24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 32:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4b9,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Dropper.Trojan.Generic Sample ccd4e6d67224… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample ccd4e6d67224…. Malware family: Dropper.Trojan.Generic. Threat score 100/100. 17/23 AV engines flagged this file. 5 malicious and 8 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/ccd4e6d67224c9ed683a8fab1f23580923aada973369d97eb8fc2555afd2d9ea","keywords":["Malicious","Dropper.Trojan.Generic","malware analysis","sandbox report","threat intelligence","ccd4e6d67224c9ed683a8fab1f23580923aada973369d97eb8fc2555afd2d9ea"],"about":{"@type":"SoftwareApplication","name":"78d9ac9954516ac096992cf654caa1fc","applicationCategory":["peexe","executable"],"identifier":"ccd4e6d67224c9ed683a8fab1f23580923aada973369d97eb8fc2555afd2d9ea","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Dropper.Trojan.Generic","antivirusDetections":{"malicious":17,"total":23},"behavioralIndicators":{"malicious":5,"suspicious":8},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T1ebe,"78d9ac9954516ac096992cf654caa1fc.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004688) "78d9ac9954516ac096992cf654caa1fc.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004688) "78d9ac9954516ac096992cf654caa1fc.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000ffff0000000048d3f10438cf1c77b424d402b4d3f104010000006824d402b424d4026824d402040000000400000000e05b7600100000b4d3f104010000006824d402cd971c779c971c7788ede072b50f52766824d40200001c7700000000440f6a710000000080ee58760100000000000000f8e25b76000000000400000080a9b17348405a76f8e25b76b8d3f10480e8d9730805d50280e8d973b4d3f1040000000080e8d97300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000d6bdd702ecbdd702 (UID: 00000000-00004688) "78d9ac9954516ac096992cf654caa1fc.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff00000000000000000000000076d6d7028ed6d702 (UID: 00000000-00004688) "78d9ac9954516ac096992cf654caa1fc.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000003edbd70252dbd702 (UID: 00000000-00004688) "78d9ac9954516ac096992cf654caa1fc.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000005ee0d70276e0d702 (UID: 00000000-00004688) "78d9ac9954516ac096992cf654caa1fc.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000007edfd70294dfd702 (UID: 00000000-00004688) "78d9ac9954516ac096992cf654caa1fc.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff00000000000000000000000056e4d7026ee4d702 (UID: 00000000-00004688) "78d9ac9954516ac096992cf654caa1fc.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000fe04d8021605d802 (UID: 00000000-00004688) "78d9ac9954516ac096992cf654caa1fc.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004688) "78d9ac9954516ac096992cf654caa1fc.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007880) "78d9ac9954516ac096992cf654caa1fc.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007880)26:T4ae,"78d9ac9954516ac096992cf654caa1fc.exe" called "GetVersionExA" with parameter 940000000600000002000000f0230000020000000011d5026824d4026811d5026824d4026824d4026824d4026824d4023021d4026824d4026824d4026824d4026811d5026824d4026824d4026824d4026824d4026824d4026824d4021800d5026824d4026824d4026824d4026824d4023021d4026824d4026824d4023021d4026824d4026824d4026824d4026824d4026824d402 (UID: 00000000-00004688) "78d9ac9954516ac096992cf654caa1fc.exe" called "GetVersionExA" with parameter 9c0000000600000002000000f0230000020000000000000000000000ffffffffffffffff240000000000000068fbb8000000000004000000000000000000000000000000000000000000000000000000a1d08be1a1aa86956cfbb800270e1e77ffffffff2400000068fbb800040000000000000008609d3604000000f83d4000f023000002000000f050b2748cfbb8003e464000 (UID: 00000000-00004688) "78d9ac9954516ac096992cf654caa1fc.exe" called "GetVersionExA" with parameter 940000000600000002000000f0230000020000000092260370332603b89226037033260370332603703326037033260320302603703326037033260370332603b8922603703326037033260370332603703326037033260370332603f089260370332603703326037033260370332603203026037033260370332603203026037033260370332603703326037033260370332603 (UID: 00000000-00007880)27:T406,"78d9ac9954516ac096992cf654caa1fc.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004688) "78d9ac9954516ac096992cf654caa1fc.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004688) "78d9ac9954516ac096992cf654caa1fc.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004688) "78d9ac9954516ac096992cf654caa1fc.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004688) "78d9ac9954516ac096992cf654caa1fc.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007880) "78d9ac9954516ac096992cf654caa1fc.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007880) "78d9ac9954516ac096992cf654caa1fc.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007880) "78d9ac9954516ac096992cf654caa1fc.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007880)28:T2f80,"78d9ac9954516ac096992cf654caa1fc.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00004688) "78d9ac9954516ac096992cf654caa1fc.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00004688) "78d9ac9954516ac096992cf654caa1fc.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00004688) "78d9ac9954516ac096992cf654caa1fc.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004688) "78d9ac9954516ac096992cf654caa1fc.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00004688) "78d9ac9954516ac096992cf654caa1fc.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00004688) "78d9ac9954516ac096992cf654caa1fc.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00004688) "78d9ac9954516ac096992cf654caa1fc.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00004688) "78d9ac9954516ac096992cf654caa1fc.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00004688) "78d9ac9954516ac096992cf654caa1fc.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00004688) "78d9ac9954516ac096992cf654caa1fc.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00004688) "78d9ac9954516ac096992cf654caa1fc.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00004688) "78d9ac9954516ac096992cf654caa1fc.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00004688) "78d9ac9954516ac096992cf654caa1fc.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00004688) "78d9ac9954516ac096992cf654caa1fc.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00004688) "78d9ac9954516ac096992cf654caa1fc.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00004688) "78d9ac9954516ac096992cf654caa1fc.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00004688) "78d9ac9954516ac096992cf654caa1fc.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00004688) "78d9ac9954516ac096992cf654caa1fc.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00004688) "78d9ac9954516ac096992cf654caa1fc.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00004688) "78d9ac9954516ac096992cf654caa1fc.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00004688) "78d9ac9954516ac096992cf654caa1fc.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00004688) "78d9ac9954516ac096992cf654caa1fc.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00004688) "78d9ac9954516ac096992cf654caa1fc.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00004688) "78d9ac9954516ac096992cf654caa1fc.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00004688) "78d9ac9954516ac096992cf654caa1fc.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00004688) "78d9ac9954516ac096992cf654caa1fc.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00004688) "78d9ac9954516ac096992cf654caa1fc.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00004688) "78d9ac9954516ac096992cf654caa1fc.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00004688) "78d9ac9954516ac096992cf654caa1fc.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00004688) "78d9ac9954516ac096992cf654caa1fc.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00004688) "78d9ac9954516ac096992cf654caa1fc.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00004688) "78d9ac9954516ac096992cf654caa1fc.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00004688) "78d9ac9954516ac096992cf654caa1fc.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00004688) "78d9ac9954516ac096992cf654caa1fc.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00004688) "78d9ac9954516ac096992cf654caa1fc.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00004688) "78d9ac9954516ac096992cf654caa1fc.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00004688) "78d9ac9954516ac096992cf654caa1fc.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00004688) "78d9ac9954516ac096992cf654caa1fc.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00004688) "78d9ac9954516ac096992cf654caa1fc.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00004688) "78d9ac9954516ac096992cf654caa1fc.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00004688) "78d9ac9954516ac096992cf654caa1fc.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00004688) "78d9ac9954516ac096992cf654caa1fc.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00004688) "78d9ac9954516ac096992cf654caa1fc.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00004688) "78d9ac9954516ac096992cf654caa1fc.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00004688) "78d9ac9954516ac096992cf654caa1fc.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00004688) "78d9ac9954516ac096992cf654caa1fc.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00004688) "78d9ac9954516ac096992cf654caa1fc.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionAndSpinCount (UID: 00000000-00004688) "78d9ac9954516ac096992cf654caa1fc.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00007880) "78d9ac9954516ac096992cf654caa1fc.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00007880) "78d9ac9954516ac096992cf654caa1fc.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00007880) "78d9ac9954516ac096992cf654caa1fc.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00007880) "78d9ac9954516ac096992cf654caa1fc.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00007880) "78d9ac9954516ac096992cf654caa1fc.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00007880) "78d9ac9954516ac096992cf654caa1fc.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00007880) "78d9ac9954516ac096992cf654caa1fc.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00007880) "78d9ac9954516ac096992cf654caa1fc.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00007880) "78d9ac9954516ac096992cf654caa1fc.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00007880) "78d9ac9954516ac096992cf654caa1fc.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00007880) "78d9ac9954516ac096992cf654caa1fc.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00007880) "78d9ac9954516ac096992cf654caa1fc.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00007880) "78d9ac9954516ac096992cf654caa1fc.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00007880) "78d9ac9954516ac096992cf654caa1fc.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00007880) "78d9ac9954516ac096992cf654caa1fc.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00007880) "78d9ac9954516ac096992cf654caa1fc.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00007880) "78d9ac9954516ac096992cf654caa1fc.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00007880) "78d9ac9954516ac096992cf654caa1fc.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00007880) "78d9ac9954516ac096992cf654caa1fc.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00007880) "78d9ac9954516ac096992cf654caa1fc.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00007880) "78d9ac9954516ac096992cf654caa1fc.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00007880) "78d9ac9954516ac096992cf654caa1fc.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00007880) "78d9ac9954516ac096992cf654caa1fc.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00007880) "78d9ac9954516ac096992cf654caa1fc.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00007880) "78d9ac9954516ac096992cf654caa1fc.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00007880) "78d9ac9954516ac096992cf654caa1fc.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00007880) "78d9ac9954516ac096992cf654caa1fc.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00007880) "78d9ac9954516ac096992cf654caa1fc.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00007880) "78d9ac9954516ac096992cf654caa1fc.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00007880) "78d9ac9954516ac096992cf654caa1fc.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00007880) "78d9ac9954516ac096992cf654caa1fc.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00007880) "78d9ac9954516ac096992cf654caa1fc.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00007880) "78d9ac9954516ac096992cf654caa1fc.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00007880) "78d9ac9954516ac096992cf654caa1fc.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00007880) "78d9ac9954516ac096992cf654caa1fc.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00007880) "78d9ac9954516ac096992cf654caa1fc.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00007880) "78d9ac9954516ac096992cf654caa1fc.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00007880) "78d9ac9954516ac096992cf654caa1fc.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00007880) "78d9ac9954516ac096992cf654caa1fc.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00007880) "78d9ac9954516ac096992cf654caa1fc.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00007880) "78d9ac9954516ac096992cf654caa1fc.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00007880) "78d9ac9954516ac096992cf654caa1fc.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00007880) "78d9ac9954516ac096992cf654caa1fc.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00007880) "78d9ac9954516ac096992cf654caa1fc.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00007880) "78d9ac9954516ac096992cf654caa1fc.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00007880) "78d9ac9954516ac096992cf654caa1fc.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00007880) "78d9ac9954516ac096992cf654caa1fc.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionAndSpinCount (UID: 00000000-00007880)29:T2e5b,Found reference to API (Indicator: "GetLastError"; File: "78d9ac9954516ac096992cf654caa1fc") Found reference to API (Indicator: "HeapFree"; File: "78d9ac9954516ac096992cf654caa1fc") Found reference to API (Indicator: "GetStdHandle"; File: "78d9ac9954516ac096992cf654caa1fc") Found reference to API (Indicator: "EnterCriticalSection"; File: "78d9ac9954516ac096992cf654caa1fc") Found reference to API (Indicator: "GetConsoleOutputCP"; File: "78d9ac9954516ac096992cf654caa1fc") Found reference to API (Indicator: "LoadResource"; File: "78d9ac9954516ac096992cf654caa1fc") Found reference to API (Indicator: "WriteConsoleW"; File: "78d9ac9954516ac096992cf654caa1fc") Found reference to API (Indicator: "GetConsoleCP"; File: "78d9ac9954516ac096992cf654caa1fc") Found reference to API (Indicator: "GetOEMCP"; File: "78d9ac9954516ac096992cf654caa1fc") Found reference to API (Indicator: "LCMapStringA"; File: "78d9ac9954516ac096992cf654caa1fc") Found reference to API (Indicator: "HeapDestroy"; File: "78d9ac9954516ac096992cf654caa1fc") Found reference to API (Indicator: "ExitProcess"; File: "78d9ac9954516ac096992cf654caa1fc") Found reference to API (Indicator: "TlsAlloc"; File: "78d9ac9954516ac096992cf654caa1fc") Found reference to API (Indicator: "GetVersionExA"; File: "78d9ac9954516ac096992cf654caa1fc") Found reference to API (Indicator: "GetEnvironmentStringsW"; File: "78d9ac9954516ac096992cf654caa1fc") Found reference to API (Indicator: "FlushFileBuffers"; File: "78d9ac9954516ac096992cf654caa1fc") Found reference to API (Indicator: "GetModuleFileNameA"; File: "78d9ac9954516ac096992cf654caa1fc") Found reference to API (Indicator: "RtlUnwind"; File: "78d9ac9954516ac096992cf654caa1fc") Found reference to API (Indicator: "LoadLibraryA"; File: "78d9ac9954516ac096992cf654caa1fc") Found reference to API (Indicator: "FreeEnvironmentStringsA"; File: "78d9ac9954516ac096992cf654caa1fc") Found reference to API (Indicator: "DeleteCriticalSection"; File: "78d9ac9954516ac096992cf654caa1fc") Found reference to API (Indicator: "GetCurrentProcess"; File: "78d9ac9954516ac096992cf654caa1fc") Found reference to API (Indicator: "GetEnvironmentStrings"; File: "78d9ac9954516ac096992cf654caa1fc") Found reference to API (Indicator: "GetConsoleMode"; File: "78d9ac9954516ac096992cf654caa1fc") Found reference to API (Indicator: "GetLocaleInfoA"; File: "78d9ac9954516ac096992cf654caa1fc") Found reference to API (Indicator: "GetCurrentProcessId"; File: "78d9ac9954516ac096992cf654caa1fc") Found reference to API (Indicator: "LCMapStringW"; File: "78d9ac9954516ac096992cf654caa1fc") Found reference to API (Indicator: "SetHandleCount"; File: "78d9ac9954516ac096992cf654caa1fc") Found reference to API (Indicator: "LockResource"; File: "78d9ac9954516ac096992cf654caa1fc") Found reference to API (Indicator: "WideCharToMultiByte"; File: "78d9ac9954516ac096992cf654caa1fc") Found reference to API (Indicator: "UnhandledExceptionFilter"; File: "78d9ac9954516ac096992cf654caa1fc") Found reference to API (Indicator: "TlsGetValue"; File: "78d9ac9954516ac096992cf654caa1fc") Found reference to API (Indicator: "MultiByteToWideChar"; File: "78d9ac9954516ac096992cf654caa1fc") Found reference to API (Indicator: "HeapSize"; File: "78d9ac9954516ac096992cf654caa1fc") Found reference to API (Indicator: "FreeEnvironmentStringsW"; File: "78d9ac9954516ac096992cf654caa1fc") Found reference to API (Indicator: "GetCommandLineA"; File: "78d9ac9954516ac096992cf654caa1fc") Found reference to API (Indicator: "GetProcAddress"; File: "78d9ac9954516ac096992cf654caa1fc") Found reference to API (Indicator: "TlsFree"; File: "78d9ac9954516ac096992cf654caa1fc") Found reference to API (Indicator: "GetProcessHeap"; File: "78d9ac9954516ac096992cf654caa1fc") Found reference to API (Indicator: "LeaveCriticalSection"; File: "78d9ac9954516ac096992cf654caa1fc") Found reference to API (Indicator: "SetFilePointer"; File: "78d9ac9954516ac096992cf654caa1fc") Found reference to API (Indicator: "GetCPInfo"; File: "78d9ac9954516ac096992cf654caa1fc") Found reference to API (Indicator: "GetStringTypeA"; File: "78d9ac9954516ac096992cf654caa1fc") Found reference to API (Indicator: "GetModuleHandleA"; File: "78d9ac9954516ac096992cf654caa1fc") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; File: "78d9ac9954516ac096992cf654caa1fc") Found reference to API (Indicator: "WriteFile"; File: "78d9ac9954516ac096992cf654caa1fc") Found reference to API (Indicator: "GetStartupInfoA"; File: "78d9ac9954516ac096992cf654caa1fc") Found reference to API (Indicator: "CloseHandle"; File: "78d9ac9954516ac096992cf654caa1fc") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; File: "78d9ac9954516ac096992cf654caa1fc") Found reference to API (Indicator: "TerminateProcess"; File: "78d9ac9954516ac096992cf654caa1fc") Found reference to API (Indicator: "GetACP"; File: "78d9ac9954516ac096992cf654caa1fc") Found reference to API (Indicator: "HeapReAlloc"; File: "78d9ac9954516ac096992cf654caa1fc") Found reference to API (Indicator: "GetStringTypeW"; File: "78d9ac9954516ac096992cf654caa1fc") Found reference to API (Indicator: "HeapAlloc"; File: "78d9ac9954516ac096992cf654caa1fc") Found reference to API (Indicator: "IsDebuggerPresent"; File: "78d9ac9954516ac096992cf654caa1fc") Found reference to API (Indicator: "SetStdHandle"; File: "78d9ac9954516ac096992cf654caa1fc") Found reference to API (Indicator: "SizeofResource"; File: "78d9ac9954516ac096992cf654caa1fc") Found reference to API (Indicator: "QueryPerformanceCounter"; File: "78d9ac9954516ac096992cf654caa1fc") Found reference to API (Indicator: "WriteConsoleA"; File: "78d9ac9954516ac096992cf654caa1fc") Found reference to API (Indicator: "InitializeCriticalSection"; File: "78d9ac9954516ac096992cf654caa1fc") Found reference to API (Indicator: "HeapCreate"; File: "78d9ac9954516ac096992cf654caa1fc") Found reference to API (Indicator: "VirtualFree"; File: "78d9ac9954516ac096992cf654caa1fc") Found reference to API (Indicator: "InterlockedDecrement"; File: "78d9ac9954516ac096992cf654caa1fc") Found reference to API (Indicator: "Sleep"; File: "78d9ac9954516ac096992cf654caa1fc") Found reference to API (Indicator: "GetFileType"; File: "78d9ac9954516ac096992cf654caa1fc") Found reference to API (Indicator: "TlsSetValue"; File: "78d9ac9954516ac096992cf654caa1fc") Found reference to API (Indicator: "CreateFileA"; File: "78d9ac9954516ac096992cf654caa1fc") Found reference to API (Indicator: "GetTickCount"; File: "78d9ac9954516ac096992cf654caa1fc") Found reference to API (Indicator: "GetCurrentThreadId"; File: "78d9ac9954516ac096992cf654caa1fc") Found reference to API (Indicator: "FindResourceA"; File: "78d9ac9954516ac096992cf654caa1fc") Found reference to API (Indicator: "VirtualAlloc"; File: "78d9ac9954516ac096992cf654caa1fc") Found reference to API (Indicator: "SetLastError"; File: "78d9ac9954516ac096992cf654caa1fc") Found reference to API (Indicator: "InterlockedIncrement"; File: "78d9ac9954516ac096992cf654caa1fc") Found reference to API (Indicator: "ShellExecuteExA"; File: "78d9ac9954516ac096992cf654caa1fc") Found reference to API (Indicator: "SHGetSpecialFolderPathA"; File: "78d9ac9954516ac096992cf654caa1fc") Found reference to API (Indicator: "EnumWindows"; File: "78d9ac9954516ac096992cf654caa1fc") Found reference to API (Indicator: "EncodePointer"; File: "78d9ac9954516ac096992cf654caa1fc") Found reference to API (Indicator: "DecodePointer"; File: "78d9ac9954516ac096992cf654caa1fc") Found reference to API (Indicator: "FlsFree"; File: "78d9ac9954516ac096992cf654caa1fc") Found reference to API (Indicator: "FlsSetValue"; File: "78d9ac9954516ac096992cf654caa1fc") Found reference to API (Indicator: "FlsGetValue"; File: "78d9ac9954516ac096992cf654caa1fc") Found reference to API (Indicator: "FlsAlloc"; File: "78d9ac9954516ac096992cf654caa1fc") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; File: "78d9ac9954516ac096992cf654caa1fc") Found reference to API (Indicator: "GetProcessWindowStation"; File: "78d9ac9954516ac096992cf654caa1fc") Found reference to API (Indicator: "GetUserObjectInformationA"; File: "78d9ac9954516ac096992cf654caa1fc") Found reference to API (Indicator: "GetLastActivePopup"; File: "78d9ac9954516ac096992cf654caa1fc") Found reference to API (Indicator: "GetActiveWindow"; File: "78d9ac9954516ac096992cf654caa1fc") Found reference to API (Indicator: "MessageBoxA"; File: "78d9ac9954516ac096992cf654caa1fc") Found reference to API (Indicator: "GetModuleFileNameExA"; File: "78d9ac9954516ac096992cf654caa1fc") Found reference to API (Indicator: "EnumProcessModules"; File: "78d9ac9954516ac096992cf654caa1fc") Found reference to API (Indicator: "EnumProcesses"; File: "78d9ac9954516ac096992cf654caa1fc") Found reference to API (Indicator: "GetFileSize"; File: "78d9ac9954516ac096992cf654caa1fc") Found reference to API (Indicator: "CreateMutexA"; File: "78d9ac9954516ac096992cf654caa1fc") Found reference to API (Indicator: "OpenProcess"; File: "78d9ac9954516ac096992cf654caa1fc") Found reference to API (Indicator: "OutputDebugStringA"; File: "78d9ac9954516ac096992cf654caa1fc") Found reference to API (Indicator: "ReadFile"; File: "78d9ac9954516ac096992cf654caa1fc") Found reference to API (Indicator: "WaitForSingleObject"; File: "78d9ac9954516ac096992cf654caa1fc") Found reference to API (Indicator: "CreateProcessA"; File: "78d9ac9954516ac096992cf654caa1fc") Found reference to API (Indicator: "WinExec"; File: "78d9ac9954516ac096992cf654caa1fc") Found reference to API (Indicator: "DeleteFileA"; File: "78d9ac9954516ac096992cf654caa1fc") Found reference to API (Indicator: "GetSystemDirectoryA"; File: "78d9ac9954516ac096992cf654caa1fc") Found reference to API (Indicator: "GetTempPathA"; File: "78d9ac9954516ac096992cf654caa1fc") Found reference to API (Indicator: "CharLowerA"; File: "78d9ac9954516ac096992cf654caa1fc") Found reference to API (Indicator: "GetUserNameA"; File: "78d9ac9954516ac096992cf654caa1fc") Found reference to API (Indicator: "InternetReadFile"; File: "78d9ac9954516ac096992cf654caa1fc") Found reference to API (Indicator: "InternetCloseHandle"; File: "78d9ac9954516ac096992cf654caa1fc") Found reference to API (Indicator: "HttpSendRequestA"; File: "78d9ac9954516ac096992cf654caa1fc") Found reference to API (Indicator: "HttpOpenRequestA"; File: "78d9ac9954516ac096992cf654caa1fc") Found reference to API (Indicator: "InternetConnectA"; File: "78d9ac9954516ac096992cf654caa1fc") Found reference to API (Indicator: "InternetOpenA"; File: "78d9ac9954516ac096992cf654caa1fc") Found reference to API (Indicator: "HttpAddRequestHeadersA"; File: "78d9ac9954516ac096992cf654caa1fc") Found reference to API (Indicator: "InternetQueryOptionA"; File: "78d9ac9954516ac096992cf654caa1fc") Found reference to API (Indicator: "GetModuleBaseNameA"; File: "78d9ac9954516ac096992cf654caa1fc") Found reference to API (Indicator: "ExitThread"; File: "78d9ac9954516ac096992cf654caa1fc") Found reference to API (Indicator: "CreateThread"; File: "78d9ac9954516ac096992cf654caa1fc") Found reference to API (Indicator: "GetFileAttributesA"; File: "78d9ac9954516ac096992cf654caa1fc") Found reference to API (Indicator: "RaiseException"; File: "78d9ac9954516ac096992cf654caa1fc") Found reference to API (Indicator: "SetEndOfFile"; File: "78d9ac9954516ac096992cf654caa1fc") Found reference to API (Indicator: "WSAStartup"; File: "78d9ac9954516ac096992cf654caa1fc") Found reference to API (Indicator: "gethostbyname"; File: "78d9ac9954516ac096992cf654caa1fc") Found reference to API (Indicator: "inet_ntoa"; File: "78d9ac9954516ac096992cf654caa1fc") Found reference to API (Indicator: "gethostname"; File: "78d9ac9954516ac096992cf654caa1fc") Found reference to API (Indicator: "WSACleanup"; File: "78d9ac9954516ac096992cf654caa1fc")2a:T800,"78d9ac9954516ac096992cf654caa1fc.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 76410000 "78d9ac9954516ac096992cf654caa1fc.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 76410000 "78d9ac9954516ac096992cf654caa1fc.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 76410000 "78d9ac9954516ac096992cf654caa1fc.exe" loaded module "KERNEL32" at base 74b10000 "78d9ac9954516ac096992cf654caa1fc.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 727b0000 "78d9ac9954516ac096992cf654caa1fc.exe" loaded module "KERNEL32.DLL" at base 74b10000 "78d9ac9954516ac096992cf654caa1fc.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73650000 "78d9ac9954516ac096992cf654caa1fc.exe" loaded module "NTDLL.DLL" at base 77180000 "78d9ac9954516ac096992cf654caa1fc.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 730f0000 "78d9ac9954516ac096992cf654caa1fc.exe" loaded module "SHELL32.DLL" at base 74e70000 "78d9ac9954516ac096992cf654caa1fc.exe" loaded module "RPCRT4.DLL" at base 74d40000 "78d9ac9954516ac096992cf654caa1fc.exe" loaded module "%WINDIR%\SYSWOW64\\WINDOWS.STATEREPOSITORYPS.DLL" at base 72600000 "78d9ac9954516ac096992cf654caa1fc.exe" loaded module "%WINDIR%\SYSWOW64\SHELL32.DLL" at base 74e70000 "78d9ac9954516ac096992cf654caa1fc.exe" loaded module "API-MS-WIN-CORE-PROCESSTHREADS-L1-1-2.DLL" at base 74b10000 "78d9ac9954516ac096992cf654caa1fc.exe" loaded module "USER32.DLL" at base 76290000 "78d9ac9954516ac096992cf654caa1fc.exe" loaded module "%WINDIR%\SYSWOW64\URLMON.DLL" at base 73490000 "78d9ac9954516ac096992cf654caa1fc.exe" loaded module "MSISO.DLL" at base 725a0000 "78d9ac9954516ac096992cf654caa1fc.exe" loaded module "SSPICLI.DLL" at base 73ba0000 "78d9ac9954516ac096992cf654caa1fc.exe" loaded module "API-MS-WIN-CORE-URL-L1-1-0.DLL" at base 76410000 "78d9ac9954516ac096992cf654caa1fc.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 73c80000 "78d9ac9954516ac096992cf654caa1fc.exe" loaded module "%WINDIR%\SYSTEM32\SFC_OS.DLL" at base 725600002b:T59d,"78d9ac9954516ac096992cf654caa1fc.exe" touched "Computer" (Path: "HKCU\WOW6432NODE\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "78d9ac9954516ac096992cf654caa1fc.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\WOW6432NODE\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\TREATAS") "78d9ac9954516ac096992cf654caa1fc.exe" touched "Private Profile Object" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{75847177-F077-4171-BD2C-A6BB2164FBD0}\INPROCSERVER32") "78d9ac9954516ac096992cf654caa1fc.exe" touched "Sync root manager" (Path: "HKCU\WOW6432NODE\CLSID\{F324E4F9-8496-40B2-A1FF-9617C1C9AFFE}\INSTANCE") "78d9ac9954516ac096992cf654caa1fc.exe" touched "ExecuteAssociation" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{1649D1CF-DEAF-4A68-ABE8-5C9F68572FD1}\INPROCSERVER32") "78d9ac9954516ac096992cf654caa1fc.exe" touched "Property System Both Class Factory" (Path: "HKCU\WOW6432NODE\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\TREATAS") "78d9ac9954516ac096992cf654caa1fc.exe" touched "Security Manager" (Path: "HKCU\WOW6432NODE\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\TREATAS") "78d9ac9954516ac096992cf654caa1fc.exe" touched "ShellItemArray Shell Namespace helper" (Path: "HKCU\WOW6432NODE\CLSID\{CDC82860-468D-4D4E-B7E7-C298FF23AB2C}\TREATAS") "78d9ac9954516ac096992cf654caa1fc.exe" touched "ShellItem Shell Namespace helper" (Path: "HKCU\WOW6432NODE\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}\TREATAS")2c:T47f,"78d9ac9954516ac096992cf654caa1fc" file has an entrypoint instructions - "call 0x404387,jmp 0x40168f,mov eax, 0x40c008,ret ,mov eax, dword ptr [0x40ec20],test eax, eax,push esi,push 0x14,pop esi,jne 0x401869,mov eax, 0x200,jmp 0x40186f,cmp eax, esi,jge 0x401874,mov eax, esi,mov dword ptr [0x40ec20], eax,push 4,push eax,call 0x40445b,test eax, eax,pop ecx,pop ecx,mov dword ptr [0x40dc04], eax,jne 0x4018a5,push 4,push esi,mov dword ptr [0x40ec20], esi,call 0x40445b,test eax, eax,pop ecx,pop ecx,mov dword ptr [0x40dc04], eax,jne 0x4018a5,push 0x1a,pop eax,pop esi,ret ,xor edx, edx," "sxs.dll" file has an entrypoint instructions - "cmp dword ptr [esp + 8], 1,jne 0x100044b1,call 0x10008bd8,push dword ptr [esp + 4],mov ecx, dword ptr [esp + 0x10],mov edx, dword ptr [esp + 0xc],call 0x100043af,pop ecx,ret 0xc,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,lea eax, [edx - 1],pop ebx,ret ,lea esp, [esp],lea esp, [esp],xor eax, eax,mov al, byte ptr [esp + 8],push ebx,mov ebx, eax,shl eax, 8,mov edx, dword ptr [esp + 8],test edx, 3,je 0x1000450d,mov cl, byte ptr [edx],add edx, 1,cmp cl, bl,je 0x100044d0,test cl, cl,je 0x10004556,"2d:T649,"78d9ac9954516ac096992cf654caa1fc.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "78d9ac9954516ac096992cf654caa1fc.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "78d9ac9954516ac096992cf654caa1fc.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "78d9ac9954516ac096992cf654caa1fc.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TERMINAL SERVER"; Key: ""; Value: "") "78d9ac9954516ac096992cf654caa1fc.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "78d9ac9954516ac096992cf654caa1fc.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "78d9ac9954516ac096992cf654caa1fc.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "78d9ac9954516ac096992cf654caa1fc.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "78d9ac9954516ac096992cf654caa1fc.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "78d9ac9954516ac096992cf654caa1fc.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: ""; Value: "") "78d9ac9954516ac096992cf654caa1fc.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: ""; Value: "")2e:Tbdc,"78d9ac9954516ac096992cf654caa1fc.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "78d9ac9954516ac096992cf654caa1fc.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: "78D9AC9954516AC096992CF654CAA1FC.EXE"; Value: "") "78d9ac9954516ac096992cf654caa1fc.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "78d9ac9954516ac096992cf654caa1fc.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TERMINAL SERVER"; Key: "TSAPPCOMPAT"; Value: "") "78d9ac9954516ac096992cf654caa1fc.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TERMINAL SERVER"; Key: "TSUSERENABLED"; Value: "") "78d9ac9954516ac096992cf654caa1fc.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "78d9ac9954516ac096992cf654caa1fc.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "78d9ac9954516ac096992cf654caa1fc.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "LOGFLAGS"; Value: "") "78d9ac9954516ac096992cf654caa1fc.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "SHOWDEBUGINFO"; Value: "") "78d9ac9954516ac096992cf654caa1fc.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: "CACHE"; Value: "") "78d9ac9954516ac096992cf654caa1fc.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY"; Value: "") "78d9ac9954516ac096992cf654caa1fc.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK"; Value: "") "78d9ac9954516ac096992cf654caa1fc.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "TYPE"; Value: "") "78d9ac9954516ac096992cf654caa1fc.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "ALTERNATECODEPAGE"; Value: "") "78d9ac9954516ac096992cf654caa1fc.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "78d9ac9954516ac096992cf654caa1fc.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "78d9ac9954516ac096992cf654caa1fc.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "78d9ac9954516ac096992cf654caa1fc.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "ENABLED"; Value: "") "78d9ac9954516ac096992cf654caa1fc.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: "FIPSALGORITHMPOLICY"; Value: "")2f:T4dd,"78d9ac9954516ac096992cf654caa1fc.exe" trying to touch file "C:\Windows\System32\WOW64LOG.DLL" "78d9ac9954516ac096992cf654caa1fc.exe" trying to touch file "C:\Windows\SysWOW64\apphelp.dll" "78d9ac9954516ac096992cf654caa1fc.exe" trying to touch file "C:\78d9ac9954516ac096992cf654caa1fc.exe" "78d9ac9954516ac096992cf654caa1fc.exe" trying to touch file "C:\Windows\SysWOW64\ntdll.dll" "78d9ac9954516ac096992cf654caa1fc.exe" trying to touch file "C:\Windows\SysWOW64\kernel32.dll" "78d9ac9954516ac096992cf654caa1fc.exe" trying to touch file "C:\Windows\SysWOW64\KernelBase.dll" "78d9ac9954516ac096992cf654caa1fc.exe" trying to touch file "C:\Windows\apppatch\sysmain.sdb" "78d9ac9954516ac096992cf654caa1fc.exe" trying to touch file "C:\Windows\SysWOW64\win32u.dll" "78d9ac9954516ac096992cf654caa1fc.exe" trying to touch file "C:\Windows\SysWOW64\ucrtbase.dll" "78d9ac9954516ac096992cf654caa1fc.exe" trying to touch file "C:\Windows\SysWOW64\msvcp_win.dll" "78d9ac9954516ac096992cf654caa1fc.exe" trying to touch file "C:\Windows\SysWOW64\gdi32full.dll" "78d9ac9954516ac096992cf654caa1fc.exe" trying to touch file "C:\Windows\SysWOW64\gdi32.dll" "78d9ac9954516ac096992cf654caa1fc.exe" trying to touch file "C:\Windows\SysWOW64\user32.dll"30:T7a9,"78d9ac9954516ac096992cf654caa1fc.exe" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL" "78d9ac9954516ac096992cf654caa1fc.exe" trying to access non-existent file "C:\FLTLIB.DLL" "78d9ac9954516ac096992cf654caa1fc.exe" trying to access non-existent file "C:\CRYPTSP.DLL" "78d9ac9954516ac096992cf654caa1fc.exe" trying to access non-existent file "C:\Windows\SysWOW64\RPCSS.DLL" "78d9ac9954516ac096992cf654caa1fc.exe" trying to access non-existent file "C:\WINDOWS\system32\rpcss.dll" "78d9ac9954516ac096992cf654caa1fc.exe" trying to access non-existent file "C:\CLDAPI.DLL" "78d9ac9954516ac096992cf654caa1fc.exe" trying to access non-existent file "C:\CLDAPI.dll" "78d9ac9954516ac096992cf654caa1fc.exe" trying to access non-existent file "C:\AEPIC.DLL" "78d9ac9954516ac096992cf654caa1fc.exe" trying to access non-existent file "C:\AEPIC.dll" "78d9ac9954516ac096992cf654caa1fc.exe" trying to access non-existent file "C:\BCRYPT.DLL" "78d9ac9954516ac096992cf654caa1fc.exe" trying to access non-existent file "C:\bcrypt.dll" "78d9ac9954516ac096992cf654caa1fc.exe" trying to access non-existent file "C:\PROPSYS.DLL" "78d9ac9954516ac096992cf654caa1fc.exe" trying to access non-existent file "C:\PROPSYS.dll" "78d9ac9954516ac096992cf654caa1fc.exe" trying to access non-existent file "C:\EDPUTIL.DLL" "78d9ac9954516ac096992cf654caa1fc.exe" trying to access non-existent file "C:\edputil.dll" "78d9ac9954516ac096992cf654caa1fc.exe" trying to access non-existent file "C:\URLMON.DLL" "78d9ac9954516ac096992cf654caa1fc.exe" trying to access non-existent file "C:\urlmon.dll" "78d9ac9954516ac096992cf654caa1fc.exe" trying to access non-existent file "C:\IERTUTIL.DLL" "78d9ac9954516ac096992cf654caa1fc.exe" trying to access non-existent file "C:\iertutil.dll" "78d9ac9954516ac096992cf654caa1fc.exe" trying to access non-existent file "C:\MPR.DLL" "78d9ac9954516ac096992cf654caa1fc.exe" trying to access non-existent file "C:\MPR.dll"31:T22d5,Found string "Content-Type: multipart/form-data"; File: "78d9ac9954516ac096992cf654caa1fc") Found string "!This program cannot be run in DOS mode.<(;H<(;H<(;HEH=(;HFH((;HVHI(;H'fH-(;H<(:HF(;HAH=(;HCH=(;HRich<(;H.text`.rdata@.data.reloctBh(SSSShSSShSSSSPSSSShSSjPSSSSSVWhExPhExPj_^[tSSSShSSjPhYYh0SVW3Pj&SWPhxgSSSSjYYShPSSh PPPhI^[_3WWWWWWWWWWVVVVPPPPPVVVVVSSSSSPhP3SSSSSVVVVVSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSVVVVVVVVVVSSSSSYYtJVhB=VVVVV0VVVVVu59=9=,l@_^[u WPSu&WVS^_[3tVPWWWWWVVVVV~,WPV98t^tVPVt/9UY__^[\$ UV35P3_^][9csmT$(jD$,9hWWWWWYt.VYt"VWWWWWtC9UWWWWWHt$GGG@@Ht'fGG+}WWWWW0WWWWWX_^]QSUVWYYr|YYt+_^][Y;5\s95Dm=Yt/jtJVUPSSSSSY]_^[>"u&< tKHt2Ht&^SSSSS>t3;8VVVVVt(9uVVVVVVVVVVSSSSSSSSSSt,9]u!f;t9]WWWWWSVWUj]_^[;t$,v-UQPXY]Y[VVVVVSUVW_^][;5`?0A@@JuFh=8;Wto=XBt^9(uZtD9(u@Y_^][_^][Fpt"^SSSSSj"^SSSSSQSWVjvN+D$t+HtPPPPPWWWWWuaVjuL9=;5\swIVSPFVSjYYt}~%9MQVjr 8^ SVWSSSSStm95SSSSS0SSSSS_^[]0SSSSSVVVVVSVW3_^[]VVVVVu8SS3GWhh9]$SSt)9]t"9]9] uSSSSSSSSSStR:Qt<:Qt&:QFVhh9] SS;5`Bv$;5|BPPPPPPPPPPPPPPPPWWWWWc:\Users\zqp\AppData\Local\Temp\rrr.txtcmd1%s\cmd.exe /c %s >%s%s\cmd.exe /c %s%s/cmd%d.datcmd_sys_CMD...cmd_downloads%s_%s_%d.jpgdownload ...download_uploads/jd/uploads/%sorderupload ...upload_get command from order...%s/order.dat/jd/order/%suploadToSpace info...%s/tmpxor.dat%s/tmp.dat%s.jpgProcess: HostName: %sIP: %sProxy: %sUser: %sSystemDir: %sOS Language Version: %dSystem Version: %d.%d %s (Build %d)Get Proxy Failedbegin thread...bad allocationUnknown exceptionccs=UTF-8UTF-16LEUNICODE(null)( 8PX700WP`h````xpxxxxEncodePointerKERNEL32.DLLDecodePointerFlsFreeFlsSetValueFlsGetValueFlsAllocCorExitProcessmscoree.dllruntime error TLOSS errorSING errorDOMAIN errorR6034An application has made an attempt to load the C runtime library incorrectly.Please contact the application's support team for more information.R6033- Attempt to use MSIL code from this assembly during native code initializationThis indicates a bug in your application. It is most likely the result of calling an MSIL-compiled (/clr) function from a native constructor or from DllMain.R6032- not enough space for locale informationR6031- Attempt to initialize the CRT more than once.This indicates a bug in your application.R6030- CRT not initializedR6028- unable to initialize heapR6027- not enough space for lowio initializationR6026- not enough space for stdio initializationR6025- pure virtual function callR6024- not enough space for _onexit/atexit tableR6019- unable to open console deviceR6018- unexpected heap errorR6017- unexpected multithread lock errorR6016- not enough space for thread dataThis application has requested the Runtime to terminate it in an unusual way.Please contact the application's support team for more information.R6009- not enough space for environmentR6008- not enough space for argumentsR6002- floating point not loadedMicrosoft Visual C++ Runtime LibraryRuntime Error!Program: InitializeCriticalSectionAndSpinCountkernel32.dll !"#$%&'()*+ -./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~('8PW700PP`h`hhhxppwpp Complete Object Locator' Class Hierarchy Descriptor' Base Class Array' Base Class Descriptor at ( Type Descriptor'`local static thread guard'`managed vector copy constructor iterator'`vector vbase copy constructor iterator'`vector copy constructor iterator'`dynamic atexit destructor for '`dynamic initializer for '`eh vector vbase copy constructor iterator'`eh vector copy constructor iterator'`managed vector destructor iterator'`managed vector constructor iterator'`placement delete[] closure'`placement delete closure'`omni callsig' delete[] new[]`local vftable constructor closure'`local vftable'`RTTI`udt returning'`copy constructor closure'`eh vector vbase constructor iterator'`eh vector destructor iterator'`eh vector constructor iterator'`virtual displacement map'`vector vbase constructor iterator'`vector destructor iterator'`vector constructor iterator'`scalar deleting destructor'`default constructor closure'`vector deleting destructor'`vbase destructor'`string'`local static guard'`typeof'`vcall'`vbtable'`vftable'operator delete new__unaligned__restrict__ptr64__clrcall__fastcall__thiscall__stdcall__pascal__cdecl__based(GetProcessWindowStationGetUserObjectInformationAGetLastActivePopupGetActiveWindowMessageBoxAUSER32.DLL !"#$%&'()*+ -./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\]^_`abcdefghijklmnopqrstuvwxyz{|}~ !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~HH:mm:ssdddd, MMMM dd, yyyyMM/dd/yyDecemberNovemberOctoberSeptemberAugustJulyJuneAprilMarchFebruaryJanuarySaturdayFridayThursdayWednesdayTuesdayMondaySundayCONOUT$SunMonTueWedThuFriSatJanFebMarAprMayJunJulAugSepOctNovDecVirtualFreeVirtualAllocCloseHandleGetFileSizeSleepCreateFileAGetProcAddressLoadLibraryAGetLastErrorCreateMutexAOpenProcessGetCurrentProcessIdOutputDebugStringAWriteFileMultiByteToWideCharReadFileWaitForSingleObjectCreateProcessAWinExecWideCharToMultiByteDeleteFileAGetSystemDirectoryAGetTempPathAGetVersionExAGetOEMCPKERNEL32.dllMessageBoxACharLowerAUSER32.dllGetUserNameAADVAPI32.dllSHGetSpecialFolderPathASHELL32.dllInternetReadFileInternetCloseHandleHttpSendRequestAHttpOpenRequestAInternetConnectAInternetOpenAHttpAddRequestHeadersAInternetQueryOptionAWININET.dllGetModuleBaseNameAEnumProcessModulesPSAPI.DLLWS2_32.dllExitThreadGetCurrentThreadIdCreateThreadGetFileAttributesAGetCommandLineAHeapFreeHeapAllocGetProcessHeapTerminateProcessGetCurrentProcessUnhandledExceptionFilterSetUnhandledExceptionFilterIsDebuggerPresentEnterCriticalSectionLeaveCriticalSectionRaiseExceptionRtlUnwindSetHandleCountGetStdHandleGetFileTypeGetStartupInfoADeleteCriticalSectionSetFilePointerGetModuleHandleATlsGetValueTlsAllocTlsSetValueTlsFreeInterlockedIncrementSetLastErrorInterlockedDecrementExitProcessGetConsoleCPGetConsoleModeGetModuleFileNameAFreeEnvironmentStringsAGetEnvironmentStringsFreeEnvironmentStringsWGetEnvironmentStringsWHeapDestroyHeapCreateQueryPerformanceCounterGetTickCountGetSystemTimeAsFileTimeHeapReAllocSetStdHandleFlushFileBuffersHeapSizeInitializeCriticalSectionGetCPInfoGetACPWriteConsoleAGetConsoleOutputCPWriteConsoleWSetEndOfFileLCMapStringALCMapStringWGetStringTypeAGetStringTypeWGetLocaleInfoAwdmaud.dllfuc_trendwww.setchon.com/jd/upload.aspx.?AVbad_alloc@std@@.?AVexception@std@@.?AVtype_info@@ abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ2*2B2n23R3a3j3q3}343494@4R4l4|45`5f5s5~5616_67#7)797t77K8]8o88P9b99h:z:;!;';U;<2<`<=E=K=_=>!>\>i>o>t>>8?>?`?0;0E0L0091`12D2V2n22@3U3p3{33(4G4U4[4j44M5a5s56&6,616<6B6N6^6z67:7?7[7a7g7s78:8@8E8N8T8c8x89&9-9;9H9S9Y9_9j9>1>a>g>o>|>*0_0x01 1$1n1t1x1|12 2A2k26777N7718H8v88f9m9B::Q;F<=m=t=z==7>C>M>2"2H2^2p2u2{23`3f3394f46B6y68-9r99#:-:7:R:Y:x:;7;H;S;a;o;v;<:p>">)>6>=>C>K>Q>]>b>1+161<1B1G1P1m1s1~12$2*2;2266B6u6949B9h999:M:;3;>;F;<1/>4>B>l>?4?r?1&2,2Z22/343\3~34_4i47&737M7e7s70*060q0224C4}4525T5626z66p7|78!8'80858D8k8: ;C;T;> ?7?A?F?K?P?[?*0/060;0B0G00K1U1]12&2{22Q3W33)4/4;4505K57O7h7o7w7|78^8d8h8l8p8919[9:g:~:;&;+;8;Z;;-=4=:==V>]>000?0O0[0e0m0x06"6)6Y66g7i9{9=,=:=]=>%>*>0>:>I>>,?;?3r3v3{3x5|56 6$6(6,6064686<6@6D6H6L6P6T6X6\6`6d6h6l6p6t6x6|6,101D1H1X1\1`1h12X2x23(3H3h34(4H4h4t4505P5p5|5686D6`67 7@7`74P8T8X8p8t8x88`:t:|:;$;`?1$1014181<1@1H1L1P1T1X1\1`1d1h1l1p1t12 2$2(2,2024282<2@2P2X2\2`2d2h2l2p2t2x2|22@3D3"; File: "sxs.dll")1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"ccd4e6d67224c9ed683a8fab1f23580923aada973369d97eb8fc2555afd2d9ea","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790599650358,"unified_at":"2026-09-28T12:47:30.358Z","metadata":{"hashes":{"sha256":"ccd4e6d67224c9ed683a8fab1f23580923aada973369d97eb8fc2555afd2d9ea","sha1":"c5fe78d3911b4f65043fceb4b9f43acbb05c34b1","md5":"78d9ac9954516ac096992cf654caa1fc","sha512":"fdbd495529589cf3dfac53f7337d752301f281fa44f34ec456455999c5e55eba543eabe516b1cda4723df552578fd8eba0839e54c51d17932b4bccc3454b55a1","ssdeep":"1536:73lOFnV98szKufcY4PtDntpO0c9YiGTDNTxyMlnbHHOcfYVPkRLFztJpi:7IVmlufIrtm0ThMMlbHu7qttJc","ssdeep_chunks":["1536:73lOFnV","1536:3lOFnV9","1536:lOFnV98","1536:OFnV98s","1536:FnV98sz","1536:nV98szK","1536:V98szKu","1536:98szKuf","1536:8szKufc","1536:szKufcY","1536:zKufcY4","1536:KufcY4P","1536:ufcY4Pt","1536:fcY4PtD","1536:cY4PtDn","1536:Y4PtDnt","1536:4PtDntp","1536:PtDntpO","1536:tDntpO0","1536:DntpO0c","1536:ntpO0c9","1536:tpO0c9Y","1536:pO0c9Yi","1536:O0c9YiG","1536:0c9YiGT","1536:c9YiGTD","1536:9YiGTDN","1536:YiGTDNT","1536:iGTDNTx","1536:GTDNTxy","1536:TDNTxyM","1536:DNTxyMl","1536:NTxyMln","1536:TxyMlnb","1536:xyMlnbH","1536:yMlnbHH","1536:MlnbHHO","1536:lnbHHOc","1536:nbHHOcf","1536:bHHOcfY","1536:HHOcfYV","1536:HOcfYVP","1536:OcfYVPk","1536:cfYVPkR","1536:fYVPkRL","1536:YVPkRLF","1536:VPkRLFz","1536:PkRLFzt","1536:kRLFztJ","1536:RLFztJp","1536:LFztJpi","3072:73lOFnV","3072:3lOFnV9","3072:lOFnV98","3072:OFnV98s","3072:FnV98sz","3072:nV98szK","3072:V98szKu","3072:98szKuf","3072:8szKufc","3072:szKufcY","3072:zKufcY4","3072:KufcY4P","3072:ufcY4Pt","3072:fcY4PtD","3072:cY4PtDn","3072:Y4PtDnt","3072:4PtDntp","3072:PtDntpO","3072:tDntpO0","3072:DntpO0c","3072:ntpO0c9","3072:tpO0c9Y","3072:pO0c9Yi","3072:O0c9YiG","3072:0c9YiGT","3072:c9YiGTD","3072:9YiGTDN","3072:YiGTDNT","3072:iGTDNTx","3072:GTDNTxy","3072:TDNTxyM","3072:DNTxyMl","3072:NTxyMln","3072:TxyMlnb","3072:xyMlnbH","3072:yMlnbHH","3072:MlnbHHO","3072:lnbHHOc","3072:nbHHOcf","3072:bHHOcfY","3072:HHOcfYV","3072:HOcfYVP","3072:OcfYVPk","3072:cfYVPkR","3072:fYVPkRL","3072:YVPkRLF","3072:VPkRLFz","3072:PkRLFzt","3072:kRLFztJ","3072:RLFztJp","3072:LFztJpi","1536:7IVmluf","1536:IVmlufI","1536:VmlufIr","1536:mlufIrt","1536:lufIrtm","1536:ufIrtm0","1536:fIrtm0T","1536:Irtm0Th","1536:rtm0ThM","1536:tm0ThMM","1536:m0ThMMl","1536:0ThMMlb","1536:ThMMlbH","1536:hMMlbHu","1536:MMlbHu7","1536:MlbHu7q","1536:lbHu7qt","1536:bHu7qtt","1536:Hu7qttJ","1536:u7qttJc"],"imphash":"162a2d1a6a4acaa83f0f2e20458815fd"},"file_info":{"file_name":"78d9ac9954516ac096992cf654caa1fc","file_type":["peexe","executable"],"file_type_id":"exe","file_size":129536,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1614312757000,"last_seen":1736239043000,"last_multi_scan":1736239043000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["daggerpanda","fucobha","icefog","targeted"]},"stats":{"av":{"malicious_count":17,"suspicious_count":0,"total_engines":23},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":47},"sandbox_signatures":{"informative_count":103,"suspicious_count":8,"malicious_count":5,"total":116},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Backdoor/Win32.Icefog","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan[APT]/Win32.Icefog","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/Fucobha.xqfgo","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Dropped:Trojan.GenericKD.61360001","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"malicious","threat_name":"Win.Malware.Fucobha-10035929-0","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cylance":{"name":"Cylance","success":true,"verdict":"malicious","threat_name":"Malware_-10","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Dropped:Trojan.GenericKD.61360001 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win32/Fucobha.A trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 004e73e41 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Agent.bkxivv","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"malicious","threat_name":"Confidence_96","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/Fucobha-A","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/ABTrojan.EJGU-6345","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"TrojanDownloader.Agent","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Downloader.Agent.Win32.315497","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Dropper.Trojan.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"informative","value":"Imports GetCommandLine API"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Calls an API typically used to find a resource in a module"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"}],"sources":[{"report_type":"sandbox","report_id":"677ce7c3d6074d8cf50aefd2"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to executes commands or batch file"},{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"677ce7c3d6074d8cf50aefd2"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"}],"sources":[{"report_type":"sandbox","report_id":"677ce7c3d6074d8cf50aefd2"}]},{"tactic":"Execution","technique":"Malicious File","attack_id":"T1204.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1204/002","identifiers":[{"type":"malicious","value":"The analysis spawned a process that was identified as malicious"}],"sources":[{"report_type":"sandbox","report_id":"677ce7c3d6074d8cf50aefd2"}]},{"tactic":"Persistence","technique":"Local Account","attack_id":"T1136.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1136/001","identifiers":[{"type":"informative","value":"Contains ability to create local account"}],"sources":[{"report_type":"sandbox","report_id":"677ce7c3d6074d8cf50aefd2"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"677ce7c3d6074d8cf50aefd2"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"677ce7c3d6074d8cf50aefd2"}]},{"tactic":"Persistence","technique":"DLL Search Order Hijacking","attack_id":"T1574.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/001","sources":[{"report_type":"sandbox","report_id":"677ce7c3d6074d8cf50aefd2"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"677ce7c3d6074d8cf50aefd2"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"677ce7c3d6074d8cf50aefd2"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"malicious","value":"Writes data to a remote process"},{"type":"malicious","value":"Creates a process in suspended mode (likely for process injection)"},{"type":"informative","value":"Contains ability to inject code into another process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"677ce7c3d6074d8cf50aefd2"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"677ce7c3d6074d8cf50aefd2"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to check debugger is running (API string)"},{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"},{"type":"suspicious","value":"Queries kernel debugger information"}],"sources":[{"report_type":"sandbox","report_id":"677ce7c3d6074d8cf50aefd2"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Shows ability to obfuscate file or information"}],"sources":[{"report_type":"sandbox","report_id":"677ce7c3d6074d8cf50aefd2"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"suspicious","value":"Modifies proxy settings"}],"sources":[{"report_type":"sandbox","report_id":"677ce7c3d6074d8cf50aefd2"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"677ce7c3d6074d8cf50aefd2"}]},{"tactic":"Defense Evasion","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"malicious","value":"PE file contains executable resources"},{"type":"suspicious","value":"section contains high entropy"},{"type":"informative","value":"YARA signature match – Embedded PE executable"},{"type":"informative","value":"YARA signature match - PE executable embedded in .rsrc section"}],"sources":[{"report_type":"sandbox","report_id":"677ce7c3d6074d8cf50aefd2"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"677ce7c3d6074d8cf50aefd2"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"}],"sources":[{"report_type":"sandbox","report_id":"677ce7c3d6074d8cf50aefd2"}]},{"tactic":"Defense Evasion","technique":"Dynamic API Resolution","attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","identifiers":[{"type":"informative","value":"Contains ability to dynamically determine API calls"}],"sources":[{"report_type":"sandbox","report_id":"677ce7c3d6074d8cf50aefd2"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"}],"sources":[{"report_type":"sandbox","report_id":"677ce7c3d6074d8cf50aefd2"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Contains ability to delete files/directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"677ce7c3d6074d8cf50aefd2"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"677ce7c3d6074d8cf50aefd2"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"677ce7c3d6074d8cf50aefd2"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Contains ability to retrieve the host name of a computer (API string)"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Contains ability to retrieve information about the current system (API string)"}],"sources":[{"report_type":"sandbox","report_id":"677ce7c3d6074d8cf50aefd2"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Contains ability to query system locale (API string)"}],"sources":[{"report_type":"sandbox","report_id":"677ce7c3d6074d8cf50aefd2"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"},{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"},{"type":"informative","value":"Calls an API typically used to enumerate active windows"}],"sources":[{"report_type":"sandbox","report_id":"677ce7c3d6074d8cf50aefd2"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"suspicious","value":"Reads configuration files (.ini files)"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Touches files in program files directory"}],"sources":[{"report_type":"sandbox","report_id":"677ce7c3d6074d8cf50aefd2"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"suspicious","value":"Queries process information"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Contains ability to retrieve/open a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"677ce7c3d6074d8cf50aefd2"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"}],"sources":[{"report_type":"sandbox","report_id":"677ce7c3d6074d8cf50aefd2"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"677ce7c3d6074d8cf50aefd2"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Contains ability to retrieve usernames and/or user information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"677ce7c3d6074d8cf50aefd2"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"677ce7c3d6074d8cf50aefd2"}]},{"tactic":"Discovery","technique":"Local Account","attack_id":"T1087.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1087/001","sources":[{"report_type":"sandbox","report_id":"677ce7c3d6074d8cf50aefd2"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Contains ability to retrieve internet settings (API string)"}],"sources":[{"report_type":"sandbox","report_id":"677ce7c3d6074d8cf50aefd2"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"677ce7c3d6074d8cf50aefd2"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"677ce7c3d6074d8cf50aefd2"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","sources":[{"report_type":"sandbox","report_id":"677ce7c3d6074d8cf50aefd2"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Contains ability to create a HTTP or FTP session (API string)"},{"type":"informative","value":"Contains ability to create a new HTTP request (API string)"},{"type":"informative","value":"Found potential URL in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"677ce7c3d6074d8cf50aefd2"}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"informative","value":"Contains ability to communicate with C2 using Sockets (API string)"}],"sources":[{"report_type":"sandbox","report_id":"677ce7c3d6074d8cf50aefd2"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"informative","value":"Contains ability to download a file from a URL (API string)"},{"type":"informative","value":"Dropped files"},{"type":"suspicious","value":"Writes a PE file header to disc"},{"type":"suspicious","value":"Drops executable files"}],"sources":[{"report_type":"sandbox","report_id":"677ce7c3d6074d8cf50aefd2"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Found string related to HTTP headers"},{"type":"informative","value":"Contains reference to Windows internet services (API string)"}],"sources":[{"report_type":"sandbox","report_id":"677ce7c3d6074d8cf50aefd2"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Making HTTPS connections using secure TLS/SSL version"}],"sources":[{"report_type":"sandbox","report_id":"677ce7c3d6074d8cf50aefd2"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"677ce7c3d6074d8cf50aefd2"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over C2 Channel","attack_id":"T1041","attack_id_wiki":"https://attack.mitre.org/techniques/T1041","identifiers":[{"type":"informative","value":"Contains ability to upload file/data"}],"sources":[{"report_type":"sandbox","report_id":"677ce7c3d6074d8cf50aefd2"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"677ce7c3d6074d8cf50aefd2"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"677ce7c3d6074d8cf50aefd2"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Calls an API typically used to find a resource in a module","description":"\"78d9ac9954516ac096992cf654caa1fc.exe\" called \"FindResourceA\" with parameter \"123\" - (UID: 00000000-00007880)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-140","sources":[{"report_type":"sandbox","report_id":"677ce7c3d6074d8cf50aefd2"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Calls an API typically used to load a resource in memory","description":"\"78d9ac9954516ac096992cf654caa1fc.exe\" called \"LoadResource with parameter {'hModule': '0', 'hResInfo': '4255816'}\" (UID: 00000000-00007880)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"677ce7c3d6074d8cf50aefd2"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; File: \"78d9ac9954516ac096992cf654caa1fc\")\n Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"78d9ac9954516ac096992cf654caa1fc\")\n Found reference to API \"WaitForSingleObject\" (Indicator: \"WaitForSingleObject\"; File: \"78d9ac9954516ac096992cf654caa1fc\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"677ce7c3d6074d8cf50aefd2"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to inject code into another process (API string)","description":"Found reference to API \"VirtualFree\" (Indicator: \"VirtualFree\"; File: \"78d9ac9954516ac096992cf654caa1fc\")\n Found reference to API \"VirtualAlloc\" (Indicator: \"VirtualAlloc\"; File: \"78d9ac9954516ac096992cf654caa1fc\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"78d9ac9954516ac096992cf654caa1fc\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"677ce7c3d6074d8cf50aefd2"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"78d9ac9954516ac096992cf654caa1fc\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"677ce7c3d6074d8cf50aefd2"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; File: \"78d9ac9954516ac096992cf654caa1fc\")\n Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"78d9ac9954516ac096992cf654caa1fc\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"78d9ac9954516ac096992cf654caa1fc\")\n Found reference to API \"OutputDebugStringA\" (Indicator: \"OutputDebugString\"; File: \"78d9ac9954516ac096992cf654caa1fc\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"677ce7c3d6074d8cf50aefd2"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"78d9ac9954516ac096992cf654caa1fc\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"78d9ac9954516ac096992cf654caa1fc\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"78d9ac9954516ac096992cf654caa1fc\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-148","sources":[{"report_type":"sandbox","report_id":"677ce7c3d6074d8cf50aefd2"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"Assembly shows XOR instruction xor eax\n ebp in Stream UID: 52148-13-00402554\n Assembly shows XOR instruction xor ecx\n ebp in Stream UID: 52148-13-00402554\n Assembly shows XOR instruction xor eax\n ebp in Stream UID: 52148-85-00404816\n Assembly shows XOR instruction xor ecx\n ebp in Stream UID: 52148-85-00404816","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"677ce7c3d6074d8cf50aefd2"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"677ce7c3d6074d8cf50aefd2"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"677ce7c3d6074d8cf50aefd2"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: Contains ability to create a new HTTP request (API string)\n Matched sigs: Found potential URL in binary/memory\n Matched sigs: Contains ability to communicate with network (API string)\n Matched sigs: Contains ability to create a HTTP or FTP session (API string)","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"677ce7c3d6074d8cf50aefd2"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"78d9ac9954516ac096992cf654caa1fc\")\n file/memory contains long string with (Indicator: \"GetCommandLine\"; File: \"sxs.dll\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"677ce7c3d6074d8cf50aefd2"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API possibly used to retrieve a handle to the foreground window","description":"\"78d9ac9954516ac096992cf654caa1fc.exe\" called \"GetForegroundWindow\" (UID: 00000000-00004688)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-142","sources":[{"report_type":"sandbox","report_id":"677ce7c3d6074d8cf50aefd2"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to enumerate active windows","description":"\"78d9ac9954516ac096992cf654caa1fc.exe\" called \"EnumWindows\" with parameter \"0\" - (UID: 00000000-00007880)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-152","sources":[{"report_type":"sandbox","report_id":"677ce7c3d6074d8cf50aefd2"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"78d9ac9954516ac096992cf654caa1fc.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00004688)\n \"78d9ac9954516ac096992cf654caa1fc.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00007880)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"677ce7c3d6074d8cf50aefd2"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$25","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"677ce7c3d6074d8cf50aefd2"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"$26","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"677ce7c3d6074d8cf50aefd2"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform scheduled transfer (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"78d9ac9954516ac096992cf654caa1fc\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"677ce7c3d6074d8cf50aefd2"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query system locale (API string)","description":"Found reference to API \"GetLocaleInfoA\" (Indicator: \"GetLocaleInfo\"; File: \"78d9ac9954516ac096992cf654caa1fc\")","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"677ce7c3d6074d8cf50aefd2"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"78d9ac9954516ac096992cf654caa1fc.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"78d9ac9954516ac096992cf654caa1fc.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"677ce7c3d6074d8cf50aefd2"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; File: \"78d9ac9954516ac096992cf654caa1fc\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"677ce7c3d6074d8cf50aefd2"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve information about the current system (API string)","description":"Found reference to API \"GetUserObjectInformationA\" (Indicator: \"GetUserObjectInformation\"; File: \"78d9ac9954516ac096992cf654caa1fc\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"677ce7c3d6074d8cf50aefd2"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"78d9ac9954516ac096992cf654caa1fc\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"677ce7c3d6074d8cf50aefd2"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"Found reference to API \"EnumWindows\" (Indicator: \"EnumWindows\"; File: \"78d9ac9954516ac096992cf654caa1fc\")\n Found reference to API \"GetActiveWindow\" (Indicator: \"GetActiveWindow\"; File: \"78d9ac9954516ac096992cf654caa1fc\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"677ce7c3d6074d8cf50aefd2"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"GetVersionExA\" (Indicator: \"GetVersionExA\"; File: \"78d9ac9954516ac096992cf654caa1fc\")\n Found reference to API \"GetVersionExA\" (Indicator: \"GetVersion\"; File: \"78d9ac9954516ac096992cf654caa1fc\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"677ce7c3d6074d8cf50aefd2"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Found reference to API \"GetStartupInfoA\" (Indicator: \"GetStartupInfo\"; File: \"78d9ac9954516ac096992cf654caa1fc\")","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-167","sources":[{"report_type":"sandbox","report_id":"677ce7c3d6074d8cf50aefd2"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"78d9ac9954516ac096992cf654caa1fc.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"677ce7c3d6074d8cf50aefd2"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"78d9ac9954516ac096992cf654caa1fc.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\78D9AC9954516AC096992CF654CAA1FC.EXE\")","origin":"Registry Access","mitre_attack_id":"T1518","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"677ce7c3d6074d8cf50aefd2"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"\"78d9ac9954516ac096992cf654caa1fc.exe\" called \"CreateProcessW\" with parameter \"\"C:\\78d9ac9954516ac096992cf654caa1fc.exe\" uac\" - (UID: 00000000-00004688)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"677ce7c3d6074d8cf50aefd2"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$27","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"677ce7c3d6074d8cf50aefd2"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$28","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"677ce7c3d6074d8cf50aefd2"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"Found reference to API \"CreateProcessA\" (Indicator: \"CreateProcess\"; File: \"78d9ac9954516ac096992cf654caa1fc\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"677ce7c3d6074d8cf50aefd2"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFileA\" (Indicator: \"CreateFile\"; File: \"78d9ac9954516ac096992cf654caa1fc\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"677ce7c3d6074d8cf50aefd2"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically determine API calls","description":"Found GetProcAddress() and LoadLibraryA() in an import section (Source: 78d9ac9954516ac096992cf654caa1fc)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: sxs.dll)","origin":"Static Parser","mitre_attack_id":"T1027.007","relevance":1,"id":"static-79","sources":[{"report_type":"sandbox","report_id":"677ce7c3d6074d8cf50aefd2"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$29","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"677ce7c3d6074d8cf50aefd2"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Found reference to API \"ShellExecuteExA\" (Indicator: \"ShellExecute\"; File: \"78d9ac9954516ac096992cf654caa1fc\")\n Found reference to API \"WinExec\" (Indicator: \"WinExec\"; File: \"78d9ac9954516ac096992cf654caa1fc\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-240","sources":[{"report_type":"sandbox","report_id":"677ce7c3d6074d8cf50aefd2"}]},{"level":"informative","category":"General","name":"Contains ability to executes commands or batch file","description":"Found string \"c:\\WINDOWS\\system32\\cmd.exe /c net user >c:\\Users\\zqp\\AppData\\Local\\Temp\\rrr.txt\" (Indicator: \"\\system32\\cmd.exe /c \"; File: \"78d9ac9954516ac096992cf654caa1fc\")\n Found string \"c:\\WINDOWS\\system32\\cmd.exe /c net user >c:\\Users\\zqp\\AppData\\Local\\Temp\\rrr.txt\" (Indicator: \"cmd.exe /c\"; File: \"78d9ac9954516ac096992cf654caa1fc\")\n Found string \"%s\\cmd.exe /c %s >%s\" (Indicator: \"cmd.exe /c\"; File: \"78d9ac9954516ac096992cf654caa1fc\")\n Found string \"%s\\cmd.exe /c %s\" (Indicator: \"cmd.exe /c\"; File: \"78d9ac9954516ac096992cf654caa1fc\")\n file/memory contains long string with (Indicator: \"\\system32\\cmd.exe /c \"; File: \"sxs.dll\")\n file/memory contains long string with (Indicator: \"cmd.exe /c\"; File: \"sxs.dll\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-174","sources":[{"report_type":"sandbox","report_id":"677ce7c3d6074d8cf50aefd2"}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"Found reference to API \"LoadResource\" (Indicator: \"LoadResource\"; File: \"78d9ac9954516ac096992cf654caa1fc\")\n Found reference to API \"LockResource\" (Indicator: \"LockResource\"; File: \"78d9ac9954516ac096992cf654caa1fc\")\n Found reference to API \"SizeofResource\" (Indicator: \"SizeofResource\"; File: \"78d9ac9954516ac096992cf654caa1fc\")\n Found reference to API \"FindResourceA\" (Indicator: \"FindResource\"; File: \"78d9ac9954516ac096992cf654caa1fc\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-550","sources":[{"report_type":"sandbox","report_id":"677ce7c3d6074d8cf50aefd2"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"78d9ac9954516ac096992cf654caa1fc\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"677ce7c3d6074d8cf50aefd2"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"78d9ac9954516ac096992cf654caa1fc\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"677ce7c3d6074d8cf50aefd2"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/open a process (API string)","description":"Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; File: \"78d9ac9954516ac096992cf654caa1fc\")\n Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; File: \"78d9ac9954516ac096992cf654caa1fc\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"677ce7c3d6074d8cf50aefd2"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; File: \"78d9ac9954516ac096992cf654caa1fc\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; File: \"78d9ac9954516ac096992cf654caa1fc\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"677ce7c3d6074d8cf50aefd2"}]},{"level":"informative","category":"General","name":"Contains export functions","description":"\"sxs.dll\" contains export function called \"fuc_trend\" at ordinal 1","origin":"Static Parser","relevance":1,"id":"static-78","sources":[{"report_type":"sandbox","report_id":"677ce7c3d6074d8cf50aefd2"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"Local\\SM0:4688:168:WilStaging_02\"\n \"Local\\SM0:4688:64:WilError_01\"\n \"SM0:4688:64:WilError_01\"\n \"Local\\ZonesCacheCounterMutex\"\n \"Local\\ZonesLockedCacheCounterMutex\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"677ce7c3d6074d8cf50aefd2"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$2a","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"677ce7c3d6074d8cf50aefd2"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"78d9ac9954516ac096992cf654caa1fc.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 73C20000\n \"78d9ac9954516ac096992cf654caa1fc.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 72970000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"677ce7c3d6074d8cf50aefd2"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"78d9ac9954516ac096992cf654caa1fc.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 74D40000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"677ce7c3d6074d8cf50aefd2"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"78d9ac9954516ac096992cf654caa1fc\" was detected as \"EP:Microsoft Visual C/C++\" and name: \"Compiler\"\n \"78d9ac9954516ac096992cf654caa1fc\" was detected as \"Microsoft Visual C/C++\" and name: \"Compiler\"\n \"78d9ac9954516ac096992cf654caa1fc\" was detected as \"Microsoft Linker\" and name: \"Linker\"\n \"sxs.dll\" was detected as \"EP:Microsoft Visual C/C++\" and name: \"Compiler\"\n \"sxs.dll\" was detected as \"Microsoft Visual C/C++\" and name: \"Compiler\"\n \"sxs.dll\" was detected as \"Microsoft Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"677ce7c3d6074d8cf50aefd2"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$2b","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"677ce7c3d6074d8cf50aefd2"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"78d9ac9954516ac096992cf654caa1fc\" has an executable section named \".text\"\n \"sxs.dll\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"677ce7c3d6074d8cf50aefd2"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"78d9ac9954516ac096992cf654caa1fc\" has an writable section named \".data\"\n \"sxs.dll\" has an writable section named \".data\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"677ce7c3d6074d8cf50aefd2"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"$2c","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"677ce7c3d6074d8cf50aefd2"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"78d9ac9954516ac096992cf654caa1fc.exe\" (UID: 00000000-00007880) was launched with new environment variables: \"PROCESSOR_ARCHITEW6432=\"AMD64\"\"\n Process \"78d9ac9954516ac096992cf654caa1fc.exe\" (UID: 00000000-00007880) was launched with modified environment variables: \"PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles\"","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"677ce7c3d6074d8cf50aefd2"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"78d9ac9954516ac096992cf654caa1fc.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")\n \"78d9ac9954516ac096992cf654caa1fc.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"78d9ac9954516ac096992cf654caa1fc.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"677ce7c3d6074d8cf50aefd2"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"78d9ac9954516ac096992cf654caa1fc.exe\" with commandline \"uac\" (UID: 00000000-00007880)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"677ce7c3d6074d8cf50aefd2"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"78d9ac9954516ac096992cf654caa1fc.exe\" with commandline \"uac\" (UID: 00000000-00007880)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"677ce7c3d6074d8cf50aefd2"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"78d9ac9954516ac096992cf654caa1fc\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"sxs.dll\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"677ce7c3d6074d8cf50aefd2"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"78d9ac9954516ac096992cf654caa1fc\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"677ce7c3d6074d8cf50aefd2"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"78d9ac9954516ac096992cf654caa1fc.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"677ce7c3d6074d8cf50aefd2"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"\"sxs.dll\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"- Location: [%PROGRAMFILES%\\(x86)\\Internet Explorer\\sxs.dll]- [targetUID: 00000000-00007880]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"677ce7c3d6074d8cf50aefd2"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$2d","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"677ce7c3d6074d8cf50aefd2"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"78d9ac9954516ac096992cf654caa1fc.exe\" queries basic process information of the \"C:\\78d9ac9954516ac096992cf654caa1fc.exe\" (UID: 4688)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"677ce7c3d6074d8cf50aefd2"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$2e","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"677ce7c3d6074d8cf50aefd2"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"78d9ac9954516ac096992cf654caa1fc.exe\" reads file \"c:\\users\\%osuser%\\desktop\\desktop.ini\"\n \"78d9ac9954516ac096992cf654caa1fc.exe\" reads file \"c:\\users\\%osuser%\\documents\\desktop.ini\"\n \"78d9ac9954516ac096992cf654caa1fc.exe\" reads file \"c:\\users\\%osuser%\\music\\desktop.ini\"\n \"78d9ac9954516ac096992cf654caa1fc.exe\" reads file \"c:\\users\\%osuser%\\pictures\\desktop.ini\"\n \"78d9ac9954516ac096992cf654caa1fc.exe\" reads file \"c:\\users\\%osuser%\\videos\\desktop.ini\"\n \"78d9ac9954516ac096992cf654caa1fc.exe\" reads file \"c:\\users\\%osuser%\\downloads\\desktop.ini\"\n \"78d9ac9954516ac096992cf654caa1fc.exe\" reads file \"c:\\users\\%osuser%\\onedrive\\desktop.ini\"\n \"78d9ac9954516ac096992cf654caa1fc.exe\" reads file \"c:\\78d9ac9954516ac096992cf654caa1fc.exe:zone.identifier\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"677ce7c3d6074d8cf50aefd2"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Able to identify virtual environment by using user activity (API string)\n Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"677ce7c3d6074d8cf50aefd2"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$2f","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"677ce7c3d6074d8cf50aefd2"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in program files directory","description":"\"78d9ac9954516ac096992cf654caa1fc.exe\" touched file \"C:\\Program Files (x86)\\Internet Explorer\\sxs.dll\"","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-113","sources":[{"report_type":"sandbox","report_id":"677ce7c3d6074d8cf50aefd2"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"\"78d9ac9954516ac096992cf654caa1fc.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\Caches\"\n \"78d9ac9954516ac096992cf654caa1fc.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\"","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"677ce7c3d6074d8cf50aefd2"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$30","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"677ce7c3d6074d8cf50aefd2"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"78d9ac9954516ac096992cf654caa1fc.exe\" writes file \"c:\\program files (x86)\\internet explorer\\sxs.dll\"\n \"78d9ac9954516ac096992cf654caa1fc.exe\" writes file \"%programfiles%\\(x86)\\internet explorer\\sxs.dll\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"677ce7c3d6074d8cf50aefd2"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with C2 using Sockets (API string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; File: \"78d9ac9954516ac096992cf654caa1fc\")","origin":"File/Memory","mitre_attack_id":"T1095","relevance":1,"id":"string-228","sources":[{"report_type":"sandbox","report_id":"677ce7c3d6074d8cf50aefd2"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"Found reference to API \"HttpSendRequest failed\" (Indicator: \"HttpSendRequest\"; File: \"78d9ac9954516ac096992cf654caa1fc\")\n Found reference to API \"InternetReadFile\" (Indicator: \"InternetReadFile\"; File: \"78d9ac9954516ac096992cf654caa1fc\")\n Found reference to API \"HttpSendRequestA\" (Indicator: \"HttpSendRequest\"; File: \"78d9ac9954516ac096992cf654caa1fc\")\n Found reference to API \"HttpOpenRequestA\" (Indicator: \"HttpOpenRequest\"; File: \"78d9ac9954516ac096992cf654caa1fc\")\n Found reference to API \"InternetConnectA\" (Indicator: \"InternetConnect\"; File: \"78d9ac9954516ac096992cf654caa1fc\")\n Found reference to API \"InternetOpenA\" (Indicator: \"InternetOpen\"; File: \"78d9ac9954516ac096992cf654caa1fc\")\n Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; File: \"78d9ac9954516ac096992cf654caa1fc\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"677ce7c3d6074d8cf50aefd2"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create a HTTP or FTP session (API string)","description":"Found reference to API \"InternetConnectA\" (Indicator: \"InternetConnect\"; File: \"78d9ac9954516ac096992cf654caa1fc\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-538","sources":[{"report_type":"sandbox","report_id":"677ce7c3d6074d8cf50aefd2"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create a new HTTP request (API string)","description":"Found reference to API \"HttpOpenRequestA\" (Indicator: \"HttpOpenRequest\"; File: \"78d9ac9954516ac096992cf654caa1fc\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-537","sources":[{"report_type":"sandbox","report_id":"677ce7c3d6074d8cf50aefd2"}]},{"level":"informative","category":"Network Related","name":"Contains ability to download a file from a URL (API string)","description":"Found reference to API \"InternetReadFile\" (Indicator: \"InternetReadFile\"; File: \"78d9ac9954516ac096992cf654caa1fc\")","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-241","sources":[{"report_type":"sandbox","report_id":"677ce7c3d6074d8cf50aefd2"}]},{"level":"informative","category":"Network Related","name":"Contains ability to retrieve internet settings (API string)","description":"Found reference to API \"InternetQueryOptionA\" (Indicator: \"InternetQueryOption\"; File: \"78d9ac9954516ac096992cf654caa1fc\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-314","sources":[{"report_type":"sandbox","report_id":"677ce7c3d6074d8cf50aefd2"}]},{"level":"informative","category":"Network Related","name":"Contains ability to upload file/data","description":"$31","origin":"File/Memory","mitre_attack_id":"T1041","relevance":1,"id":"string-511","sources":[{"report_type":"sandbox","report_id":"677ce7c3d6074d8cf50aefd2"}]},{"level":"informative","category":"Network Related","name":"Contains reference to Windows internet services (API string)","description":"Found reference to API \"InternetOpenA\" (Indicator: \"InternetOpen\"; File: \"78d9ac9954516ac096992cf654caa1fc\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-539","sources":[{"report_type":"sandbox","report_id":"677ce7c3d6074d8cf50aefd2"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"www.setchon.com\"\n Pattern match: \"explorerdllmain...http/1.1mydownloadsendrequest\"","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"677ce7c3d6074d8cf50aefd2"}]},{"level":"informative","category":"Network Related","name":"Found string related to HTTP headers","description":"Found string \"HTTP/1.1\" (Indicator: \"HTTP/1.1\"; File: \"78d9ac9954516ac096992cf654caa1fc\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-457","sources":[{"report_type":"sandbox","report_id":"677ce7c3d6074d8cf50aefd2"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e\n Observed JA3 fingerprint: bd0bf25947d4a37404f0424edf4db9ad","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"677ce7c3d6074d8cf50aefd2"}]},{"level":"informative","category":"Network Related","name":"Making HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"677ce7c3d6074d8cf50aefd2"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - PE executable embedded in .rsrc section","description":"YARA signature for embedded PE executable in .rsrc section matched on file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1027.009","relevance":5,"id":"yara-26","sources":[{"report_type":"sandbox","report_id":"677ce7c3d6074d8cf50aefd2"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match – Embedded PE executable","description":"YARA signature matched on embedded PE in file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1027.009","relevance":2,"id":"yara-140","sources":[{"report_type":"sandbox","report_id":"677ce7c3d6074d8cf50aefd2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"78d9ac9954516ac096992cf654caa1fc.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"677ce7c3d6074d8cf50aefd2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"Found reference to API \"GetEnvironmentStringsW\" (Indicator: \"GetEnvironmentStrings\"; File: \"78d9ac9954516ac096992cf654caa1fc\")\n Found reference to API \"GetCurrentProcess\" (Indicator: \"GetCurrentProcess\"; File: \"78d9ac9954516ac096992cf654caa1fc\")\n Found reference to API \"GetEnvironmentStrings\" (Indicator: \"GetEnvironmentStrings\"; File: \"78d9ac9954516ac096992cf654caa1fc\")\n Found reference to API \"GetCurrentProcessId\" (Indicator: \"GetCurrentProcess\"; File: \"78d9ac9954516ac096992cf654caa1fc\")\n Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; File: \"78d9ac9954516ac096992cf654caa1fc\")\n Found reference to API \"EnumProcessModules\" (Indicator: \"EnumProcessModules\"; File: \"78d9ac9954516ac096992cf654caa1fc\")\n Found reference to API \"EnumProcesses\" (Indicator: \"EnumProcesses\"; File: \"78d9ac9954516ac096992cf654caa1fc\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"677ce7c3d6074d8cf50aefd2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; File: \"78d9ac9954516ac096992cf654caa1fc\")","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"677ce7c3d6074d8cf50aefd2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; File: \"78d9ac9954516ac096992cf654caa1fc\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"677ce7c3d6074d8cf50aefd2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"78d9ac9954516ac096992cf654caa1fc\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"677ce7c3d6074d8cf50aefd2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"Found reference to API \"GetFileSize\" (Indicator: \"GetFileSize\"; File: \"78d9ac9954516ac096992cf654caa1fc\")\n Found reference to API \"GetSystemDirectoryA\" (Indicator: \"GetSystemDirectory\"; File: \"78d9ac9954516ac096992cf654caa1fc\")\n Found reference to API \"GetTempPathA\" (Indicator: \"GetTempPath\"; File: \"78d9ac9954516ac096992cf654caa1fc\")\n Found reference to API \"GetFileAttributesA\" (Indicator: \"GetFileAttributes\"; File: \"78d9ac9954516ac096992cf654caa1fc\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"677ce7c3d6074d8cf50aefd2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; File: \"78d9ac9954516ac096992cf654caa1fc\")\n Found reference to API \"GetModuleFileNameExA\" (Indicator: \"GetModuleFileName\"; File: \"78d9ac9954516ac096992cf654caa1fc\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"677ce7c3d6074d8cf50aefd2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host name of a computer (API string)","description":"Found reference to API \"gethostname\" (Indicator: \"gethostname\"; File: \"78d9ac9954516ac096992cf654caa1fc\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-532","sources":[{"report_type":"sandbox","report_id":"677ce7c3d6074d8cf50aefd2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"78d9ac9954516ac096992cf654caa1fc\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"677ce7c3d6074d8cf50aefd2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve usernames and/or user information (API string)","description":"Found reference to API \"GetProcessWindowStation\" (Indicator: \"GetProcessWindowStation\"; File: \"78d9ac9954516ac096992cf654caa1fc\")\n Found reference to API \"GetUserObjectInformationA\" (Indicator: \"GetUserObjectInformation\"; File: \"78d9ac9954516ac096992cf654caa1fc\")\n Found reference to API \"GetUserNameA\" (Indicator: \"GetUserName\"; File: \"78d9ac9954516ac096992cf654caa1fc\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"677ce7c3d6074d8cf50aefd2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Imports GetCommandLine API","description":"Observed import api \"GetCommandLineA\" which can \"Retrieves the command-line string for the current process\" [Source: 78d9ac9954516ac096992cf654caa1fc]\n Observed import api \"GetCommandLineA\" which can \"Retrieves the command-line string for the current process\" [Source: sxs.dll]","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-88","sources":[{"report_type":"sandbox","report_id":"677ce7c3d6074d8cf50aefd2"}]},{"level":"informative","category":"System Security","name":"Contains ability to create local account","description":"Found string \"c:\\WINDOWS\\system32\\cmd.exe /c net user >c:\\Users\\zqp\\AppData\\Local\\Temp\\rrr.txt\" (Indicator: \"net user \"; File: \"78d9ac9954516ac096992cf654caa1fc\")\n file/memory contains long string with (Indicator: \"net user \"; File: \"sxs.dll\")","origin":"File/Memory","mitre_attack_id":"T1136.001","relevance":1,"id":"string-528","sources":[{"report_type":"sandbox","report_id":"677ce7c3d6074d8cf50aefd2"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"DeleteFileA\" (Indicator: \"DeleteFile\"; File: \"78d9ac9954516ac096992cf654caa1fc\")","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"677ce7c3d6074d8cf50aefd2"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; File: \"78d9ac9954516ac096992cf654caa1fc\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; File: \"78d9ac9954516ac096992cf654caa1fc\")\n Found reference to API \"CorExitProcess\" (Indicator: \"ExitProcess\"; File: \"78d9ac9954516ac096992cf654caa1fc\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"677ce7c3d6074d8cf50aefd2"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"78d9ac9954516ac096992cf654caa1fc\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"677ce7c3d6074d8cf50aefd2"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"\"78d9ac9954516ac096992cf654caa1fc.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\USERSETTINGS\\S-1-5-21-735145574-3570218355-1207367261-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME2\\78D9AC9954516AC096992CF654CAA1FC.EXE\"; Value: \"\")","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"677ce7c3d6074d8cf50aefd2"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"Found reference to API \"CreateMutexA\" (Indicator: \"CreateMutex\"; File: \"78d9ac9954516ac096992cf654caa1fc\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-354","sources":[{"report_type":"sandbox","report_id":"677ce7c3d6074d8cf50aefd2"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"78d9ac9954516ac096992cf654caa1fc\" was detected as \"VC8 -> Microsoft Corporation\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"677ce7c3d6074d8cf50aefd2"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"78d9ac9954516ac096992cf654caa1fc.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"677ce7c3d6074d8cf50aefd2"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries kernel debugger information","description":"\"78d9ac9954516ac096992cf654caa1fc.exe\" at 00000000-00004688-00000C13-757689606","origin":"API Call","mitre_attack_id":"T1622","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"677ce7c3d6074d8cf50aefd2"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries process information","description":"\"78d9ac9954516ac096992cf654caa1fc.exe\" queried SystemProcessInformation at 00000000-00004688-00000C13-757120998 [PID: 4688]\n \"78d9ac9954516ac096992cf654caa1fc.exe\" queried SystemProcessInformation at 00000000-00004688-00000C13-757130903 [PID: 4688]\n \"78d9ac9954516ac096992cf654caa1fc.exe\" queried SystemProcessInformation at 00000000-00007880-00000C13-758178867 [PID: 7880]\n \"78d9ac9954516ac096992cf654caa1fc.exe\" queried SystemProcessInformation at 00000000-00007880-00000C13-758188361 [PID: 7880]","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"677ce7c3d6074d8cf50aefd2"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"section contains high entropy","description":"\"78d9ac9954516ac096992cf654caa1fc\" has section name .text with entropy \"6.60559638048\"\n \"78d9ac9954516ac096992cf654caa1fc\" has section name .rsrc with entropy \"6.22873601259\"\n \"sxs.dll\" has section name .text with entropy \"6.59768357849\"","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"677ce7c3d6074d8cf50aefd2"}]},{"level":"suspicious","category":"General","name":"Reads configuration files (.ini files)","description":"\"78d9ac9954516ac096992cf654caa1fc.exe\" reads file \"C:\\Users\\%OSUSER%\\Desktop\\desktop.ini\"\n \"78d9ac9954516ac096992cf654caa1fc.exe\" reads file \"C:\\Users\\%OSUSER%\\Documents\\desktop.ini\"\n \"78d9ac9954516ac096992cf654caa1fc.exe\" reads file \"C:\\Users\\%OSUSER%\\Music\\desktop.ini\"\n \"78d9ac9954516ac096992cf654caa1fc.exe\" reads file \"C:\\Users\\%OSUSER%\\Pictures\\desktop.ini\"\n \"78d9ac9954516ac096992cf654caa1fc.exe\" reads file \"C:\\Users\\%OSUSER%\\Videos\\desktop.ini\"\n \"78d9ac9954516ac096992cf654caa1fc.exe\" reads file \"C:\\Users\\%OSUSER%\\Downloads\\desktop.ini\"\n \"78d9ac9954516ac096992cf654caa1fc.exe\" reads file \"C:\\Users\\%OSUSER%\\OneDrive\\desktop.ini\"","origin":"API Call","mitre_attack_id":"T1083","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"677ce7c3d6074d8cf50aefd2"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"\"sxs.dll\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"- Location: [%PROGRAMFILES%\\(x86)\\Internet Explorer\\sxs.dll]- [targetUID: 00000000-00007880]","origin":"Binary File","mitre_attack_id":"T1105","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"677ce7c3d6074d8cf50aefd2"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes a PE file header to disc","description":"\"78d9ac9954516ac096992cf654caa1fc.exe\" wrote 14848 bytes starting with PE header signature to file \"C:\\Program Files (x86)\\Internet Explorer\\sxs.dll\": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...","origin":"API Call","mitre_attack_id":"T1105","relevance":10,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"677ce7c3d6074d8cf50aefd2"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"78d9ac9954516ac096992cf654caa1fc.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\"; Value: \"01000000\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"677ce7c3d6074d8cf50aefd2"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"GetVersionExA\n GetModuleFileNameA\n LoadLibraryA\n LockResource\n UnhandledExceptionFilter\n GetCommandLineA\n GetProcAddress\n GetModuleHandleA\n WriteFile\n GetStartupInfoA\n TerminateProcess\n IsDebuggerPresent\n Sleep\n CreateFileA\n GetTickCount\n FindResourceA\n VirtualAlloc\n ShellExecuteExA\n GetUserNameA\n GetFileAttributesA\n WinExec\n OpenProcess\n DeleteFileA\n GetTempPathA\n CreateThread\n GetSystemDirectoryA\n ExitThread\n OutputDebugStringA\n CreateProcessA\n GetFileSize\n HttpSendRequestA\n InternetCloseHandle\n InternetOpenA\n InternetConnectA\n InternetQueryOptionA\n InternetReadFile\n WSAStartup","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"677ce7c3d6074d8cf50aefd2"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Creates a process in suspended mode (likely for process injection)","description":"\"78d9ac9954516ac096992cf654caa1fc.exe\" called \"CreateProcessW\" with parameter \"\"C:\\78d9ac9954516ac096992cf654caa1fc.exe\" uac\" - (UID: 00000000-00004688)","origin":"API Call","mitre_attack_id":"T1055","relevance":10,"id":"api-129","sources":[{"report_type":"sandbox","report_id":"677ce7c3d6074d8cf50aefd2"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"PE file contains executable resources","description":"78d9ac9954516ac096992cf654caa1fc has PE file in resource with name: \"DATA\" and filetype:PE32 executable (DLL) (GUI) Intel 80386\n for MS Windows","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":10,"id":"static-97","sources":[{"report_type":"sandbox","report_id":"677ce7c3d6074d8cf50aefd2"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"677ce7c3d6074d8cf50aefd2"}]},{"level":"malicious","category":"General","name":"The analysis spawned a process that was identified as malicious","description":"27/41 Antivirus vendors marked spawned process \"78d9ac9954516ac096992cf654caa1fc.exe\" (PID: 7880) as malicious (classified as \"Gen:Variant.Zusy\" with 65% detection rate)","origin":"Monitored Target","mitre_attack_id":"T1204.002","relevance":10,"id":"target-58","sources":[{"report_type":"sandbox","report_id":"677ce7c3d6074d8cf50aefd2"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"\"78d9ac9954516ac096992cf654caa1fc.exe\" wrote 00000004 bytes to a remote process \"C:\\78d9ac9954516ac096992cf654caa1fc.exe\" (Handle: 1068)","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"677ce7c3d6074d8cf50aefd2"}]}],"incidents":[{"name":"Persistence","details_count":1,"details":[{"detail":"Writes data to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"677ce7c3d6074d8cf50aefd2"}]},{"name":"Fingerprint","details_count":4,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Queries process information"},{"detail":"Queries sensitive IE security settings"},{"detail":"Queries the display settings of system associated file extensions"}],"sources":[{"report_type":"sandbox","report_id":"677ce7c3d6074d8cf50aefd2"}]}]},"activity":{"stats":{"process_count":2,"spawned_processes_count":2,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":5,"imported_dlls_count":53,"dropped_files_count":0,"extracted_files_count":1,"files_written_count":2,"files_deleted_count":0,"registry_keys_created_count":1,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":1,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["daggerpanda","fucobha","icefog","targeted"],"sample_flags":["Multi-Process","Extracted Files"],"sandbox_reports":[{"id":"677ce7c3d6074d8cf50aefd2","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"submit_name":"78d9ac9954516ac096992cf654caa1fc","analysis_start_time":"2025-01-07T08:37:23+00:00","indicators_count":{"informative":103,"suspicious":18,"malicious":5},"tags":["Multi-Process","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"677ce7c3d6074d8cf50aefd2"}],"processes":[{"pid":4688,"ppid":0,"name":"78d9ac9954516ac096992cf654caa1fc.exe","command_line":"","sha256":"ccd4e6d67224c9ed683a8fab1f23580923aada973369d97eb8fc2555afd2d9ea","normalized_path":"C:\\78d9ac9954516ac096992cf654caa1fc.exe","uid":"00000000-00004688","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="},{"pid":7880,"ppid":4688,"name":"78d9ac9954516ac096992cf654caa1fc.exe","command_line":"uac","sha256":"ccd4e6d67224c9ed683a8fab1f23580923aada973369d97eb8fc2555afd2d9ea","normalized_path":"C:\\78d9ac9954516ac096992cf654caa1fc.exe","parent_uid":"00000000-00004688","uid":"00000000-00007880"}],"all_imported_dlls":["profapi.dll","advapi32.dll","powrprof.dll","win32u.dll","imm32.dll","VxSSL32.dll","ws2_32.dll","cryptsp.dll","oleaut32.dll","kernel32.dll","msvcp_win.dll","cldapi.dll","ntmarta.dll","clbcatq.dll","sfc_os.dll","cryptbase.dll","shlwapi.dll","aepic.dll","urlmon.dll","imagehlp.dll","mpr.dll","windows.storage.dll","user32.dll","cfgmgr32.dll","kernel.appcore.dll","wow64.dll","KernelBase.dll","msvcrt.dll","SHCore.dll","sspicli.dll","bcryptprimitives.dll","fltLib.dll","ntdll.dll","rpcrt4.dll","ole32.dll","uxtheme.dll","bcrypt.dll","iertutil.dll","msIso.dll","pcacli.dll","wow64win.dll","ucrtbase.dll","propsys.dll","edputil.dll","Windows.StateRepositoryPS.dll","setupapi.dll","wow64cpu.dll","apphelp.dll","gdi32.dll","gdi32full.dll","shell32.dll","sechost.dll","combase.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"sxs.dll","sha256":"602af65ea3c8cdc09d14a16edf2b359c3b579aa6e3c7e077434d0be39cdd0631","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"677ce7c3d6074d8cf50aefd2"}]}],"files_written":[{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"677ce7c3d6074d8cf50aefd2"}]},{"path":"%PROGRAMFILES%\\(x86)\\Internet Explorer\\sxs.dll","sources":[{"report_type":"sandbox","report_id":"677ce7c3d6074d8cf50aefd2"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"677ce7c3d6074d8cf50aefd2"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"Local\\SM0:4688:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"677ce7c3d6074d8cf50aefd2"}]},{"name":"Local\\SM0:4688:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"677ce7c3d6074d8cf50aefd2"}]},{"name":"SM0:4688:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"677ce7c3d6074d8cf50aefd2"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"677ce7c3d6074d8cf50aefd2"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"677ce7c3d6074d8cf50aefd2"}]}]}},"report_ids":{"sandbox_job_ids":["677ce7c3d6074d8cf50aefd2"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Dropper.Trojan.Generic Sample ccd4e6d67224… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample ccd4e6d67224…. Malware family: Dropper.Trojan.Generic. Threat score 100/100. 17/23 AV engines flagged this file. 5 malicious and 8 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/ccd4e6d67224c9ed683a8fab1f23580923aada973369d97eb8fc2555afd2d9ea"}],["$","meta","4",{"property":"og:title","content":"Malicious Dropper.Trojan.Generic Sample ccd4e6d67224… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample ccd4e6d67224…. Malware family: Dropper.Trojan.Generic. Threat score 100/100. 17/23 AV engines flagged this file. 5 malicious and 8 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/ccd4e6d67224c9ed683a8fab1f23580923aada973369d97eb8fc2555afd2d9ea"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Dropper.Trojan.Generic Sample ccd4e6d67224… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample ccd4e6d67224…. Malware family: Dropper.Trojan.Generic. Threat score 100/100. 17/23 AV engines flagged this file. 5 malicious and 8 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L32","11",{}]]