indicator: \"hardware\\description\\system\\centralprocessor\") in Source: cmd.exe","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-351","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"Environment Awareness","name":"Makes a code branch decision directly after an API that is environment aware","description":"Found API call EnumServicesStatusExW@ADVAPI32.DLL directly followed by \"cmp eax, 01h\" and \"je 008163A5h\" at 00000000-00007452-2726-274-008162AC","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497","relevance":10,"id":"stream-39","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"}]},{"level":"informative","category":"Environment Awareness","name":"Possible DLL sideloading","description":"Possible dll side loading: %TEMP%\\NSBD764.TMP\\SYSTEM.DLL\n %TEMP%\\NSBD764.TMP\\NSIS7Z.DLL\n %TEMP%\\NSBD764.TMP\\STDUTILS.DLL\n %TEMP%\\NSBD764.TMP\\SPIDERBANNER.DLL\n %TEMP%\\NSBD764.TMP\\NSEXEC.DLL\n %TEMP%\\NSBD764.TMP\\WINSHELL.DLL","origin":"Indicator Combinations","mitre_attack_id":"T1574.001","relevance":5,"id":"summary-47","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"}]},{"level":"informative","category":"Environment Awareness","name":"Queries TCP/IP interface details","description":"$37","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-130","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"$38","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information of an entire harddrive","description":"\"waaake.exe\" queries volume information of \"C:\\\" at 00000000-00006656-00000C17-400694895\n \"cmd.exe\" queries volume information of \"C:\\\" at 00000000-00000580-00000C17-404481717","origin":"API Call","mitre_attack_id":"T1082","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"Waaake_Setup.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"tasklist.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"waaake.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"waaake.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"reg.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"Waaake_Setup.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\UNINSTALL\\1AA323D8-1AF7-575C-AA21-FF3F6189D55F\")\n \"Waaake_Setup.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\WAAAKE_SETUP.EXE\")","origin":"Registry Access","mitre_attack_id":"T1518","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"Environment Awareness","name":"References to WMI query strings used for process discovery","description":"Found string \"SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process\" (Indicator: \" Win32_Process\"; File: \"00000000-00007452.00000000.87841.00811000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-513","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"Environment Awareness","name":"Tries to enumerate windows environment variables","description":"Process \"cmd.exe\" with commandline \"/c tasklist /FI \"USERNAME eq %USERNAME%\" /FI \"IMAGENAME eq waaake.exe\" /FO csv | \"%WINDIR%\\\\system32\\\\find.exe\" \"waaake.exe\"\" (UID: 00000000-00006292)","origin":"Monitored Target","mitre_attack_id":"T1082","relevance":1,"id":"target-334","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"Environment Awareness","name":"Tries to retrieve device driver information","description":"\"Waaake_Setup.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\SANDBOXFLTR\"; Key: \"\"; Value: \"\")","origin":"Registry Access","mitre_attack_id":"T1652","relevance":1,"id":"registry-174","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"External Systems","name":"Sample was identified as clean by Antivirus engines","description":"0/26 Antivirus vendors marked sample as clean (0% detection rate)","origin":"External System","relevance":10,"id":"avtest-1","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"General","name":"Able to aggregate collected data, possibly for exfiltration","description":"\"app-64.7z\" copied on \"%TEMP%\\nsbD764.tmp\\app-64.7z\"","origin":"Binary File","mitre_attack_id":"T1074","relevance":1,"id":"binary-87","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"General","name":"Able to create/load registry keys (API string)","description":"Found registry modification API: \"RegCreateKeyExW\" in file \"Waaake_Setup.exe\"\n Found registry modification API: \"RegCreateKeyExW\" in \"00000000-00002028.00000000.90115.70CDF000.00000002.mdmp\"\n Found registry modification API: \"RegLoadKeyW\" in \"00000000-00002028.00000000.90115.70CDF000.00000002.mdmp\"\n Found registry modification API: \"RegConnectRegistryW\" in \"00000000-00002028.00000000.90115.70CDF000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-307","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"General","name":"Able to rename or move file/directory (API string)","description":"Found string \"MoveFileW\" (Indicator: \"MoveFileW\"; File: \"Waaake_Setup.exe\")\n Found string \"MoveFileExW\" (Indicator: \"MoveFileExW\"; File: \"Waaake_Setup.exe\")\n file/memory contains long string with (Indicator: \"MoveFileW\"; File: \"nsis7z.dll\")\n file/memory contains long string with (Indicator: \"MoveFileW\"; File: \"Uninstall waaake.exe\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-884","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"General","name":"Able to retrieve command line parameters of the running process","description":"file/memory contains long string(File: \"nsis7z.dll\")\n file/memory contains long string(File: \"elevate.exe\")\n file/memory contains long string(File: \"StdUtils.dll\")\n file/memory contains long string(File: \"nsExec.dll\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-930","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"}]},{"level":"informative","category":"General","name":"Accesses Software Policy Settings","description":"$39","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-18","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"$3a","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"$3b","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a named pipe","description":"\"waaake.exe\" called \"CreateNamedPipeA\" with parameter \"\\\\?\\pipe\\uv\\18446744073709551615-6656\"\n dwOpenMode: \"1074528259\"\n dwPipeMode: \"0\" - (UID: 00000000-00006656)\n \"waaake.exe\" called \"CreateNamedPipeA\" with parameter \"\\\\?\\pipe\\uv\\18446744073709551615-6656\"\n dwOpenMode: \"1074528257\"\n dwPipeMode: \"0\" - (UID: 00000000-00006656)\n \"waaake.exe\" called \"CreateNamedPipeA\" with parameter \"\\\\?\\pipe\\uv\\0-6656\"\n dwOpenMode: \"1074528257\"\n dwPipeMode: \"0\" - (UID: 00000000-00006656)\n \"waaake.exe\" called \"CreateNamedPipeA\" with parameter \"\\\\?\\pipe\\uv\\1-6656\"\n dwOpenMode: \"1074528257\"\n dwPipeMode: \"0\" - (UID: 00000000-00006656)\n \"waaake.exe\" called \"CreateNamedPipeA\" with parameter \"\\\\?\\pipe\\uv\\0-6656\"\n dwOpenMode: \"1074528259\"\n dwPipeMode: \"0\" - (UID: 00000000-00006656)\n \"waaake.exe\" called \"CreateNamedPipeA\" with parameter \"\\\\?\\pipe\\uv\\1-6656\"\n dwOpenMode: \"1074528259\"\n dwPipeMode: \"0\" - (UID: 00000000-00006656)","origin":"API Call","mitre_attack_id":"T1570","relevance":3,"id":"api-275","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"$3c","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create an instance of a named pipe","description":"\"Waaake_Setup.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\" - (UID: 00000000-00005000)\n \"cmd.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\" - (UID: 00000000-00006292)\n \"waaake.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\\uv\\18446744073709551615-6656\" - (UID: 00000000-00006656)\n \"waaake.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\\uv\\0-6656\" - (UID: 00000000-00006656)\n \"waaake.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\\uv\\1-6656\" - (UID: 00000000-00006656)\n \"waaake.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\\mojo.6656.6684.3494298515299519822\" - (UID: 00000000-00006656)\n \"waaake.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\\mojo.6656.6684.9891112449285977307\" - (UID: 00000000-00006656)\n \"waaake.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\\mojo.6656.6684.6656898436499592066\" - (UID: 00000000-00006656)","origin":"API Call","mitre_attack_id":"T1570","relevance":3,"id":"api-138","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$3d","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"General","name":"Calls an API typically used to move file or directory","description":"$3e","origin":"API Call","mitre_attack_id":"T1570","relevance":1,"id":"api-224","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"details too long to display","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"142.251.34.234:443\"\n \"142.250.189.131:443\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"tasklist.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"}]},{"level":"informative","category":"General","name":"Contains SQL queries","description":"\"SELECT Name FROM Win32_Service WHERE ProcessId = %d and State=\"Running\"\" (Source: 2726-256-00814615, Indicator: \"select name from win32_service where processid = %d and state=\"running\"\")\n \"SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process\" (Source: 2726-305-00812E12, Indicator: \"select __path, processid, csname, caption, sessionid, threadcount, workingsetsize, kernelmodetime, usermodetime from win32_process\")\n \"SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Proces\" (Source: 00000000-00007452-00002718-370182602, Indicator: \"select __path, processid, csname, caption, sessionid, threadcount, workingsetsize, kernelmodetime, usermodetime from win32_proces\")","origin":"File/Memory","mitre_attack_id":"T1213","relevance":2,"id":"string-16","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; File: \"Waaake_Setup.exe\")\n file/memory contains long string with (Indicator: \"CreateProcess\"; File: \"nsExec.dll\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; File: \"Waaake_Setup.exe\")","origin":"File/Memory","mitre_attack_id":"T1074.001","relevance":1,"id":"string-423","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; File: \"Waaake_Setup.exe\")\n file/memory contains long string with (Indicator: \"CreateFile\"; File: \"nsExec.dll\")\n Found reference to API \"REGEDIT: CreateFile failed, GetLastError() = %d\" (Indicator: \"CreateFile\"; Source: \"00000000-00002028.00000000.90115.70CDF000.00000002.mdmp\")\n Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"00000000-00002028.00000000.90115.70CDF000.00000002.mdmp\")\n Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"00000000-00004796.00000000.91471.DB88A000.00000002.mdmp\")\n Found reference to API \"CreateFileMappingW\" (Indicator: \"CreateFile\"; Source: \"00000000-00004796.00000000.91471.DB88A000.00000002.mdmp\")\n Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"00000000-00005988.00000000.91480.DB88A000.00000002.mdmp\")\n Found reference to API \"CreateFileMappingW\" (Indicator: \"CreateFile\"; Source: \"00000000-00005988.00000000.91480.DB88A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"General","name":"Contains ability to delay the execution of current thread","description":"Sleep@KERNEL32.DLL at 00000000-00007452-2726-143-0081ED50","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497.003","relevance":3,"id":"stream-103","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; File: \"Waaake_Setup.exe\")\n Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00002028.00000000.90115.70CDF000.00000002.mdmp\")\n Found reference to API \"RegUnLoadKeyW\" (Indicator: \"RegUnLoadKey\"; Source: \"00000000-00002028.00000000.90115.70CDF000.00000002.mdmp\")\n Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00004796.00000000.91471.DB88A000.00000002.mdmp\")\n Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00005988.00000000.91480.DB88A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically load libraries","description":"LoadLibraryW@KERNEL32.DLL at 00000000-00007452-2726-332-0081218B","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":3,"id":"stream-108","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$3f","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Found reference to API \"ShellExecuteExW\" (Indicator: \"ShellExecute\"; File: \"Waaake_Setup.exe\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-240","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"Found reference to API \"FindResourceExW\" (Indicator: \"FindResource\"; Source: \"00000000-00004796.00000000.91471.DB88A000.00000002.mdmp\")\n Found reference to API \"LoadResource\" (Indicator: \"LoadResource\"; Source: \"00000000-00004796.00000000.91471.DB88A000.00000002.mdmp\")\n Found reference to API \"FindResourceExW\" (Indicator: \"FindResource\"; Source: \"00000000-00005988.00000000.91480.DB88A000.00000002.mdmp\")\n Found reference to API \"LoadResource\" (Indicator: \"LoadResource\"; Source: \"00000000-00005988.00000000.91480.DB88A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-550","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"General","name":"Contains ability to move file or directory (API string)","description":"Found reference to API \"MoveFileW\" (Indicator: \"MoveFile\"; File: \"Waaake_Setup.exe\")\n Found reference to API \"MoveFileExW\" (Indicator: \"MoveFile\"; File: \"Waaake_Setup.exe\")","origin":"File/Memory","mitre_attack_id":"T1570","relevance":1,"id":"string-322","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"Waaake_Setup.exe\")\n file/memory contains long string with (Indicator: \"GetCommandLine\"; File: \"nsExec.dll\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"Waaake_Setup.exe\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/open a process (API string)","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcess\"; File: \"Waaake_Setup.exe\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcess\"; Source: \"00000000-00002028.00000000.90115.70CDF000.00000002.mdmp\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00002028.00000000.90115.70CDF000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"$40","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; File: \"Waaake_Setup.exe\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-208","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"General","name":"Contains reference to method used by Windows shell items (API string)","description":"Found reference to API \"SHFileOperationW\" (Indicator: \"SHFileOperation\"; File: \"Waaake_Setup.exe\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-269","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$41","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"General","name":"Creates directory on disk","description":"\"Waaake_Setup.exe\" with parameter %TEMP%\\ (UID: 00000000-00005000)\n \"Waaake_Setup.exe\" with parameter C:\\Users (UID: 00000000-00005000)\n \"Waaake_Setup.exe\" with parameter C:\\Users\\%OSUSER% (UID: 00000000-00005000)\n \"Waaake_Setup.exe\" with parameter %USERPROFILE%\\AppData (UID: 00000000-00005000)\n \"Waaake_Setup.exe\" with parameter %USERPROFILE%\\AppData\\Local (UID: 00000000-00005000)\n \"Waaake_Setup.exe\" with parameter %LOCALAPPDATA%\\Temp (UID: 00000000-00005000)\n \"Waaake_Setup.exe\" with parameter %TEMP%\\nsbD764.tmp (UID: 00000000-00005000)\n \"Waaake_Setup.exe\" with parameter %LOCALAPPDATA%\\Programs (UID: 00000000-00005000)\n \"Waaake_Setup.exe\" with parameter %LOCALAPPDATA%\\Programs\\waaake (UID: 00000000-00005000)\n \"Waaake_Setup.exe\" with parameter %TEMP%\\nsbD764.tmp\\7z-out (UID: 00000000-00005000)","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-318","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"$42","origin":"Created Mutant","mitre_attack_id":"T1480","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"$43","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"}]},{"level":"informative","category":"General","name":"Executes powershell with commandline","description":"Process \"powershell.exe\" with commandline \"-NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -\" (UID: 00000000-00004796)\n Process \"powershell.exe\" with commandline \"-NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -\" (UID: 00000000-00008116)\n Process \"powershell.exe\" with commandline \"-NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -\" (UID: 00000000-00005988)","origin":"Monitored Target","mitre_attack_id":"T1059.001","relevance":5,"id":"target-110","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"$44","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"$45","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"General","name":"Found E-Mail address in binary/memory","description":"Pattern match: \"nathan@tootallnate.net\"\n Pattern match: \"git@github.com\"\n Pattern match: \"jprichardson@gmail.com\"\n Pattern match: \"feross@feross.org\"\n Pattern match: \"robert@broofa.com\"\n Pattern match: \"felix@debuggable.com\"\n Pattern match: \"rob@robwu.nl\"\n Pattern match: \"opensrc@ryanzim.com\"\n Pattern match: \"deoxxa@fknsrs.biz\"\n Pattern match: \"iam@alexindigo.com\"\n Pattern match: \"ruben@verborgh.org\"\n Pattern match: \"hildebrandt@plus-innovations.com\"\n Pattern match: \"eoxfeld@gmail.com\"\n Pattern match: \"mail@juliangruber.com\"\n Pattern match: \"sindresorhus@gmail.com\"\n Pattern match: \"ljharb@gmail.com\"\n Pattern match: \"raynos2@gmail.com\"\n Pattern match: \"petka_antonov@hotmail.com\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"}]},{"level":"informative","category":"General","name":"Found named pipe like strings","description":"Found string - \\\\.\\pipe\\mojo.6656.6684.3494298515299519822\n Found string - \\\\.\\pipe\\mojo.6656.6684.9891112449285977307\n Found string - \\\\.\\pipe\\mojo.6656.6684.6656898436499592066\n Found string - \\\\.\\pipe\\PSHost.134164579730780645.4796.DefaultAppDomain.powershell\n Found string - \\\\.\\pipe\\PSHost.134164579731103296.8116.DefaultAppDomain.powershell\n Found string - \\\\.\\pipe\\PSHost.134164579732308119.5988.DefaultAppDomain.powershell","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-146","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"$46","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$47","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"General","name":"Loads rich edit control libraries","description":"\"Waaake_Setup.exe\" loaded module \"%WINDIR%\\SysWOW64\\riched20.dll\" at 72410000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-2","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"powershell.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\fe2524177eb3088c77be666722039f52\\mscorlib.ni.dll\" at EFC20000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-3","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"General","name":"Loads the AMSI (Antimalware Scan Interface) DLL","description":"\"powershell.exe\" loaded module \"%WINDIR%\\System32\\amsi.dll\" at 169E0000","origin":"Loaded Module","mitre_attack_id":"T1562.001","id":"module-8","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"Waaake_Setup.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 73CA0000\n \"Waaake_Setup.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 72940000\n \"cmd.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 73CA0000\n \"tasklist.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 73CA0000\n \"tasklist.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 72940000\n \"waaake.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 1F460000\n \"waaake.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 1E740000\n \"cmd.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 1F460000\n \"reg.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 1F460000\n \"powershell.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 1F460000\n \"powershell.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 1E740000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"General","name":"Loads the CLR Loader DLL","description":"\"powershell.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll\" at FA010000","origin":"Loaded Module","mitre_attack_id":"T1620","id":"module-7","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"Waaake_Setup.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 73D00000\n \"cmd.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 73D00000\n \"tasklist.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 73D00000\n \"waaake.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 203A0000\n \"cmd.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 203A0000\n \"reg.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 203A0000\n \"powershell.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 203A0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"19001a000000000040c7651ff87f0000@ntdll.dll\"\n \"220023000000000018c7651ff87f0000@ntdll.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"$48","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$49","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"$4a","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"$4b","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"fonts.googleapis.com\"\n \"fonts.gstatic.com\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"General","name":"Reads Windows Trust Settings","description":"\"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-20","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"$4c","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"General","name":"References Windows file paths for DLLs (possible dropped files)","description":"$4d","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"\"Waaake_Setup.exe\" searching for class \"#32770\"\n \"Waaake_Setup.exe\" searching for class \"SysListView32\"","origin":"API Call","mitre_attack_id":"T1010","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"$4e","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"$4f","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"The input sample is signed with a certificate issued by \"CN=WR2, O=Google Trust Services, C=US\" (SHA1: 09:4B:1C:B6:64:C5:97:5E:E3:CF:D9:FF:1A:01:C4:D8:D7:10:82:7A; see report for more information)\n The input sample is signed with a certificate issued by \"CN=GTS Root R1, O=Google Trust Services LLC, C=US\" (SHA1: 66:E4:16:12:60:B1:00:FE:E0:DE:28:7A:9A:52:93:B4:C2:22:4A:E6; see report for more information)\n The input sample is signed with a certificate issued by \"CN=GlobalSign Root CA, OU=Root CA, O=GlobalSign nv-sa, C=BE\" (SHA1: 08:74:54:87:E8:91:C1:9E:30:78:C1:F2:A0:7E:45:29:50:EF:36:F6; see report for more information)\n The input sample is signed with a certificate issued by \"CN=WR2, O=Google Trust Services, C=US\" (SHA1: C0:70:82:EC:9D:28:B5:4B:51:02:7A:C7:BE:63:94:B1:DC:64:29:FF; see report for more information)","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"nsis7z.dll\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"elevate.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"StdUtils.dll\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"System.dll\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"SpiderBanner.dll\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"nsExec.dll\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"WinShell.dll\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"General","name":"Writes files in a temp directory","description":"\"Waaake_Setup.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\nsbD764.tmp\\System.dll\"\n \"Waaake_Setup.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\nsbD764.tmp\\StdUtils.dll\"\n \"Waaake_Setup.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\nsbD764.tmp\\SpiderBanner.dll\"\n \"Waaake_Setup.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\nsbD764.tmp\\nsExec.dll\"\n \"Waaake_Setup.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\nsbD764.tmp\\app-64.7z\"","origin":"API Call","mitre_attack_id":"T1005","relevance":1,"id":"api-267","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; File: \"Waaake_Setup.exe\")\n file/memory contains long string with (Indicator: \"LoadLibrary\"; File: \"System.dll\")\n Found reference to API \"!This program cannot be run in DOS mode.Rich.text`.relocFU(Lf;.h5}3SHELL32SHCreateItemFromParsingNameGlobalFreeGetProcAddressLoadLibraryAKERNEL32.DLLCoCreateInstanceOLE32.DLLWinShell.dllSetLnkAUMIUninstAppUserModelIdUninstShortcut1#1)1?1j12@2I2i2\" (Indicator: \"LoadLibrary\"; File: \"WinShell.dll\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00004796.00000000.91471.DB88A000.00000002.mdmp\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00005988.00000000.91480.DB88A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to lookup the windows account name","description":"GetUserNameExW@SSPICLI.DLL at 00000000-00007452-2726-291-0081707D","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1033","relevance":5,"id":"stream-28","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"Waaake_Setup.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)\n \"tasklist.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)\n \"waaake.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$50","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"Installation/Persistence","name":"Drops temp files","description":"\"48df6f2f-4fa5-485b-80da-81c590e32d6b.tmp\" has type \"Unknown\"\n \"26d3604e-d8c1-4e21-94af-0903e7f9ba69.tmp\" has type \"Unknown\" - Location: [%APPDATA%\\WAAAKE\\26d3604e-d8c1-4e21-94af-0903e7f9ba69.tmp]\n \"cefbffe5-fa68-4346-b355-80f3284cce92.tmp\" has type \"Unknown\"\n \"54e1c8c6-4a74-4f48-95d1-b9535578e335.tmp\" has type \"Unknown\" - Location: [%APPDATA%\\WAAAKE\\54e1c8c6-4a74-4f48-95d1-b9535578e335.tmp]","origin":"Binary File","mitre_attack_id":"T1105","relevance":1,"id":"binary-53","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$51","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"Installation/Persistence","name":"Potential hijacking of DLL execution flow detected","description":"$52","origin":"Binary File","mitre_attack_id":"T1574.001","relevance":5,"id":"binary-91","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"Waaake_Setup.exe\" queries basic process information of the \"C:\\Waaake_Setup.exe\" (UID: 5000)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$53","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"Waaake_Setup.exe\" reads file \"c:\\users\\%osuser%\\desktop\\desktop.ini\"\n \"Waaake_Setup.exe\" reads file \"c:\\users\\%osuser%\\documents\\desktop.ini\"\n \"Waaake_Setup.exe\" reads file \"c:\\users\\%osuser%\\music\\desktop.ini\"\n \"Waaake_Setup.exe\" reads file \"c:\\users\\%osuser%\\pictures\\desktop.ini\"\n \"Waaake_Setup.exe\" reads file \"c:\\users\\%osuser%\\videos\\desktop.ini\"\n \"Waaake_Setup.exe\" reads file \"c:\\users\\%osuser%\\downloads\\desktop.ini\"\n \"Waaake_Setup.exe\" reads file \"c:\\users\\%osuser%\\onedrive\\desktop.ini\"\n \"Waaake_Setup.exe\" reads file \"c:\\waaake_setup.exe\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"$54","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"\"Waaake_Setup.exe\" trying to touch file \"C:\\Windows\\System32\\WOW64LOG.DLL\"\n \"Waaake_Setup.exe\" trying to touch file \"C:\\WAAAKE_SETUP.EXE.LOCAL\"\n \"Waaake_Setup.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\imm32.dll\"\n \"Waaake_Setup.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\KernelBase.dll\"\n \"Waaake_Setup.exe\" trying to touch file \"C:\\Windows\\WindowsShell.Manifest\"\n \"Waaake_Setup.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\oleaut32.dll\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"\"Waaake_Setup.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\Caches\"\n \"Waaake_Setup.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\WAAAKE.lnk\"\n \"Waaake_Setup.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\"\n \"powershell.exe\" touched file \"C:\\Windows\\System32\\CatRoot\"\n \"powershell.exe\" touched file \"C:\\Windows\\System32\\catroot2\"","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access LNK files (Windows shortcut)","description":"\"Waaake_Setup.exe\" trying to access LNK file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\WAAAKE.lnk\"\n \"Waaake_Setup.exe\" trying to access LNK file \"C:\\Users\\%OSUSER%\\Desktop\\WAAAKE.lnk\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-203","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$55","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$56","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"Waaake_Setup.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\nsbd764.tmp\\system.dll\"\n \"Waaake_Setup.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\nsbd764.tmp\\stdutils.dll\"\n \"Waaake_Setup.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\nsbd764.tmp\\spiderbanner.dll\"\n \"Waaake_Setup.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\nsbd764.tmp\\nsexec.dll\"\n \"Waaake_Setup.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\nsbd764.tmp\\app-64.7z\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes log files","description":"\"Waaake_Setup.exe\" writes a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\nsbD764.tmp\\7z-out\\icudtl.dat\"\n \"Waaake_Setup.exe\" writes a file \"%TEMP%\\nsbD764.tmp\\7z-out\\icudtl.dat\"\n \"waaake.exe\" writes a file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\WAAAKE\\Local Storage\\leveldb\\000001.dbtmp\"\n \"waaake.exe\" writes a file \"%APPDATA%\\WAAAKE\\Local Storage\\leveldb\\000001.dbtmp\"\n \"waaake.exe\" writes a file \"%LOCALAPPDATA%\\Programs\\waaake\\icudtl.dat\"\n \"waaake.exe\" writes a file \"%TEMP%\\nsbD764.tmp\\7z-out\\icudtl.dat\"","origin":"API Call","mitre_attack_id":"T1074.001","relevance":1,"id":"api-159","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create/connect to a named pipe (API string)","description":"file/memory contains long string with (Indicator: \"CreatePipe\"; File: \"nsExec.dll\")\n file/memory contains long string with (Indicator: \"PeekNamedPipe\"; File: \"nsExec.dll\")","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-210","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"Network Related","name":"Contains reference to OpenSSL library string","description":"Found string \"--use-openssl-ca\" (Indicator: \"openssl-\"; Source: \"00000000-00006656.00000000.89710.0004C000.00000004.mdmp, 00000000-00006656.00000000.89710.0005C000.00000004.mdmp, 00000000-00006656.00000001.91631.0004C000.00000004.mdmp, 00000000-00006656.00000001.91631.0005C000.00000004.mdmp\")\n Found string \"I --openssl-config\" (Indicator: \"openssl-\"; Source: \"00000000-00006656.00000000.89710.0005C000.00000004.mdmp, 00000000-00006656.00000001.91631.0005C000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1573.002","relevance":1,"id":"string-494","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"$57","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"Network Related","name":"Found domain strings related to cloud services(possible C&C communication)","description":"file/memory contains long string with (Indicator: \".googleapis.com\"; File: \"48df6f2f-4fa5-485b-80da-81c590e32d6b.tmp\")\n Found string \"fonts.googleapis.com\" (Indicator: \".googleapis.com\"; File: \"PCAP\")","origin":"File/Memory","mitre_attack_id":"T1102","relevance":1,"id":"string-186","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"Network Related","name":"Found mail related domain names","description":"Observed email domain:\"]emx.l\" [Source: Waaake_Setup.exe]","origin":"File/Memory","mitre_attack_id":"T1071.003","relevance":1,"id":"string-169","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"2.5.29.37\"\n \"2.5.29.35\"\n Potential IP \"127.0.0.1\" found in string \"activate inspector on host:port (default: 127.0.0.1:9229)\"\n \"127.0.0.1\"\n \"0.0.0.0\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$58","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$59","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"Network Related","name":"Found string related to HTTP headers","description":"Found string \"HTTP/1.1 400 Bad Request\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00006656.00000000.89710.00028000.00000004.mdmp, 00000000-00006656.00000001.91631.00028000.00000004.mdmp\")\n Found string \"HTTP/1.1 408 Request Timeout\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00006656.00000000.89710.00028000.00000004.mdmp, 00000000-00006656.00000001.91631.00028000.00000004.mdmp\")\n Found string \"HTTP/1.1 431 Request Header Fields Too Large\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00006656.00000000.89710.00028000.00000004.mdmp, 00000000-00006656.00000001.91631.00028000.00000004.mdmp\")\n Found string \"HTTP/1.1 413 Payload Too Large\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00006656.00000000.89710.00028000.00000004.mdmp, 00000000-00006656.00000001.91631.00028000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-457","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"Network Related","name":"High entropy domain detected","description":"Contacted domain: \"fonts.googleapis.com\" has high entropy","origin":"Network Traffic","mitre_attack_id":"T1568.002","relevance":5,"id":"network-81","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: 1fc1c530fdab845a0a2b05d0b5335bcb","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"Network Related","name":"Makes HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"Network Related","name":"References hosts file in file/memory","description":"Found string \"C:\\WINDOWS\\system32\\drivers\\etc\\hosts\" (Indicator: \"\\system32\\drivers\\etc\\hosts\"; Source: \"00000000-00006656.00000000.89710.00070000.00000004.mdmp, 00000000-00006656.00000001.91631.00070000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1565","relevance":1,"id":"string-479","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"Network Related","name":"Short-term SSL certificate detected","description":"Short term registered certificate: \"fonts.googleapis.com\" (83 days old)\n Short term registered certificate: \"fonts.gstatic.com\" (83 days old)","origin":"Certificate Data","mitre_attack_id":"T1583.001","relevance":5,"id":"certificate-3","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"Network Related","name":"Uses HTTPS for communication","description":"HTTPS traffic to \"142.251.34.234\" on port \"443\"\n HTTPS traffic to \"142.250.189.131\" on port \"443\"","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":3,"id":"network-38","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - AES encryption","description":"YARA signature for AES encryption matched on file \"nsis7z.dll\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-103","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match – Rust-compiled binary","description":"YARA signature for Rust-compiled binary file \"tailwindcss-oxide.linux-x64-musl.node\"\n YARA signature for Rust-compiled binary file \"tailwindcss-oxide.linux-x64-gnu.node\"","origin":"YARA Signature","relevance":1,"id":"yara-185","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access web session cookie","description":"file/memory contains long string with (Indicator: \"--user-data-dir\"; Source: \"00000000-00006656.00000000.89710.000F4000.00000004.mdmp\")\n file/memory contains long string with (Indicator: \"--user-data-dir\"; Source: \"00000000-00006656.00000000.89710.00130000.00000004.mdmp\")\n file/memory contains long string with (Indicator: \"--user-data-dir\"; Source: \"00000000-00006656.00000000.89710.003CC000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1550.004","relevance":1,"id":"string-794","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to discover operating system information (API string)","description":"Found reference to API \"10304910370,6452,3024,,RtlGetVersion,NTDLL.dll,\"00:23:49.328\",RX=0,PX=0\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00005988.00000000.91480.B1B50000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"$5a","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Attempts to read volume data via DOS device path","description":"\"Waaake_Setup.exe\" tries to directly access volume data \"Z:\"","origin":"API Call","mitre_attack_id":"T1006","relevance":1,"id":"api-306","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$5b","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"Waaake_Setup.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"Waaake_Setup.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"2\"\n \"th32ProcessID\": \"5000\"}\n \"cmd.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"tasklist.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"waaake.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"reg.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve computer name","description":"\"Waaake_Setup.exe\" called \"GetComputerNameW\" (UID: 00000000-00005000)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-141","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"waaake.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"09000000001000000000010000000000fffffeffff7f0000ff0000000000000008000000d8210000000001000600004f\"}\n \"powershell.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"09000000001000000000010000000000fffffeffff7f0000ff0000000000000008000000d8210000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$5c","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to access clipboard data (API string)","description":"Found reference to API \"OpenClipboard\" (Indicator: \"OpenClipboard\"; File: \"Waaake_Setup.exe\")","origin":"File/Memory","mitre_attack_id":"T1115","relevance":1,"id":"string-188","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to capture screen (API string)","description":"Found reference to API \"GetDC\" (Indicator: \"GetDC\"; File: \"Waaake_Setup.exe\")","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"Found reference to API \"FindFirstFileW\" (Indicator: \"FindFirstFile\"; File: \"Waaake_Setup.exe\")\n Found reference to API \"FindNextFileW\" (Indicator: \"FindNextFile\"; File: \"Waaake_Setup.exe\")\n Found reference to API \"FindFirstFileW\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00004796.00000000.91471.DB88A000.00000002.mdmp\")\n Found reference to API \"FindFirstFileW\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00005988.00000000.91480.DB88A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$5d","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate running processes using Tasklist","description":"Observed string: \"\"%WINDIR%\\system32\\cmd.exe\" /c tasklist /FI \"USERNAME eq %USERNAME%\" /FI \"IMAGENAME eq waaake.exe\" /FO csv | \"%WINDIR%\\system3\" (Indicator: \" tasklist \") in Source: 00000000-00005000-00000C47-5493745780, Observed string: \"%WINDIR%\\SysWOW64\\tasklist.exe\" [Source: 00000000-00006292-00000BC0-369053153], Observed string: \"%WINDIR%\\system32\\tasklist.exe\" [Source: 00000000-00006292-00000C47-1213820850], Observed string: \"tasklist /FI \"USERNAME eq %OSUSER%\" /FI \"IMAGENAME eq waaake.exe\" /FO csv\" (Indicator: \"tasklist \") in Source: 00000000-00006292-00000C47-1213820850, Observed string: \"tasklist.exe\" [Source: 00000000-00007452-00000BC0-369191673], Observed string: \"/c tasklist /FI \"USERNAME eq %USERNAME%\" /FI \"IMAGENAME eq waaake.exe\" /FO csv | \"%WINDIR%\\system32\\find.exe\" \"waaake.exe\"\" (Indicator: \" tasklist \") in Source: cmd.exe","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-517","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; File: \"Waaake_Setup.exe\")\n Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00002028.00000000.90115.70CDF000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"$5e","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"Waaake_Setup.exe\")\n file/memory contains long string with (Indicator: \"GetProcAddress\"; File: \"System.dll\")\n file/memory contains long string with (Indicator: \"GetProcAddress\"; File: \"nsExec.dll\")\n Found reference to API \"!This program cannot be run in DOS mode.Rich.text`.relocFU(Lf;.h5}3SHELL32SHCreateItemFromParsingNameGlobalFreeGetProcAddressLoadLibraryAKERNEL32.DLLCoCreateInstanceOLE32.DLLWinShell.dllSetLnkAUMIUninstAppUserModelIdUninstShortcut1#1)1?1j12@2I2i2\" (Indicator: \"GetProcAddress\"; File: \"WinShell.dll\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00004796.00000000.91471.DB88A000.00000002.mdmp\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00005988.00000000.91480.DB88A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"$5f","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; File: \"Waaake_Setup.exe\")\n file/memory contains long string with (Indicator: \"GetModuleFileName\"; File: \"nsExec.dll\")\n Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00004796.00000000.91471.DB88A000.00000002.mdmp\")\n Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00005988.00000000.91480.DB88A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the local name for a socket (API string)","description":"Found reference to API \"_getsocknamean]\" (Indicator: \"getsockname\"; Source: \"00000000-00006656.00000000.89710.0054C000.00000004.mdmp, 00000000-00006656.00000001.91631.0054C000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-224","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; File: \"Waaake_Setup.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-131","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"Waaake_Setup.exe\")\n file/memory contains long string with (Indicator: \"GetTickCount\"; File: \"nsExec.dll\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00002028.00000000.90115.70CDF000.00000002.mdmp\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00004796.00000000.91471.DB88A000.00000002.mdmp\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00005988.00000000.91480.DB88A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve usernames and/or user information (API string)","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; File: \"Waaake_Setup.exe\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00002028.00000000.90115.70CDF000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"$60","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found system command-related strings","description":"$61","origin":"File/Memory","mitre_attack_id":"T1082","relevance":7,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Reads system-defined device setup information from registry","description":"\"waaake.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0002\"; Key: \"PRUNINGMODE\")\n \"waaake.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E96E-E325-11CE-BFC1-08002BE10318}\\0003\"; Key: \"PROFILEENUMMODE\")\n \"waaake.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E96E-E325-11CE-BFC1-08002BE10318}\\0003\"; Key: \"ICMPROFILE\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-106","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"References to WMI query strings used for information discovery","description":"Found string \"SELECT Name FROM Win32_Service WHERE ProcessId = %d and State=\"Running\"\" (Indicator: \" Win32_Service\"; File: \"00000000-00007452.00000000.87841.00811000.00000020.mdmp\")\n Found string \"SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process\" (Indicator: \" Win32_Process\"; File: \"00000000-00007452.00000000.87841.00811000.00000020.mdmp\")\n Found string \"ame FROM Win32_Service WHERE ProcessId = %d and State=\"Running\"\" (Indicator: \" Win32_Service\"; File: \"00000000-00007452.00000000.87841.00811000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-507","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Uses REG.EXE to query registry keys","description":"Process \"reg.exe\" with commandline \"QUERY HKEY_LOCAL_MACHINE\\\\SOFTWARE\\\\Microsoft\\\\Cryptography /v MachineGuid\" (UID: 00000000-00002028)\n Process \"reg.exe\" with commandline \"reg query \"HKEY_LOCAL_MACHINE\\\\HARDWARE\\\\DESCRIPTION\\\\System\\\\CentralProcessor\\\\0\" /v FeatureSet\" (UID: 00000000-00007184)","origin":"Monitored Target","mitre_attack_id":"T1012","relevance":3,"id":"target-144","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"System Security","name":"Able to delete registry key/value (API string)","description":"Found registry deletion API: \"RegDeleteValueW\" in file \"Waaake_Setup.exe\"\n Found registry deletion API: \"RegDeleteKeyW\" in file \"Waaake_Setup.exe\"\n Found registry deletion API: \"RegDeleteKeyExW\" in file \"Waaake_Setup.exe\"\n Found registry deletion API: \"RegDeleteValueW\" in \"00000000-00002028.00000000.90115.70CDF000.00000002.mdmp\"\n Found registry deletion API: \"RegDeleteKeyExW\" in \"00000000-00002028.00000000.90115.70CDF000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-230","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"System Security","name":"Able to retrieve/open a process (API string)","description":"Found string \"OpenProcessToken\" (Indicator: \"OpenProcess\"; File: \"Waaake_Setup.exe\")\n file/memory contains long string with (Indicator: \"OpenProcess\"; File: \"nsis7z.dll\")\n file/memory contains long string with (Indicator: \"OpenProcess\"; File: \"Uninstall waaake.exe\")\n Found string \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00005000-00000C2C-368115695\")\n Found string \"OpenProcessTokenW\" (Indicator: \"OpenProcess\"; Source: \"00000000-00004796-00000C2C-433759417\")\n Found string \"OpenProcessW\" (Indicator: \"OpenProcess\"; Source: \"00000000-00004796-00000C2C-433759793\")\n Found string \"OpenProcessToken\" (Indicator: \"OpenProcess\"; Source: \"00000000-00002028.00000000.90115.70CDF000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-729","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"System Security","name":"Calls an API typically used to enable or disable privileges in the specified access token","description":"\"Waaake_Setup.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00005000)\n \"tasklist.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00007452)\n \"powershell.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00004796)\n \"powershell.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00008116)\n \"powershell.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00005988)","origin":"API Call","mitre_attack_id":"T1134","relevance":3,"id":"api-111","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"$62","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; File: \"Waaake_Setup.exe\")\n Found reference to API \"RemoveDirectoryW\" (Indicator: \"RemoveDirectory\"; File: \"Waaake_Setup.exe\")\n file/memory contains long string with (Indicator: \"DeleteFile\"; File: \"nsExec.dll\")\n Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; Source: \"00000000-00002028.00000000.90115.70CDF000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"Found reference to API \"AdjustTokenPrivileges\" (Indicator: \"AdjustTokenPrivileges\"; File: \"Waaake_Setup.exe\")\n Found reference to API \"LookupPrivilegeValueW\" (Indicator: \"LookupPrivilegeValue\"; File: \"Waaake_Setup.exe\")\n Found reference to API \"SeShutdownPrivilege\" (Indicator: \"SeShutdownPrivilege\"; File: \"Waaake_Setup.exe\")\n Found reference to API \"SeDebugPrivilege\" (Indicator: \"SeDebugPrivilege\"; File: \"00000000-00007452.00000000.87841.00811000.00000020.mdmp\")\n Found reference to API \"SeBackupPrivilege\" (Indicator: \"SeBackupPrivilege\"; Source: \"00000000-00002028.00000000.90115.70CDF000.00000002.mdmp\")\n Found reference to API \"AdjustTokenPrivileges\" (Indicator: \"AdjustTokenPrivileges\"; Source: \"00000000-00002028.00000000.90115.70CDF000.00000002.mdmp\")\n Found reference to API \"LookupPrivilegeValueW\" (Indicator: \"LookupPrivilegeValue\"; Source: \"00000000-00002028.00000000.90115.70CDF000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify file attributes (API string)","description":"Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; File: \"Waaake_Setup.exe\")","origin":"File/Memory","mitre_attack_id":"T1222","relevance":1,"id":"string-426","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify the user configuration/privilege (API string)","description":"Found reference to API \"SystemParametersInfoW\" (Indicator: \"SystemParametersInfo\"; File: \"Waaake_Setup.exe\")","origin":"File/Memory","mitre_attack_id":"T1098","relevance":1,"id":"string-132","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"Found reference to API \"SetFileSecurityW\" (Indicator: \"SetFileSecurityW\"; File: \"Waaake_Setup.exe\")\n file/memory contains long string with (Indicator: \"InitializeSecurityDescriptor\"; File: \"nsExec.dll\")\n file/memory contains long string with (Indicator: \"SetSecurityDescriptorDacl\"; File: \"nsExec.dll\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"System Security","name":"Contains ability to shutdown system","description":"Observed string: \"shutdown\" (Indicator: \"shutdown\") in Source: 00000000-00006656.00000000.89710.00124000.00000004.mdmp\n 00000000-00006656.00000000.89710.003EC000.00000004.mdmp\n 00000000-00006656.00000001.91631.00124000.00000004.mdmp\n 00000000-00006656.00000001.91631.003EC000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1529","relevance":1,"id":"string-406","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; File: \"Waaake_Setup.exe\")\n file/memory contains long string with (Indicator: \"ExitProcess\"; File: \"nsExec.dll\")\n file/memory contains long string with (Indicator: \"TerminateProcess\"; File: \"nsExec.dll\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00002028.00000000.90115.70CDF000.00000002.mdmp\")\n Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00002028.00000000.90115.70CDF000.00000002.mdmp\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00004796.00000000.91471.DB88A000.00000002.mdmp\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00005988.00000000.91480.DB88A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"System Security","name":"Contains ability to use security policy setting (API string)","description":"Found reference to API \"SeRestorePrivilege\" (Indicator: \"SeRestorePrivilege\"; Source: \"00000000-00002028.00000000.90115.70CDF000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1548","relevance":3,"id":"string-97","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"Waaake_Setup.exe\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00002028.00000000.90115.70CDF000.00000002.mdmp\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00004796.00000000.91471.DB88A000.00000002.mdmp\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00005988.00000000.91480.DB88A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"$63","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"tasklist.exe\" opened \"\\Device\\KsecDD\"\n \"waaake.exe\" opened \"\\Device\\KsecDD\"\n \"powershell.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$64","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"System Security","name":"Writes registry keys","description":"$65","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to reboot/shutdown the operating system (API string)","description":"Found reference to API \"ExitWindowsEx\" (Indicator: \"ExitWindows\"; File: \"Waaake_Setup.exe\")\n Found reference to API \"InitiateShutdownW\" (Indicator: \"InitiateShutdown\"; File: \"Waaake_Setup.exe\")","origin":"File/Memory","mitre_attack_id":"T1529","relevance":3,"id":"string-189","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops executable files inside temp directory","description":"$66","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-33","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"$67","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files with image extension","description":"\"icon.png\" has type \"PNG image data 512 x 512 8-bit/color RGBA non-interlaced\" and extension \"png\"","origin":"Binary File","mitre_attack_id":"T1105","id":"binary-56","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"}]},{"level":"informative","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"$68","origin":"File/Memory","mitre_attack_id":"T1106","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"Waaake_Setup.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"Waaake_Setup.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"tasklist.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"Tries to save executable or command in registry","description":"\"Waaake_Setup.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\UNINSTALL\\1AA323D8-1AF7-575C-AA21-FF3F6189D55F\"; Key: \"UNINSTALLSTRING\"; Value: \"\"%LOCALAPPDATA%\\Programs\\waaake\\Uninstall waaake.exe\" /currentuser\")\n \"Waaake_Setup.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\UNINSTALL\\1AA323D8-1AF7-575C-AA21-FF3F6189D55F\"; Key: \"QUIETUNINSTALLSTRING\"; Value: \"\"%LOCALAPPDATA%\\Programs\\waaake\\Uninstall waaake.exe\" /currentuser /S\")\n \"Waaake_Setup.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\UNINSTALL\\1AA323D8-1AF7-575C-AA21-FF3F6189D55F\"; Key: \"DISPLAYICON\"; Value: \"%LOCALAPPDATA%\\Programs\\waaake\\waaake.exe,0\")","origin":"Registry Access","mitre_attack_id":"T1547","relevance":7,"id":"registry-113","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"Uses a Windows Living Off The Land Binaries (LOL bins)","description":"Process \"%WINDIR%\\SysWOW64\\cmd.exe\" launched with commandline \"/c tasklist /FI \"USERNAME eq %USERNAME%\" /FI \"IMAGENAME eq waaake.exe\" /FO csv | \"%WINDIR%\\\\system32\\\\find.exe\" \"waaake.exe\"\" (UID: 00000000-00006292)\n Process \"%WINDIR%\\SysWOW64\\tasklist.exe\" launched with commandline \"tasklist /FI \"USERNAME eq %OSUSER%\" /FI \"IMAGENAME eq waaake.exe\" /FO csv\" (UID: 00000000-00007452)\n Process \"%WINDIR%\\SysWOW64\\find.exe\" launched with commandline \"\"waaake.exe\"\" (UID: 00000000-00007680)\n Process \"%WINDIR%\\system32\\chcp.com\" launched with commandline \"\" (UID: 00000000-00004500)\n Process \"%WINDIR%\\System32\\reg.exe\" launched with commandline \"QUERY HKEY_LOCAL_MACHINE\\\\SOFTWARE\\\\Microsoft\\\\Cryptography /v MachineGuid\" (UID: 00000000-00002028)\n Process \"%WINDIR%\\system32\\reg.exe\" launched with commandline \"reg query \"HKEY_LOCAL_MACHINE\\\\HARDWARE\\\\DESCRIPTION\\\\System\\\\CentralProcessor\\\\0\" /v FeatureSet\" (UID: 00000000-00007184)","origin":"Monitored Target","relevance":3,"id":"target-411","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"\"powershell.exe\" is allocating memory with PAGE_GUARD access rights (Handle: FFFFFFFFFFFFFFFF); (PID: 4796)\n \"powershell.exe\" is allocating memory with PAGE_GUARD access rights (Handle: FFFFFFFFFFFFFFFF); (PID: 8116)\n \"powershell.exe\" is allocating memory with PAGE_GUARD access rights (Handle: FFFFFFFFFFFFFFFF); (PID: 5988)","origin":"API Call","mitre_attack_id":"T1562.001","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"suspicious","category":"General","name":"Reads configuration files (.ini files)","description":"\"Waaake_Setup.exe\" reads file \"C:\\Users\\%OSUSER%\\Desktop\\desktop.ini\"\n \"Waaake_Setup.exe\" reads file \"C:\\Users\\%OSUSER%\\Documents\\desktop.ini\"\n \"Waaake_Setup.exe\" reads file \"C:\\Users\\%OSUSER%\\Music\\desktop.ini\"\n \"Waaake_Setup.exe\" reads file \"C:\\Users\\%OSUSER%\\Pictures\\desktop.ini\"\n \"Waaake_Setup.exe\" reads file \"C:\\Users\\%OSUSER%\\Videos\\desktop.ini\"\n \"Waaake_Setup.exe\" reads file \"C:\\Users\\%OSUSER%\\Downloads\\desktop.ini\"\n \"Waaake_Setup.exe\" reads file \"C:\\Users\\%OSUSER%\\OneDrive\\desktop.ini\"","origin":"API Call","mitre_attack_id":"T1083","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"suspicious","category":"General","name":"Sends UDP traffic","description":"\"UDP connection to 142.250.189.131\"","origin":"Network Traffic","mitre_attack_id":"T1095","relevance":1,"id":"network-5","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"$69","origin":"Binary File","mitre_attack_id":"T1105","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes a PE file header to disc","description":"$6a","origin":"API Call","mitre_attack_id":"T1105","relevance":10,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 142.251.34.234 on port 443 is sent without HTTP header\n UDP traffic to 142.250.189.131 on port 443\n TCP traffic to 142.250.189.131 on port 443 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match - ChaCha20 encryption algorithm","description":"YARA signature for ChaCha20 256-bit key algorithm matched on file \"waaake.exe\"\n YARA signature for ChaCha20 128-bit key algorithm matched on file \"waaake.exe\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":9,"id":"yara-44","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match – cryptographic algorithms","description":"YARA signature matched on AES instruction used in file \"waaake.exe\"","origin":"YARA Signature","mitre_attack_id":"T1027.013","relevance":1,"id":"yara-155","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains references to WMI/WMIC","description":"Found string \"root\\cimv2\" (Indicator: \"root\\cimv2\"; in File: \"00000000-00007452.00000000.87841.00811000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":3,"id":"string-30","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"$6b","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"$6c","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Contains native function calls","description":"NtQueryInformationProcess@NTDLL.DLL at 00000000-00007452-2726-267-008149CC","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":5,"id":"stream-22","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"}]},{"level":"malicious","category":"Environment Awareness","name":"Tries to gather information about running processes on a system","description":"Process \"tasklist.exe\" with commandline \"tasklist /FI \"USERNAME eq %OSUSER%\" /FI \"IMAGENAME eq waaake.exe\" /FO csv\" (UID: 00000000-00007452)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-136","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"$6d","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Opens a handle of credential dumping utility","description":"\"tasklist.exe\" opens a process \"C:\\Windows\\System32\\lsass.exe\" (UID: 00000000-00007452)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-300","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"$6e","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains strings related to AMSI (Anti Malware Scan Interface)","description":"Observed string: \":\\WINDOWS\\SYSTEM32\\amsi.dll\" (Indicator: \"amsi.dll\") in Source: 00000000-00008260.00000000.294793.F5830000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-231","sources":[{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00003448.00000000.289289.0041E000.00000004.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Spawns Windows crash diagnostic and reporting process","description":"Process \"WerFault.exe\" [UID: 00000000-00005180]\n Process \"WerFault.exe\" [UID: 00000000-00008508]","origin":"Monitored Target","mitre_attack_id":"T1564","relevance":1,"id":"target-585","sources":[{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"Waaake_Setup.exe\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"Waaake_Setup.exe\")\n Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"Waaake_Setup.exe\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-148","sources":[{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"PE file contains zero-sized sections","description":"Raw size of \".ndata\" is zero\n Raw size of \".data\" is zero","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-5","sources":[{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform AES/RC4 encryption (API string)","description":"Found reference to API \"CryptProtectData\" (Indicator: \"CryptProtectData\"; File: \"Waaake_Setup.exe\")\n Found reference to API \"CryptUnprotectData\" (Indicator: \"CryptUnprotectData\"; File: \"Waaake_Setup.exe\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-438","sources":[{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform decryption (API string)","description":"Found reference to API \"CryptUnprotectData\" (Indicator: \"CryptUnprotectData\"; File: \"Waaake_Setup.exe\")\n Found reference to API \"CryptDecrypt\" (Indicator: \"CryptDecrypt\"; Source: \"00000000-00006504.00000000.295707.FB930000.00000004.mdmp, 00000000-00007920.00000000.295713.DE770000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-212","sources":[{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform encryption (API string)","description":"Found reference to API \"CryptProtectData\" (Indicator: \"CryptProtectData\"; File: \"Waaake_Setup.exe\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-108","sources":[{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform encryption/decryption using RSA algorithm","description":"Found string \"rsacryptoserviceprovider\" (Indicator: \"RSACryptoServiceProvider\"; Source: \"00000000-00008260.00000000.294793.170E0000.00000004.mdmp\")\n Found string \"psrsacryptoserviceprovider\" (Indicator: \"RSACryptoServiceProvider\"; Source: \"00000000-00008260.00000000.294793.17160000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1573.002","relevance":1,"id":"string-352","sources":[{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains possible references to Golang crypto modules","description":"$6f","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-234","sources":[{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to cryptographic keys","description":"Found string \"ncrypted Private Key\" (Indicator: \"private key\"; Source: \"00000000-00008260.00000000.294793.F5830000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-280","sources":[{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"Cryptographic Related","name":"Found XOR operators (encryption/decryption)","description":"Found string \"var v = (b[i] ^ 0xff) + carry;\" (Indicator: \" ^ \"; Source: \"00000000-00002420.00000000.291187.00028000.00000004.mdmp, 00000000-00002420.00000001.293106.00028000.00000004.mdmp\")\n Found string \"v = (v ^ 0xff) + carry;\" (Indicator: \" ^ \"; Source: \"00000000-00002420.00000000.291187.00028000.00000004.mdmp, 00000000-00002420.00000001.293106.00028000.00000004.mdmp\")\n Found string \"for (k = 0; k < 8; k++) c = c & 1 ? poly ^ (c >>> 1) : (c = c >>> 1);\" (Indicator: \" ^ \"; Source: \"00000000-00002420.00000000.291187.000D0000.00000004.mdmp\")\n Found string \"const r = table[(crc.readUInt32BE() ^ (ch >>> 0)) & 0xff];\" (Indicator: \" ^ \"; Source: \"00000000-00002420.00000000.291187.000D0000.00000004.mdmp\")\n Found string \"return (l ^ r) >>> 0;\" (Indicator: \" ^ \"; Source: \"00000000-00002420.00000000.291187.000D0000.00000004.mdmp\")\n Found string \"c = c ^ ((multiply(k, (k ^ 1 >>> 0)) >> 8) & 0xff);\" (Indicator: \" ^ \"; Source: \"00000000-00002420.00000000.291187.000D0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-624","sources":[{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"Cryptographic Related","name":"Imports crypto-related APIs","description":"Observed import api \"CryptProtectData\" which can \"perform encryption on the data\" [Source: StdUtils.dll]\n Observed import api \"CryptUnprotectData\" which can \"perform decryption and does an integrity check of the data\" [Source: StdUtils.dll]","origin":"Static Parser","mitre_attack_id":"T1486","relevance":1,"id":"static-82","sources":[{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve date formats supported by the local system (API string)","description":"Found reference to API \"GetDateFormatW\" (Indicator: \"GetDateFormat\"; File: \"Waaake_Setup.exe\")\n Found reference to API \"GetTimeFormatW\" (Indicator: \"GetTimeFormat\"; File: \"Waaake_Setup.exe\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-901","sources":[{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an APIs used to retrieve process information","description":"Observed import api \"OpenProcessToken\" which can be \"used to retrieve process information\" [Source: Waaake_Setup.exe]\n Observed import api \"OpenProcessToken\" which can be \"used to retrieve process information\" [Source: vulkan-1.dll]\n Observed import api \"OpenProcessToken\" which can be \"used to retrieve process information\" [Source: nsis7z.dll]\n Observed import api \"OpenProcessToken\" which can be \"used to retrieve process information\" [Source: Uninstall waaake.exe]","origin":"Static Parser","mitre_attack_id":"T1057","relevance":5,"id":"static-189","sources":[{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine timezone (API string)","description":"Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; File: \"Waaake_Setup.exe\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-248","sources":[{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the current user information","description":"Observed string: \"cmd += 'query user';\" (Indicator: \"query user\") in Source: 00000000-00002420.00000000.291187.00040000.00000004.mdmp\n 00000000-00002420.00000001.293106.00040000.00000004.mdmp\n 00000000-00002420.00000002.295027.00040000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-432","sources":[{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"General","name":"An application crash occurred","description":"\"svchost.exe\" loaded module \"%WINDIR%\\System32\\Faultrep.dll\" at 8DC70000","origin":"Loaded Module","id":"module-1","sources":[{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"General","name":"Contains ability to create/control drivers (API string)","description":"Found reference to API \"DeviceIoControl\" (Indicator: \"DeviceIoControl\"; File: \"Waaake_Setup.exe\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-220","sources":[{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically determine API calls","description":"Found GetProcAddress() and LoadLibraryA() in an import section (Source: WinShell.dll)","origin":"Static Parser","mitre_attack_id":"T1027.007","relevance":1,"id":"static-79","sources":[{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"General","name":"Contains export functions","description":"$70","origin":"Static Parser","relevance":1,"id":"static-78","sources":[{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"General","name":"Contains reference to WMI activity (Powershell command string)","description":"file/memory contains long string with (Indicator: \"Invoke-CimMethod\"; Source: \"00000000-00002420.00000000.291187.00040000.00000004.mdmp, 00000000-00002420.00000001.293106.00040000.00000004.mdmp, 00000000-00002420.00000002.295027.00040000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":1,"id":"string-390","sources":[{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"General","name":"Contains references to file movement (imports API)","description":"Found MoveFileW in import section (Source: Waaake_Setup.exe)\n Found MoveFileW in import section (Source: nsis7z.dll)\n Found MoveFileW in import section (Source: Uninstall waaake.exe)","origin":"Static Parser","mitre_attack_id":"T1083","relevance":1,"id":"static-205","sources":[{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"General","name":"Found well known domains (string)","description":"$71","origin":"File/Memory","relevance":1,"id":"string-135","sources":[{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"General","name":"PE file contains Debug data directory","description":"\"ffmpeg.dll\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"\n \"vulkan-1.dll\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"\n \"libEGL.dll\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"\n \"nsis7z.dll\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"\n \"elevate.exe\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"","origin":"Static Parser","id":"static-146","sources":[{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"Waaake_Setup.exe\" has an executable section named \".text\"\n \"ffmpeg.dll\" has an executable section named \".text\"\n \"vulkan-1.dll\" has an executable section named \".text\"\n \"libEGL.dll\" has an executable section named \".text\"\n \"nsis7z.dll\" has an executable section named \".text\"\n \"Uninstall waaake.exe\" has an executable section named \".text\"\n \"elevate.exe\" has an executable section named \".text\"\n \"StdUtils.dll\" has an executable section named \".text\"\n \"System.dll\" has an executable section named \".text\"\n \"SpiderBanner.dll\" has an executable section named \".text\"\n \"nsExec.dll\" has an executable section named \".text\"\n \"WinShell.dll\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"Waaake_Setup.exe\" has an writable section named \".data\"\n \"Waaake_Setup.exe\" has an writable section named \".ndata\"\n \"ffmpeg.dll\" has an writable section named \".data\"\n \"ffmpeg.dll\" has an writable section named \".tls\"\n \"vulkan-1.dll\" has an writable section named \".data\"\n \"vulkan-1.dll\" has an writable section named \".tls\"\n \"libEGL.dll\" has an writable section named \".data\"\n \"libEGL.dll\" has an writable section named \".tls\"\n \"nsis7z.dll\" has an writable section named \".data\"\n \"Uninstall waaake.exe\" has an writable section named \".data\"\n \"Uninstall waaake.exe\" has an writable section named \".ndata\"\n \"elevate.exe\" has an writable section named \".data\"\n \"StdUtils.dll\" has an writable section named \".data\"\n \"System.dll\" has an writable section named \".data\"\n \"SpiderBanner.dll\" has an writable section named \".data\"\n \"nsExec.dll\" has an writable section named \".data\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"$72","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"General","name":"PE file has a big raw size section","description":"Raw size of \".text\" is \"0x24dc00\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-125","sources":[{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"General","name":"PE file has a big virtual size section","description":"Virtual size of \".ndata\" is \"0x124000\" greater than 0x100000\n Virtual size of \".text\" is \"0x24da65\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-124","sources":[{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"General","name":"PE file has a high image base","description":"\"ffmpeg.dll\" has high imagebase \"0x180000000\"\n \"vulkan-1.dll\" has high imagebase \"0x180000000\"\n \"libEGL.dll\" has high imagebase \"0x180000000\"","origin":"Static Parser","relevance":1,"id":"static-93","sources":[{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"Installation/Persistence","name":"Attempts remote code execution into another process memory space","description":"$73","origin":"API Call","mitre_attack_id":"T1055.002","relevance":1,"id":"api-315","sources":[{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - High entropy File","description":"YARA signature to detect high entropy file process \"00000000-00006360\"\n YARA signature to detect high entropy file file \"sample.bin\"\n YARA signature to detect high entropy file file \"installer.exe\"\n YARA signature to detect high entropy file process \"00000000-00009076\"\n YARA signature to detect high entropy file file \"Uninstall waaake.exe\"","origin":"YARA Signature","mitre_attack_id":"T1027.013","relevance":5,"id":"yara-605","sources":[{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - Medium entropy File","description":"$74","origin":"YARA Signature","mitre_attack_id":"T1027.013","relevance":5,"id":"yara-606","sources":[{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - RC4 Encryption","description":"$75","origin":"YARA Signature","mitre_attack_id":"T1027","id":"yara-104","sources":[{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"Found string \"+ncalrpc:[OLE5463810014BBB65BAC1693DBF351]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00001752.00000000.295180.02E60000.00000004.mdmp\")\n Found string \"+ncalrpc:[OLE348C1E0DEB0242A5BD541CD9A683]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00008260.00000000.294793.F35B0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access credential file using Kerberos","description":"Found string \"Kerberos\" (Indicator: \"kerberos\"; Source: \"00000000-00001752.00000000.295180.02E60000.00000004.mdmp, 00000000-00008260.00000000.294793.F35B0000.00000004.mdmp\")\n Found string \"kerberosclient\" (Indicator: \"kerberos\"; Source: \"00000000-00008260.00000000.294793.17100000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1558","relevance":1,"id":"string-868","sources":[{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to import GetCommandLine API, which retrieves the command line string for the current process","description":"Observed import api \"GetCommandLineA\" which can \"retrieve the command-line string for the current process\" [Source: ffmpeg.dll]\n Observed import api \"GetCommandLineA\" which can \"retrieve the command-line string for the current process\" [Source: vulkan-1.dll]\n Observed import api \"GetCommandLineA\" which can \"retrieve the command-line string for the current process\" [Source: libEGL.dll]\n Observed import api \"GetCommandLineA\" which can \"retrieve the command-line string for the current process\" [Source: nsis7z.dll]\n Observed import api \"GetCommandLineA\" which can \"retrieve the command-line string for the current process\" [Source: elevate.exe]","origin":"Static Parser","mitre_attack_id":"T1059.003","relevance":1,"id":"static-88","sources":[{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve user name","description":"\"powershell.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"2\"}\n \"powershell.exe\" called \"GetUserNameW\" (UID: 00000000-00005328)\n \"powershell.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"65538\"}\n \"powershell.exe\" called \"GetUserNameW\" (UID: 00000000-00008580)\n \"powershell.exe\" called \"GetUserNameW\" (UID: 00000000-00005988)\n \"powershell.exe\" called \"GetUserNameW\" (UID: 00000000-00008188)","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-135","sources":[{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate objects (Powershell command string)","description":"file/memory contains long string with (Indicator: \"Select-Object\"; Source: \"00000000-00002420.00000000.291187.00040000.00000004.mdmp, 00000000-00002420.00000001.293106.00040000.00000004.mdmp, 00000000-00002420.00000002.295027.00040000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-374","sources":[{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve data about the local computer (API string)","description":"Found reference to API \"InterlockedExchange\" (Indicator: \"InterlockedExchange\"; File: \"Waaake_Setup.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":3,"id":"string-115","sources":[{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve instances of WMI objects (Powershell command string)","description":"$76","origin":"File/Memory","mitre_attack_id":"T1518.001","relevance":1,"id":"string-277","sources":[{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve processes (Powershell command string)","description":"file/memory contains long string with (Indicator: \"Get-Process\"; Source: \"00000000-00002420.00000000.291187.00040000.00000004.mdmp, 00000000-00002420.00000001.293106.00040000.00000004.mdmp, 00000000-00002420.00000002.295027.00040000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-291","sources":[{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"Found reference to API \"GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; File: \"Waaake_Setup.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-107","sources":[{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieves the class object from a DLL object handler (API string)","description":"Found reference to API \"DllGetClassObject\" (Indicator: \"DllGetClassObject\"; Source: \"00000000-00008260.00000000.294793.97F32000.00000002.mdmp\")","origin":"File/Memory","relevance":1,"id":"string-82","sources":[{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"System Security","name":"Calls an API used to open a process handle","description":"Observed import api \"OpenProcess\" which can be \"used to open a process handle\" [Source: Waaake_Setup.exe]\n Observed import api \"OpenProcess\" which can be \"used to open a process handle\" [Source: vulkan-1.dll]\n Observed import api \"OpenProcess\" which can be \"used to open a process handle\" [Source: nsis7z.dll]\n Observed import api \"OpenProcess\" which can be \"used to open a process handle\" [Source: Uninstall waaake.exe]","origin":"Static Parser","mitre_attack_id":"T1489","relevance":5,"id":"static-191","sources":[{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"System Security","name":"Contains ability to disable Windows Defender using PowerShell","description":"Found string \"DisableRealtimeMonitoring\" (Indicator: \"disablerealtimemonitoring\"; Source: \"00000000-00008260.00000000.294793.97F32000.00000002.mdmp\")\n Found string \"DisableIOAVProtection\" (Indicator: \"disableioavprotection\"; Source: \"00000000-00008260.00000000.294793.97F32000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-748","sources":[{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"System Security","name":"Found anti-virus related strings names","description":"$77","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":3,"id":"string-134","sources":[{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"System Security","name":"Imports system security related APIs","description":"$78","origin":"Static Parser","mitre_attack_id":"T1134.001","relevance":1,"id":"static-87","sources":[{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"nsis7z.dll\" was detected as \"Borland Delphi 3.0 (???)\"\n \"elevate.exe\" was detected as \"VC8 -> Microsoft Corporation\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Section contains high entropy","description":"$79","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"suspicious","category":"Environment Awareness","name":"Attempts to retrieve geographical location information","description":"\"waaake.exe\" called \"GetUserGeoID\" with parameters {\"GeoClass\": \"16\"}\n \"waaake.exe\" called \"GetGeoInfoW\" with parameters {\"Location\": \"244\"\n \"GeoType\": \"4\"\n \"lpGeoData\": \"5439573\"\n \"cchData\": \"3\"\n \"LangId\": \"0\"}\n \"waaake.exe\" called \"getaddrinfo\" with parameters {\"pNodeName\": \"wpad\"\n \"pHints\": \"10a3ff1d8\"\n \"ppResult\": \"0000000000000000\"}\n \"waaake.exe\" called \"getaddrinfo\" with parameters {\"pNodeName\": \"wpad\"\n \"pHints\": \"1043ff288\"\n \"ppResult\": \"0000000000000000\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":10,"id":"api-308","sources":[{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to detect virtual environment","description":"\"waaake.exe\" (Path: \"HKLM\\HARDWARE\\DESCRIPTION\\SYSTEM\\CENTRALPROCESSOR\\0\"; Key: \"~MHZ\")\n \"waaake.exe\" (Path: \"HKLM\\HARDWARE\\DESCRIPTION\\SYSTEM\\CENTRALPROCESSOR\\0\"; Key: \"PROCESSORNAMESTRING\")\n \"waaake.exe\" (Path: \"HKLM\\HARDWARE\\DESCRIPTION\\SYSTEM\\CENTRALPROCESSOR\\1\"; Key: \"~MHZ\")\n \"waaake.exe\" (Path: \"HKLM\\HARDWARE\\DESCRIPTION\\SYSTEM\\CENTRALPROCESSOR\\1\"; Key: \"PROCESSORNAMESTRING\")\n \"reg.exe\" (Path: \"HKLM\\HARDWARE\\DESCRIPTION\\SYSTEM\\CENTRALPROCESSOR\\0\"; Key: \"FEATURESET\")","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-87","sources":[{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"suspicious","category":"Environment Awareness","name":"Executes WMI queries known to be used for VM detection","description":"\"tasklist.exe\" issued a query \"SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'WAAAKE.EXE'\"","origin":"API Call","mitre_attack_id":"T1047","relevance":10,"id":"api-57","sources":[{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"suspicious","category":"Environment Awareness","name":"Found a reference to a WMI query string known to be used for VM detection","description":"$7a","origin":"File/Memory","mitre_attack_id":"T1047","relevance":10,"id":"string-55","sources":[{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match - ChaCha20 128-bit algorithm","description":"YARA signature for ChaCha20 128-bit key algorithm matched on file \"waaake.exe\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":9,"id":"yara-57","sources":[{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match - ChaCha20 256-bit algorithm","description":"YARA signature for ChaCha20 256-bit key algorithm matched on file \"waaake.exe\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":9,"id":"yara-44","sources":[{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"StdUtils.dll\" claimed CRC 142210 while the actual is CRC 140732","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"OpenProcessToken\n RegCloseKey\n RegEnumKeyW\n RegDeleteKeyW\n RegCreateKeyExW\n RegDeleteValueW\n RegOpenKeyExW\n CreateThread\n GetTickCount\n DeleteFileW\n WriteFile\n FindFirstFileW\n GetFileSize\n GetModuleHandleW\n GetProcAddress\n GetTempFileNameW\n CopyFileW\n GetModuleHandleA\n LoadLibraryExW\n CreateProcessW\n CreateDirectoryW\n GetTempPathW\n GetFileAttributesW\n CreateFileW\n GetCommandLineW\n Sleep\n GetSystemDirectoryW\n GetModuleFileNameW\n FindNextFileW\n ShellExecuteExW\n FindWindowExW\n GetCommandLineA\n IsDebuggerPresent\n GetStartupInfoW\n ExitThread\n GetModuleHandleExW\n TerminateProcess\n GetFileSizeEx\n FindFirstFileExW\n SleepConditionVariableSRW\n UnhandledExceptionFilter\n RegOpenKeyExA\n GetModuleFileNameA\n LoadLibraryW\n GetFileAttributesExW\n LoadLibraryExA\n OutputDebugStringA\n GetModuleHandleExA\n GetSystemInfo\n VirtualAlloc\n DeviceIoControl\n GetVersionExW\n ShellExecuteW\n GetWindowThreadProcessId\n VirtualProtect\n SetSecurityDescriptorDacl\n CreateFileMappingW\n MapViewOfFile\n LoadLibraryA","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]}],"incidents":[{"name":"Spyware","details_count":2,"details":[{"detail":"Hooks API calls"},{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"name":"Persistence","details_count":3,"details":[{"detail":"Writes data to a remote process"},{"detail":"Creates new processes"},{"detail":"Spawns a lot of processes"}],"sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"name":"Fingerprint","details_count":2,"details":[{"detail":"Queries the display settings of system associated file extensions"},{"detail":"Tries to gather information about running processes on a system"}],"sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"name":"Evasive","details_count":6,"details":[{"detail":"Marks file for deletion"},{"detail":"Executes WMI queries known to be used for VM detection"},{"detail":"Found a reference to a WMI query string known to be used for VM detection"},{"detail":"Contains ability to adjust token privileges"},{"detail":"Contains ability to terminate a process"},{"detail":"Writes archive files"}],"sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 2 domains and 2 hosts"}],"sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]}]},"activity":{"stats":{"process_count":22,"spawned_processes_count":22,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":63,"imported_dlls_count":159,"dropped_files_count":0,"extracted_files_count":38,"files_written_count":135,"files_deleted_count":0,"registry_keys_created_count":54,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":54,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":5,"dns_resolutions_count":3,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["evasive"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files","Sample Crashed"],"sandbox_reports":[{"id":"699de503daaa9a9dfa040671","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"contacted_countries":["USA"],"submit_name":"Waaake_Setup.exe","analysis_start_time":"2026-02-24T17:51:17+00:00","indicators_count":{"informative":230,"suspicious":63,"malicious":4},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true},{"id":"6892b78940ad7bbf2b02839c","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"contacted_countries":["USA"],"submit_name":"Waaake_Setup.exe","analysis_start_time":"2025-08-06T02:02:02+00:00","indicators_count":{"informative":245,"suspicious":78,"malicious":6},"tags":["Multi-Process","Network Traffic","Extracted Files","Sample Crashed"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"142.251.34.234","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"}]},{"address":"142.250.189.131","port":443,"protocol":"UDP","country":"United States","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"}]},{"address":"142.250.72.106","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"address":"142.251.40.227","port":443,"protocol":"UDP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"address":"172.67.142.83","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]}],"dns_resolutions":[{"domain":"fonts.googleapis.com","address":"142.251.34.234","ttl":300,"country":"United States","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"domain":"fonts.gstatic.com","address":"142.250.189.131","ttl":36,"country":"United States","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"domain":"waaake.com","address":"172.67.142.83","ttl":300,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]}],"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}],"processes":[{"pid":3448,"ppid":0,"name":"Waaake_Setup.exe","command_line":"","sha256":"fda4866ce7784c356ebacd24873258507e5cace3f2a0e1f1fabcbb97de1995ea","normalized_path":"C:\\Waaake_Setup.exe","uid":"00000000-00003448","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABfklEQVR4Xu2XwUrDQBRF+0FWNxJ1oVglCEXFlYIVpQurCxciaBU/wCAuFNqdIOIPWPop6qb4FVpxGZ3gG6b3zUxeAzGbHJhN8+59ZyAUUqkYxP+EuVODQ3lT6HKi0OVEKVAKjAhUp2aSMxi8mz97aV19JOfl9Q0fidACtJyOBFpOJwtOgTSJo5tPJlCdDHAslcwCuDwRSMnY0ALPvT4TcBW2O0O2/CAaejMurC9hmgAup9tLMyYjArd3XSaAhdHjF1veMm5vy1w/8QzB/gewCMuwCG8vzRBM4Pikzcom/t7u+943K9r/Padnl87MQ9+eIZiAAsvoRlhk3gTnJRmFVWBza5eV1RtdVmSWbTeaLLO602HzIgEFlmEJFmXNOAVqy3VdVFs7Z0W2snBlXWfCjQs2b8s4BRTj3IQYN+MVmA7m47mlPVbkKlMEs4vxQthk866MV0CBJa4iE5z3ZXIROIzkmVQBhaQIkWZEAnlSChT6dVTot6FeboJDeWHu/AE0sOmYLCbloQAAAABJRU5ErkJggg=="},{"pid":9120,"ppid":3448,"name":"cmd.exe","command_line":"/c tasklist /FI \"USERNAME eq %USERNAME%\" /FI \"IMAGENAME eq waaake.exe\" /FO csv | \"%WINDIR%\\system32\\find.exe\" \"waaake.exe\"","sha256":"4c3ea4c44aab74350355c419826b8c9e6172c3bd8f0bb5817ecf7be50b629051","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00000000-00003448","uid":"00000000-00009120"},{"pid":4924,"ppid":9120,"name":"tasklist.exe","command_line":"tasklist /FI \"USERNAME eq %OSUSER%\" /FI \"IMAGENAME eq waaake.exe\" /FO csv","sha256":"cc87ad2c2a96507d33a0a7e09f1e42d19c7e2aa26a4071a4d8e9dd096ebcf33e","normalized_path":"%WINDIR%\\SysWOW64\\tasklist.exe","parent_uid":"00000000-00009120","uid":"00000000-00004924"},{"pid":1868,"ppid":9120,"name":"find.exe","command_line":"\"waaake.exe\"","sha256":"6b78ed0bb79eafbfcac09d9a7bdc61657b1ea0e04d3b7e19411fd21426171b89","normalized_path":"%WINDIR%\\SysWOW64\\find.exe","parent_uid":"00000000-00009120","uid":"00000000-00001868"},{"pid":2420,"ppid":0,"name":"waaake.exe","command_line":"","sha256":"4bfae9dda9f98953f2f2c057f8e7dcc1ecd840134b3e86ff61c036c776c6f564","normalized_path":"%LOCALAPPDATA%\\Programs\\waaake\\waaake.exe","uid":"00000000-00002420","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABfklEQVR4Xu2XwUrDQBRF+0FWNxJ1oVglCEXFlYIVpQurCxciaBU/wCAuFNqdIOIPWPop6qb4FVpxGZ3gG6b3zUxeAzGbHJhN8+59ZyAUUqkYxP+EuVODQ3lT6HKi0OVEKVAKjAhUp2aSMxi8mz97aV19JOfl9Q0fidACtJyOBFpOJwtOgTSJo5tPJlCdDHAslcwCuDwRSMnY0ALPvT4TcBW2O0O2/CAaejMurC9hmgAup9tLMyYjArd3XSaAhdHjF1veMm5vy1w/8QzB/gewCMuwCG8vzRBM4Pikzcom/t7u+943K9r/Padnl87MQ9+eIZiAAsvoRlhk3gTnJRmFVWBza5eV1RtdVmSWbTeaLLO602HzIgEFlmEJFmXNOAVqy3VdVFs7Z0W2snBlXWfCjQs2b8s4BRTj3IQYN+MVmA7m47mlPVbkKlMEs4vxQthk866MV0CBJa4iE5z3ZXIROIzkmVQBhaQIkWZEAnlSChT6dVTot6FeboJDeWHu/AE0sOmYLCbloQAAAABJRU5ErkJggg=="},{"pid":3756,"ppid":2420,"name":"cmd.exe","command_line":"/d /s /c \"chcp\"","sha256":"ec436aeee41857eee5875efdb7166fe043349db5f58f3ee9fc4ff7f50005767f","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00002420","uid":"00000000-00003756"},{"pid":3472,"ppid":3756,"name":"chcp.com","command_line":"","sha256":"c5d29fd4a61366c3f1dcbf5066254de119ca1cf743e1c637310b001ba86b2a45","normalized_path":"%WINDIR%\\system32\\chcp.com","parent_uid":"00000000-00003756","uid":"00000000-00003472"},{"pid":6424,"ppid":2420,"name":"cmd.exe","command_line":"/d /s /c \"%windir%\\System32\\REG.exe QUERY HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Cryptography /v MachineGuid\"","sha256":"ec436aeee41857eee5875efdb7166fe043349db5f58f3ee9fc4ff7f50005767f","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00002420","uid":"00000000-00006424"},{"pid":6228,"ppid":6424,"name":"reg.exe","command_line":"QUERY HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Cryptography /v MachineGuid","sha256":"6b3ef0286b7f12b6dbd3bfe07f2473de16b30f2496a45985901f035cb509435f","normalized_path":"%WINDIR%\\System32\\reg.exe","parent_uid":"00000000-00006424","uid":"00000000-00006228"},{"pid":1532,"ppid":2420,"name":"cmd.exe","command_line":"/d /s /c \"reg query \"HKEY_LOCAL_MACHINE\\HARDWARE\\DESCRIPTION\\System\\CentralProcessor\\0\" /v FeatureSet\"","sha256":"ec436aeee41857eee5875efdb7166fe043349db5f58f3ee9fc4ff7f50005767f","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00002420","uid":"00000000-00001532"},{"pid":9068,"ppid":1532,"name":"reg.exe","command_line":"reg query \"HKEY_LOCAL_MACHINE\\HARDWARE\\DESCRIPTION\\System\\CentralProcessor\\0\" /v FeatureSet","sha256":"6b3ef0286b7f12b6dbd3bfe07f2473de16b30f2496a45985901f035cb509435f","normalized_path":"%WINDIR%\\system32\\reg.exe","parent_uid":"00000000-00001532","uid":"00000000-00009068"},{"pid":8236,"ppid":2420,"name":"waaake.exe","command_line":"\"%APPDATA%\\WAAAKE\" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1672,i,1865523958015848432,11298539846598035016,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mojo-platform-channel-handle=1684 /prefetch:2","sha256":"4bfae9dda9f98953f2f2c057f8e7dcc1ecd840134b3e86ff61c036c776c6f564","normalized_path":"%LOCALAPPDATA%\\Programs\\waaake\\waaake.exe","parent_uid":"00000000-00002420","uid":"00000000-00008236"},{"pid":8508,"ppid":8236,"name":"WerFault.exe","command_line":"-u -p 8236 -s 416","sha256":"0476d175606aac098363c328166a33f85b7efc2d0be82c0d80ba406113affbfe","normalized_path":"%WINDIR%\\system32\\WerFault.exe","parent_uid":"00000000-00008236","uid":"00000000-00008508"},{"pid":5328,"ppid":2420,"name":"powershell.exe","command_line":"-NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -","sha256":"34507738f84b9d4f231dc0c187fee4a03b4ddb84cf63ff56a4a1761a9bd56ea6","normalized_path":"%WINDIR%\\system32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00002420","uid":"00000000-00005328"},{"pid":8580,"ppid":2420,"name":"powershell.exe","command_line":"-NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -","sha256":"34507738f84b9d4f231dc0c187fee4a03b4ddb84cf63ff56a4a1761a9bd56ea6","normalized_path":"%WINDIR%\\system32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00002420","uid":"00000000-00008580"},{"pid":5988,"ppid":2420,"name":"powershell.exe","command_line":"-NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -","sha256":"34507738f84b9d4f231dc0c187fee4a03b4ddb84cf63ff56a4a1761a9bd56ea6","normalized_path":"%WINDIR%\\system32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00002420","uid":"00000000-00005988"},{"pid":9076,"ppid":2420,"name":"waaake.exe","command_line":"\"%APPDATA%\\WAAAKE\" --field-trial-handle=1672,i,1865523958015848432,11298539846598035016,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mojo-platform-channel-handle=1932 /prefetch:3","sha256":"4bfae9dda9f98953f2f2c057f8e7dcc1ecd840134b3e86ff61c036c776c6f564","normalized_path":"%LOCALAPPDATA%\\Programs\\waaake\\waaake.exe","parent_uid":"00000000-00002420","uid":"00000000-00009076"},{"pid":8188,"ppid":2420,"name":"powershell.exe","command_line":"-NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -","sha256":"34507738f84b9d4f231dc0c187fee4a03b4ddb84cf63ff56a4a1761a9bd56ea6","normalized_path":"%WINDIR%\\system32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00002420","uid":"00000000-00008188"},{"pid":6360,"ppid":2420,"name":"waaake.exe","command_line":"\"%APPDATA%\\WAAAKE\" --app-user-model-id=com.waaake.app --app-path=\"%LOCALAPPDATA%\\Programs\\waaake\\resources\\app.asar\" --no-sandbox --no-zygote --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --time-ticks-at-unix-epoch=-1754466429779123 --launch-time-ticks=4574977044 --field-trial-handle=1672,i,1865523958015848432,11298539846598035016,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mojo-platform-channel-handle=3012 /prefetch:1","sha256":"4bfae9dda9f98953f2f2c057f8e7dcc1ecd840134b3e86ff61c036c776c6f564","normalized_path":"%LOCALAPPDATA%\\Programs\\waaake\\waaake.exe","parent_uid":"00000000-00002420","uid":"00000000-00006360"},{"pid":4384,"ppid":2420,"name":"powershell.exe","command_line":"-NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -","sha256":"34507738f84b9d4f231dc0c187fee4a03b4ddb84cf63ff56a4a1761a9bd56ea6","normalized_path":"%WINDIR%\\system32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00002420","uid":"00000000-00004384"},{"pid":7828,"ppid":0,"name":"svchost.exe","command_line":"-k WerSvcGroup","sha256":"b868487f8edbd0571d30d89573f087bfeac3da190652344afd351b1868ea0f8b","normalized_path":"%WINDIR%\\System32\\svchost.exe","uid":"00000000-00007828","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABfklEQVR4Xu2XwUrDQBRF+0FWNxJ1oVglCEXFlYIVpQurCxciaBU/wCAuFNqdIOIPWPop6qb4FVpxGZ3gG6b3zUxeAzGbHJhN8+59ZyAUUqkYxP+EuVODQ3lT6HKi0OVEKVAKjAhUp2aSMxi8mz97aV19JOfl9Q0fidACtJyOBFpOJwtOgTSJo5tPJlCdDHAslcwCuDwRSMnY0ALPvT4TcBW2O0O2/CAaejMurC9hmgAup9tLMyYjArd3XSaAhdHjF1veMm5vy1w/8QzB/gewCMuwCG8vzRBM4Pikzcom/t7u+943K9r/Padnl87MQ9+eIZiAAsvoRlhk3gTnJRmFVWBza5eV1RtdVmSWbTeaLLO602HzIgEFlmEJFmXNOAVqy3VdVFs7Z0W2snBlXWfCjQs2b8s4BRTj3IQYN+MVmA7m47mlPVbkKlMEs4vxQthk866MV0CBJa4iE5z3ZXIROIzkmVQBhaQIkWZEAnlSChT6dVTot6FeboJDeWHu/AE0sOmYLCbloQAAAABJRU5ErkJggg=="},{"pid":5180,"ppid":7828,"name":"WerFault.exe","command_line":"-pss -s 460 -p 8236 -ip 8236","sha256":"0476d175606aac098363c328166a33f85b7efc2d0be82c0d80ba406113affbfe","normalized_path":"%WINDIR%\\system32\\WerFault.exe","parent_uid":"00000000-00007828","uid":"00000000-00005180"}],"all_imported_dlls":["mscoree.dll","userenv.dll","version.dll","nsis7z.dll","atl.dll","StdUtils.dll","shfolder.dll","bcrypt.dll","dbghelp.dll","System.Transactions.dll","SHCore.dll","aepic.dll","devobj.dll","Microsoft.PowerShell.ConsoleHost.ni.dll","dcomp.dll","advapi32.dll","IconCodecService.dll","IPHLPAPI.DLL","combase.dll","VxSSL32.dll","System.Core.ni.dll","System.Management.Automation.ni.dll","wbemcomn.dll","wow64cpu.dll","windows.storage.dll","TextInputFramework.dll","OneCoreCommonProxyStub.dll","OneCoreUAPCommonProxyStub.dll","ulib.dll","ucrtbase_clr0400.dll","System.ni.dll","uxtheme.dll","WinShell.dll","netutils.dll","dxgi.dll","rsaenh.dll","amsi.dll","KBDUS.DLL","nlaapi.dll","cfgmgr32.dll","wintrust.dll","directmanipulation.dll","setupapi.dll","msctf.dll","sxs.dll","System.Data.ni.dll","Microsoft.PowerShell.Security.ni.dll","clbcatq.dll","linkinfo.dll","secur32.dll","Windows.UI.dll","DataExchange.dll","Microsoft.Management.Infrastructure.ni.dll","WindowsCodecs.dll","dwmapi.dll","cldapi.dll","cscapi.dll","powrprof.dll","KernelBase.dll","winsta.dll","MMDevAPI.dll","gpapi.dll","msasn1.dll","Windows.StateRepositoryPS.dll","dnsapi.dll","ole32.dll","riched20.dll","CoreUIComponents.dll","CoreMessaging.dll","dhcpcsvc.dll","winhttp.dll","rpcrt4.dll","mpr.dll","fastprox.dll","ntdll.dll","fltLib.dll","DWrite.dll","d3d11.dll","MsSpellCheckingFacility.dll","rasadhlp.dll","msvcrt.dll","usp10.dll","wbemprox.dll","wbemsvc.dll","dbgcore.dll","MpOAV.dll","GY3205hl.dll","System.Xml.ni.dll","profapi.dll","shell32.dll","user32.dll","gdi32full.dll","msvcp_win.dll","ntshrui.dll","winmmbase.dll","wtsapi32.dll","ntmarta.dll","System.dll","System.Data.dll","WinTypes.dll","nsi.dll","dhcpcsvc6.dll","Windows.Globalization.dll","clr.dll","apphelp.dll","psapi.dll","fsutilext.dll","dpapi.dll","vcruntime140_clr0400.dll","clrjit.dll","imm32.dll","ws2_32.dll","srvcli.dll","mscorlib.ni.dll","ucrtbase.dll","cryptbase.dll","bcryptprimitives.dll","sechost.dll","cryptsp.dll","framedynos.dll","System.DirectoryServices.ni.dll","System.Configuration.ni.dll","gdi32.dll","sspicli.dll","kernel.appcore.dll","oleaut32.dll","SpiderBanner.dll","wow64.dll","propsys.dll","mscms.dll","BCP47Langs.dll","twinapi.dll","crypt32.dll","wow64win.dll","kernel32.dll","win32u.dll","oleacc.dll","atlthunk.dll","System.Management.ni.dll","System.Transactions.ni.dll","shlwapi.dll","comctl32.dll","winmm.dll","mscoreei.dll","msls31.dll","VxSSL64.dll","mswsock.dll","twinapi.appcore.dll","rmclient.dll","weretw.dll","wersvc.dll","kl59VRSK.dll","System.Numerics.ni.dll","nsExec.dll","ffmpeg.dll","usermgrcli.dll","wldp.dll","Faultrep.dll","wer.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"waaake.exe","sha256":"911cf3390830a891bd0da2e0690910af736a448474c8990a5f7564ba87a5162b","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"name":"WinShell.dll","sha256":"9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"name":"nsExec.dll","sha256":"5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"name":"WAAAKE.lnk","sha256":"229ec03859c1ce0b071e93a1fc433afe2674018d9ae874a8a11a5a9769408ab0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"name":"Uninstall waaake.exe","sha256":"b31e52ab03dcec1fee2486cc2744c95487341fea1552f5b700b0526dcf08d9c8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"name":"libEGL.dll","sha256":"5b5c5c8c4f93982453eb4eba9bdc11107ea60a2911ba5f0ab63648195e7c4b62","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"name":"libGLESv2.dll","sha256":"c44cfd2115dcd3e911eb016d5cf5b21cd12888aaa46bfb230d32442f31383a08","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"name":"snapshot_blob.bin","sha256":"69d9b2ecbc649fed6c41ca18e94f3a36b6770ff7038e9a0d07ae1ab824d9f7fb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"}]},{"name":"v8_context_snapshot.bin","sha256":"462919f1b49c9e913042f9e9a738e9510884d5920a426a8a5f1b188e28c4da91","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"}]},{"name":"installer.exe","sha256":"258b78517c3cada10c0062f31a2bc576c46b9a5d57314eeb089515a663227938","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"name":"ffmpeg.dll","sha256":"5c504fb53b5548b5f88e24b098b6412e97b84dd85e7659e7a859c045ee3e5c93","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"name":"elevate.exe","sha256":"9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"name":"vk_swiftshader.dll","sha256":"ffc4d5e0c956a42fb153ac0de436d179bfd21a115e37fcd34de71d778119c8e8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"name":"vulkan-1.dll","sha256":"66cdd5fe1711e98e69042ad07185e24264c4e6daf6a8b8284492037cd79e09a4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"name":"SpiderBanner.dll","sha256":"996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"name":"StdUtils.dll","sha256":"b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"name":"System.dll","sha256":"3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"name":"nsis7z.dll","sha256":"b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"name":"26d3604e-d8c1-4e21-94af-0903e7f9ba69.tmp","sha256":"21160e14f4705e84b5a3d72ecc711f295c990d559f6f163426e1d99c407412d9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"}]},{"name":"54e1c8c6-4a74-4f48-95d1-b9535578e335.tmp","sha256":"be4b8924ab38e8acf350e6e3b9f1f63a1a94952d8002759acd6946c4d5d0b5de","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"}]},{"name":"index","sha256":"fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"}]},{"name":"temp-index","sha256":"82d5d2000213d33f4c3ae509205dde8b084056de645ede5de8169e44c2a4badc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"}]},{"name":"DIPS-journal","sha256":"5e01e568c4bd74822d0daeca309fdcd0947106e0d476c66d7692523831182824","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"}]},{"name":"data_0","sha256":"d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"}]},{"name":"data_1","sha256":"35bb2f189c643dcf52ecf037603d104035ecdc490bf059b7736e58ef7d821a09","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"}]},{"name":"data_2","sha256":"ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"}]},{"name":"data_3","sha256":"e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"}]},{"name":"tailwindcss-oxide.linux-x64-gnu.node","sha256":"5eec39b16921a4e83f94245d193f95c12f34aebfbafed74dfd19f84bd4774f9e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"name":"lightningcss.linux-x64-gnu.node","sha256":"cfd25c2374e6cda3b829bc71e154b4bcc14796e4122856d493aec70337bcee26","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"name":"lightningcss.linux-x64-musl.node","sha256":"16eb62f6df7d2b6394ba547ecf2fc68a039ab9873bc69ce639367db68d5ab2b8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"name":"87d2d4c2-ed18-49fc-a2fc-37804a6a7de0.tmp","sha256":"be4b8924ab38e8acf350e6e3b9f1f63a1a94952d8002759acd6946c4d5d0b5de","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"name":"000001.dbtmp","sha256":"0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"name":"b33349a3-58e9-405d-b5e3-e6c942b4f9b1.tmp","sha256":"226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"name":"c94fed91-59a8-4b4b-9d12-661bdaf0e150.tmp","sha256":"c26679fb1fddd5e8da36215a296a8e9817ace25fedcda8474a21abd81ed5287f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"name":"package.json","sha256":"6352543d65ba6f900c2b21d42323dbd4b166aef7952a18d5568178212a4b0a4c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"name":"LICENSE","sha256":"60e0b68c0f35c078eef3a5d29419d0b03ff84ec1df9c3f9d6e39a519a5ae7985","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"name":"LICENSE.electron.txt","sha256":"5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"name":"LICENSES.chromium.html","sha256":"a3b5b3ebe34dd8ef4331f846ef1c0163885cd9240cbe945d84dac219b0de97f7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]}],"files_written":[{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"path":"%LOCALAPPDATA%\\Temp","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"path":"%TEMP%\\nsaD58E.tmp","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"}]},{"path":"%TEMP%\\nsbD764.tmp","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"}]},{"path":"C:\\Users","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"path":"%USERPROFILE%\\AppData","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"path":"%TEMP%\\nsbD764.tmp\\System.dll","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"}]},{"path":"%LOCALAPPDATA%\\Programs","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"path":"%TEMP%\\nsbD764.tmp\\StdUtils.dll","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"}]},{"path":"%TEMP%\\nsbD764.tmp\\SpiderBanner.dll","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"}]},{"path":"%TEMP%\\nsbD764.tmp\\nsExec.dll","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"}]},{"path":"%TEMP%\\nsbD764.tmp\\app-64.7z","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"}]},{"path":"%TEMP%\\nsbD764.tmp\\7z-out","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"}]},{"path":"%TEMP%\\nsbD764.tmp\\nsis7z.dll","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"}]},{"path":"%TEMP%\\nsbD764.tmp\\7z-out\\resources","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"}]},{"path":"%TEMP%\\nsbD764.tmp\\7z-out\\resources\\app.asar.unpacked","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"}]},{"path":"%TEMP%\\nsbD764.tmp\\7z-out\\resources\\app.asar.unpacked\\node_modules","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"}]},{"path":"%TEMP%\\nsbD764.tmp\\7z-out\\resources\\app.asar.unpacked\\node_modules\\@tailwindcss","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"}]},{"path":"%TEMP%\\nsbD764.tmp\\7z-out\\resources\\app.asar.unpacked\\node_modules\\@tailwindcss\\oxide","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"}]},{"path":"%TEMP%\\nsbD764.tmp\\7z-out\\resources\\app.asar.unpacked\\node_modules\\@tailwindcss\\oxide\\node_modules","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"}]},{"path":"%TEMP%\\nsbD764.tmp\\7z-out\\resources\\app.asar.unpacked\\node_modules\\@tailwindcss\\oxide\\node_modules\\@tailwindcss","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"}]},{"path":"%TEMP%\\nsbD764.tmp\\7z-out\\resources\\app.asar.unpacked\\node_modules\\lightningcss","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"}]},{"path":"%TEMP%\\nsbD764.tmp\\7z-out\\resources\\app.asar.unpacked\\node_modules\\lightningcss\\node_modules","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"}]},{"path":"%TEMP%\\nsbD764.tmp\\7z-out\\LICENSE.electron.txt","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"}]},{"path":"%TEMP%\\nsbD764.tmp\\7z-out\\LICENSES.chromium.html","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"}]},{"path":"%TEMP%\\nsbD764.tmp\\7z-out\\chrome_100_percent.pak","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"}]},{"path":"%TEMP%\\nsbD764.tmp\\7z-out\\chrome_200_percent.pak","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"}]},{"path":"%TEMP%\\nsbD764.tmp\\7z-out\\icudtl.dat","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"}]},{"path":"%TEMP%\\nsbD764.tmp\\7z-out\\locales","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"}]},{"path":"%TEMP%\\nsbD764.tmp\\7z-out\\locales\\af.pak","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"}]},{"path":"pipe\\uv\\18446744073709551615-6656","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"}]},{"path":"pipe\\uv\\0-6656","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"}]},{"path":"pipe\\uv\\1-6656","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{D03DB0C1-2729-4674-A875-8625DD784300}","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{D27478B9-2058-11E8-B41F-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{3FC98E00-C370-43D9-A2DC-B067CC06FAD9}","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"path":"pipe\\mojo.6656.6684.3494298515299519822","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"}]},{"path":"pipe\\mojo.6656.6684.9891112449285977307","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"}]},{"path":"%TEMP%\\sslkey.txt","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"path":"%APPDATA%\\WAAAKE\\Local Storage\\leveldb\\LOG","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"path":"%APPDATA%\\WAAAKE\\Network\\NetworkDataMigrated","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"path":"%APPDATA%\\WAAAKE\\Local Storage\\leveldb\\LOCK","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"path":"%APPDATA%\\WAAAKE\\Local Storage\\leveldb\\MANIFEST-000001","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"path":"%APPDATA%\\WAAAKE\\Code Cache\\js\\index","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"path":"%APPDATA%\\WAAAKE\\Code Cache\\wasm\\index","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"path":"%APPDATA%\\WAAAKE\\Code Cache\\wasm\\index-dir\\temp-index","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"path":"%APPDATA%\\WAAAKE\\Code Cache\\js\\index-dir\\temp-index","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"path":"%APPDATA%\\WAAAKE\\Local Storage\\leveldb\\000001.dbtmp","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"path":"%APPDATA%\\WAAAKE\\GPUCache\\index","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"path":"%APPDATA%\\WAAAKE\\GPUCache\\data_0","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"path":"%APPDATA%\\WAAAKE\\GPUCache\\data_1","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"path":"%APPDATA%\\WAAAKE\\GPUCache\\data_2","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"path":"%APPDATA%\\WAAAKE\\GPUCache\\data_3","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"path":"%APPDATA%\\WAAAKE\\DawnWebGPUCache\\index","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"path":"%APPDATA%\\WAAAKE\\DawnWebGPUCache\\data_0","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"path":"%APPDATA%\\WAAAKE\\DawnWebGPUCache\\data_1","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"path":"%APPDATA%\\WAAAKE\\DawnWebGPUCache\\data_2","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"path":"%APPDATA%\\WAAAKE\\DawnWebGPUCache\\data_3","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"path":"%APPDATA%\\WAAAKE\\DawnGraphiteCache\\index","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"path":"%APPDATA%\\WAAAKE\\DawnGraphiteCache\\data_0","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"path":"%APPDATA%\\WAAAKE\\DawnGraphiteCache\\data_1","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"path":"%APPDATA%\\WAAAKE\\DawnGraphiteCache\\data_2","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"path":"%APPDATA%\\WAAAKE\\DawnGraphiteCache\\data_3","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"path":"%APPDATA%\\WAAAKE\\Local Storage\\leveldb\\000003.log","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"path":"%APPDATA%\\WAAAKE\\54e1c8c6-4a74-4f48-95d1-b9535578e335.tmp","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"}]},{"path":"%APPDATA%\\WAAAKE\\26d3604e-d8c1-4e21-94af-0903e7f9ba69.tmp","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"}]},{"path":"%APPDATA%\\WAAAKE\\DIPS","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"path":"%APPDATA%\\WAAAKE\\DIPS-journal","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"path":"%APPDATA%\\WAAAKE\\DIPS-wal","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"path":"%APPDATA%\\WAAAKE\\DIPS-shm","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"path":"pipe\\mojo.6656.6684.6656898436499592066","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"}]},{"path":"pipe\\uv\\2-6656","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"}]},{"path":"pipe\\uv\\3-6656","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"}]},{"path":"pipe\\uv\\4-6656","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"}]},{"path":"pipe\\uv\\5-6656","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"}]},{"path":"pipe\\uv\\6-6656","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"}]},{"path":"pipe\\uv\\7-6656","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"}]},{"path":"%APPDATA%\\WAAAKE\\Shared Dictionary\\cache\\index","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"path":"%APPDATA%\\WAAAKE\\Shared Dictionary\\db","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"path":"%APPDATA%\\WAAAKE\\Network\\Trust Tokens","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"path":"%APPDATA%\\WAAAKE\\Network\\Trust Tokens-journal","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"path":"%APPDATA%\\WAAAKE\\Shared Dictionary\\db-journal","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"path":"%APPDATA%\\WAAAKE\\Shared Dictionary\\cache\\index-dir\\temp-index","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"path":"%WINDIR%\\System32\\CatRoot","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"path":"%WINDIR%\\System32\\catroot2","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"path":"%TEMP%\\nsyEA36.tmp","sources":[{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"path":"%TEMP%\\nsjEBFC.tmp","sources":[{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"path":"%TEMP%\\nsjEBFC.tmp\\System.dll","sources":[{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"path":"%TEMP%\\nsjEBFC.tmp\\StdUtils.dll","sources":[{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"path":"%TEMP%\\nsjEBFC.tmp\\SpiderBanner.dll","sources":[{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"path":"%TEMP%\\nsjEBFC.tmp\\nsExec.dll","sources":[{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"path":"%TEMP%\\nsjEBFC.tmp\\app-64.7z","sources":[{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"path":"%TEMP%\\nsjEBFC.tmp\\7z-out","sources":[{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"path":"%TEMP%\\nsjEBFC.tmp\\nsis7z.dll","sources":[{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"path":"%TEMP%\\nsjEBFC.tmp\\7z-out\\resources","sources":[{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"path":"%TEMP%\\nsjEBFC.tmp\\7z-out\\resources\\app.asar.unpacked","sources":[{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"path":"%TEMP%\\nsjEBFC.tmp\\7z-out\\resources\\app.asar.unpacked\\node_modules","sources":[{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"path":"%TEMP%\\nsjEBFC.tmp\\7z-out\\resources\\app.asar.unpacked\\node_modules\\@tailwindcss","sources":[{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"path":"%TEMP%\\nsjEBFC.tmp\\7z-out\\resources\\app.asar.unpacked\\node_modules\\@tailwindcss\\oxide","sources":[{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"path":"%TEMP%\\nsjEBFC.tmp\\7z-out\\resources\\app.asar.unpacked\\node_modules\\@tailwindcss\\oxide\\node_modules","sources":[{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"path":"%TEMP%\\nsjEBFC.tmp\\7z-out\\resources\\app.asar.unpacked\\node_modules\\@tailwindcss\\oxide\\node_modules\\@tailwindcss","sources":[{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"path":"%TEMP%\\nsjEBFC.tmp\\7z-out\\resources\\app.asar.unpacked\\node_modules\\lightningcss","sources":[{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"path":"%TEMP%\\nsjEBFC.tmp\\7z-out\\resources\\app.asar.unpacked\\node_modules\\lightningcss\\node_modules","sources":[{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"path":"%TEMP%\\nsjEBFC.tmp\\7z-out\\LICENSE.electron.txt","sources":[{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"path":"%TEMP%\\nsjEBFC.tmp\\7z-out\\LICENSES.chromium.html","sources":[{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"path":"%TEMP%\\nsjEBFC.tmp\\7z-out\\chrome_100_percent.pak","sources":[{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"path":"%TEMP%\\nsjEBFC.tmp\\7z-out\\chrome_200_percent.pak","sources":[{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"path":"pipe\\uv\\18446744073709551615-2420","sources":[{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"path":"pipe\\uv\\0-2420","sources":[{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"path":"pipe\\uv\\1-2420","sources":[{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"path":"pipe\\mojo.2420.7840.3858394551723903062","sources":[{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"path":"pipe\\mojo.2420.7840.11344399748894177711","sources":[{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"path":"%APPDATA%\\WAAAKE\\c94fed91-59a8-4b4b-9d12-661bdaf0e150.tmp","sources":[{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"path":"%APPDATA%\\WAAAKE\\87d2d4c2-ed18-49fc-a2fc-37804a6a7de0.tmp","sources":[{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"path":"pipe\\uv\\2-2420","sources":[{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"path":"pipe\\uv\\3-2420","sources":[{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"path":"pipe\\uv\\4-2420","sources":[{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"path":"pipe\\uv\\5-2420","sources":[{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"path":"pipe\\uv\\6-2420","sources":[{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"path":"pipe\\uv\\7-2420","sources":[{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"path":"pipe\\mojo.2420.7840.13693850443555054841","sources":[{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"path":"pipe\\mojo.2420.7840.667398157542796421","sources":[{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"path":"%TEMP%\\b735df55-7826-4916-a86c-e17ffd9e45c7.tmp","sources":[{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"path":"pipe\\mojo.2420.5664.7483677740148908304","sources":[{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"path":"%APPDATA%\\WAAAKE\\Network\\b33349a3-58e9-405d-b5e3-e6c942b4f9b1.tmp","sources":[{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"path":"%APPDATA%\\WAAAKE\\Network\\Cookies","sources":[{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"path":"%APPDATA%\\WAAAKE\\Network\\Cookies-journal","sources":[{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"path":"%APPDATA%\\WAAAKE\\Cache\\Cache_Data\\index","sources":[{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"path":"%APPDATA%\\WAAAKE\\Cache\\Cache_Data\\data_0","sources":[{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"path":"%APPDATA%\\WAAAKE\\Cache\\Cache_Data\\data_1","sources":[{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"path":"%APPDATA%\\WAAAKE\\Cache\\Cache_Data\\data_2","sources":[{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"path":"%APPDATA%\\WAAAKE\\Cache\\Cache_Data\\data_3","sources":[{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WBEM\\CIMOM\\","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\CONNECTIONS\\","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\NETWORK\\LOCATION AWARENESS\\","sources":[{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\ROOT\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\ROOT\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\ROOT\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\SMARTCARDROOT\\","sources":[{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\SMARTCARDROOT\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\SMARTCARDROOT\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\SMARTCARDROOT\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\FLIGHTROOT\\","sources":[{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\FLIGHTROOT\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\FLIGHTROOT\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5000:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5000:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"}]},{"name":"\\BaseNamedObjects\\SyncRootManager","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"name":"Local\\SM0:5000:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"}]},{"name":"Local\\SM0:5000:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"}]},{"name":"SM0:5000:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"}]},{"name":"1aa323d8-1af7-575c-aa21-ff3f6189d55f","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5000:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\1aa323d8-1af7-575c-aa21-ff3f6189d55f","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7452:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"}]},{"name":"SM0:7452:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6656:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6656:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"}]},{"name":"Local\\SM0:6656:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"}]},{"name":"SM0:6656:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7804:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7804:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"}]},{"name":"Local\\SM0:7804:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"}]},{"name":"SM0:7804:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4796:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"}]},{"name":"SM0:4796:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"}]},{"name":"Local\\SM0:4796:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:4796:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:8116:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"}]},{"name":"SM0:8116:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"}]},{"name":"Local\\SM0:8116:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:8116:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5988:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"name":"Local\\SM0:5988:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"name":"SM0:5988:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5988:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"699de503daaa9a9dfa040671"},{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:3448:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:3448:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"name":"Local\\SM0:3448:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"name":"SM0:3448:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"name":"Local\\SM0:3448:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:3448:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:4924:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"name":"SM0:4924:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:2420:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2420:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"name":"Local\\SM0:2420:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"name":"SM0:2420:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"name":"Local\\SM0:5328:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"name":"SM0:5328:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"name":"Local\\SM0:8580:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"name":"SM0:8580:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"name":"SM0:9076:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"name":"Local\\SM0:9076:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"name":"SM0:8188:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"name":"Local\\SM0:8188:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"name":"SM0:6360:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"name":"Local\\SM0:6360:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5328:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5328:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:8580:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:8580:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:9076:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:9076:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:8188:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:8188:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6360:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6360:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6892b78940ad7bbf2b02839c"}]}]}},"report_ids":{"sandbox_job_ids":["699de503daaa9a9dfa040671","6892b78940ad7bbf2b02839c"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Sample fda4866ce778… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample fda4866ce778…. Threat score 100/100. 0/26 AV engines flagged this file. 4 malicious and 23 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/fda4866ce7784c356ebacd24873258507e5cace3f2a0e1f1fabcbb97de1995ea"}],["$","meta","4",{"property":"og:title","content":"Malicious Sample fda4866ce778… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample fda4866ce778…. Threat score 100/100. 0/26 AV engines flagged this file. 4 malicious and 23 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/fda4866ce7784c356ebacd24873258507e5cace3f2a0e1f1fabcbb97de1995ea"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Sample fda4866ce778… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample fda4866ce778…. Threat score 100/100. 0/26 AV engines flagged this file. 4 malicious and 23 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L7b","11",{}]]