26:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 42:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 25:T4c1,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win/malicious_confidence_100% Sample e5262db186c9… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample e5262db186c9…. Malware family: Win/malicious_confidence_100%. Threat score 100/100. 24/27 AV engines flagged this file. 6 malicious and 23 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60","keywords":["Malicious","Win/malicious_confidence_100%","malware analysis","sandbox report","threat intelligence","e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60"],"about":{"@type":"SoftwareApplication","name":"update.bin","applicationCategory":["peexe","executable"],"identifier":"e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Win/malicious_confidence_100%","antivirusDetections":{"malicious":24,"total":27},"behavioralIndicators":{"malicious":6,"suspicious":23},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:Tdde,Heuristic match: "*reflect.name" Heuristic match: "*runtime.name" Heuristic match: "runtime.(*functype).in" Heuristic match: "runtime.(*bucket).mp" Heuristic match: "runtime.(*Func).Name" Heuristic match: "runtime.(*_type).name" Heuristic match: "runtime.name.name" Heuristic match: "runtime.(*name).name" Heuristic match: "sync.(*Once).Do" Heuristic match: "os.(*File).Name" Heuristic match: "os.(*fileStat).Name" Heuristic match: "unicode.In" Heuristic match: "unicode.Is" Heuristic match: "unicode.to" Heuristic match: "unicode.To" Heuristic match: "reflect.name.name" Heuristic match: "reflect.(*funcType).in" Heuristic match: "reflect.(*rtype).Name" Heuristic match: "reflect.(*rtype).In" Heuristic match: "reflect.flag.ro" Heuristic match: "reflect.Value.Int" Heuristic match: "reflect.(*name).name" Heuristic match: "reflect.(*structType).Name" Heuristic match: "reflect.(*structType).In" Heuristic match: "reflect.(*funcType).Name" Heuristic match: "reflect.(*funcType).In" Heuristic match: "reflect.(*funcTypeFixed128).Name" Heuristic match: "reflect.(*funcTypeFixed128).In" Heuristic match: "reflect.(*funcTypeFixed16).Name" Heuristic match: "reflect.(*funcTypeFixed16).In" Heuristic match: "reflect.(*funcTypeFixed32).Name" Heuristic match: "reflect.(*funcTypeFixed32).In" Heuristic match: "reflect.(*funcTypeFixed4).Name" Heuristic match: "reflect.(*funcTypeFixed4).In" Heuristic match: "reflect.(*funcTypeFixed64).Name" Heuristic match: "reflect.(*funcTypeFixed64).In" Heuristic match: "reflect.(*funcTypeFixed8).Name" Heuristic match: "reflect.(*funcTypeFixed8).In" Heuristic match: "reflect.(*interfaceType).Name" Heuristic match: "*big.Int" Heuristic match: "type..eq.struct { runtime.full runtime.lfstack; runtime.empty runtime.lfstack; runtime.pad0 [64]uint8; runtime.wbufSpans struct { runtime.lock runtime.mutex; runtime.free runtime.mSpanList; runtime.busy runtime.mSpanList }; _ uint32; runtime.bytesMarked ui" Heuristic match: "reflect.(*interfaceType).In" Heuristic match: "reflect.(*ptrType).Name" Heuristic match: "reflect.(*ptrType).In" Heuristic match: "reflect.(*sliceType).Name" Heuristic match: "reflect.(*sliceType).In" Pattern match: "type..hash.math/rand.Rand" Pattern match: "type..eq.math/rand.Rand" Pattern match: "type..hash.math/rand.lockedSource" Pattern match: "type..eq.math/rand.lockedSource" Heuristic match: "math/big.(*decimal).at" Heuristic match: "encoding/gob.typeId.name" Heuristic match: "encoding/gob.(*CommonType).id" Heuristic match: "encoding/gob.(*CommonType).name" Heuristic match: "encoding/gob.(*sliceType).id" Heuristic match: "encoding/gob.(*sliceType).name" Heuristic match: "encoding/gob.(*structType).id" Heuristic match: "encoding/gob.(*structType).name" Heuristic match: "encoding/gob.(*arrayType).id" Heuristic match: "encoding/gob.(*arrayType).name" Heuristic match: "encoding/gob.(*gobEncoderType).id" Heuristic match: "encoding/gob.(*gobEncoderType).name" Heuristic match: "encoding/gob.(*mapType).id" Heuristic match: "encoding/gob.(*mapType).name" Heuristic match: "encoding/gob.(*typeId).name" Heuristic match: "regexp/syntax.(*compiler).cat" Heuristic match: "regexp/syntax.bw" Heuristic match: "jobnhbgnnifpodhhpkmf/ciffbcdgbdlnejkjfbjk/pbijaooedmdfdbnenbcm.Hhchnmfhohgpckopgkbi.Name" Heuristic match: "jobnhbgnnifpodhhpkmf/ciffbcdgbdlnejkjfbjk/pbijaooedmdfdbnenbcm.(*jppjnkbpecjlbbcaeifm).Name" Heuristic match: "jobnhbgnnifpodhhpkmf/ciffbcdgbdlnejkjfbjk/pbijaooedmdfdbnenbcm.(*Hhchnmfhohgpckopgkbi).Name"28:T454,Observed string: "{queuefinalizer during GCreflect.Value.SetComplexrunqsteal: runq overflowruntime: VirtualFree of runtime: found obj at *(span has no free objectsstack trace unavailablestructure needs cleaningunexpected exponent baseunexpected mantissa basev" (Indicator: "VirtualFree") in Source: e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin Observed string: "missing stack in newstackmissing traceGCSweepStartno buffer space availableno such device or addressno such network interfaceno suitable address foundoperation now in progressreflect: Bits of nil Typereleasep: invalid p stateresource deadlock avoidedruntime: t.spanKey= runtime: VirtualAlloc of runtime: program exceeds runtime" (Indicator: "VirtualAlloc") in Source: e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin Observed string: "VirtualFree" (Indicator: "VirtualFree") in Source: e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin Observed string: "VirtualAlloc" (Indicator: "VirtualAlloc") in Source: e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin29:T180c,Observed string: "crypto/aes" (Indicator: "crypto/aes") in Source: e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin Observed string: "crypto/md5" (Indicator: "crypto/md5") in Source: e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin Observed string: "crypto/rsa" (Indicator: "crypto/rsa") in Source: e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin Observed string: "crypto/rand" (Indicator: "crypto/rand") in Source: e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin Observed string: "crypto/sha1" (Indicator: "crypto/sha1") in Source: e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin Observed string: "crypto/x509" (Indicator: "crypto/x509") in Source: e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin Observed string: "crypto/cipher" (Indicator: "crypto/cipher") in Source: e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin Observed string: "crypto/sha256" (Indicator: "crypto/sha256") in Source: e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin Observed string: "crypto/sha512" (Indicator: "crypto/sha512") in Source: e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin Observed string: "addspecial on invalid pointerbufio.Scanner: token too longcrypto/aes: invalid key size e" (Indicator: "addspecial on invalid pointerbufio.Scanner: token too longcrypto/aes: invalid key size e") in Source: e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin Observed string: "abi mismatch detected between assignment to entry in nil mapattempt to register empty namecheckdead: inconsistent countscrypto/dsa: invalid public keycrypto/rsa: verification errorfailed to get system page sizefreedefer with d._panic != nilin exponent of numeric literalinappropriate ioctl for deviceinvalid function symbol tableinvalid network interface nameinvalid pointer found on stacklooking for beginning of valuen" (Indicator: "abi mismatch detected between assignment to entry in nil mapattempt to register empty namecheckdead: inconsistent countscrypto/dsa: invalid public keycrypto/rsa: verification errorfailed to get system page sizefreedefer with d._panic != nilin exponent of numeric literalinappropriate ioctl for deviceinvalid function symbol tableinvalid network interface nameinvalid pointer found on stacklooking for beginning of valuen") in Source: e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin Observed string: "bootstrap type already present: bufio: invalid use of UnreadBytebufio: invalid use of UnreadRunecrypto/aes: input not full blockexpected end of string, found %qgchelper not running on g0 stackin literal false (expecting 'a')in literal false (expecting 'e')in literal false (expecting 'l')in literal false (expecting 's')numerical argument out of domainp" (Indicator: "bootstrap type already present: bufio: invalid use of UnreadBytebufio: invalid use of UnreadRunecrypto/aes: input not full blockexpected end of string, found %qgchelper not running on g0 stackin literal false (expecting 'a')in literal false (expecting 'e')in literal false (expecting 'l')in literal false (expecting 's')numerical argument out of domainp") in Source: e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin, Observed string: "k_cgo_notify_runtime_init_done missingall goroutines are asleep - deadlock!bytes.Buffer: truncation out of rangecannot exec a shared library directlycipher: message authentication failedcrypto/rsa: public exponent too largecrypto/rsa: public exponent too smallcrypto: Size of unknown hash functionexplicitly tagged member didn't matchgU" (Indicator: "k_cgo_notify_runtime_init_done missingall goroutines are asleep - deadlock!bytes.Buffer: truncation out of rangecannot exec a shared library directlycipher: message authentication failedcrypto/rsa: public exponent too largecrypto/rsa: public exponent too smallcrypto: Size of unknown hash functionexplicitly tagged member didn't matchgU") in Source: e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin, Observed string: "$after decimal point in numeric literalarg size to reflect.call more than 1GBcan not access a needed shared libraryconcurrent map iteration and map writecrypto/sha256: invalid hash state sizecrypto/sha512: invalid hash state sizeencoding alphabet is not 64-bytes longgcBgMarkWorker: blackening not enabledgob: unknown type id or corrupted datainternal error: unknown string type %dl" (Indicator: "$after decimal point in numeric literalarg size to reflect.call more than 1GBcan not access a needed shared libraryconcurrent map iteration and map writecrypto/sha256: invalid hash state sizecrypto/sha512: invalid hash state sizeencoding alphabet is not 64-bytes longgcBgMarkWorker: blackening not enabledgob: unknown type id or corrupted datainternal error: unknown string type %dl") in Source: e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin, Observed string: "casfrom_Gscanstatus: gp->status is not in scan statecrypto/rsa: message too long for RSA public key sized" (Indicator: "casfrom_Gscanstatus: gp->status is not in scan statecrypto/rsa: message too long for RSA public key sized") in Source: e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin, Observed string: "crypto/cipher.NewCTR" (Indicator: "crypto/cipher.NewCTR") in Source: e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin, Observed string: "crypto/cipher.dup" (Indicator: "crypto/cipher.dup") in Source: e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin, Observed string: "crypto/cipher.(*ctr).refill" (Indicator: "crypto/cipher.(*ctr).refill") in Source: e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin, Observed string: "crypto/cipher.(*ctr).XORKeyStream" (Indicator: "crypto/cipher.(*ctr).XORKeyStream") in Source: e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin, Observed string: "crypto/cipher.fastXORBytes" (Indicator: "crypto/cipher.fastXORBytes") in Source: e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin2a:Tbfa,Observed string: "Argentina Standard TimeAstrakhan Standard TimeCertGetCertificateChainE. Africa Standard TimeE. Europe Standard TimeFreeEnvironmentStringsWGetEnvironmentVariableWGetSystemTimeAsFileTimeGreenland Standard TimeGreenwich Standard TimeI" (Indicator: "GetSystemTime") in Source: e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin Observed string: "Azerbaijan Standard TimeBangladesh Standard TimeCape Verde Standard TimeCertFreeCertificateChainCreateToolhelp32SnapshotGetSystemTimeAsFileTime" (Indicator: "GetSystemTime") in Source: e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin Observed string: "attempting to link in too many shared librariesbufio: reader returned negative count from Readinvalid string length %d: exceeds input size %druntime: CreateIoCompletionPort failed (errno= x509: public key contains large public exponentInt.GobDecode: encoding version %d not supportedP has unflushed stats at end of mark terminationTime.MarshalJSON: year outside of range [0,9999]Time.MarshalText: year outside of range [0,9999]bufio: writer returned negative count from Writecould not find GetSystemTimeAsFileTime() syscalldivision of zero by zero or infinity by infinityruntime: cannot map pages in arena address spaceruntime: waitforsingleobject unexpected; result=runtime: waitforsingleobject wait_failed; errno=strconv: illegal AppendFloat/FormatFloat bitSizesyscall: string with NUL passed to StringToUTF16x509: public key contains zero or negative valuecasgstatus: waiting for Gwaiting but is Grunnablegob: registering duplicate names for %s: %q != %qgob: registering duplicate types for %q: %s != %sinvalid memory add" (Indicator: "GetSystemTime") in Source: e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin Observed string: "attempting to link in too many shared librariesbufio: reader returned negative count from Readinvalid string length %d: exceeds input size %druntime: CreateIoCompletionPort failed (errno= x509: public key contains large public exponentInt.GobDecode: encoding version %d not supportedP has unflushed stats at end of mark terminationTime.MarshalJSON: year outside of range [0,9999]Time.MarshalText: year outside of range [0,9999]bufio: writer returned negative count from Writecould not find GetSystemTimeAsFileTime() syscalldivision of zero by zero or infinity by infinityruntime: cannot map pages in arena address spaceruntime: waitforsingleobject unexpected; result=runtime: waitforsingleobject wait_failed; errno=strconv: illegal AppendFloat/FormatFloat bitSizesyscall: string with NUL passed to StringToUTF16x509: public key contains zero or negative valuecasgstatus: waiting for Gwaiting but is Grunnablegob: registering duplicate names for %s: %q != %qgob: registering duplicate types for %q: %s != %sinvalid memory ad" (Indicator: "GetSystemTime") in Source: e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin Observed string: "GetSystemTimePreciseAsFileTime" (Indicator: "GetSystemTime") in Source: 00000000-00007144-00000C1E-757589492b:Tba3,Observed string: "Argentina Standard TimeAstrakhan Standard TimeCertGetCertificateChainE. Africa Standard TimeE. Europe Standard TimeFreeEnvironmentStringsWGetEnvironmentVariableWGetSystemTimeAsFileTimeGreenland Standard TimeGreenwich Standard TimeI" (Indicator: "GetSystemTimeAsFileTime") in Source: e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin Observed string: "Azerbaijan Standard TimeBangladesh Standard TimeCape Verde Standard TimeCertFreeCertificateChainCreateToolhelp32SnapshotGetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime") in Source: e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin Observed string: "attempting to link in too many shared librariesbufio: reader returned negative count from Readinvalid string length %d: exceeds input size %druntime: CreateIoCompletionPort failed (errno= x509: public key contains large public exponentInt.GobDecode: encoding version %d not supportedP has unflushed stats at end of mark terminationTime.MarshalJSON: year outside of range [0,9999]Time.MarshalText: year outside of range [0,9999]bufio: writer returned negative count from Writecould not find GetSystemTimeAsFileTime() syscalldivision of zero by zero or infinity by infinityruntime: cannot map pages in arena address spaceruntime: waitforsingleobject unexpected; result=runtime: waitforsingleobject wait_failed; errno=strconv: illegal AppendFloat/FormatFloat bitSizesyscall: string with NUL passed to StringToUTF16x509: public key contains zero or negative valuecasgstatus: waiting for Gwaiting but is Grunnablegob: registering duplicate names for %s: %q != %qgob: registering duplicate types for %q: %s != %sinvalid memory add" (Indicator: "GetSystemTimeAsFileTime") in Source: e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin Observed string: "attempting to link in too many shared librariesbufio: reader returned negative count from Readinvalid string length %d: exceeds input size %druntime: CreateIoCompletionPort failed (errno= x509: public key contains large public exponentInt.GobDecode: encoding version %d not supportedP has unflushed stats at end of mark terminationTime.MarshalJSON: year outside of range [0,9999]Time.MarshalText: year outside of range [0,9999]bufio: writer returned negative count from Writecould not find GetSystemTimeAsFileTime() syscalldivision of zero by zero or infinity by infinityruntime: cannot map pages in arena address spaceruntime: waitforsingleobject unexpected; result=runtime: waitforsingleobject wait_failed; errno=strconv: illegal AppendFloat/FormatFloat bitSizesyscall: string with NUL passed to StringToUTF16x509: public key contains zero or negative valuecasgstatus: waiting for Gwaiting but is Grunnablegob: registering duplicate names for %s: %q != %qgob: registering duplicate types for %q: %s != %sinvalid memory ad" (Indicator: "GetSystemTimeAsFileTime") in Source: e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin2c:Tbfa,Observed string: "Argentina Standard TimeAstrakhan Standard TimeCertGetCertificateChainE. Africa Standard TimeE. Europe Standard TimeFreeEnvironmentStringsWGetEnvironmentVariableWGetSystemTimeAsFileTimeGreenland Standard TimeGreenwich Standard TimeI" (Indicator: "GetSystemTime") in Source: e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin Observed string: "Azerbaijan Standard TimeBangladesh Standard TimeCape Verde Standard TimeCertFreeCertificateChainCreateToolhelp32SnapshotGetSystemTimeAsFileTime" (Indicator: "GetSystemTime") in Source: e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin Observed string: "attempting to link in too many shared librariesbufio: reader returned negative count from Readinvalid string length %d: exceeds input size %druntime: CreateIoCompletionPort failed (errno= x509: public key contains large public exponentInt.GobDecode: encoding version %d not supportedP has unflushed stats at end of mark terminationTime.MarshalJSON: year outside of range [0,9999]Time.MarshalText: year outside of range [0,9999]bufio: writer returned negative count from Writecould not find GetSystemTimeAsFileTime() syscalldivision of zero by zero or infinity by infinityruntime: cannot map pages in arena address spaceruntime: waitforsingleobject unexpected; result=runtime: waitforsingleobject wait_failed; errno=strconv: illegal AppendFloat/FormatFloat bitSizesyscall: string with NUL passed to StringToUTF16x509: public key contains zero or negative valuecasgstatus: waiting for Gwaiting but is Grunnablegob: registering duplicate names for %s: %q != %qgob: registering duplicate types for %q: %s != %sinvalid memory add" (Indicator: "GetSystemTime") in Source: e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin Observed string: "attempting to link in too many shared librariesbufio: reader returned negative count from Readinvalid string length %d: exceeds input size %druntime: CreateIoCompletionPort failed (errno= x509: public key contains large public exponentInt.GobDecode: encoding version %d not supportedP has unflushed stats at end of mark terminationTime.MarshalJSON: year outside of range [0,9999]Time.MarshalText: year outside of range [0,9999]bufio: writer returned negative count from Writecould not find GetSystemTimeAsFileTime() syscalldivision of zero by zero or infinity by infinityruntime: cannot map pages in arena address spaceruntime: waitforsingleobject unexpected; result=runtime: waitforsingleobject wait_failed; errno=strconv: illegal AppendFloat/FormatFloat bitSizesyscall: string with NUL passed to StringToUTF16x509: public key contains zero or negative valuecasgstatus: waiting for Gwaiting but is Grunnablegob: registering duplicate names for %s: %q != %qgob: registering duplicate types for %q: %s != %sinvalid memory ad" (Indicator: "GetSystemTime") in Source: e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin Observed string: "GetSystemTimePreciseAsFileTime" (Indicator: "GetSystemTime") in Source: 00000000-00007144-00000C1E-757589492d:T51c,"update.bin.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00007144) "update.bin.exe" called "GetProcAddress" with a parameter CancelIoEx (UID: 00000000-00007144) "update.bin.exe" called "GetProcAddress" with a parameter SetFileCompletionNotificationModes (UID: 00000000-00007144) "update.bin.exe" called "GetProcAddress" with a parameter WSAEnumProtocolsW (UID: 00000000-00007144) "update.bin.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00007144) "update.bin.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00007144) "update.bin.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00007144) "update.bin.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00007144) "update.bin.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00007144) "update.bin.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00007144) "update.bin.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00007144) "update.bin.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00007144) "update.bin.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00007144)2e:Te91c,Found string "WSAIoctl" (Indicator: "WSAIoctl"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "HeapAlloc" (Indicator: "HeapAlloc"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "GetFileType" (Indicator: "GetFileType"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "OpenService" (Indicator: "OpenService"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "CreateService" (Indicator: "CreateService"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "GetFileInformationByHandle" (Indicator: "GetFileInfo"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "GetFileInformationByHandle" (Indicator: "GetFileInformationByHandle"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "vmatchmonthntohspanicpop3srune sleepslicet" (Indicator: "ntohs"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "9ExpireFridayGOROOTGetACPGothicHangulHatranHebrewHyphenKaithiKhojkiLepchaLycianLydianMinttlMondayP" (Indicator: "GetACP"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string ",renamerune1 secondsocketstringstructsweep telnetuint16uint32uint64v" (Indicator: "socket"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "AvestanBengaliBrailleChanDirCopySidCypriotDeseretD" (Indicator: "CopySid"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "WSARecvWSASendZ" (Indicator: "WSASend"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "tAcceptExAd" (Indicator: "AcceptEx"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "#ParseIntPhags_PaPriorityRdlengthReadFileSaturdayTagbanwaTai_ThamTai_VietThursdayTifinaghUgariticWSAIoctlZ" (Indicator: "ReadFile"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "#ParseIntPhags_PaPriorityRdlengthReadFileSaturdayTagbanwaTai_ThamTai_VietThursdayTifinaghUgariticWSAIoctlZ" (Indicator: "WSAIoctl"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "FindCloseH" (Indicator: "FindClose"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "LocalFreeM" (Indicator: "LocalFree"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "MalayalamMongolianMoveFileWNO`" (Indicator: "MoveFile"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "MalayalamMongolianMoveFileWNO`" (Indicator: "MoveFileW"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "igWSASendToWednesdayWriteFileX%" (Indicator: "WriteFile"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "igWSASendToWednesdayWriteFileX%" (Indicator: "WSASend"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "CreateFileCreatePipeDX3" (Indicator: "CreatePipe"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "GetIfEntryGetVersionGlagoliticHS" (Indicator: "GetIfEntry"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "GetIfEntryGetVersionGlagoliticHS" (Indicator: "GetVersion"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "WSACleanupWSASocketWWSAStartupW" (Indicator: "WSACleanup"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "WSACleanupWSASocketWWSAStartupW" (Indicator: "WSAStartup"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "getsockoptgoroutine g|" (Indicator: "getsockopt"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "TCloseHandleCreateFileWDeleteFileWE" (Indicator: "CloseHandle"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "TCloseHandleCreateFileWDeleteFileWE" (Indicator: "CreateFileW"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "TCloseHandleCreateFileWDeleteFileWE" (Indicator: "DeleteFileW"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "1ExitProcessF" (Indicator: "ExitProcess"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "FreeLibraryF" (Indicator: "FreeLibrary"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "sGOTRACEBACKGetFileTypeH0UCAn" (Indicator: "GetFileType"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "]MoveFileExWM" (Indicator: "MoveFile"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "]MoveFileExWM" (Indicator: "MoveFileExW"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "NetShareAddNetShareDelNew_Tai_LueN}9" (Indicator: "NetShareAdd"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "NetShareAddNetShareDelNew_Tai_LueN}9" (Indicator: "NetShareDel"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "Old_PersianOpenProcessPau_Cin_HauPc" (Indicator: "OpenProcess"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "RegCloseKeyS" (Indicator: "RegCloseKey"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "^SetFileTimeSignWritingSoft_DottedT" (Indicator: "SetFileTime"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "cgocall nilclosesocketcreated by crypt32.dlld" (Indicator: "closesocket"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "cgocall nilclosesocketcreated by crypt32.dlld" (Indicator: "socket"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "gccheckmarkgeneralizedgetpeernamegetsocknamegx"6" (Indicator: "getpeername"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin"), Found string "gccheckmarkgeneralizedgetpeernamegetsocknamegx"6" (Indicator: "getsockname"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "GetAddrInfoWGetConsoleCPGetLastErrorGetLengthSidGetStdHandleGetTempPathWH#" (Indicator: "GetConsoleCP"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "GetAddrInfoWGetConsoleCPGetLastErrorGetLengthSidGetStdHandleGetTempPathWH#" (Indicator: "GetLastError"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "GetAddrInfoWGetConsoleCPGetLastErrorGetLengthSidGetStdHandleGetTempPathWH#" (Indicator: "GetLength"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "GetAddrInfoWGetConsoleCPGetLastErrorGetLengthSidGetStdHandleGetTempPathWH#" (Indicator: "GetLengthSid"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "GetAddrInfoWGetConsoleCPGetLastErrorGetLengthSidGetStdHandleGetTempPathWH#" (Indicator: "GetStdHandle"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "GetAddrInfoWGetConsoleCPGetLastErrorGetLengthSidGetStdHandleGetTempPathWH#" (Indicator: "GetTempPathW"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "jLoadLibraryWM" (Indicator: "LoadLibraryW"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "RReadConsoleWRevertToSelfSERIALNUMBERS" (Indicator: "ReadConsoleW"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "RReadConsoleWRevertToSelfSERIALNUMBERS" (Indicator: "RevertToSelf"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "SetEndOfFileSora_SompengSyloti_NagriT?" (Indicator: "SetEndOfFile"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "YTransmitFileU" (Indicator: "TransmitFile"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "OCertOpenStoreD" (Indicator: "CertOpenStore"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "FindFirstFileFindNextFileWFreeAddrInfoWGC sweep waitG" (Indicator: "FindNextFileW"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "MapViewOfFileMasaram_GondiMende_KikakuiNewFloat(NaN)Old_HungarianP" (Indicator: "MapViewOfFile"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "RegDeleteKeyWRegEnumKeyExWRegEnumValueWRegOpenKeyExWRk" (Indicator: "RegDeleteKeyW"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "RegDeleteKeyWRegEnumKeyExWRegEnumValueWRegOpenKeyExWRk" (Indicator: "RegEnumKeyExW"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "RegDeleteKeyWRegEnumKeyExWRegEnumValueWRegOpenKeyExWRk" (Indicator: "RegEnumValueW"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "RegDeleteKeyWRegEnumKeyExWRegEnumValueWRegOpenKeyExWRk" (Indicator: "RegOpenKeyExW"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "yWriteConsoleWX" (Indicator: "WriteConsoleW"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "getTypeInfo: gethostbynamegetservbynameinvalid UTF-8invalid base kernel32.dll" (Indicator: "gethostbyname"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "getTypeInfo: gethostbynamegetservbynameinvalid UTF-8invalid base kernel32.dll" (Indicator: "getservbyname"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "CertCloseStoreCreateProcessWCryptGenRandomD!" (Indicator: "CertCloseStore"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "CertCloseStoreCreateProcessWCryptGenRandomD!" (Indicator: "CreateProcessW"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "CertCloseStoreCreateProcessWCryptGenRandomD!" (Indicator: "CryptGenRandom"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string ")`FindFirstFileWFormatMessageWGC assist waitGC worker initGetConsoleModeGetProcAddressGetUserNameExWH" (Indicator: "FindFirstFileW"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string ")`FindFirstFileWFormatMessageWGC assist waitGC worker initGetConsoleModeGetProcAddressGetUserNameExWH" (Indicator: "FormatMessageW"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string ")`FindFirstFileWFormatMessageWGC assist waitGC worker initGetConsoleModeGetProcAddressGetUserNameExWH" (Indicator: "GetConsoleMode"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string ")`FindFirstFileWFormatMessageWGC assist waitGC worker initGetConsoleModeGetProcAddressGetUserNameExWH" (Indicator: "GetProcAddress"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string ")`FindFirstFileWFormatMessageWGC assist waitGC worker initGetConsoleModeGetProcAddressGetUserNameExWH" (Indicator: "GetUserName"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string ")`FindFirstFileWFormatMessageWGC assist waitGC worker initGetConsoleModeGetProcAddressGetUserNameExWH" (Indicator: "GetUserNameEx"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "#MB; allocated NetUserGetInfoOther_ID_StartPattern_SyntaxProcess32NextWQuotation_MarkR" (Indicator: "Process32Next"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "#MB; allocated NetUserGetInfoOther_ID_StartPattern_SyntaxProcess32NextWQuotation_MarkR" (Indicator: "Process32NextW"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "RegSetValueExWS\" (Indicator: "RegSetValueExW"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "SetFilePointerT" (Indicator: "SetFilePointer"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "gcrescanstacksgcstoptheworldgetprotobynamei`Oo" (Indicator: "getprotobyname"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "CreateHardLinkWDeviceIoControlDuplicateHandleE+" (Indicator: "DeviceIoControl"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "CreateHardLinkWDeviceIoControlDuplicateHandleE+" (Indicator: "DuplicateHandle"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "Failed to find Failed to load FlushViewOfFileGetAdaptersInfoGetCommandLineWGetProcessTimesGetStartupInfoWH" (Indicator: "GetAdaptersInfo"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "Failed to find Failed to load FlushViewOfFileGetAdaptersInfoGetCommandLineWGetProcessTimesGetStartupInfoWH" (Indicator: "GetCommandLineW"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "Failed to find Failed to load FlushViewOfFileGetAdaptersInfoGetCommandLineWGetProcessTimesGetStartupInfoWH" (Indicator: "GetStartupInfoW"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "7gLoadLibraryExW" (Indicator: "LoadLibraryExW"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "OpenThreadTokenOther_LowercaseOther_UppercaseP+" (Indicator: "OpenThread"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "OpenThreadTokenOther_LowercaseOther_UppercaseP+" (Indicator: "OpenThreadToken"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "Process32FirstWPsalter_PahlaviR" (Indicator: "Process32First"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "Process32FirstWPsalter_PahlaviR" (Indicator: "Process32FirstW"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "MTRegCreateKeyExWRegDeleteValueWS" (Indicator: "RegCreateKeyExW"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "MTRegCreateKeyExWRegDeleteValueWS" (Indicator: "RegDeleteValueW"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "GUnmapViewOfFileV_" (Indicator: "UnmapViewOfFile"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "CreateDirectoryWC" (Indicator: "CreateDirectoryW"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "DnsNameCompare_WDuplicateTokenExFf" (Indicator: "DuplicateToken"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "DnsNameCompare_WDuplicateTokenExFf" (Indicator: "DuplicateTokenEx"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "FlushFileBuffersGC worker (idle)GetComputerNameWGetCurrentThreadGetFullPathNameWGetLongPathNameWH" (Indicator: "FlushFileBuffers"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "FlushFileBuffersGC worker (idle)GetComputerNameWGetCurrentThreadGetFullPathNameWGetLongPathNameWH" (Indicator: "GetComputerName"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "FlushFileBuffersGC worker (idle)GetComputerNameWGetCurrentThreadGetFullPathNameWGetLongPathNameWH" (Indicator: "GetComputerNameW"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "FlushFileBuffersGC worker (idle)GetComputerNameWGetCurrentThreadGetFullPathNameWGetLongPathNameWH" (Indicator: "GetCurrentThread"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "FlushFileBuffersGC worker (idle)GetComputerNameWGetCurrentThreadGetFullPathNameWGetLongPathNameWH" (Indicator: "GetFullPathNameW"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "FlushFileBuffersGC worker (idle)GetComputerNameWGetCurrentThreadGetFullPathNameWGetLongPathNameWH" (Indicator: "GetLongPathNameW"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "MSpanList_InsertMSpanList_RemoveMeroitic_CursiveNetApiBufferFreeO" (Indicator: "NetApiBufferFree"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "(OpenProcessTokenOther_AlphabeticQU;" (Indicator: "OpenProcess"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "(OpenProcessTokenOther_AlphabeticQU;" (Indicator: "OpenProcessToken"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "RegQueryInfoKeyWRegQueryValueExWRemoveDirectoryWRoundingMode(%d)SetFilePointerExTerminateProcessU" (Indicator: "RegQueryInfoKeyW"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "RegQueryInfoKeyWRegQueryValueExWRemoveDirectoryWRoundingMode(%d)SetFilePointerExTerminateProcessU" (Indicator: "RegQueryValueExW"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "RegQueryInfoKeyWRegQueryValueExWRemoveDirectoryWRoundingMode(%d)SetFilePointerExTerminateProcessU" (Indicator: "RemoveDirectoryW"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "RegQueryInfoKeyWRegQueryValueExWRemoveDirectoryWRoundingMode(%d)SetFilePointerExTerminateProcessU" (Indicator: "SetFilePointer"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "RegQueryInfoKeyWRegQueryValueExWRemoveDirectoryWRoundingMode(%d)SetFilePointerExTerminateProcessU" (Indicator: "SetFilePointerEx"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "RegQueryInfoKeyWRegQueryValueExWRemoveDirectoryWRoundingMode(%d)SetFilePointerExTerminateProcessU" (Indicator: "TerminateProcess"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "FLE Standard TimeGC assist markingGMT Standard TimeGTB Standard TimeGetCurrentProcessGetShortPathNameWIi" (Indicator: "GetCurrentProcess"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "LookupAccountSidWM" (Indicator: "LookupAccountSidW"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "Caucasian_AlbanianCommandLineToArgvWCreateFileMappingWCuba Standard TimeFiji Standard TimeGetComputerNameExWGetExitCodeProcessGetFileAttributesWGetModuleFileNameWH" (Indicator: "CommandLineToArgvW"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "Caucasian_AlbanianCommandLineToArgvWCreateFileMappingWCuba Standard TimeFiji Standard TimeGetComputerNameExWGetExitCodeProcessGetFileAttributesWGetModuleFileNameWH" (Indicator: "CreateFileMappingW"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "Caucasian_AlbanianCommandLineToArgvWCreateFileMappingWCuba Standard TimeFiji Standard TimeGetComputerNameExWGetExitCodeProcessGetFileAttributesWGetModuleFileNameWH" (Indicator: "GetComputerName"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "Caucasian_AlbanianCommandLineToArgvWCreateFileMappingWCuba Standard TimeFiji Standard TimeGetComputerNameExWGetExitCodeProcessGetFileAttributesWGetModuleFileNameWH" (Indicator: "GetComputerNameEx"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "Caucasian_AlbanianCommandLineToArgvWCreateFileMappingWCuba Standard TimeFiji Standard TimeGetComputerNameExWGetExitCodeProcessGetFileAttributesWGetModuleFileNameWH" (Indicator: "GetComputerNameExW"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "Caucasian_AlbanianCommandLineToArgvWCreateFileMappingWCuba Standard TimeFiji Standard TimeGetComputerNameExWGetExitCodeProcessGetFileAttributesWGetModuleFileNameWH" (Indicator: "GetFileAttributesW"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "Caucasian_AlbanianCommandLineToArgvWCreateFileMappingWCuba Standard TimeFiji Standard TimeGetComputerNameExWGetExitCodeProcessGetFileAttributesWGetModuleFileNameWH" (Indicator: "GetModuleFileNameW"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "p|LookupAccountNameWN." (Indicator: "LookupAccountNameW"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "RFS specific errorRegional_IndicatorRussia Time Zone 3SetFileAttributesWSystemFunction036" (Indicator: "SetFileAttributesW"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "X\lCanadian_AboriginalChina Standard TimeCreateSymbolicLinkWCryptAcquireContextCryptReleaseContextEgypt Standard TimeF"U!L" (Indicator: "CryptReleaseContext"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin"), Found string "GetCurrentProcessIdGetFileAttributesExGetTokenInformationH" (Indicator: "GetCurrentProcess"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin"), Found string "GetCurrentProcessIdGetFileAttributesExGetTokenInformationH" (Indicator: "GetCurrentProcessId"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin"), Found string "GetCurrentProcessIdGetFileAttributesExGetTokenInformationH" (Indicator: "GetTokenInformation"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin"), Found string "MultiByteToWideCharN" (Indicator: "MultiByteToWideChar"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin"), Found string "S"=TNepal Standard TimePattern_White_SpaceRussia Time Zone 10Russia Time Zone 11Samoa Standard TimeSetTokenInformationSyria Standard TimeTokyo Standard TimeTomsk Standard TimeTonga Standard TimeWaitForSingleObjectY" (Indicator: "SetTokenInformation"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "S"=TNepal Standard TimePattern_White_SpaceRussia Time Zone 10Russia Time Zone 11Samoa Standard TimeSetTokenInformationSyria Standard TimeTokyo Standard TimeTomsk Standard TimeTonga Standard TimeWaitForSingleObjectY" (Indicator: "WaitForSingleObject"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin"), Found string "Arabic Standard TimeAzores Standard TimeCertOpenSystemStoreWCreateProcessAsUserWCryptAcquireContextWD" (Indicator: "CreateProcessA"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin"), Found string "Arabic Standard TimeAzores Standard TimeCertOpenSystemStoreWCreateProcessAsUserWCryptAcquireContextWD" (Indicator: "CreateProcessAsUserW"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin"), Found string "Arabic Standard TimeAzores Standard TimeCertOpenSystemStoreWCreateProcessAsUserWCryptAcquireContextWD" (Indicator: "CryptAcquireContextW"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin"), Found string "dGetAcceptExSockaddrsGetAdaptersAddressesGetCurrentDirectoryWGetFileAttributesExWGetProcessMemoryInfoIDS_Trinary_OperatorIR" (Indicator: "AcceptEx"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin"), Found string "dGetAcceptExSockaddrsGetAdaptersAddressesGetCurrentDirectoryWGetFileAttributesExWGetProcessMemoryInfoIDS_Trinary_OperatorIR" (Indicator: "etCurrentDirectoryW"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin"), Found string "dGetAcceptExSockaddrsGetAdaptersAddressesGetCurrentDirectoryWGetFileAttributesExWGetProcessMemoryInfoIDS_Trinary_OperatorIR" (Indicator: "GetAcceptExSockaddrs"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin"), Found string "dGetAcceptExSockaddrsGetAdaptersAddressesGetCurrentDirectoryWGetFileAttributesExWGetProcessMemoryInfoIDS_Trinary_OperatorIR" (Indicator: "GetAdaptersAddresses"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin"), Found string "dGetAcceptExSockaddrsGetAdaptersAddressesGetCurrentDirectoryWGetFileAttributesExWGetProcessMemoryInfoIDS_Trinary_OperatorIR" (Indicator: "GetCurrentDirectoryW"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin"), Found string "dGetAcceptExSockaddrsGetAdaptersAddressesGetCurrentDirectoryWGetFileAttributesExWGetProcessMemoryInfoIDS_Trinary_OperatorIR" (Indicator: "GetFileAttributesExW"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin"), Found string "dGetAcceptExSockaddrsGetAdaptersAddressesGetCurrentDirectoryWGetFileAttributesExWGetProcessMemoryInfoIDS_Trinary_OperatorIR" (Indicator: "GetProcessMemoryInfo"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin"), Found string "Israel Standard TimeJordan Standard TimeMSpanList_InsertBackMeroitic_HieroglyphsSeek: invalid offsetSeek: invalid whenceSetCurrentDirectoryWSetHandleInformationTaipei Standard TimeTerminal_PunctuationTurkey Standard TimeXF" (Indicator: "etCurrentDirectoryW"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin"), Found string "Israel Standard TimeJordan Standard TimeMSpanList_InsertBackMeroitic_HieroglyphsSeek: invalid offsetSeek: invalid whenceSetCurrentDirectoryWSetHandleInformationTaipei Standard TimeTerminal_PunctuationTurkey Standard TimeXF" (Indicator: "SetCurrentDirectory"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin"), Found string "Israel Standard TimeJordan Standard TimeMSpanList_InsertBackMeroitic_HieroglyphsSeek: invalid offsetSeek: invalid whenceSetCurrentDirectoryWSetHandleInformationTaipei Standard TimeTerminal_PunctuationTurkey Standard TimeXF" (Indicator: "SetCurrentDirectoryW"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin"), Found string "Israel Standard TimeJordan Standard TimeMSpanList_InsertBackMeroitic_HieroglyphsSeek: invalid offsetSeek: invalid whenceSetCurrentDirectoryWSetHandleInformationTaipei Standard TimeTerminal_PunctuationTurkey Standard TimeXF" (Indicator: "SetHandleInformation"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin"), Found string "AdjustTokenPrivilegesAlaskan Standard TimeAnatolian_HieroglyphsArabian Standard TimeB" (Indicator: "AdjustTokenPrivileges"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin"), Found string "LookupPrivilegeValueWMagadan Standard TimeMorocco Standard TimeMyanmar Standard TimeNamibia Standard TimeNetGetJoinInformationNorfolk Standard TimeOther_Grapheme_ExtendP" (Indicator: "LookupPrivilegeValueW"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin"), Found string "LookupPrivilegeValueWMagadan Standard TimeMorocco Standard TimeMyanmar Standard TimeNamibia Standard TimeNetGetJoinInformationNorfolk Standard TimeOther_Grapheme_ExtendP" (Indicator: "NetGetJoinInformation"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin"), file/memory contains long string with (Indicator: "ConvertSidToStringSidW"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin"), file/memory contains long string with (Indicator: "ConvertStringSidToSidW"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin"), file/memory contains long string with (Indicator: "GetEnvironmentStrings"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin"), file/memory contains long string with (Indicator: "GetEnvironmentStringsW"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin"), file/memory contains long string with (Indicator: "GetTimeZoneInformation"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin"), Found string "NtWaitForSingleObject" (Indicator: "NtWaitForSingleObject"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin"), Found string "NtWaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin"), Found string "Argentina Standard TimeAstrakhan Standard TimeCertGetCertificateChainE. Africa Standard TimeE. Europe Standard TimeFreeEnvironmentStringsWGetEnvironmentVariableWGetSystemTimeAsFileTimeGreenland Standard TimeGreenwich Standard TimeI" (Indicator: "CertGetCertificateChain"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin"), Found string "Argentina Standard TimeAstrakhan Standard TimeCertGetCertificateChainE. Africa Standard TimeE. Europe Standard TimeFreeEnvironmentStringsWGetEnvironmentVariableWGetSystemTimeAsFileTimeGreenland Standard TimeGreenwich Standard TimeI" (Indicator: "FreeEnvironmentStringsW"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin"), Found string "Argentina Standard TimeAstrakhan Standard TimeCertGetCertificateChainE. Africa Standard TimeE. Europe Standard TimeFreeEnvironmentStringsWGetEnvironmentVariableWGetSystemTimeAsFileTimeGreenland Standard TimeGreenwich Standard TimeI" (Indicator: "GetEnvironmentVariable"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin"), Found string "Argentina Standard TimeAstrakhan Standard TimeCertGetCertificateChainE. Africa Standard TimeE. Europe Standard TimeFreeEnvironmentStringsWGetEnvironmentVariableWGetSystemTimeAsFileTimeGreenland Standard TimeGreenwich Standard TimeI" (Indicator: "GetEnvironmentVariableW"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin"), Found string "Argentina Standard TimeAstrakhan Standard TimeCertGetCertificateChainE. Africa Standard TimeE. Europe Standard TimeFreeEnvironmentStringsWGetEnvironmentVariableWGetSystemTimeAsFileTimeGreenland Standard TimeGreenwich Standard TimeI" (Indicator: "GetSystemTime"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin"), Found string "Argentina Standard TimeAstrakhan Standard TimeCertGetCertificateChainE. Africa Standard TimeE. Europe Standard TimeFreeEnvironmentStringsWGetEnvironmentVariableWGetSystemTimeAsFileTimeGreenland Standard TimeGreenwich Standard TimeI" (Indicator: "GetSystemTimeAsFileTime"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin"), file/memory contains long string with (Indicator: "SetEnvironmentVariable"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin"), file/memory contains long string with (Indicator: "SetEnvironmentVariableW"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin"), Found string "Azerbaijan Standard TimeBangladesh Standard TimeCape Verde Standard TimeCertFreeCertificateChainCreateToolhelp32SnapshotGetSystemTimeAsFileTime" (Indicator: "CertFreeCertificateChain"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin"), Found string "Azerbaijan Standard TimeBangladesh Standard TimeCape Verde Standard TimeCertFreeCertificateChainCreateToolhelp32SnapshotGetSystemTimeAsFileTime" (Indicator: "CreateToolhelp32Snapshot"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin"), Found string "Azerbaijan Standard TimeBangladesh Standard TimeCape Verde Standard TimeCertFreeCertificateChainCreateToolhelp32SnapshotGetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin"), Found string "Azerbaijan Standard TimeBangladesh Standard TimeCape Verde Standard TimeCertFreeCertificateChainCreateToolhelp32SnapshotGetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin"), Found string "North Asia Standard TimePacific SA Standard TimeQueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin"), Found string "{queuefinalizer during GCreflect.Value.SetComplexrunqsteal: runq overflowruntime: VirtualFree of runtime: found obj at *(span has no free objectsstack trace unavailablestructure needs cleaningunexpected exponent baseunexpected mantissa basev" (Indicator: "VirtualFree"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") file/memory contains long string with (Indicator: "ExpandEnvironmentStringsW"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") file/memory contains long string with (Indicator: "VirtualAlloc"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "lock: lock countslice bounds out of rangesocket type not supportedstartm: p has runnable gsstoplockedm: not runnableunexpected fault address unexpected key value typeunknown Go type for slicex*HO`" (Indicator: "socket"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "ACentral Asia Standard TimeCertFreeCertificateContextE. Australia Standard TimeEkaterinburg Standard TimeGetFileInformationByHandleLine Islands Standard TimeMf\Y" (Indicator: "CertFreeCertificateContext"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "ACentral Asia Standard TimeCertFreeCertificateContextE. Australia Standard TimeEkaterinburg Standard TimeGetFileInformationByHandleLine Islands Standard TimeMf\Y" (Indicator: "GetFileInfo"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "ACentral Asia Standard TimeCertFreeCertificateContextE. Australia Standard TimeEkaterinburg Standard TimeGetFileInformationByHandleLine Islands Standard TimeMf\Y" (Indicator: "GetFileInformationByHandle"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "]Newfoundland Standard TimePostQueuedCompletionStatusQueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "CertEnumCertificatesInStoreEaster Island Standard TimeG waiting list is corruptedG" (Indicator: "CertEnumCertificatesInStore"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") file/memory contains long string with (Indicator: "socket"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "mCertAddCertificateContextToStoreCertVerifyCertificateChainPolicyI" (Indicator: "CertAddCertificateContextToStore"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") file/memory contains long string with (Indicator: "GetSystemTime"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") file/memory contains long string with (Indicator: "GetSystemTimeAsFileTime"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") file/memory contains long string with (Indicator: "QueryPerformanceFrequency"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "runtime.getGetProcAddress" (Indicator: "GetProcAddress"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "time.Sleep" (Indicator: "Sleep"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "runtime.timeSleepUntil" (Indicator: "Sleep"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "runtime.traceHeapAlloc" (Indicator: "HeapAlloc"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "syscall.GetLastError" (Indicator: "GetLastError"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "syscall.GetVersion" (Indicator: "GetVersion"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "syscall.ReadFile" (Indicator: "ReadFile"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "syscall.WriteFile" (Indicator: "WriteFile"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "syscall.CloseHandle" (Indicator: "CloseHandle"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "syscall.GetStdHandle" (Indicator: "GetStdHandle"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "syscall.FindClose" (Indicator: "FindClose"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "syscall.GetFileInformationByHandle" (Indicator: "GetFileInfo"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "syscall.GetFileInformationByHandle" (Indicator: "GetFileInformationByHandle"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "syscall.GetTimeZoneInformation" (Indicator: "GetTimeZoneInformation"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "syscall.OpenProcess" (Indicator: "OpenProcess"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "syscall.TerminateProcess" (Indicator: "TerminateProcess"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "syscall.GetFileType" (Indicator: "GetFileType"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "syscall.CryptGenRandom" (Indicator: "CryptGenRandom"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "syscall.GetEnvironmentVariable" (Indicator: "GetEnvironmentVariable"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "syscall.SetHandleInformation" (Indicator: "SetHandleInformation"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "syscall.RegCloseKey" (Indicator: "RegCloseKey"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "syscall.GetConsoleMode" (Indicator: "GetConsoleMode"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "syscall.WSAStartup" (Indicator: "WSAStartup"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "syscall.WSAIoctl" (Indicator: "WSAIoctl"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "syscall.Closesocket" (Indicator: "socket"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "syscall.WSASend" (Indicator: "WSASend"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "internal/syscall/windows.MoveFileEx" (Indicator: "MoveFile"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "eicppanmgiigbeblppmd/heapjnpececmcgncmcfb/lkhlnakioccljlbjoloc/bdalegiamdedigadphck.OpenSCManager" (Indicator: "OpenSCManager"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "eicppanmgiigbeblppmd/heapjnpececmcgncmcfb/lkhlnakioccljlbjoloc/bdalegiamdedigadphck.ControlService" (Indicator: "ControlService"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "eicppanmgiigbeblppmd/heapjnpececmcgncmcfb/lkhlnakioccljlbjoloc/bdalegiamdedigadphck.EnumServicesStatusEx" (Indicator: "EnumServicesStatus"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "eicppanmgiigbeblppmd/heapjnpececmcgncmcfb/lkhlnakioccljlbjoloc/bdalegiamdedigadphck.EnumServicesStatusEx" (Indicator: "EnumServicesStatusEx"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "eicppanmgiigbeblppmd/heapjnpececmcgncmcfb/lkhlnakioccljlbjoloc/bdalegiamdedigadphck.QueryServiceStatusEx" (Indicator: "QueryServiceStatus"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "eicppanmgiigbeblppmd/heapjnpececmcgncmcfb/lkhlnakioccljlbjoloc/bdalegiamdedigadphck.QueryServiceStatusEx" (Indicator: "QueryServiceStatusEx"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "eicppanmgiigbeblppmd/heapjnpececmcgncmcfb/lkhlnakioccljlbjoloc/bdalegiamdedigadphck.GetLastError" (Indicator: "GetLastError"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "eicppanmgiigbeblppmd/heapjnpececmcgncmcfb/lkhlnakioccljlbjoloc/bdalegiamdedigadphck.GetStdHandle" (Indicator: "GetStdHandle"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "eicppanmgiigbeblppmd/heapjnpececmcgncmcfb/lkhlnakioccljlbjoloc/bdalegiamdedigadphck.SetHandleInformation" (Indicator: "SetHandleInformation"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "io/ioutil.WriteFile" (Indicator: "WriteFile"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "eicppanmgiigbeblppmd/heapjnpececmcgncmcfb/lkhlnakioccljlbjoloc/bdalegiamdedigadphck/ppnjmhoabnidcbmnhpoj/cojemfdcdhopolgcdpnm.(*Mgr).OpenService" (Indicator: "OpenService"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "WSAGetOverlappedResult" (Indicator: "WSAGetOverlappedResult"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "WriteFile" (Indicator: "WriteFile"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "WriteConsoleW" (Indicator: "WriteConsoleW"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "VirtualFree" (Indicator: "VirtualFree"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "VirtualAlloc" (Indicator: "VirtualAlloc"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "SwitchToThread" (Indicator: "SwitchToThread"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "SetWaitableTimer" (Indicator: "SetWaitableTimer"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "SetUnhandledExceptionFilter" (Indicator: "SetUnhandledExceptionFilter"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "SetUnhandledExceptionFilter" (Indicator: "UnhandledExceptionFilter"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "SetEvent" (Indicator: "SetEvent"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "SetErrorMode" (Indicator: "SetErrorMode"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "LoadLibraryA" (Indicator: "LoadLibraryA"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "LoadLibraryW" (Indicator: "LoadLibraryW"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "GetSystemInfo" (Indicator: "GetSystemInfo"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "GetStdHandle" (Indicator: "GetStdHandle"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "GetProcessAffinityMask" (Indicator: "GetProcessAffinityMask"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "GetProcAddress" (Indicator: "GetProcAddress"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStringsW"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "GetConsoleMode" (Indicator: "GetConsoleMode"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "FreeEnvironmentStringsW" (Indicator: "FreeEnvironmentStringsW"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "ExitProcess" (Indicator: "ExitProcess"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "DuplicateHandle" (Indicator: "DuplicateHandle"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "CreateThread" (Indicator: "CreateThread"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "CreateEventA" (Indicator: "CreateEventA"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "CloseHandle" (Indicator: "CloseHandle"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "AddVectoredExceptionHandler" (Indicator: "AddVectoredExceptionHandler"; File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "6021735590,5868,3106,,FindNextFileW,kernel32.dll,"00:20:19.687",RX=0,PX=0" (Indicator: "FindNextFileW"; Source: "00000000-00007144.00000000.78174.02CD0000.00000004.mdmp") Found string "" (Indicator: "GetDeviceCaps"; Source: "00000000-00007144.00000000.78174.02CD0000.00000004.mdmp, 00000000-00007144.00000001.80093.02CD0000.00000004.mdmp, 00000000-00007144.00000002.82013.02CD0000.00000004.mdmp") Found string "" (Indicator: "GetDC"; Source: "00000000-00007144.00000000.78174.02CD0000.00000004.mdmp, 00000000-00007144.00000001.80093.02CD0000.00000004.mdmp, 00000000-00007144.00000002.82013.02CD0000.00000004.mdmp") Found string "" (Indicator: "GetDC"; Source: "00000000-00007144.00000000.78174.02CD0000.00000004.mdmp, 00000000-00007144.00000001.80093.02CD0000.00000004.mdmp, 00000000-00007144.00000002.82013.02CD0000.00000004.mdmp") Found string "" (Indicator: "GetDCEx"; Source: "00000000-00007144.00000000.78174.02CD0000.00000004.mdmp, 00000000-00007144.00000001.80093.02CD0000.00000004.mdmp, 00000000-00007144.00000002.82013.02CD0000.00000004.mdmp") Found string "" (Indicator: "GetWindow"; Source: "00000000-00007144.00000000.78174.02CD0000.00000004.mdmp, 00000000-00007144.00000001.80093.02CD0000.00000004.mdmp, 00000000-00007144.00000002.82013.02CD0000.00000004.mdmp") Found string "" (Indicator: "GetWindowDC"; Source: "00000000-00007144.00000000.78174.02CD0000.00000004.mdmp, 00000000-00007144.00000001.80093.02CD0000.00000004.mdmp, 00000000-00007144.00000002.82013.02CD0000.00000004.mdmp") Found string "" (Indicator: "CreateDCA"; Source: "00000000-00007144.00000000.78174.02CD0000.00000004.mdmp, 00000000-00007144.00000001.80093.02CD0000.00000004.mdmp, 00000000-00007144.00000002.82013.02CD0000.00000004.mdmp") Found string "" (Indicator: "ReleaseDC"; Source: "00000000-00007144.00000000.78174.02CD0000.00000004.mdmp, 00000000-00007144.00000001.80093.02CD0000.00000004.mdmp, 00000000-00007144.00000002.82013.02CD0000.00000004.mdmp") Found string "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00007144.00000000.78174.02CD0000.00000004.mdmp, 00000000-00007144.00000001.80093.02CD0000.00000004.mdmp, 00000000-00007144.00000002.82013.02CD0000.00000004.mdmp") Found string "" (Indicator: "EnumThreadWindows"; Source: "00000000-00007144.00000000.78174.02CD0000.00000004.mdmp, 00000000-00007144.00000001.80093.02CD0000.00000004.mdmp, 00000000-00007144.00000002.82013.02CD0000.00000004.mdmp") Found string "" (Indicator: "EnumChildWindows"; Source: "00000000-00007144.00000000.78174.02CD0000.00000004.mdmp, 00000000-00007144.00000001.80093.02CD0000.00000004.mdmp, 00000000-00007144.00000002.82013.02CD0000.00000004.mdmp") Found string "" (Indicator: "DefWindowProcW"; Source: "00000000-00007144.00000000.78174.02CD0000.00000004.mdmp, 00000000-00007144.00000001.80093.02CD0000.00000004.mdmp, 00000000-00007144.00000002.82013.02CD0000.00000004.mdmp") Found string "" (Indicator: "GetWindow"; Source: "00000000-00007144.00000000.78174.02CD0000.00000004.mdmp, 00000000-00007144.00000001.80093.02CD0000.00000004.mdmp, 00000000-00007144.00000002.82013.02CD0000.00000004.mdmp") Found string "" (Indicator: "BitBlt"; Source: "00000000-00007144.00000000.78174.02CD0000.00000004.mdmp, 00000000-00007144.00000001.80093.02CD0000.00000004.mdmp, 00000000-00007144.00000002.82013.02CD0000.00000004.mdmp") Found string "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00007144.00000000.78174.02CD0000.00000004.mdmp, 00000000-00007144.00000001.80093.02CD0000.00000004.mdmp, 00000000-00007144.00000002.82013.02CD0000.00000004.mdmp") Found string "" (Indicator: "DestroyWindow"; Source: "00000000-00007144.00000000.78174.02CD0000.00000004.mdmp, 00000000-00007144.00000001.80093.02CD0000.00000004.mdmp, 00000000-00007144.00000002.82013.02CD0000.00000004.mdmp") Found string "" (Indicator: "RedrawWindow"; Source: "00000000-00007144.00000000.78174.02CD0000.00000004.mdmp, 00000000-00007144.00000001.80093.02CD0000.00000004.mdmp, 00000000-00007144.00000002.82013.02CD0000.00000004.mdmp") Found string "3003495278,5868,3106,,FindNextFileW,kernel32.dll,"00:20:18.421",RX=0,PX=0" (Indicator: "FindNextFileW"; Source: "00000000-00007144.00000000.78174.02CD0000.00000004.mdmp") Found string "10280844100,5868,3106,,FindNextFileW,kernel32.dll,"00:20:21.453",RX=0,PX=0" (Indicator: "FindNextFileW"; Source: "00000000-00007144.00000000.78174.02CD0000.00000004.mdmp") Found string "10268078195,5868,3106,,FindNextFileW,kernel32.dll,"00:20:21.453",RX=0,PX=0" (Indicator: "FindNextFileW"; Source: "00000000-00007144.00000000.78174.02CD0000.00000004.mdmp") Found string "10280132719,5868,3104,,FindFirstFileW,kernel32.dll,"00:20:21.453",RX=0,PX=0" (Indicator: "FindFirstFileW"; Source: "00000000-00007144.00000000.78174.02CD0000.00000004.mdmp") Found string "10212584852,5868,3106,,FindNextFileW,kernel32.dll,"00:20:21.437",RX=0,PX=0" (Indicator: "FindNextFileW"; Source: "00000000-00007144.00000000.78174.02CD0000.00000004.mdmp") Found string "10258713991,5868,3106,,FindNextFileW,kernel32.dll,"00:20:21.453",RX=0,PX=0" (Indicator: "FindNextFileW"; Source: "00000000-00007144.00000000.78174.02CD0000.00000004.mdmp") Found string "10243399659,5868,3104,,FindFirstFileW,kernel32.dll,"00:20:21.437",RX=0,PX=0" (Indicator: "FindFirstFileW"; Source: "00000000-00007144.00000000.78174.02CD0000.00000004.mdmp") Found string "10279223076,5868,3106,,FindNextFileW,kernel32.dll,"00:20:21.453",RX=0,PX=0" (Indicator: "FindNextFileW"; Source: "00000000-00007144.00000000.78174.02CD0000.00000004.mdmp") Found string "10277151629,5868,3106,,FindNextFileW,kernel32.dll,"00:20:21.453",RX=0,PX=0" (Indicator: "FindNextFileW"; Source: "00000000-00007144.00000000.78174.02CD0000.00000004.mdmp") Found string "10263009014,5868,3104,,FindFirstFileW,kernel32.dll,"00:20:21.453",RX=0,PX=0" (Indicator: "FindFirstFileW"; Source: "00000000-00007144.00000000.78174.02CD0000.00000004.mdmp") Found string "10259494554,5868,3106,,FindNextFileW,kernel32.dll,"00:20:21.453",RX=0,PX=0" (Indicator: "FindNextFileW"; Source: "00000000-00007144.00000000.78174.02CD0000.00000004.mdmp") Found string "10232824839,5868,3106,,FindNextFileW,kernel32.dll,"00:20:21.437",RX=0,PX=0" (Indicator: "FindNextFileW"; Source: "00000000-00007144.00000000.78174.02CD0000.00000004.mdmp") Found string "10266833991,5868,3106,,FindNextFileW,kernel32.dll,"00:20:21.453",RX=0,PX=0" (Indicator: "FindNextFileW"; Source: "00000000-00007144.00000000.78174.02CD0000.00000004.mdmp") Found string "10273299042,5868,3106,,FindNextFileW,kernel32.dll,"00:20:21.453",RX=0,PX=0" (Indicator: "FindNextFileW"; Source: "00000000-00007144.00000000.78174.02CD0000.00000004.mdmp") Found string "10257244564,5868,3106,,FindNextFileW,kernel32.dll,"00:20:21.453",RX=0,PX=0" (Indicator: "FindNextFileW"; Source: "00000000-00007144.00000000.78174.02CD0000.00000004.mdmp") Found string "P08 - PowerAndSleep.lnkf5-" (Indicator: "Sleep"; Source: "00000000-00007144.00000001.80093.02CD0000.00000004.mdmp") Found string "82152540166,5868,3106,,FindNextFileW,kernel32.dll,"00:20:51.406",RX=0,PX=0" (Indicator: "FindNextFileW"; Source: "00000000-00007144.00000001.80093.02CD0000.00000004.mdmp") Found string "82258854982,5868,3106,,FindNextFileW,kernel32.dll,"00:20:51.453",RX=0,PX=0" (Indicator: "FindNextFileW"; Source: "00000000-00007144.00000001.80093.02CD0000.00000004.mdmp") Found string "82258335626,5868,3106,,FindNextFileW,kernel32.dll,"00:20:51.453",RX=0,PX=0" (Indicator: "FindNextFileW"; Source: "00000000-00007144.00000001.80093.02CD0000.00000004.mdmp") Found string "82209762660,5868,3106,,FindNextFileW,kernel32.dll,"00:20:51.421",RX=0,PX=0" (Indicator: "FindNextFileW"; Source: "00000000-00007144.00000001.80093.02CD0000.00000004.mdmp") Found string "82205177418,5868,3106,,FindNextFileW,kernel32.dll,"00:20:51.421",RX=0,PX=0" (Indicator: "FindNextFileW"; Source: "00000000-00007144.00000001.80093.02CD0000.00000004.mdmp") Found string "82254847975,5868,3106,,FindNextFileW,kernel32.dll,"00:20:51.453",RX=0,PX=0" (Indicator: "FindNextFileW"; Source: "00000000-00007144.00000001.80093.02CD0000.00000004.mdmp") Found string "82212027674,5868,3106,,FindNextFileW,kernel32.dll,"00:20:51.437",RX=0,PX=0" (Indicator: "FindNextFileW"; Source: "00000000-00007144.00000001.80093.02CD0000.00000004.mdmp") Found string "82256903803,5868,3106,,FindNextFileW,kernel32.dll,"00:20:51.453",RX=0,PX=0" (Indicator: "FindNextFileW"; Source: "00000000-00007144.00000001.80093.02CD0000.00000004.mdmp") Found string "82254356996,5868,3106,,FindNextFileW,kernel32.dll,"00:20:51.453",RX=0,PX=0" (Indicator: "FindNextFileW"; Source: "00000000-00007144.00000001.80093.02CD0000.00000004.mdmp") Found string "82257880432,5868,3106,,FindNextFileW,kernel32.dll,"00:20:51.453",RX=0,PX=0" (Indicator: "FindNextFileW"; Source: "00000000-00007144.00000001.80093.02CD0000.00000004.mdmp") Found string "82259270289,5868,3106,,FindNextFileW,kernel32.dll,"00:20:51.453",RX=0,PX=0" (Indicator: "FindNextFileW"; Source: "00000000-00007144.00000001.80093.02CD0000.00000004.mdmp") Found string "82207886426,5868,3106,,FindNextFileW,kernel32.dll,"00:20:51.421",RX=0,PX=0" (Indicator: "FindNextFileW"; Source: "00000000-00007144.00000001.80093.02CD0000.00000004.mdmp") Found string "82251932299,5868,3106,,FindNextFileW,kernel32.dll,"00:20:51.453",RX=0,PX=0" (Indicator: "FindNextFileW"; Source: "00000000-00007144.00000001.80093.02CD0000.00000004.mdmp") Found string "82256277482,5868,3106,,FindNextFileW,kernel32.dll,"00:20:51.453",RX=0,PX=0" (Indicator: "FindNextFileW"; Source: "00000000-00007144.00000001.80093.02CD0000.00000004.mdmp") Found string "154204944147,5868,3104,,FindFirstFileW,kernel32.dll,"00:21:21.421",RX=0,PX=0" (Indicator: "FindFirstFileW"; Source: "00000000-00007144.00000002.82013.02CD0000.00000004.mdmp") Found string "154187879826,5868,3106,,FindNextFileW,kernel32.dll,"00:21:21.421",RX=0,PX=0" (Indicator: "FindNextFileW"; Source: "00000000-00007144.00000002.82013.02CD0000.00000004.mdmp") Found string "154239811312,5868,3106,,FindNextFileW,kernel32.dll,"00:21:21.437",RX=0,PX=0" (Indicator: "FindNextFileW"; Source: "00000000-00007144.00000002.82013.02CD0000.00000004.mdmp") Found string "154193489768,5868,3106,,FindNextFileW,kernel32.dll,"00:21:21.421",RX=0,PX=0" (Indicator: "FindNextFileW"; Source: "00000000-00007144.00000002.82013.02CD0000.00000004.mdmp") Found string "154225495247,5868,3106,,FindNextFileW,kernel32.dll,"00:21:21.437",RX=0,PX=0" (Indicator: "FindNextFileW"; Source: "00000000-00007144.00000002.82013.02CD0000.00000004.mdmp") Found string "154160763023,5868,3104,,FindFirstFileW,kernel32.dll,"00:21:21.406",RX=0,PX=0" (Indicator: "FindFirstFileW"; Source: "00000000-00007144.00000002.82013.02CD0000.00000004.mdmp") Found string "154249816679,5868,3106,,FindNextFileW,kernel32.dll,"00:21:21.453",RX=0,PX=0" (Indicator: "FindNextFileW"; Source: "00000000-00007144.00000002.82013.02CD0000.00000004.mdmp") Found string "154213752516,5868,3106,,FindNextFileW,kernel32.dll,"00:21:21.437",RX=0,PX=0" (Indicator: "FindNextFileW"; Source: "00000000-00007144.00000002.82013.02CD0000.00000004.mdmp") Found string "154153004259,5868,3106,,FindNextFileW,kernel32.dll,"00:21:21.406",RX=0,PX=0" (Indicator: "FindNextFileW"; Source: "00000000-00007144.00000002.82013.02CD0000.00000004.mdmp") Found string "154183656174,5868,3106,,FindNextFileW,kernel32.dll,"00:21:21.421",RX=0,PX=0" (Indicator: "FindNextFileW"; Source: "00000000-00007144.00000002.82013.02CD0000.00000004.mdmp") Found string "154223286727,5868,3104,,FindFirstFileW,kernel32.dll,"00:21:21.437",RX=0,PX=0" (Indicator: "FindFirstFileW"; Source: "00000000-00007144.00000002.82013.02CD0000.00000004.mdmp") Found string "154183200549,5868,3106,,FindNextFileW,kernel32.dll,"00:21:21.421",RX=0,PX=0" (Indicator: "FindNextFileW"; Source: "00000000-00007144.00000002.82013.02CD0000.00000004.mdmp") Found string "154052107545,5868,3104,,FindFirstFileW,kernel32.dll,"00:21:21.359",RX=0,PX=0" (Indicator: "FindFirstFileW"; Source: "00000000-00007144.00000002.82013.02CD0000.00000004.mdmp") Found string "154245300602,5868,3106,,FindNextFileW,kernel32.dll,"00:21:21.453",RX=0,PX=0" (Indicator: "FindNextFileW"; Source: "00000000-00007144.00000002.82013.02CD0000.00000004.mdmp")2f:T89b,"f~*math/big: cannot unmarshal %q into a *big.Float (%v)runtime.SetFinalizer: pointer not in allocated blockruntime: GetQueuedCompletionStatusEx failed (errno= runtime: use of FixAlloc_Alloc before FixAlloc_InitTime.MarshalBinary: zone offset has fractional minutefunction symbol table not sorted by program counter: reflect.Value.Slice: string slice index out of boundsreflect: non-interface type passed to Type.Implementsgoroutine running on other thread; stack unavailablebytes.Buffer: reader returned negative count from ReadgcControllerState.findRunnable: blackening not enabledinternal error: polling on unsupported descriptor typeno goroutines (main called runtime.Goexit) - deadlock!reflect.FuncOf does not support more than 50 argumentsruntime: GetQueuedCompletionStatus returned op == nilruntime: signal received on thread not created by Go.x509: cannot verify signature: algorithm unimplementedSOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zonesbufio.Scanner: SplitFunc returns negative advance countcasfr" in Source: e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin "*math/big: cannot unmarshal %q into a *big.Float (%v)runtime.SetFinalizer: pointer not in allocated blockruntime: GetQueuedCompletionStatusEx failed (errno= runtime: use of FixAlloc_Alloc before FixAlloc_InitTime.MarshalBinary: zone offset has fractional minutefunction symbol table not sorted by program counter: reflect.Value.Slice: string slice index out of boundsreflect: non-interface type passed to Type.Implementsgoroutine running on other thread; stack unavailablebytes.Buffer: reader returned negative count from ReadgcControllerState.findRunnable: blackening not enabledinternal error: polling on unsupported descriptor typeno goroutines (main called runtime.Goexit) - deadlock!reflect.FuncOf does not support more than 50 argumentsruntime: GetQueuedCompletionStatus returned op == nilruntime: signal received on thread not created by Go.x509: cannot verify signature: algorithm unimplementedSOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zonesbufio.Scanner: SplitFunc returns negative advance countcasfro" in Source: e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin30:T57f,"update.bin.exe" touched "WBEM Scripting Locator" (Path: "HKCU\WOW6432NODE\CLSID\{76A64158-CB41-11D1-8B02-00600806D9B6}") "update.bin.exe" touched "WBEM Locator" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}") "update.bin.exe" touched "WbemDefaultPathParser" (Path: "HKCU\WOW6432NODE\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\TREATAS") "update.bin.exe" touched "Windows Management and Instrumentation" (Path: "HKCU\WOW6432NODE\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\TREATAS") "update.bin.exe" touched "PSFactoryBuffer" (Path: "HKCU\WOW6432NODE\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\TREATAS") "update.bin.exe" touched "Microsoft WBEM Call Context" (Path: "HKCU\WOW6432NODE\CLSID\{674B6698-EE92-11D0-AD71-00C04FD8FDFF}\TREATAS") "update.bin.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemServices" (Path: "HKCU\WOW6432NODE\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\TREATAS") "update.bin.exe" touched "Microsoft WBEM (non)Standard Marshaling for IEnumWbemClassObject" (Path: "HKCU\WOW6432NODE\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\TREATAS") "update.bin.exe" touched "Microsoft WBEM WbemClassObject Marshalling proxy" (Path: "HKCU\WOW6432NODE\CLSID\{4590F812-1D3A-11D0-891F-00AA004B2E24}\TREATAS") "update.bin.exe" touched "WbemStatusCode" (Path: "HKCU\WOW6432NODE\CLSID\{EB87E1BD-3233-11D2-AEC9-00C04FB68820}\TREATAS")31:T592,Observed string: "jLoadLibraryWM" (Indicator: "LoadLibrary") in Source: e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin Observed string: "7gLoadLibraryExW" (Indicator: "LoadLibrary") in Source: e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin Observed string: "runtime.getLoadLibraryEx" (Indicator: "LoadLibrary") in Source: e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin Observed string: "runtime.getLoadLibrary" (Indicator: "LoadLibrary") in Source: e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin Observed string: "eicppanmgiigbeblppmd/heapjnpececmcgncmcfb/lkhlnakioccljlbjoloc/bdalegiamdedigadphck.LoadLibraryEx" (Indicator: "LoadLibrary") in Source: e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin Observed string: "eicppanmgiigbeblppmd/heapjnpececmcgncmcfb/lkhlnakioccljlbjoloc/bdalegiamdedigadphck._LoadLibraryEx" (Indicator: "LoadLibrary") in Source: e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin Observed string: "LoadLibraryA" (Indicator: "LoadLibrary") in Source: e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin Observed string: "LoadLibraryW" (Indicator: "LoadLibrary") in Source: e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin Observed string: "LoadLibraryExW" (Indicator: "LoadLibrary") in Source: 00000000-00007144-00000C1E-7588986732:T6a7,"upgrade_bulk.xml" has type "Unknown" - Location: [C:\$WINDOWS.~BT\DUDownload\Setup\upgrade_bulk.xml] "Appraiser_TelemetryRunList.xml" has type "Unknown" - Location: [C:\$WINDOWS.~BT\Sources\Panther\Appraiser_TelemetryRunList.xml] "diagwrn.xml" has type "Unknown" - Location: [C:\$WINDOWS.~BT\Sources\Panther\diagwrn.xml] "windlp.state-old.xml" has type "Unknown" - Location: [C:\$WINDOWS.~BT\Sources\Panther\windlp.state-old.xml] "windlp.state.xml" has type "Unknown" - Location: [C:\$WINDOWS.~BT\Sources\Panther\windlp.state.xml] "W162x7STtEKk-ZBa.1.1.1.7.29.1.4.0.0_APPRAISER_HumanReadable.xml" has type "Unknown" - Location: [C:\$WINDOWS.~BT\Sources\Panther\W162x7STtEKk-ZBa.1.1.1.7.29.1.4.0.0_APPRAISER_HumanReadable.xml] "diagerr.xml" has type "Unknown" - Location: [C:\$WINDOWS.~BT\Sources\Panther\diagerr.xml] "uninstall.xml" has type "Unknown" - Location: [C:\$WINDOWS.~BT\Sources\uninstall.xml] "CompatData_2018_06_15_02_38_01_3_00000021.xml" has type "Unknown" - Location: [C:\$WINDOWS.~BT\Sources\Panther\CompatData_2018_06_15_02_38_01_3_00000021.xml] "CompatData_2018_06_15_02_37_58_3_00000021.xml" has type "Unknown" - Location: [C:\$WINDOWS.~BT\Sources\Panther\CompatData_2018_06_15_02_37_58_3_00000021.xml] "reagent.xml" has type "Unknown" - Location: [C:\$WINDOWS.~BT\Sources\reagent.xml] "W162x7STtEKk-ZBa.1.1.1.7.29.1.4.0.0_APPRAISER_SetupOutput.xml" has type "Unknown" - Location: [C:\$WINDOWS.~BT\Sources\Panther\W162x7STtEKk-ZBa.1.1.1.7.29.1.4.0.0_APPRAISER_SetupOutput.xml] "W162x7STtEKk-ZBa.1.1.1.7.29.1.4.0.0_APPRAISER_SetupOutputHw.xml" has type "Unknown" - Location: [C:\$WINDOWS.~BT\Sources\Panther\W162x7STtEKk-ZBa.1.1.1.7.29.1.4.0.0_APPRAISER_SetupOutputHw.xml]33:T493,Observed string: "WSARecvWSASendZ" (Indicator: "WSARecv") in Source: e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin Observed string: "WSARecvWSASendZ" (Indicator: "WSASend") in Source: e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin Observed string: "igWSASendToWednesdayWriteFileX%" (Indicator: "WSASend") in Source: e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin Observed string: "WSACleanupWSASocketWWSAStartupW" (Indicator: "WSAStartup") in Source: e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin Observed string: "WSARecvFromWarang_CitiWhite_SpaceXT" (Indicator: "WSARecv") in Source: e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin Observed string: "syscall.WSAStartup" (Indicator: "WSAStartup") in Source: e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin Observed string: "syscall.WSARecv" (Indicator: "WSARecv") in Source: e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin Observed string: "syscall.WSASend" (Indicator: "WSASend") in Source: e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin34:T65e,"update.bin.exe" called "FindFirstFileW" with parameter C:\* (UID: 00000000-00007144) "update.bin.exe" called "FindFirstFileW" with parameter C:\$Recycle.Bin\* (UID: 00000000-00007144) "update.bin.exe" called "FindNextFileW" with parameter S-1-5-18 (UID: 00000000-00007144) "update.bin.exe" called "FindFirstFileW" with parameter C:\$Recycle.Bin\S-1-5-18\* (UID: 00000000-00007144) "update.bin.exe" called "FindNextFileW" with parameter desktop.ini (UID: 00000000-00007144) "update.bin.exe" called "FindNextFileW" with parameter S-1-5-21-735145574-3570218355-1207367261-1001 (UID: 00000000-00007144) "update.bin.exe" called "FindFirstFileW" with parameter C:\$Recycle.Bin\S-1-5-21-735145574-3570218355-1207367261-1001\* (UID: 00000000-00007144) "update.bin.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00007144) "update.bin.exe" called "FindNextFileW" with parameter $WINDOWS.~BT (UID: 00000000-00007144) "update.bin.exe" called "FindFirstFileW" with parameter C:\$WINDOWS.~BT\* (UID: 00000000-00007144) "update.bin.exe" called "FindFirstFileW" with parameter C:\$WINDOWS.~BT\DUDownload\* (UID: 00000000-00007144) "update.bin.exe" called "FindNextFileW" with parameter Setup (UID: 00000000-00007144) "update.bin.exe" called "FindFirstFileW" with parameter C:\$WINDOWS.~BT\DUDownload\Setup\* (UID: 00000000-00007144) "update.bin.exe" called "FindNextFileW" with parameter acmigration.dll (UID: 00000000-00007144) "update.bin.exe" called "FindNextFileW" with parameter appraiser.sdb (UID: 00000000-00007144) "update.bin.exe" called "FindNextFileW" with parameter diagtrack.dll (UID: 00000000-00007144)35:T7d0,Observed string: "" [Source: 00000000-00007144.00000000.78174.02CD0000.00000004.mdmp 00000000-00007144.00000001.80093.02CD0000.00000004.mdmp 00000000-00007144.00000002.82013.02CD0000.00000004.mdmp] Observed string: "" [Source: 00000000-00007144.00000000.78174.02CD0000.00000004.mdmp 00000000-00007144.00000001.80093.02CD0000.00000004.mdmp 00000000-00007144.00000002.82013.02CD0000.00000004.mdmp] Observed string: "" [Source: 00000000-00007144.00000000.78174.02CD0000.00000004.mdmp 00000000-00007144.00000001.80093.02CD0000.00000004.mdmp 00000000-00007144.00000002.82013.02CD0000.00000004.mdmp] Observed string: "" [Source: 00000000-00007144.00000000.78174.02CD0000.00000004.mdmp 00000000-00007144.00000001.80093.02CD0000.00000004.mdmp 00000000-00007144.00000002.82013.02CD0000.00000004.mdmp] Observed string: "" [Source: 00000000-00007144.00000000.78174.02CD0000.00000004.mdmp 00000000-00007144.00000001.80093.02CD0000.00000004.mdmp 00000000-00007144.00000002.82013.02CD0000.00000004.mdmp] Observed string: "" [Source: 00000000-00007144.00000000.78174.02CD0000.00000004.mdmp 00000000-00007144.00000001.80093.02CD0000.00000004.mdmp 00000000-00007144.00000002.82013.02CD0000.00000004.mdmp] Observed string: "" [Source: 00000000-00007144.00000000.78174.02CD0000.00000004.mdmp 00000000-00007144.00000001.80093.02CD0000.00000004.mdmp 00000000-00007144.00000002.82013.02CD0000.00000004.mdmp] Observed string: "" [Source: 00000000-00007144.00000000.78174.02CD0000.00000004.mdmp 00000000-00007144.00000001.80093.02CD0000.00000004.mdmp 00000000-00007144.00000002.82013.02CD0000.00000004.mdmp]36:Tb70,Observed string: "FindNextFile" [Source: e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin] Observed string: "eFindNextFileG6" [Source: e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin] Observed string: "FindFirstFileFindNextFileWFreeAddrInfoWGC sweep waitG" [Source: e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin] Observed string: ")`FindFirstFileWFormatMessageWGC assist waitGC worker initGetConsoleModeGetProcAddressGetUserNameExWH" [Source: e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin] Observed string: "syscall.FindFirstFile" [Source: e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin] Observed string: "syscall.FindNextFile" [Source: e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin] Observed string: "internal/poll.(*FD).FindNextFile" [Source: e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin] Observed string: "os.statWithFindFirstFile" [Source: e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin] Observed string: "FindNextFileW" [Source: 00000000-00007144-00000C1E-76043229] Observed string: "6021735590,5868,3106,,FindNextFileW,kernel32.dll,"00:20:19.687",RX=0,PX=0" [Source: 00000000-00007144.00000000.78174.02CD0000.00000004.mdmp] Observed string: "3003495278,5868,3106,,FindNextFileW,kernel32.dll,"00:20:18.421",RX=0,PX=0" [Source: 00000000-00007144.00000000.78174.02CD0000.00000004.mdmp] Observed string: "10280844100,5868,3106,,FindNextFileW,kernel32.dll,"00:20:21.453",RX=0,PX=0" [Source: 00000000-00007144.00000000.78174.02CD0000.00000004.mdmp] Observed string: "10268078195,5868,3106,,FindNextFileW,kernel32.dll,"00:20:21.453",RX=0,PX=0" [Source: 00000000-00007144.00000000.78174.02CD0000.00000004.mdmp] Observed string: "10280132719,5868,3104,,FindFirstFileW,kernel32.dll,"00:20:21.453",RX=0,PX=0" [Source: 00000000-00007144.00000000.78174.02CD0000.00000004.mdmp] Observed string: "10212584852,5868,3106,,FindNextFileW,kernel32.dll,"00:20:21.437",RX=0,PX=0" [Source: 00000000-00007144.00000000.78174.02CD0000.00000004.mdmp] Observed string: "10258713991,5868,3106,,FindNextFileW,kernel32.dll,"00:20:21.453",RX=0,PX=0" [Source: 00000000-00007144.00000000.78174.02CD0000.00000004.mdmp] Observed string: "10243399659,5868,3104,,FindFirstFileW,kernel32.dll,"00:20:21.437",RX=0,PX=0" [Source: 00000000-00007144.00000000.78174.02CD0000.00000004.mdmp] Observed string: "10279223076,5868,3106,,FindNextFileW,kernel32.dll,"00:20:21.453",RX=0,PX=0" [Source: 00000000-00007144.00000000.78174.02CD0000.00000004.mdmp] Observed string: "10277151629,5868,3106,,FindNextFileW,kernel32.dll,"00:20:21.453",RX=0,PX=0" [Source: 00000000-00007144.00000000.78174.02CD0000.00000004.mdmp] Observed string: "10263009014,5868,3104,,FindFirstFileW,kernel32.dll,"00:20:21.453",RX=0,PX=0" [Source: 00000000-00007144.00000000.78174.02CD0000.00000004.mdmp]37:T40a,Observed string: "RegDeleteKeyWRegEnumKeyExWRegEnumValueWRegOpenKeyExWRk" (Indicator: "RegOpenKey") in Source: e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin Observed string: "RegDeleteKeyWRegEnumKeyExWRegEnumValueWRegOpenKeyExWRk" (Indicator: "RegEnumKey") in Source: e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin Observed string: "RegQueryInfoKeyWRegQueryValueExWRemoveDirectoryWRoundingMode(%d)SetFilePointerExTerminateProcessU" (Indicator: "RegQueryValue") in Source: e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin Observed string: "syscall.RegOpenKeyEx" (Indicator: "RegOpenKey") in Source: e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin Observed string: "syscall.RegEnumKeyEx" (Indicator: "RegEnumKey") in Source: e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin Observed string: "syscall.RegQueryValueEx" (Indicator: "RegQueryValue") in Source: e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin38:T49d,Observed string: "GetAddrInfoWGetConsoleCPGetLastErrorGetLengthSidGetStdHandleGetTempPathWH#" (Indicator: "GetTempPath") in Source: e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin Observed string: "dGetAcceptExSockaddrsGetAdaptersAddressesGetCurrentDirectoryWGetFileAttributesExWGetProcessMemoryInfoIDS_Trinary_OperatorIR" (Indicator: "GetCurrentDirectory") in Source: e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin Observed string: "Pacific Standard TimeReadDirectoryChangesWRomance Standard TimeRussian Standard TimeSE Asia Standard TimeS" (Indicator: "ReadDirectoryChange") in Source: e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin Observed string: "eicppanmgiigbeblppmd/heapjnpececmcgncmcfb/lkhlnakioccljlbjoloc/bdalegiamdedigadphck.GetSystemDirectory" (Indicator: "GetSystemDirectory") in Source: e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin Observed string: "eicppanmgiigbeblppmd/heapjnpececmcgncmcfb/lkhlnakioccljlbjoloc/bdalegiamdedigadphck.GetSystemDirectory.func1" (Indicator: "GetSystemDirectory") in Source: e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin39:T780,Observed string: "AvestanBengaliBrailleChanDirCopySidCypriotDeseretD" which can Copies a security identifier (SID) to a buffer. [Source: e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin] Observed string: "GetAddrInfoWGetConsoleCPGetLastErrorGetLengthSidGetStdHandleGetTempPathWH#" which can Returns the length in bytes of a valid security identifier (SID). [Source: e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin] Observed string: "RReadConsoleWRevertToSelfSERIALNUMBERS" which can Terminates the impersonation of a client application. [Source: e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin] Observed string: "0ImpersonateSelfK" which can Obtains an access token that impersonates the security context of the calling process. [Source: e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin] Observed string: "DnsNameCompare_WDuplicateTokenExFf" which can Creates a new access token that duplicates one already in existence. [Source: e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin] Observed string: "DnsNameCompare_WDuplicateTokenExFf" which can Creates a new access token that duplicates an existing token. [Source: e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin] Observed string: "GetCurrentProcessIdGetFileAttributesExGetTokenInformationH" which can Retrieves a specified type of information about an access token. [Source: e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin] Observed string: "S"=TNepal Standard TimePattern_White_SpaceRussia Time Zone 10Russia Time Zone 11Samoa Standard TimeSetTokenInformationSyria Standard TimeTokyo Standard TimeTomsk Standard TimeTonga Standard TimeWaitForSingleObjectY" which can Sets various types of information for a specified access token. [Source: e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin]3a:T510,"update.bin.exe" called "OpenServiceW" to access the "BITS" service requesting "SERVICE_ALL_ACCESS" (0XF01FF) access rights "update.bin.exe" called "OpenServiceW" to access the "BrokerInfrastructure" service requesting "SERVICE_ALL_ACCESS" (0XF01FF) access rights "update.bin.exe" called "OpenServiceW" to access the "EventLog" service requesting "SERVICE_ALL_ACCESS" (0XF01FF) access rights "update.bin.exe" called "OpenServiceW" to access the "SDRSVC" service requesting "SERVICE_ALL_ACCESS" (0XF01FF) access rights "update.bin.exe" called "OpenServiceW" to access the "SstpSvc" service requesting "SERVICE_ALL_ACCESS" (0XF01FF) access rights "update.bin.exe" called "OpenServiceW" to access the "UI0Detect" service requesting "SERVICE_ALL_ACCESS" (0XF01FF) access rights "update.bin.exe" called "OpenServiceW" to access the "wbengine" service requesting "SERVICE_ALL_ACCESS" (0XF01FF) access rights "update.bin.exe" called "OpenServiceW" to access the "WdNisSvc" service requesting "SERVICE_ALL_ACCESS" (0XF01FF) access rights "update.bin.exe" called "OpenServiceW" to access the "WebClient" service requesting "SERVICE_ALL_ACCESS" (0XF01FF) access rights "update.bin.exe" called "OpenServiceW" to access the "WinDefend" service requesting "SERVICE_ALL_ACCESS" (0XF01FF) access rights3b:T718,Observed string: "Argentina Standard TimeAstrakhan Standard TimeCertGetCertificateChainE. Africa Standard TimeE. Europe Standard TimeFreeEnvironmentStringsWGetEnvironmentVariableWGetSystemTimeAsFileTimeGreenland Standard TimeGreenwich Standard TimeI" (Indicator: "GetSystemTimeAsFileTime") in Source: e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin Observed string: "attempting to link in too many shared librariesbufio: reader returned negative count from Readinvalid string length %d: exceeds input size %druntime: CreateIoCompletionPort failed (errno= x509: public key contains large public exponentInt.GobDecode: encoding version %d not supportedP has unflushed stats at end of mark terminationTime.MarshalJSON: year outside of range [0,9999]Time.MarshalText: year outside of range [0,9999]bufio: writer returned negative count from Writecould not find GetSystemTimeAsFileTime() syscalldivision of zero by zero or infinity by infinityruntime: cannot map pages in arena address spaceruntime: waitforsingleobject unexpected; result=runtime: waitforsingleobject wait_failed; errno=strconv: illegal AppendFloat/FormatFloat bitSizesyscall: string with NUL passed to StringToUTF16x509: public key contains zero or negative valuecasgstatus: waiting for Gwaiting but is Grunnablegob: registering duplicate names for %s: %q != %qgob: registering duplicate types for %q: %s != %sinvalid memory add" (Indicator: "GetSystemTimeAsFileTime") in Source: e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin Observed string: "Azerbaijan Standard TimeBangladesh Standard TimeCape Verde Standard TimeCertFreeCertificateChainCreateToolhelp32SnapshotGetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime") in Source: e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin3c:T80a,"_unpacked.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00002416) "_unpacked.exe" called "GetProcAddress" with a parameter GetStdHandle (UID: 00000000-00002416) "_unpacked.exe" called "GetProcAddress" with a parameter SetHandleInformation (UID: 00000000-00002416) "_unpacked.exe" called "GetProcAddress" with a parameter WSAStartup (UID: 00000000-00002416) "_unpacked.exe" called "GetProcAddress" with a parameter CancelIoEx (UID: 00000000-00002416) "_unpacked.exe" called "GetProcAddress" with a parameter SetFileCompletionNotificationModes (UID: 00000000-00002416) "_unpacked.exe" called "GetProcAddress" with a parameter WSAEnumProtocolsW (UID: 00000000-00002416) "_unpacked.exe" called "GetProcAddress" with a parameter GetConsoleMode (UID: 00000000-00002416) "_unpacked.exe" called "GetProcAddress" with a parameter GetCommandLineW (UID: 00000000-00002416) "_unpacked.exe" called "GetProcAddress" with a parameter GetVersion (UID: 00000000-00002416) "_unpacked.exe" called "GetProcAddress" with a parameter SetEvent (UID: 00000000-00002416) "_unpacked.exe" called "GetProcAddress" with a parameter WaitForSingleObject (UID: 00000000-00002416) "_unpacked.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00002416) "_unpacked.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00002416) "_unpacked.exe" called "GetProcAddress" with a parameter RegisterServiceCtrlHandlerExW (UID: 00000000-00002416) "_unpacked.exe" called "GetProcAddress" with a parameter CreateMutexW (UID: 00000000-00002416) "_unpacked.exe" called "GetProcAddress" with a parameter GetEnvironmentVariableW (UID: 00000000-00002416) "_unpacked.exe" called "GetProcAddress" with a parameter GetLogicalDriveStringsW (UID: 00000000-00002416)3d:T57d,Observed string:"TCloseHandleCreateFileWDeleteFileWE" that creates/opens a file or I/O device. [Source: e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin] Observed string:"TCloseHandleCreateFileWDeleteFileWE" that closes an open object handle. [Source: e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin] Observed string:"#ParseIntPhags_PaPriorityRdlengthReadFileSaturdayTagbanwaTai_ThamTai_VietThursdayTifinaghUgariticWSAIoctlZ" that reads data from a file or I/O device. [Source: e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin] Observed string:"Caucasian_AlbanianCommandLineToArgvWCreateFileMappingWCuba Standard TimeFiji Standard TimeGetComputerNameExWGetExitCodeProcessGetFileAttributesWGetModuleFileNameWH" that creates/opens a file or I/O device. [Source: e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin] Observed string:"CloseHandle" that closes an open object handle. [Source: 00000000-00002416-00000C1E-177448084] Observed string:"CreateFileCreatePipeDX3" that creates/opens a file or I/O device. [Source: e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin] Observed string:"CreateFileW" that creates/opens a file or I/O device. [Source: 00000000-00002416-00000C1E-21529094] Observed string:"ReadFile" that reads data from a file or I/O device. [Source: 00000000-00002416-00000C1E-179593320]3e:T6123,Found string "HeapAlloc" (Indicator: "HeapAlloc"; in File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string ")`FindFirstFileWFormatMessageWGC assist waitGC worker initGetConsoleModeGetProcAddressGetUserNameExWH" (Indicator: "FindFirstFileW"; in File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "CreateService" (Indicator: "CreateService"; in File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "length exceeds input size (%d elements)decoding uintptr array or slice: length exceeds input size (%d elements)decoding complex64 array or slice: length exceeds input size (%d elements)decoding complex128 array or slice: length exceeds input size (%d elements)QueryPerformanceFrequency syscall returned zero, running on unsupported hardwarereflect.Value.Interface: cannot return value obtained from unexported field or methodQueryPerformanceFrequency overflow 32 bit divider, check nosplit discussion to proceed" (Indicator: "QueryPerformanceFrequency"; in File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "TCloseHandleCreateFileWDeleteFileWE" (Indicator: "CloseHandle"; in File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "#MB; allocated NetUserGetInfoOther_ID_StartPattern_SyntaxProcess32NextWQuotation_MarkR" (Indicator: "Process32Next"; in File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "#ParseIntPhags_PaPriorityRdlengthReadFileSaturdayTagbanwaTai_ThamTai_VietThursdayTifinaghUgariticWSAIoctlZ" (Indicator: "ReadFile"; in File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "(OpenProcessTokenOther_AlphabeticQU;" (Indicator: "OpenProcess"; in File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "1ExitProcessF" (Indicator: "ExitProcess"; in File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "6Aleutian Standard TimeAtlantic Standard TimeCaucasus Standard TimeConvertSidToStringSidWConvertStringSidToSidWCreateIoCompletionPortDateline Standard TimeGeorgian Standard TimeGetEnvironmentStringsWGetTimeZoneInformationHawaiian Standard TimeInscriptional_ParthianJ@" (Indicator: "ConvertSidToStringSidW"; in File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "7gLoadLibraryExW" (Indicator: "LoadLibraryExW"; in File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "9ExpireFridayGOROOTGetACPGothicHangulHatranHebrewHyphenKaithiKhojkiLepchaLycianLydianMinttlMondayP" (Indicator: "GetACP"; in File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "]MoveFileExWM" (Indicator: "MoveFile"; in File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "]Newfoundland Standard TimePostQueuedCompletionStatusQueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; in File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "^SetFileTimeSignWritingSoft_DottedT" (Indicator: "SetFileTime"; in File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "ACentral Asia Standard TimeCertFreeCertificateContextE. Australia Standard TimeEkaterinburg Standard TimeGetFileInformationByHandleLine Islands Standard TimeMf\Y" (Indicator: "CertFreeCertificateContext"; in File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "AdjustTokenPrivilegesAlaskan Standard TimeAnatolian_HieroglyphsArabian Standard TimeB" (Indicator: "AdjustTokenPrivileges"; in File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; in Source: "00000000-00002416-00000C1E-178101012") Found string "Arabic Standard TimeAzores Standard TimeCertOpenSystemStoreWCreateProcessAsUserWCryptAcquireContextWD" (Indicator: "CreateProcessA"; in File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "Argentina Standard TimeAstrakhan Standard TimeCertGetCertificateChainE. Africa Standard TimeE. Europe Standard TimeFreeEnvironmentStringsWGetEnvironmentVariableWGetSystemTimeAsFileTimeGreenland Standard TimeGreenwich Standard TimeI" (Indicator: "CertGetCertificateChain"; in File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "attempting to link in too many shared librariesbufio: reader returned negative count from Readinvalid string length %d: exceeds input size %druntime: CreateIoCompletionPort failed (errno= x509: public key contains large public exponentInt.GobDecode: encoding version %d not supportedP has unflushed stats at end of mark terminationTime.MarshalJSON: year outside of range [0,9999]Time.MarshalText: year outside of range [0,9999]bufio: writer returned negative count from Writecould not find GetSystemTimeAsFileTime() syscalldivision of zero by zero or infinity by infinityruntime: cannot map pages in arena address spaceruntime: waitforsingleobject unexpected; result=runtime: waitforsingleobject wait_failed; errno=strconv: illegal AppendFloat/FormatFloat bitSizesyscall: string with NUL passed to StringToUTF16x509: public key contains zero or negative valuecasgstatus: waiting for Gwaiting but is Grunnablegob: registering duplicate names for %s: %q != %qgob: registering duplicate types for %q: %s != %sinvalid memory add" (Indicator: "GetSystemTime"; in File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "AUS Central Standard TimeAUS Eastern Standard TimeAfghanistan Standard TimeExpandEnvironmentStringsWGetFinalPathNameByHandleWGetQueuedCompletionStatusKaliningrad Standard TimeMiddle East Standard TimeNew Zealand Standard TimeNorth Korea Standard TimeTKY." (Indicator: "ExpandEnvironmentStringsW"; in File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "Azerbaijan Standard TimeBangladesh Standard TimeCape Verde Standard TimeCertFreeCertificateChainCreateToolhelp32SnapshotGetSystemTimeAsFileTime" (Indicator: "CertFreeCertificateChain"; in File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "Caucasian_AlbanianCommandLineToArgvWCreateFileMappingWCuba Standard TimeFiji Standard TimeGetComputerNameExWGetExitCodeProcessGetFileAttributesWGetModuleFileNameWH" (Indicator: "CreateFileMappingW"; in File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "CertCloseStoreCreateProcessWCryptGenRandomD!" (Indicator: "CertCloseStore"; in File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "CloseHandle" (Indicator: "CloseHandle"; in Source: "00000000-00002416-00000C1E-177448084") Found string "CloseServiceHandle" (Indicator: "CloseServiceHandle"; in Source: "00000000-00002416-00000C1E-177278254") Found string "CoCreateFreeThreadedMarshaler" (Indicator: "CoCreateFreeThreadedMarshaler"; in Source: "00000000-00002416-00000C1E-177929801") Found string "CoCreateInstance" (Indicator: "CoCreateInstance"; in Source: "00000000-00002416-00000C1E-177645382") Found string "CoInitialize" (Indicator: "CoInitialize"; in Source: "00000000-00002416-00000C1E-177477431") Found string "ControlService" (Indicator: "ControlService"; in Source: "00000000-00002416-00000C1E-177175681") Found string "CoUninitialize" (Indicator: "CoUninitialize"; in Source: "00000000-00002416-00000C1E-179578061") Found string "CreateDirectoryWC" (Indicator: "CreateDirectoryW"; in File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "CreateFileCreatePipeDX3" (Indicator: "CreatePipe"; in File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "CreateFileW" (Indicator: "CreateFileW"; in Source: "00000000-00002416-00000C1E-21529094") Found string "CreateHardLinkWDeviceIoControlDuplicateHandleE+" (Indicator: "DeviceIoControl"; in File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "CreateMutexW" (Indicator: "CreateMutexW"; in Source: "00000000-00002416-00000C1E-21494781") Found string "CryptAcquireContextW" (Indicator: "CryptAcquireContextW"; in Source: "00000000-00002416-00000C1E-153437911") Found string "CryptGenRandom" (Indicator: "CryptGenRandom"; in Source: "00000000-00002416-00000C1E-179672800") Found string "dGetAcceptExSockaddrsGetAdaptersAddressesGetCurrentDirectoryWGetFileAttributesExWGetProcessMemoryInfoIDS_Trinary_OperatorIR" (Indicator: "etCurrentDirectoryW"; in File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "DnsNameCompare_WDuplicateTokenExFf" (Indicator: "DuplicateToken"; in File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "DuplicateTokenEx" (Indicator: "DuplicateToken"; in Source: "00000000-00002416-00000C1E-177730995") Found string "EnumServicesStatusExW" (Indicator: "EnumServicesStatus"; in Source: "00000000-00002416-00000C1E-177169717") Found string "EqualSid" (Indicator: "EqualSid"; in Source: "00000000-00002416-00000C1E-178102173") Found string "Failed to find Failed to load FlushViewOfFileGetAdaptersInfoGetCommandLineWGetProcessTimesGetStartupInfoWH" (Indicator: "GetAdaptersInfo"; in File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "FindClose" (Indicator: "FindClose"; in Source: "00000000-00002416-00000C1E-21547314") Found string "FindCloseH" (Indicator: "FindClose"; in File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "FindFirstFileFindNextFileWFreeAddrInfoWGC sweep waitG" (Indicator: "FindNextFileW"; in File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "FindFirstFileW" (Indicator: "FindFirstFileW"; in Source: "00000000-00002416-00000C1E-21530401") Found string "FindNextFileW" (Indicator: "FindNextFileW"; in Source: "00000000-00002416-00000C1E-21536690") Found string "FLE Standard TimeGC assist markingGMT Standard TimeGTB Standard TimeGetCurrentProcessGetShortPathNameWIi" (Indicator: "GetCurrentProcess"; in File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "FlsGetValue" (Indicator: "FlsGetValue"; in Source: "00000000-00002416-00000C1E-21210160") Found string "FlushFileBuffersGC worker (idle)GetComputerNameWGetCurrentThreadGetFullPathNameWGetLongPathNameWH" (Indicator: "FlushFileBuffers"; in File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "FormatMessageW" (Indicator: "FormatMessageW"; in Source: "00000000-00002416-00000C1E-177281677") Found string "FreeLibraryF" (Indicator: "FreeLibrary"; in File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "FreeSid" (Indicator: "FreeSid"; in Source: "00000000-00002416-00000C1E-178103345") Found string "GUnmapViewOfFileV_" (Indicator: "UnmapViewOfFile"; in File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "GetAddrInfoWGetConsoleCPGetLastErrorGetLengthSidGetStdHandleGetTempPathWH#" (Indicator: "GetConsoleCP"; in File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "GetCommandLineW" (Indicator: "GetCommandLineW"; in Source: "00000000-00002416-00000C1E-21398587") Found string "GetConsoleMode" (Indicator: "GetConsoleMode"; in Source: "00000000-00002416-00000C1E-21387847") Found string "GetCurrentProcessIdGetFileAttributesExGetTokenInformationH" (Indicator: "GetCurrentProcess"; in File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "GetDriveTypeW" (Indicator: "GetDriveTypeW"; in Source: "00000000-00002416-00000C1E-21520498") Found string "GetEnvironmentVariableW" (Indicator: "GetEnvironmentVariableW"; in Source: "00000000-00002416-00000C1E-21496161") Found string "GetFileAttributesExW" (Indicator: "GetFileAttributesExW"; in Source: "00000000-00002416-00000C1E-21528095") Found string "GetFileInformationByHandle" (Indicator: "GetFileInfo"; in File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "GetFileType" (Indicator: "GetFileType"; in File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "GetIfEntryGetVersionGlagoliticHS" (Indicator: "GetIfEntry"; in File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "GetLocaleInfoEx" (Indicator: "GetLocaleInfo"; in Source: "00000000-00002416-00000C1E-178239262") Found string "GetLogicalDriveStringsW" (Indicator: "GetLogicalDriveStringsW"; in Source: "00000000-00002416-00000C1E-21517357") Found string "GetStdHandle" (Indicator: "GetStdHandle"; in Source: "00000000-00002416-00000C1E-21259572") Found string "GetThreadPreferredUILanguages" (Indicator: "GetThreadPreferredUILanguages"; in Source: "00000000-00002416-00000C1E-178235797") Found string "GetTokenInformation" (Indicator: "GetTokenInformation"; in Source: "00000000-00002416-00000C1E-178099529") Found string "GetUserDefaultLCID" (Indicator: "GetUserDefaultLCID"; in Source: "00000000-00002416-00000C1E-177778320") Found string "GetVersion" (Indicator: "GetVersion"; in Source: "00000000-00002416-00000C1E-21400007") Found string "GetVolumeInformationW" (Indicator: "GetVolumeInformationW"; in Source: "00000000-00002416-00000C1E-21522258") Found string "igWSASendToWednesdayWriteFileX%" (Indicator: "WriteFile"; in File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "Israel Standard TimeJordan Standard TimeMSpanList_InsertBackMeroitic_HieroglyphsSeek: invalid offsetSeek: invalid whenceSetCurrentDirectoryWSetHandleInformationTaipei Standard TimeTerminal_PunctuationTurkey Standard TimeXF" (Indicator: "etCurrentDirectoryW"; in File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "jLoadLibraryWM" (Indicator: "LoadLibraryW"; in File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "LoadLibraryExW" (Indicator: "LoadLibraryExW"; in Source: "00000000-00002416-00000C1E-21450633") Found string "LocaleNameToLCID" (Indicator: "LocaleNameToLCID"; in Source: "00000000-00002416-00000C1E-178238109") Found string "LocalFreeM" (Indicator: "LocalFree"; in File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "Logical_Order_ExceptionLord Howe Standard TimeMB during sweep; swept Marquesas Standard TimeMauritius Standard TimeNoncharacter_Code_PointSetEnvironmentVariableWSingapore Standard TimeSri Lanka Standard TimeTocantins Standard TimeVenezuela Standard TimeW. Europe Standard TimeWest Asia Standard TimeWest Bank Standard TimeZ!" (Indicator: "SetEnvironmentVariableW"; in File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "LookupAccountSidWM" (Indicator: "LookupAccountSidW"; in File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "LookupPrivilegeValueWMagadan Standard TimeMorocco Standard TimeMyanmar Standard TimeNamibia Standard TimeNetGetJoinInformationNorfolk Standard TimeOther_Grapheme_ExtendP" (Indicator: "LookupPrivilegeValueW"; in File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "MalayalamMongolianMoveFileWNO`" (Indicator: "MoveFile"; in File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "MapViewOfFileMasaram_GondiMende_KikakuiNewFloat(NaN)Old_HungarianP" (Indicator: "MapViewOfFile"; in File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "missing stack in newstackmissing traceGCSweepStartno buffer space availableno such device or addressno such network interfaceno suitable address foundoperation now in progressreflect: Bits of nil Typereleasep: invalid p stateresource deadlock avoidedruntime: t.spanKey= runtime: VirtualAlloc of runtime: program exceeds runtime" (Indicator: "VirtualAlloc"; in File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "MSpanList_InsertMSpanList_RemoveMeroitic_CursiveNetApiBufferFreeO" (Indicator: "NetApiBufferFree"; in File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "MTRegCreateKeyExWRegDeleteValueWS" (Indicator: "RegCreateKeyExW"; in File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "MultiByteToWideCharN" (Indicator: "MultiByteToWideChar"; in File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "NetShareAddNetShareDelNew_Tai_LueN}9" (Indicator: "NetShareAdd"; in File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "North Asia Standard TimePacific SA Standard TimeQueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; in File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "NtWaitForSingleObject" (Indicator: "NtWaitForSingleObject"; in File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "Old_PersianOpenProcessPau_Cin_HauPc" (Indicator: "OpenProcess"; in File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "OpenProcessToken" (Indicator: "OpenProcess"; in Source: "00000000-00002416-00000C1E-178098053") Found string "OpenSCManagerW" (Indicator: "OpenSCManager"; in Source: "00000000-00002416-00000C1E-150990520") Found string "OpenService" (Indicator: "OpenService"; in File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "OpenServiceW" (Indicator: "OpenService"; in Source: "00000000-00002416-00000C1E-177173649") Found string "OpenThreadToken" (Indicator: "OpenThread"; in Source: "00000000-00002416-00000C1E-178096542") Found string "OpenThreadTokenOther_LowercaseOther_UppercaseP+" (Indicator: "OpenThread"; in File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "Process32FirstW" (Indicator: "Process32First"; in Source: "00000000-00002416-00000C1E-177353167") Found string "Process32FirstWPsalter_PahlaviR" (Indicator: "Process32First"; in File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "Process32NextW" (Indicator: "Process32Next"; in Source: "00000000-00002416-00000C1E-177356760") Found string "p|LookupAccountNameWN." (Indicator: "LookupAccountNameW"; in File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "QueryServiceStatusEx" (Indicator: "QueryServiceStatus"; in Source: "00000000-00002416-00000C1E-177276856") Found string "ReadFile" (Indicator: "ReadFile"; in Source: "00000000-00002416-00000C1E-179593320") Found string "RegCloseKey" (Indicator: "RegCloseKey"; in Source: "00000000-00002416-00000C1E-177700082") Found string "RegCloseKeyS" (Indicator: "RegCloseKey"; in File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "RegCreateKeyExW" (Indicator: "RegCreateKeyExW"; in Source: "00000000-00002416-00000C1E-177696484") Found string "RegDeleteKeyWRegEnumKeyExWRegEnumValueWRegOpenKeyExWRk" (Indicator: "RegDeleteKeyW"; in File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "RegEnumKeyW" (Indicator: "RegEnumKeyW"; in Source: "00000000-00002416-00000C1E-177841747") Found string "RegQueryInfoKeyWRegQueryValueExWRemoveDirectoryWRoundingMode(%d)SetFilePointerExTerminateProcessU" (Indicator: "RegQueryInfoKeyW"; in File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "RegQueryValueExW" (Indicator: "RegQueryValueExW"; in Source: "00000000-00002416-00000C1E-177697770") Found string "RegSetValueExWS\" (Indicator: "RegSetValueExW"; in File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "RFS specific errorRegional_IndicatorRussia Time Zone 3SetFileAttributesWSystemFunction036" (Indicator: "SetFileAttributesW"; in File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "RReadConsoleWRevertToSelfSERIALNUMBERS" (Indicator: "ReadConsoleW"; in File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "S"=TNepal Standard TimePattern_White_SpaceRussia Time Zone 10Russia Time Zone 11Samoa Standard TimeSetTokenInformationSyria Standard TimeTokyo Standard TimeTomsk Standard TimeTonga Standard TimeWaitForSingleObjectY" (Indicator: "SetTokenInformation"; in File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin"), Found string "SetEndOfFileSora_SompengSyloti_NagriT?" (Indicator: "SetEndOfFile"; in File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin"), Found string "SetEvent" (Indicator: "SetEvent"; in Source: "00000000-00002416-00000C1E-21447592"), Found string "SetFilePointerEx" (Indicator: "SetFilePointer"; in Source: "00000000-00002416-00000C1E-179592293"), Found string "SetFilePointerT" (Indicator: "SetFilePointer"; in File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin"), Found string "SetThreadPreferredUILanguages" (Indicator: "SetThreadPreferredUILanguages"; in Source: "00000000-00002416-00000C1E-178236962"), Found string "sGOTRACEBACKGetFileTypeH0UCAn" (Indicator: "GetFileType"; in File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin"), Found string "SysAllocStringLen" (Indicator: "SysAllocString"; in Source: "00000000-00002416-00000C1E-178298295"), Found string "SysFreeString" (Indicator: "SysFreeString"; in Source: "00000000-00002416-00000C1E-178402342"), Found string "SysStringLen" (Indicator: "SysStringLen"; in Source: "00000000-00002416-00000C1E-179019601"), Found string "ThemeApiConnectionRequest" (Indicator: "ThemeApiConnectionRequest"; in Source: "00000000-00002416-0000003B-150590328"), Found string "VariantInit" (Indicator: "VariantInit"; in Source: "00000000-00002416-00000C1E-177878146"), Found string "vmatchmonthntohspanicpop3srune sleepslicet" (Indicator: "ntohs"; in File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin"), Found string "WaitForSingleObject" (Indicator: "WaitForSingleObject"; in Source: "00000000-00002416-00000C1E-21448656"), Found string "WriteFile" (Indicator: "WriteFile"; in Source: "00000000-00002416-00000C1E-153485009"), Found string "WSACleanupWSASocketWWSAStartupW" (Indicator: "WSACleanup"; in File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin"), Found string "WSAIoctl" (Indicator: "WSAIoctl"; in File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin"), Found string "WSARecvWSASendZ" (Indicator: "WSASend"; in File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin"), Found string "WSAStartup" (Indicator: "WSAStartup"; in Source: "00000000-00002416-00000C1E-21289552"), Found string "X\lCanadian_AboriginalChina Standard TimeCreateSymbolicLinkWCryptAcquireContextCryptReleaseContextEgypt Standard TimeF"U!L" (Indicator: "CryptReleaseContext"; in File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "yWriteConsoleWX" (Indicator: "WriteConsoleW"; in File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "{queuefinalizer during GCreflect.Value.SetComplexrunqsteal: runq overflowruntime: VirtualFree of runtime: found obj at *(span has no free objectsstack trace unavailablestructure needs cleaningunexpected exponent baseunexpected mantissa basev" (Indicator: "VirtualFree"; in File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "106511435512,3216,3106,,FindNextFileW,kernel32.dll,"252:03:20.609",RX=0,PX=0" (Indicator: "FindNextFileW"; in Source: "00000000-00002416.00000001.68266.002FE000.00000004.mdmp") Found string "213022792328,3216,3106,,FindNextFileW,kernel32.dll,"252:03:50.656",RX=0,PX=0" (Indicator: "FindNextFileW"; in Source: "00000000-00002416.00000002.70186.002FE000.00000004.mdmp") Found string "960960987635,2944,3104,,FindFirstFileW,kernel32.dll,"252:06:45.937",RX=0,PX=0" (Indicator: "FindFirstFileW"; in Source: "00000000-00002416.00000003.77630.002C0000.00000004.mdmp") Found string "CoCreateInstance" (Indicator: "CoCreateInstance"; in Source: "00000000-00002416.00000003.77630.002C0000.00000004.mdmp") Found string "CoCreateInstanceHandler" (Indicator: "CoCreateInstance"; in Source: "00000000-00002416.00000003.77630.002C0000.00000004.mdmp")3f:T69d,Found string "*base64.CorruptInputError" (Indicator: "base64"; in File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "*base64.encoder" (Indicator: "base64"; in File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "*base64.Encoding" (Indicator: "base64"; in File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "crypto/rsa: missing public modulusforEachP: sched.safePointWait != 0heapBitsForSpan: base out of rangeillegal base64 data at input byte in \u hexadecimal character escapeinvalid nested repetition operatorinvalid or unsupported Perl syntaxinvalid padding bits in BIT STRINGreflect.FuncOf: too many argumentsreflect: Field index out of boundsreflect: Method index out of rangereflect: string index out of rangeruntime.SetFinalizer: cannot pass runtime: g is running but p is notruntime: unexpected return pc for schedule: spinning with local workspan and treap sizes do not match?too many references: cannot spliceunexpected runtime.netpoll error: 177635683940025046467781066894531252006-01-02T15:04:05.999999999Z07:0088817841970012523233890533447265625MHeap_FreeSpanLocked - invalid freecrypto/md5: invalid hash state sizeencoding/hex: odd length hex stringexecutable file not found in %PATH%file type does not support deadlinefindfunc: bad findfunctab entry idxfindrunnable: netpoll with spinninggreyobject: obj not pointer-" (Indicator: "base64"; in File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "encoding/base64" (Indicator: "base64"; in File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin")40:T43e,Found string "*runtime.systeminfo" (Indicator: "systeminfo"; in File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "length too largemessage too longmissing stackmapno route to hostnon-Go functionobject is remoteo{" (Indicator: "route"; in File: "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin") Found string "MSTaskListWClass" (Indicator: "tasklist"; in Source: "00000000-00002416.00000000.66347.00BD0000.00000002.mdmp, 00000000-00002416.00000001.68266.00BD0000.00000002.mdmp, 00000000-00002416.00000002.70186.00BD0000.00000002.mdmp") Found string "TaskListOverlayWnd" (Indicator: "tasklist"; in Source: "00000000-00002416.00000000.66347.00BD0000.00000002.mdmp, 00000000-00002416.00000001.68266.00BD0000.00000002.mdmp, 00000000-00002416.00000002.70186.00BD0000.00000002.mdmp") Found string "TaskListThumbnailWnd" (Indicator: "tasklist"; in Source: "00000000-00002416.00000000.66347.00BD0000.00000002.mdmp, 00000000-00002416.00000001.68266.00BD0000.00000002.mdmp, 00000000-00002416.00000002.70186.00BD0000.00000002.mdmp")41:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790318582073,"unified_at":"2026-09-25T06:43:02.073Z","metadata":{"hashes":{"sha256":"e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60","sha1":"f34e4b7080aa2ee5cfee2dac38ec0c306203b4ac","md5":"3d1cc4ef33bad0e39c757fce317ef82a","sha512":"8294b31a0f12fdc583ec1df5b9e36dfbb53745588da517c8c7842b197f96190b3228c759604df60159265e0f384bae0042ccc63ee966e81dc59b89b934b94e5b","ssdeep":"49152:QAdGB73ejP3+EMfRdASVaAvrC5Xh602+:QAgR3epMjASHch","ssdeep_chunks":["49152:QAdGB73","49152:AdGB73e","49152:dGB73ej","49152:GB73ejP","49152:B73ejP3","49152:73ejP3+","49152:3ejP3+E","49152:ejP3+EM","49152:jP3+EMf","49152:P3+EMfR","49152:3+EMfRd","49152:+EMfRdA","49152:EMfRdAS","49152:MfRdASV","49152:fRdASVa","49152:RdASVaA","49152:dASVaAv","49152:ASVaAvr","49152:SVaAvrC","49152:VaAvrC5","49152:aAvrC5X","49152:AvrC5Xh","49152:vrC5Xh6","49152:rC5Xh60","49152:C5Xh602","49152:5Xh602+","98304:QAdGB73","98304:AdGB73e","98304:dGB73ej","98304:GB73ejP","98304:B73ejP3","98304:73ejP3+","98304:3ejP3+E","98304:ejP3+EM","98304:jP3+EMf","98304:P3+EMfR","98304:3+EMfRd","98304:+EMfRdA","98304:EMfRdAS","98304:MfRdASV","98304:fRdASVa","98304:RdASVaA","98304:dASVaAv","98304:ASVaAvr","98304:SVaAvrC","98304:VaAvrC5","98304:aAvrC5X","98304:AvrC5Xh","98304:vrC5Xh6","98304:rC5Xh60","98304:C5Xh602","98304:5Xh602+","49152:QAgR3ep","49152:AgR3epM","49152:gR3epMj","49152:R3epMjA","49152:3epMjAS","49152:epMjASH","49152:pMjASHc","49152:MjASHch"],"imphash":"96c44fa1eee2c4e9b9e77d7bf42d59e6"},"file_info":{"file_name":"update.bin","file_type":["peexe","executable"],"file_type_id":"exe","file_size":3718656,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1577569357000,"last_seen":1689271980000,"last_multi_scan":1689271980000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["criminal","ransomware","scrinject","snake","ekansransomware","killpror","windows-server-utility"]},"stats":{"av":{"malicious_count":24,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":62},"sandbox_signatures":{"informative_count":115,"suspicious_count":23,"malicious_count":6,"total":144},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.FileCoder","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Antavmu","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"HEUR/AGEN.1314336","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Trojan.AV-Killer.ItW@aei5Gqj","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"malicious","threat_name":"Win.Ransomware.Snake-7546377-0","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Gen:Trojan.AV-Killer.ItW@aei5Gqj (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of WinGo/Filecoder.Snake.A trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"Ransom/Snake.a","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Riskware ( 0040eff71 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"HEUR:Trojan.Win32.AntiAV","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"Trojan-Ransom.b","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Encoder.gvakaa","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/Ransom-FUJ","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"malicious","threat_name":"Ransom/W32.Snake.3718656","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"malicious","threat_name":"Ransom.C0BFB53F","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"malicious","threat_name":"Ransom.C0BFB53F","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/Ransom.GMZL-5554","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Genus.BXR","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"Trojan.AntiAV","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.AntiAV.Win32.11788","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Win/malicious_confidence_100%","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Persistence","technique":"Kernel Modules and Extensions","attack_id":"T1215","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1215","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"tactic":"Persistence","technique":"Hooking","attack_id":"T1179","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1179","identifiers":[{"type":"suspicious","value":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1045","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1045","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1012","identifiers":[{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Contains ability to read registry keys (API string)"},{"type":"informative","value":"Contains registry location strings"},{"type":"suspicious","value":"Monitors specific registry key for changes"},{"type":"informative","value":"Reads information about supported languages"}],"sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"},{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"},{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"tactic":"Discovery","technique":"Peripheral Device Discovery","attack_id":"T1120","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1120","identifiers":[{"type":"informative","value":"Queries volume information of an entire harddrive"},{"type":"informative","value":"Queries volume information"}],"sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"tactic":"Lateral Movement","technique":"Remote Desktop Protocol","attack_id":"T1076","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1076","identifiers":[{"type":"suspicious","value":"Reads terminal service related keys (often RDP related)"}],"sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"}],"sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"},{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to create files (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function address"},{"type":"informative","value":"Found Windows API related strings"},{"type":"informative","value":"Contains ability to modify process thread functionality (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Contains Windows APIs"},{"type":"informative","value":"Contains reference to Windows native API (API string)"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"}],"sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"},{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"malicious","value":"Requested access to a critical system service"},{"type":"suspicious","value":"Opened the service control manager"}],"sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Contains ability to create/connect to a named pipe (API string)"}],"sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"},{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"},{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"suspicious","value":"Contains references to WMI/WMIC"}],"sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"},{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"},{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve/open a process (API string)"},{"type":"informative","value":"Contains ability to create a service (API string)"}],"sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"},{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"tactic":"Persistence","technique":"Kernel Modules and Extensions","attack_id":"T1547.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/006","identifiers":[{"type":"informative","value":"Contains ability to start/interact with device drivers (API string)"}],"sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"},{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"},{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"},{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"},{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to free a loaded DLL module (API string)"}],"sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"},{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"tactic":"Privilege Escalation","technique":"Create Process with Token","attack_id":"T1134.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/002","identifiers":[{"type":"informative","value":"Contains ability to create process with token (API string)"}],"sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"},{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to modify access token privileges (API string)"}],"sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"},{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Contains ability to modify process memory (API string)"},{"type":"informative","value":"Contains ability to modify the virtual address space of a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"},{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"},{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"YARA signature match - RC4 Encryption"},{"type":"suspicious","value":"Found a cryptographic related string"},{"type":"informative","value":"Loads the cryptographic module DLL"},{"type":"informative","value":"Contains reference to Base64 character set"},{"type":"informative","value":"YARA signature match - AES Encryption"}],"sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"},{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Contains ability to delete files (API string)"}],"sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"},{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Contains ability to create/open registry keys (API string)"},{"type":"informative","value":"Contains ability to close the handle to a registry key (API string)"},{"type":"informative","value":"Contains ability to delete registry value (API string)"}],"sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"},{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to set file time (API string)"},{"type":"informative","value":"Contains ability to retrieve file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"}],"sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"}],"sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"},{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"suspicious","value":"PE file has unusual entropy sections"},{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"},{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"tactic":"Defense Evasion","technique":"Dynamic API Resolution","attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","identifiers":[{"type":"informative","value":"Contains ability to dynamically determine API calls"}],"sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"},{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"}]},{"tactic":"Credential Access","technique":"Credential API Hooking","attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","identifiers":[{"type":"suspicious","value":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"suspicious","value":"Reads configuration files (.ini files)"},{"type":"informative","value":"Calls an API's typically used for searching a directory for a files"},{"type":"informative","value":"Touches files in program files directory"}],"sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"},{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"suspicious","value":"Queries process information"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Contains ability to enumerate processes (API string)"},{"type":"suspicious","value":"Calls an API typically used to enumerate process encountered in a system snapshot"}],"sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"},{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains ability to retrieve the NetBIOS name of the local computer (API string)"},{"type":"informative","value":"Contains ability to find logical drives of the machine (API string)"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Contains ability to retrieve the OS version (API string)"},{"type":"informative","value":"Contains ability to determine disk drive type (API string)"},{"type":"suspicious","value":"Found system commands related strings"},{"type":"informative","value":"Calls an API typically used to determine whether a process running under Wow64"},{"type":"informative","value":"Calls an API typically used to retrieve SID domain name"},{"type":"informative","value":"Queries volume information of an entire harddrive"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Contains ability to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains ability to retrieve volume information (API string)"},{"type":"suspicious","value":"Calls an API typically used to determine the valid logical drives on the computer"},{"type":"informative","value":"Queries volume information"}],"sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"},{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"suspicious","value":"Calls an API typically used to retrieve the current status of the specified service"},{"type":"suspicious","value":"Requested access to a system service"},{"type":"informative","value":"Contains the ability to enumerate system service (API string)"}],"sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"},{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Contains ability to retrieve the local name for a socket (API string)"},{"type":"informative","value":"Contains ability to query network adapter information (API string)"},{"type":"informative","value":"Contains ability to free the memory used by network management functions (API string)"}],"sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"},{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Contains ability to retrieve usernames (API string)"},{"type":"informative","value":"Contains ability to retrieve the name of the user associated with the current thread (API string)"}],"sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"},{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"tactic":"Discovery","technique":"Domain Account","attack_id":"T1087.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1087/002","identifiers":[{"type":"informative","value":"Contains ability to retrieve information about user accounts on a server (API string)"}],"sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"},{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"tactic":"Discovery","technique":"Remote System Discovery","attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","identifiers":[{"type":"informative","value":"Contains ability to enumerate system network resources (API string)"}],"sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"},{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine timezone (API string)"},{"type":"informative","value":"Contains ability to retrieve machine time (API string)"},{"type":"informative","value":"Contains ability to retrieve local/system time as file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"},{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Contains ability to query system locale (API string)"}],"sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"},{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","identifiers":[{"type":"suspicious","value":"Possibly tries to implement anti-virtualization techniques using MAC address detection"}],"sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"},{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Contains ability to move file or directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"},{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Writes log files"}],"sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Contains ability to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Making HTTPS connections using secure TLS/SSL version"}],"sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"suspicious","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Found potential URL in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"informative","value":"Contains ability to communicate with C2 using Sockets (API string)"}],"sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"},{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Drops XML files"},{"type":"suspicious","value":"Drops executable files"}],"sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"},{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"tactic":"Command and Control","technique":"Mail Protocols","attack_id":"T1071.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/003","identifiers":[{"type":"informative","value":"Found mail related domain names"}],"sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"},{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"},{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"YARA signature match - AES Encryption"},{"type":"informative","value":"YARA signature match - RC4 Encryption"},{"type":"informative","value":"Contains possible references to Golang crypto modules"},{"type":"informative","value":"Contains reference to cryptographic keys"}],"sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"},{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to shutdown system"}],"sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to close a handle to a service (API string)"},{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"},{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"suspicious","value":"Attempts to detect virtual machine (file access)"}],"sources":[{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","sources":[{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"tactic":"Discovery","technique":"System Network Connections Discovery","attack_id":"T1049","attack_id_wiki":"https://attack.mitre.org/techniques/T1049","identifiers":[{"type":"informative","value":"Contains ability to retrieve local network connections"}],"sources":[{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"suspicious","value":"Found a potential E-Mail address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]}],"sandbox_signatures":[{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"\".exe\" queries volume information of \"C:\\\" at 00012204-00003828-00000046-4247777554\n \".exe\" queries volume information of \"C:\\share\" at 00012204-00003828-00000046-4250294783","origin":"API Call","mitre_attack_id":"T1120","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"},{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"},{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information of an entire harddrive","description":"\".exe\" queries volume information of \"C:\\\" at 00012204-00003828-00000046-4247777554","origin":"API Call","mitre_attack_id":"T1120","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"},{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"},{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\Global\\EKANS\"\n \"Global\\EKANS\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"},{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"},{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"com.jrockit.mc.flightrecorder.controlpanel.ui_5.5.1.172852.jar\" has type \"data\"\n \"com-sun-tools-visualvm-jvm.jar\" has type \"data\"\n \"AppStore_icon.svg\" has type \"data\"\n \"CAPSULES.INF\" has type \"data\"\n \"com.jrockit.mc.ui_5.5.1.172852.jar\" has type \"data\"\n \"com.jrockit.mc.attach_5.5.1.172852.jar\" has type \"data\"\n \"603jOLdO.exe\" has type \"data\"\n \"AUDIOSEARCHMAIN.DLL\" has type \"data\"\n \"com-sun-tools-visualvm-charts_zh_CN.jar\" has type \"data\"\n \"close.svg\" has type \"data\"\n \"com.jrockit.mc.components.ui.ja_5.5.1.172852.jar\" has type \"data\"\n \"com.jrockit.mc.rjmx.zh_CN_5.5.1.172852.jar\" has type \"data\"\n \"CSS7DATA000C.DLL\" has type \"data\"\n \"access-bridge-32.jar\" has type \"data\"\n \"com-sun-tools-visualvm-profiler.jar\" has type \"data\"\n \"com-sun-tools-visualvm-uisupport_ja.jar\" has type \"data\"\n \"CZspj.doc\" has type \"data\"\n \"com-sun-tools-visualvm-host-views.jar\" has type \"data\"\n \"com-sun-tools-visualvm-profiling_zh_CN.jar\" has type \"data\"\n \"com.jrockit.mc.console.ui_5.5.1.172852.jar\" has type \"data\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"},{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"},{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"\".exe\" touched file \"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls\"\n \".exe\" touched file \"%WINDIR%\\SysWOW64\\WSHTCPIP.DLL\"\n \".exe\" touched file \"%WINDIR%\\SysWOW64\\wship6.dll\"\n \".exe\" touched file \"%WINDIR%\\SysWOW64\\wshqos.dll\"","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"},{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$27","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"},{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"},{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\".exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1215","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"},{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin\" was detected as \"tElock v1.0 (private) -> tE!\"","origin":"Static Parser","mitre_attack_id":"T1045","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"},{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"},{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Possibly checks for known debuggers/analysis tools","description":"\"EthiopicExtenderFebruaryFi;\" (Indicator: \"icext\")","origin":"File/Memory","relevance":2,"id":"string-5","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Monitors specific registry key for changes","description":"\".exe\" monitors \"\\REGISTRY\\MACHINE\\SYSTEM\\ControlSet001\\services\\WinSock2\\Parameters\\Protocol_Catalog9\" (Filter: 1; Subtree: 12643584)\n \".exe\" monitors \"\\REGISTRY\\MACHINE\\SYSTEM\\ControlSet001\\services\\WinSock2\\Parameters\\NameSpace_Catalog5\" (Filter: 1; Subtree: 12643584)","origin":"API Call","mitre_attack_id":"T1012","relevance":4,"id":"api-12","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"Heuristic match: \"19531252.5.4.32.5.4.52.5.4.62.5.4.72.5.4.82.5.4.92\"\n Heuristic match: \", idle: 2.5.4.102.5.4.112.5.4.17488281255\"","origin":"File/Memory","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"},{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"},{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"The input sample dropped very many files","description":"The input sample dropped 2000 files (often an indicator for ransomware)","origin":"Binary File","relevance":5,"id":"binary-10","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"level":"suspicious","category":"Remote Access Related","name":"Reads terminal service related keys (often RDP related)","description":"\".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TERMINAL SERVER\"; Key: \"TSUSERENABLED\")","origin":"Registry Access","mitre_attack_id":"T1076","relevance":10,"id":"registry-61","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"LoadLibraryW\n LoadLibraryA\n GetProcAddress\n CreateThread\n WriteFile\n VirtualAlloc","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"},{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"},{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"\".exe\" wrote bytes \"7111bb007a3bba00ab8b02007f950200fc8c0200729602006cc805001ecdb7007d26b700\" to virtual address \"0x76B007E4\" (part of module \"USER32.DLL\")\n \".exe\" wrote bytes \"c0df65771cf96477ccf864770d64667700000000c011cf7500000000fc3ecf7500000000e013cf75000000009457a17525e06577c6e0657700000000bc6aa07500000000cf31cf75000000009319a175000000002c32cf7500000000\" to virtual address \"0x75C41000\" (part of module \"NSI.DLL\")","origin":"Hook Detection","mitre_attack_id":"T1179","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"},{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Timestamp in PE header is very old or in the future","description":"\"e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin\" claims program is from Thu Jan 1 00:00:00 1970","origin":"Static Parser","relevance":10,"id":"static-3","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"},{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"},{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"level":"malicious","category":"Environment Awareness","name":"Found a Wine emulator related string","description":"\"wait for GC cyclewine_get_version\" (Indicator: \"wine_get_version\"; File: \"e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin\")","origin":"File/Memory","relevance":2,"id":"string-62","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"},{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"},{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"55/70 Antivirus vendors marked sample as malicious (78% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"},{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"},{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"55/70 Antivirus vendors marked sample as malicious (78% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"},{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"},{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"Observed string: \"S\"=TNepal Standard TimePattern_White_SpaceRussia Time Zone 10Russia Time Zone 11Samoa Standard TimeSetTokenInformationSyria Standard TimeTokyo Standard TimeTomsk Standard TimeTonga Standard TimeWaitForSingleObjectY\" (Indicator: \"WaitForSingleObject\") in Source: e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin, Observed string: \"NtWaitForSingleObject\" (Indicator: \"WaitForSingleObject\") in Source: e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin, Observed string: \"WaitForSingleObject\" (Indicator: \"WaitForSingleObject\") in Source: e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to free a loaded DLL module (API string)","description":"Observed string: \"FreeLibraryF\" (Indicator: \"FreeLibrary\") in Source: e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin\n Observed string: \"FreeLibraryWhenCallbackReturns\" (Indicator: \"FreeLibrary\") in Source: 00000000-00007144-00000C1E-75757922","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"},{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to impersonate access tokens (API string)","description":"Observed string: \"OpenThreadTokenOther_LowercaseOther_UppercaseP+\" (Indicator: \"OpenThreadToken\") in Source: e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin\n Observed string: \"(OpenProcessTokenOther_AlphabeticQU;\" (Indicator: \"OpenProcessToken\") in Source: e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-306","sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"},{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to modify process memory (API string)","description":"$28","origin":"File/Memory","mitre_attack_id":"T1055.003","relevance":1,"id":"string-309","sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to pass information to a window procedure (API string)","description":"Observed string: \"\" (Indicator: \"CallWindowProc\") in Source: 00000000-00007144.00000000.78174.02CD0000.00000004.mdmp\n 00000000-00007144.00000001.80093.02CD0000.00000004.mdmp\n 00000000-00007144.00000002.82013.02CD0000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to set file time (API string)","description":"Observed string: \"^SetFileTimeSignWritingSoft_DottedT\" (Indicator: \"SetFileTime\") in Source: e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-409","sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains reference to Base64 character set","description":"file/memory contains long string with (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\"; File: \"e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-338","sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"},{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Observed string: \"SetUnhandledExceptionFilter\" [Source: e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin]","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-148","sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains possible references to Golang crypto modules","description":"$29","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-234","sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"},{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to cryptographic keys","description":"file/memory contains long string with (Indicator: \"public key\"; File: \"e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin\")\n Found string \"casfrom_Gscanstatus: gp->status is not in scan statecrypto/rsa: message too long for RSA public key sized\" (Indicator: \"public key\"; File: \"e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-280","sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"},{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"update.bin.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00007144)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"},{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"\"update.bin.exe\" called \"RtlGetVersion\" with parameter 140100000a00000000000000ab3f00000200000000001800080015c08ddf6c7770e78a0002000000e82f7d746cf88a000400000002000000842d1800080015c01403000000a0360028e78a00526183745860cf0248869b74000000005be13b0efce78a00c7968474000000005860cf0248869b7401180000fce78a00d2968474d82f7d74501e8474f996847400000000d82f7d74545bcf026ce88a005860cf02d8185e76b736000000000000b4e78a003f105c76080015c090cc827401000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000006a5e787680e88a00dbcc827401000000a72a57d3 (UID: 00000000-00007144)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform scheduled transfer (API string)","description":"$2a","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"},{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query system locale (API string)","description":"Observed string: \"GetLocaleInfoEx\" [Source: 00000000-00007144-00000C1E-75761261]\n Observed string: \"GetUserDefaultLCID\" [Source: 00000000-00007144-00000C1E-242429726]","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"},{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"update.bin.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"},{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"$2b","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine time (API string)","description":"$2c","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"},{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine timezone (API string)","description":"Observed string: \"6Aleutian Standard TimeAtlantic Standard TimeCaucasus Standard TimeConvertSidToStringSidWConvertStringSidToSidWCreateIoCompletionPortDateline Standard TimeGeorgian Standard TimeGetEnvironmentStringsWGetTimeZoneInformationHawaiian Standard TimeInscriptional_ParthianJ@\" (Indicator: \"GetTimeZoneInformation\") in Source: e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin\n Observed string: \"syscall.GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\") in Source: e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-248","sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"},{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS version (API string)","description":"Observed string: \"GetIfEntryGetVersionGlagoliticHS \" [Source: e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin]\n Observed string: \"syscall.GetVersion \" [Source: e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin]\n Observed string: \"GetVersion \" [Source: 00000000-00007144-00000C1E-75820402]","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"},{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Observed API string: \"GetStartupInfo\" [Source: e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin]","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-167","sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"},{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve volume information (API string)","description":"Observed string: \"GetVolumeInformation\" [Source: 00000000-00007144-00000C1E-76034113]","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-162","sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"},{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"update.bin.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"},{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"update.bin.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"},{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"\"update.bin.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007144)\n \"update.bin.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007144)\n \"update.bin.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007144)\n \"update.bin.exe\" called \"LoadLibrary\" with a parameter kernel32 (UID: 00000000-00007144)\n \"update.bin.exe\" called \"LoadLibrary\" with a parameter kernel32.dll (UID: 00000000-00007144)\n \"update.bin.exe\" called \"LoadLibrary\" with a parameter advapi32.dll (UID: 00000000-00007144)\n \"update.bin.exe\" called \"LoadLibrary\" with a parameter ole32.dll (UID: 00000000-00007144)\n \"update.bin.exe\" called \"LoadLibrary\" with a parameter oleaut32.dll (UID: 00000000-00007144)","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"},{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$2d","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"}]},{"level":"informative","category":"General","name":"Contains Windows APIs","description":"$2e","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"}]},{"level":"informative","category":"General","name":"Contains ability to close a handle to a service (API string)","description":"Observed string: \"CloseServiceHandle\" (Indicator: \"CloseServiceHandle\") in Source: 00000000-00007144-00000C1E-241567969","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-242","sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"},{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"level":"informative","category":"General","name":"Contains ability to close the handle to a registry key (API string)","description":"Observed string: \"RegCloseKeyS\" (Indicator: \"RegCloseKey\") in Source: e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin\n Observed string: \"syscall.RegCloseKey\" (Indicator: \"RegCloseKey\") in Source: e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"},{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"Observed string: \"CertCloseStoreCreateProcessWCryptGenRandomD!\" (Indicator: \"CreateProcess\") in Source: e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin\n Observed string: \"Arabic Standard TimeAzores Standard TimeCertOpenSystemStoreWCreateProcessAsUserWCryptAcquireContextWD\" (Indicator: \"CreateProcess\") in Source: e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"},{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"level":"informative","category":"General","name":"Contains ability to create files (API string)","description":"Observed string: \"CreateFileCreatePipeDX3\" (Indicator: \"CreateFile\") in Source: e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin\n Observed string: \"TCloseHandleCreateFileWDeleteFileWE\" (Indicator: \"CreateFile\") in Source: e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin\n Observed string: \"Caucasian_AlbanianCommandLineToArgvWCreateFileMappingWCuba Standard TimeFiji Standard TimeGetComputerNameExWGetExitCodeProcessGetFileAttributesWGetModuleFileNameWH\" (Indicator: \"CreateFile\") in Source: e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin\n Observed string: \"syscall.CreateFile\" (Indicator: \"CreateFile\") in Source: e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"},{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"level":"informative","category":"General","name":"Contains ability to create/open registry keys (API string)","description":"Observed string: \"MTRegCreateKeyExWRegDeleteValueWS\" (Indicator: \"RegCreateKey\") in Source: e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-307","sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"},{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically determine API calls","description":"Found GetProcAddress() and LoadLibraryA() in an import section (Source: e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin)","origin":"Static Parser","mitre_attack_id":"T1027.007","relevance":1,"id":"static-79","sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"},{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"level":"informative","category":"General","name":"Contains ability to modify process thread functionality (API string)","description":"Found string \"OpenThreadTokenOther_LowercaseOther_UppercaseP+\" (Indicator: \"OpenThread\"; File: \"e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin\")\n Found string \"CreateThread\" (Indicator: \"CreateThread\"; File: \"e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"},{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"level":"informative","category":"General","name":"Contains ability to move file or directory (API string)","description":"Observed string: \"MalayalamMongolianMoveFileWNO`\" (Indicator: \"MoveFile\") in Source: e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin\n Observed string: \"]MoveFileExWM\" (Indicator: \"MoveFile\") in Source: e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin\n Observed string: \"internal/syscall/windows.MoveFileEx\" (Indicator: \"MoveFile\") in Source: e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin","origin":"File/Memory","mitre_attack_id":"T1570","relevance":1,"id":"string-322","sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"},{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Observed string: \"Failed to find Failed to load FlushViewOfFileGetAdaptersInfoGetCommandLineWGetProcessTimesGetStartupInfoWH\" (Indicator: \"GetCommandLine\") in Source: e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin\n Observed string: \"Caucasian_AlbanianCommandLineToArgvWCreateFileMappingWCuba Standard TimeFiji Standard TimeGetComputerNameExWGetExitCodeProcessGetFileAttributesWGetModuleFileNameWH\" (Indicator: \"CommandLineToArgv\") in Source: e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin\n Observed string: \"syscall.GetCommandLine\" (Indicator: \"GetCommandLine\") in Source: e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin\n Observed string: \"GetCommandLineW\" (Indicator: \"GetCommandLine\") in Source: 00000000-00007144-00000C1E-75820254","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"},{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/open a process (API string)","description":"Observed string: \"Old_PersianOpenProcessPau_Cin_HauPc\" (Indicator: \"OpenProcess\") in Source: e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin\n Observed string: \"(OpenProcessTokenOther_AlphabeticQU;\" (Indicator: \"OpenProcess\") in Source: e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin\n Observed string: \"syscall.OpenProcess\" (Indicator: \"OpenProcess\") in Source: e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin\n Observed string: \"OpenProcess\" (Indicator: \"OpenProcess\") in Source: 00000000-00007144-00000C1E-241871523","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"},{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Observed string: \"GetAddrInfoWGetConsoleCPGetLastErrorGetLengthSidGetStdHandleGetTempPathWH#\" (Indicator: \"GetLastError\") in Source: e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin\n Observed string: \"syscall.GetLastError\" (Indicator: \"GetLastError\") in Source: e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin\n Observed string: \"eicppanmgiigbeblppmd/heapjnpececmcgncmcfb/lkhlnakioccljlbjoloc/bdalegiamdedigadphck.GetLastError\" (Indicator: \"GetLastError\") in Source: e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"},{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"level":"informative","category":"General","name":"Contains ability to start/interact with device drivers (API string)","description":"Observed string: \"CreateHardLinkWDeviceIoControlDuplicateHandleE+\" (Indicator: \"DeviceIoControl\") in Source: e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin","origin":"File/Memory","mitre_attack_id":"T1547.006","relevance":1,"id":"string-220","sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"},{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$2f","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"},{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"level":"informative","category":"General","name":"Contains the ability to enumerate system service (API string)","description":"Observed string: \"OpenService\" [Source: e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin]\n Observed string: \"OpenSCManagerW\" [Source: 00000000-00007144-00000C1E-241487397]\n Observed string: \"EnumServicesStatusExW\" [Source: 00000000-00007144-00000C1E-241521456]\n Observed string: \"OpenServiceW\" [Source: 00000000-00007144-00000C1E-241556968]","origin":"File/Memory","mitre_attack_id":"T1007","relevance":1,"id":"string-191","sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"},{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"\"update.bin.exe\" loaded module \"KERNEL32\" at base 765a0000\n \"update.bin.exe\" loaded module \"API-MS-WIN-CORE-STRING-L1-1-0\" at base 76680000\n \"update.bin.exe\" loaded module \"API-MS-WIN-CORE-DATETIME-L1-1-1\" at base 76680000\n \"update.bin.exe\" loaded module \"API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0\" at base 76680000\n \"update.bin.exe\" loaded module \"%WINDIR%\\SYSTEM32\\IMM32.DLL\" at base 76c40000\n \"update.bin.exe\" loaded module \"API-MS-WIN-CORE-SYNCH-L1-2-0\" at base 76680000\n \"update.bin.exe\" loaded module \"API-MS-WIN-CORE-FIBERS-L1-1-1\" at base 76680000\n \"update.bin.exe\" loaded module \"API-MS-WIN-CORE-LOCALIZATION-L1-2-1\" at base 76680000\n \"update.bin.exe\" loaded module \"%WINDIR%\\TEMP\\VXOLE.DLL\" at base 72410000\n \"update.bin.exe\" loaded module \"KERNEL32.DLL\" at base 765a0000\n \"update.bin.exe\" loaded module \"ADVAPI32.DLL\" at base 76960000\n \"update.bin.exe\" loaded module \"RPCRT4.DLL\" at base 76dd0000","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"},{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"update.bin.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 76DD0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"},{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"level":"informative","category":"General","name":"Loads the cryptographic module DLL","description":"\"update.bin.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 769E0000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$30","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"},{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"},{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin\" has an writable section named \".data\"\n \"e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin\" has an writable section named \".idata\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"},{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"\"e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin\" file has an entrypoint instructions - \"jmp\t0x446720,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,mov\tebx, dword ptr [esp + 4],mov\tdword ptr fs:[0x34], 0,mov\tebp, esp,mov\tecx, dword ptr [ebx + 4],mov\teax, ecx,shl\teax, 2,sub\tesp, eax,mov\tedi, esp,mov\tesi, dword ptr [ebx + 8],cld\t,rep movsd\tdword ptr es:[edi], dword ptr [esi],call\tdword ptr [ebx],mov\tesp, ebp,mov\tebx, dword ptr [esp + 4],mov\tdword ptr [ebx + 0xc], eax,mov\tdword ptr [ebx + 0x10], edx,mov\teax, dword ptr fs:[0x34],mov\tdword ptr [ebx + 0x14], eax,ret\t,int3\t,int3\t,int3\t,int3\t,sub\tesp, 0x18,mov\tdword ptr [esp], 0xfffffff4,mov\tebp, esp,call\tdword ptr [0x777050],mov\tesp, ebp,\"","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"},{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"level":"informative","category":"General","name":"PE file has a big raw size section","description":"Raw size of \".text\" is \"0x375800\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-125","sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"},{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"level":"informative","category":"General","name":"PE file has a big virtual size section","description":"Virtual size of \".text\" is \"0x375708\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-124","sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"},{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"update.bin.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")\n \"update.bin.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"update.bin.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"update.bin.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN\")\n \"update.bin.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"},{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to create a service (API string)","description":"\"CreateService\" (Indicator: \"CreateService\"; File: \"e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin\")\n \"RegisterServiceCtrlHandlerExW\" (Indicator: \"RegisterServiceCtrlHandler\"; File: \"00000000-00007144-00000C1E-75929754\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-199","sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"},{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"$31","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"},{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"level":"informative","category":"Installation/Persistence","name":"Drops XML files","description":"$32","origin":"Binary File","mitre_attack_id":"T1105","relevance":1,"id":"binary-39","sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"},{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"\"update.bin.exe\" trying to access non-existent file \"C:\\Windows\\System32\\WOW64LOG.DLL\"\n \"update.bin.exe\" trying to access non-existent file \"C:\\WINDOWS\\system32\\rpcss.dll\"\n \"update.bin.exe\" trying to access non-existent file \"C:\\WINDOWS\\system32\\wbem\\wbemcomn.dll\"\n \"update.bin.exe\" trying to access non-existent file \"C:\\WINDOWS\\system32\\wbem\\bcrypt.dll\"\n \"update.bin.exe\" trying to access non-existent file \"C:\\CRYPTSP.dll\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"},{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes log files","description":"\"update.bin.exe\" writes a file \"C:\\$WINDOWS.~BT\\Sources\\Panther\\compatscancache.dat\"\n \"update.bin.exe\" writes a file \"C:\\$WINDOWS.~BT\\Sources\\Panther\\setuperr.log\"\n \"update.bin.exe\" writes a file \"C:\\$WINDOWS.~BT\\Sources\\SFCN.DAT\"\n \"update.bin.exe\" writes a file \"C:\\$WINDOWS.~BT\\Sources\\SFLCID.DAT\"","origin":"API Call","mitre_attack_id":"T1074.001","relevance":1,"id":"api-159","sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with C2 using Sockets (API string)","description":"$33","origin":"File/Memory","mitre_attack_id":"T1095","relevance":1,"id":"string-228","sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"},{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create/connect to a named pipe (API string)","description":"Observed string: \"CreateFileCreatePipeDX3\" (Indicator: \"CreatePipe\") in Source: e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-210","sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"},{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"level":"informative","category":"Network Related","name":"Contains ability to retrieve information about user accounts on a server (API string)","description":"Observed string: \"#MB; allocated NetUserGetInfoOther_ID_StartPattern_SyntaxProcess32NextWQuotation_MarkR\" which can Retrieves information about a particular user account on a server. [Source: e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin]","origin":"File/Memory","mitre_attack_id":"T1087.002","relevance":1,"id":"string-112","sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"},{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"level":"informative","category":"Network Related","name":"Found mail related domain names","description":"Observed email domain:\"tm0185~3.thmtm01859865[[fn=kilter]].thmx.\" [Source: 00000000-00007144.00000002.82013.02CD0000.00000004.mdmp]","origin":"File/Memory","mitre_attack_id":"T1071.003","relevance":1,"id":"string-169","sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"},{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"level":"informative","category":"Network Related","name":"Making HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x00000303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - AES Encryption","description":"YARA signature for AES encryption matched on file \"sample.bin\"\n YARA signature for AES encryption matched on process \"00000000-00007144\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-103","sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"},{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - RC4 Encryption","description":"YARA signature for RC4 encryption matched on file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-104","sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"},{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"update.bin.exe\" called \"CreateToolhelp32Snapshot\" (UID: 00000000-00007144)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"},{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API's typically used for searching a directory for a files","description":"$34","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"},{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to capture screen (API string)","description":"$35","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to determine disk drive type (API string)","description":"Observed string: \"GetDriveTypeW\" [Source: 00000000-00007144-00000C1E-76030944]","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-80","sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"},{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"$36","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"},{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate processes (API string)","description":"Observed string: \"#MB; allocated NetUserGetInfoOther_ID_StartPattern_SyntaxProcess32NextWQuotation_MarkR\" [Source: e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin]\n Observed string: \"Process32FirstWPsalter_PahlaviR\" [Source: e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin]\n Observed string: \"Azerbaijan Standard TimeBangladesh Standard TimeCape Verde Standard TimeCertFreeCertificateChainCreateToolhelp32SnapshotGetSystemTimeAsFileTime\" [Source: e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin]\n Observed string: \"CreateToolhelp32Snapshot\" [Source: 00000000-00007144-00000C1E-241660366]\n Observed string: \"Process32FirstW\" [Source: 00000000-00007144-00000C1E-241671735]\n Observed string: \"Process32NextW\" [Source: 00000000-00007144-00000C1E-241675019]","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"},{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate system network resources (API string)","description":"Observed string: \"dGetAcceptExSockaddrsGetAdaptersAddressesGetCurrentDirectoryWGetFileAttributesExWGetProcessMemoryInfoIDS_Trinary_OperatorIR\" (Indicator: \"GetAdaptersAddresses\") in Source: e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin","origin":"File/Memory","mitre_attack_id":"T1018","relevance":1,"id":"string-313","sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"},{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to find logical drives of the machine (API string)","description":"Observed string: \"GetLogicalDriveStringsW\" [Source: 00000000-00007144-00000C1E-75997256]","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-84","sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"},{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to query network adapter information (API string)","description":"Observed string: \"Failed to find Failed to load FlushViewOfFileGetAdaptersInfoGetCommandLineWGetProcessTimesGetStartupInfoWH\" [Source: e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin]","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-118","sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"},{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Observed string: \"#ParseIntPhags_PaPriorityRdlengthReadFileSaturdayTagbanwaTai_ThamTai_VietThursdayTifinaghUgariticWSAIoctlZ\" (Indicator: \"ReadFile\") in Source: e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin\n Observed string: \"syscall.ReadFile\" (Indicator: \"ReadFile\") in Source: e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin\n Observed string: \"ReadFile\" (Indicator: \"ReadFile\") in Source: 00000000-00007144-00000C1E-243657090","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-534","sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read registry keys (API string)","description":"$37","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"},{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Observed string: \")`FindFirstFileWFormatMessageWGC assist waitGC worker initGetConsoleModeGetProcAddressGetUserNameExWH\" (Indicator: \"GetProcAddress\") in Source: e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin\n Observed string: \"runtime.getGetProcAddress\" (Indicator: \"GetProcAddress\") in Source: e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin\n Observed string: \"GetProcAddress\" (Indicator: \"GetProcAddress\") in Source: e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"},{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"$38","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"},{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about the current system (API string)","description":"Observed string: \"AUS Central Standard TimeAUS Eastern Standard TimeAfghanistan Standard TimeExpandEnvironmentStringsWGetFinalPathNameByHandleWGetQueuedCompletionStatusKaliningrad Standard TimeMiddle East Standard TimeNew Zealand Standard TimeNorth Korea Standard TimeTKY.\" [Source: e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin]\n Observed string: \"GetSystemInfo\" [Source: e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin]","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"},{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the NetBIOS name of the local computer (API string)","description":"Observed string: \"FlushFileBuffersGC worker (idle)GetComputerNameWGetCurrentThreadGetFullPathNameWGetLongPathNameWH\" [Source: e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin]\n Observed string: \"Caucasian_AlbanianCommandLineToArgvWCreateFileMappingWCuba Standard TimeFiji Standard TimeGetComputerNameExWGetExitCodeProcessGetFileAttributesWGetModuleFileNameWH\" [Source: e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin]","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-122","sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"},{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Observed string: \"GetModuleFileName\" [Source: e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin]","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"},{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"Observed string: \"Argentina Standard TimeAstrakhan Standard TimeCertGetCertificateChainE. Africa Standard TimeE. Europe Standard TimeFreeEnvironmentStringsWGetEnvironmentVariableWGetSystemTimeAsFileTimeGreenland Standard TimeGreenwich Standard TimeI\" [Source: e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin]\n Observed string: \"syscall.GetEnvironmentVariable\" [Source: e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin]\n Observed string: \"GetEnvironmentVariableW\" [Source: 00000000-00007144-00000C1E-75966731]","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-107","sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"},{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the local name for a socket (API string)","description":"Observed string: \"gccheckmarkgeneralizedgetpeernamegetsocknamegx\"6\" (Indicator: \"getsockname\") in Source: e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-224","sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"},{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Observed string: \"GetTickCount64\" (Indicator: \"GetTickCount\") in Source: 00000000-00007144-00000C1E-75758373","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve usernames (API string)","description":"Observed string: \")`FindFirstFileWFormatMessageWGC assist waitGC worker initGetConsoleModeGetProcAddressGetUserNameExWH\" [Source: e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin]\n Observed string: \"p|LookupAccountNameWN.\" [Source: e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin]","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"}]},{"level":"informative","category":"System Security","name":"Contains ability to create process with token (API string)","description":"Observed string: \"Arabic Standard TimeAzores Standard TimeCertOpenSystemStoreWCreateProcessAsUserWCryptAcquireContextWD\" [Source: e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin]","origin":"File/Memory","mitre_attack_id":"T1134.002","relevance":1,"id":"string-168","sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"},{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files (API string)","description":"Observed string: \"TCloseHandleCreateFileWDeleteFileWE\" (Indicator: \"DeleteFile\") in Source: e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"},{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete registry value (API string)","description":"Observed string: \"MTRegCreateKeyExWRegDeleteValueWS\" (Indicator: \"RegDeleteValue\") in Source: e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-230","sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"},{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"Observed string: \"AdjustTokenPrivilegesAlaskan Standard TimeAnatolian_HieroglyphsArabian Standard TimeB\" [Source: e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin]\n Observed string: \"LookupPrivilegeValueWMagadan Standard TimeMorocco Standard TimeMyanmar Standard TimeNamibia Standard TimeNetGetJoinInformationNorfolk Standard TimeOther_Grapheme_ExtendP\" [Source: e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin]","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"},{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"$39","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"},{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"level":"informative","category":"System Security","name":"Contains ability to shutdown system","description":"Observed string: \"Shutdown\" (Indicator: \"shutdown\") in Source: e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin\n Observed string: \"shutdown\" (Indicator: \"shutdown\") in Source: e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin","origin":"File/Memory","mitre_attack_id":"T1529","relevance":1,"id":"string-406","sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Observed string: \"1ExitProcessF\" (Indicator: \"ExitProcess\") in Source: e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin\n Observed string: \"RegQueryInfoKeyWRegQueryValueExWRemoveDirectoryWRoundingMode(%d)SetFilePointerExTerminateProcessU\" (Indicator: \"TerminateProcess\") in Source: e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin\n Observed string: \"syscall.TerminateProcess\" (Indicator: \"TerminateProcess\") in Source: e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin\n Observed string: \"ExitProcess\" (Indicator: \"ExitProcess\") in Source: e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin\n Observed string: \"TerminateProcess\" (Indicator: \"TerminateProcess\") in Source: 00000000-00007144-00000C1E-241872439","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"},{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Observed string: \"igWSASendToWednesdayWriteFileX%\" (Indicator: \"WriteFile\") in Source: e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin\n Observed string: \"syscall.WriteFile\" (Indicator: \"WriteFile\") in Source: e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin\n Observed string: \"io/ioutil.WriteFile\" (Indicator: \"WriteFile\") in Source: e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin\n Observed string: \"WriteFile\" (Indicator: \"WriteFile\") in Source: e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-535","sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to free the memory used by network management functions (API string)","description":"Observed string: \"MSpanList_InsertMSpanList_RemoveMeroitic_CursiveNetApiBufferFreeO\" (Indicator: \"NetApiBufferFree\") in Source: e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-223","sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"},{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"Observed string: \"CreateMutexW\" (Indicator: \"CreateMutex\") in Source: 00000000-00007144-00000C1E-75957935","origin":"File/Memory","relevance":1,"id":"string-354","sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"},{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"level":"informative","category":"Unusual Characteristics","name":"Possibly uses a Windows Server utility","description":"\"RuntimeBroker.exe\" (Indicator: \"runtimebroker.exe\")","origin":"File/Memory","relevance":10,"id":"string-65","sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"update.bin.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries process information","description":"\"update.bin.exe\" queried SystemProcessInformation at 00000000-00007144-00000C13-75381065 [PID: 7144]\n \"update.bin.exe\" queried SystemProcessInformation at 00000000-00007144-00000C13-75382478 [PID: 7144]\n \"update.bin.exe\" queried SystemProcessInformation at 00000000-00007144-00000C13-241661933 [PID: 7144]\n \"update.bin.exe\" queried SystemProcessInformation at 00000000-00007144-00000C13-241665013 [PID: 7144]\n \"update.bin.exe\" queried SystemProcessInformation at 00000000-00007144-00000C13-242156237 [PID: 7144]\n \"update.bin.exe\" queried SystemProcessInformation at 00000000-00007144-00000C13-242157439 [PID: 7144]","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":".symtab with unusual entropies 0.0203931352361","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":3,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"},{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"level":"suspicious","category":"General","name":"Opened the service control manager","description":"\"update.bin.exe\" called \"OpenSCManagerW\" requesting access rights \"SC_MANAGER_ALL_ACCESS\" (0xf003f)","origin":"API Call","mitre_attack_id":"T1569.002","relevance":10,"id":"api-77","sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"}]},{"level":"suspicious","category":"General","name":"Reads configuration files (.ini files)","description":"\"update.bin.exe\" reads file \"C:\\$WINDOWS.~BT\\Sources\\Panther\\Appraiser_Data.ini\"","origin":"API Call","mitre_attack_id":"T1083","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"}]},{"level":"suspicious","category":"General","name":"Requested access to a system service","description":"$3a","origin":"API Call","mitre_attack_id":"T1007","relevance":10,"id":"api-76","sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains references to WMI/WMIC","description":"Found string \"WmiPrvSE.exe\" (Indicator: \"wmiprvse.exe\"; in Source: \"00000000-00007144.00000000.78174.33860000.00000004.mdmp, 00000000-00007144.00000001.80093.33860000.00000004.mdmp, 00000000-00007144.00000002.82013.33860000.00000004.mdmp\")\n Found string \"WMIADAP.exe\" (Indicator: \"wmiadap.exe\"; in Source: \"00000000-00007144.00000000.78174.33860000.00000004.mdmp, 00000000-00007144.00000001.80093.33860000.00000004.mdmp, 00000000-00007144.00000002.82013.33860000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":10,"id":"string-30","sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"},{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"},{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted Antivirus engine","description":"No specific details available","origin":"External System","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"},{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"level":"malicious","category":"System Security","name":"Requested access to a critical system service","description":"\"update.bin.exe\" called \"OpenServiceW\" to access the \"WinDefend\" service (\"Windows Defender\") requesting \"SERVICE_ALL_ACCESS\" (0XF01FF) access rights","origin":"API Call","mitre_attack_id":"T1569.002","relevance":10,"id":"api-79","sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to modify the virtual address space of a process (API string)","description":"Observed string: \"missing stack in newstackmissing traceGCSweepStartno buffer space availableno such device or addressno such network interfaceno suitable address foundoperation now in progressreflect: Bits of nil Typereleasep: invalid p stateresource deadlock avoidedruntime: t.spanKey= runtime: VirtualAlloc of runtime: program exceeds runtime\" (Indicator: \"VirtualAlloc\") in Source: e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin\n Observed string: \"{queuefinalizer during GCreflect.Value.SetComplexrunqsteal: runq overflowruntime: VirtualFree of runtime: found obj at *(span has no free objectsstack trace unavailablestructure needs cleaningunexpected exponent baseunexpected mantissa basev\" (Indicator: \"VirtualFree\") in Source: e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin","origin":"File/Memory","mitre_attack_id":"T1055.003","relevance":1,"id":"string-309","sources":[{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine whether a process running under Wow64","description":"\"_unpacked.exe\" called \"IsWow64Process\" with parameter \"2416\" - (UID: 00000000-00002416)\n \"_unpacked.exe\" called \"IsWow64Process\" (UID: 00000000-00002416)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve SID domain name","description":"\"_unpacked.exe\" called \"LookupAccountSidW\" (UID: 00000000-00002416)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-148","sources":[{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve local/system time as file time (API string)","description":"$3b","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function address","description":"$3c","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"level":"informative","category":"General","name":"Contains reference to Windows native API (API string)","description":"$3d","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-324","sources":[{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"level":"informative","category":"General","name":"Found Windows API related strings","description":"$3e","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"110012000c88d875@cryptbase.dll\"\n \"11001200f887d875@cryptbase.dll\"\n \"11001200e487d875@cryptbase.dll\"\n \"11001200d087d875@cryptbase.dll\"\n \"11001200bc87d875@cryptbase.dll\"\n \"11001200a887d875@cryptbase.dll\"\n \"110012009487d875@cryptbase.dll\"\n \"110012008087d875@cryptbase.dll\"\n \"110012006c87d875@cryptbase.dll\"\n \"110012005887d875@cryptbase.dll\"\n \"150016002c7a6a69@advapi32.dll\"\n \"0e000f00a47a6a69@advapi32.dll\"\n \"0e000f00d87a6a69@advapi32.dll\"\n \"11001200387f6a69@advapi32.dll\"\n \"11001200a47f6a69@advapi32.dll\"\n \"12001300b87f6a69@advapi32.dll\"\n \"12001300e07f6a69@advapi32.dll\"\n \"1400150094936a69@advapi32.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"level":"informative","category":"Installation/Persistence","name":"Connects to LPC ports","description":"\"_unpacked.exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in program files directory","description":"\"_unpacked.exe\" touched file \"C:\\Program Files\\Oracle\\VirtualBox Guest Additions\"","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-113","sources":[{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"\"_unpacked.exe\" trying to access non-existent file \"C:\\Program Files\\Oracle\\VirtualBox Guest Additions\\\"\n \"_unpacked.exe\" trying to access non-existent file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\VBoxGuestAdditions\\\"\n \"_unpacked.exe\" trying to access non-existent file \"C:\\Windows\\System32\\DriverStore\\FileRepository\\vboxguest.inf_x86_neutral_4724fcf083c0266e\\\"\n \"_unpacked.exe\" trying to access non-existent file \"C:\\Windows\\System32\\DriverStore\\FileRepository\\vboxguest.inf_x86_neutral_55bec8a7ffe19fc1\\\"\n \"_unpacked.exe\" trying to access non-existent file \"C:\\Windows\\System32\\DriverStore\\FileRepository\\vboxguest.inf_x86_neutral_5a6838e85c9947b0\\\"\n \"_unpacked.exe\" trying to access non-existent file \"C:\\Windows\\System32\\DriverStore\\FileRepository\\vboxguest.inf_x86_neutral_b5a89e0985fba0dc\\\"\n \"_unpacked.exe\" trying to access non-existent file \"Z:\\network.pcapng\\\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"level":"informative","category":"Network Related","name":"Contains ability to retrieve local network connections","description":"Observed string: \"??\\C:\\Users\\HAPUBWS\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\EAPOLK2L\\*\" (Indicator: \"net file\") in Source: 00000000-00002416.00000001.68266.002FE000.00000004.mdmp\n Observed string: \"Temporary Internet Files3\" (Indicator: \"net file\") in Source: 00000000-00002416.00000001.68266.002FE000.00000004.mdmp\n Observed string: \"Temporary Internet Files\" (Indicator: \"net file\") in Source: 00000000-00002416.00000001.68266.002FE000.00000004.mdmp\n Observed string: \"UNIDRV.HLPrnet Files\" (Indicator: \"net file\") in Source: 00000000-00002416.00000003.77630.002C0000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1049","relevance":1,"id":"string-361","sources":[{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the name of the user associated with the current thread (API string)","description":"Observed string:\")`FindFirstFileWFormatMessageWGC assist waitGC worker initGetConsoleModeGetProcAddressGetUserNameExWH\" [Source: e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin]\n Observed string:\"p|LookupAccountNameWN.\" [Source: e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.bin]","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"level":"suspicious","category":"Cryptographic Related","name":"Found a cryptographic related string","description":"$3f","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"level":"suspicious","category":"Environment Awareness","name":"Attempts to detect virtual machine (file access)","description":"\"_unpacked.exe\" trying to touch file \"C:\\Program Files\\Oracle\\VirtualBox Guest Additions\"\n \"_unpacked.exe\" trying to touch file \"C:\\Program Files\\Oracle\\VirtualBox Guest Additions\\\"","origin":"API Call","mitre_attack_id":"T1497","relevance":8,"id":"api-92","sources":[{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"level":"suspicious","category":"Environment Awareness","name":"Possibly tries to implement anti-virtualization techniques using MAC address detection","description":"\"USRCLA~1.BLFUsrClass.dat{fb25a681-d863-11e7-98d5-080027a49dd6}.TM.blf\" (Indicator: \"080027\")\n \"USRCLA~1.REGUsrClass.dat{fb25a681-d863-11e7-98d5-080027a49dd6}.TMContainer00000000000000000001.regtrans-ms\" (Indicator: \"080027\")\n \"USRCLA~2.REGUsrClass.dat{fb25a681-d863-11e7-98d5-080027a49dd6}.TMContainer00000000000000000002.regtrans-msrogp\" (Indicator: \"080027\")","origin":"File/Memory","mitre_attack_id":"T1518.001","relevance":10,"id":"string-2","sources":[{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"level":"suspicious","category":"General","name":"Found a potential E-Mail address in binary/memory","description":"Pattern match: \"1.pngcomb_field_white@1x.png\"\n Pattern match: \"1.pnga12_addblue@1x.png0\"\n Pattern match: \"1.pnga12_checkmark_white@1x.png0\"\n Pattern match: \"1.pnga12_crossmark_white@1x.png0\"\n Pattern match: \"1.pnga12_delete@1x.png\"\n Pattern match: \"1.pnga12_filleddot_white@1x.png\"\n Pattern match: \"1.pnga12_line_white@1x.png\"\n Pattern match: \"1.pnga12_roundrect_white@1x.png\"\n Pattern match: \"1.pnga12_sign_white@1x.png\"\n Pattern match: \"1.pnga12_typetextfields_white@1x.png\"\n Pattern match: \"mb_field_white@1x.png\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"\"Landscape Teal Calendar with Pic.docx\" has type \"COM executable for DOS\"- Location: [%PROGRAMFILES%\\HNC\\Shared80\\HwpTemplate\\Doc\\USA\\Calendars\\Landscape Teal Calendar with Pic.docx]- [targetUID: 00000000-00002416]","origin":"Binary File","mitre_attack_id":"T1105","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used to determine the valid logical drives on the computer","description":"\"_unpacked.exe\" called \"GetLogicalDriveStringsW\" (UID: 00000000-00002416)","origin":"API Call","mitre_attack_id":"T1082","relevance":10,"id":"api-109","sources":[{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used to enumerate process encountered in a system snapshot","description":"\"_unpacked.exe\" called \"Process32FirstW\" (UID: 00000000-00002416)\n \"_unpacked.exe\" called \"Process32NextW\" (UID: 00000000-00002416)","origin":"API Call","mitre_attack_id":"T1057","relevance":5,"id":"api-104","sources":[{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve the current status of the specified service","description":"\"_unpacked.exe\" called \"QueryServiceStatusEx\" (UID: 00000000-00002416)","origin":"API Call","mitre_attack_id":"T1007","relevance":5,"id":"api-170","sources":[{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Found system commands related strings","description":"$40","origin":"File/Memory","mitre_attack_id":"T1082","relevance":3,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]}],"incidents":[{"name":"Remote Access","details_count":1,"details":[{"detail":"Reads terminal service related keys (often RDP related)"}],"sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"Evasive","details_count":1,"details":[{"detail":"Found a Wine emulator related string"}],"sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"},{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"},{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"name":"Spyware","details_count":1,"details":[{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"},{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"name":"Persistence","details_count":1,"details":[{"detail":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"}]},{"name":"Fingerprint","details_count":1,"details":[{"detail":"Queries process information"}],"sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"},{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]}]},"activity":{"stats":{"process_count":1,"spawned_processes_count":1,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":3,"imported_dlls_count":52,"dropped_files_count":0,"extracted_files_count":535,"files_written_count":91,"files_deleted_count":0,"registry_keys_created_count":3,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":3,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["criminal","ransomware","scrinject","snake","ekansransomware","killpror","windows-server-utility"],"sample_flags":["Extracted Files"],"sandbox_reports":[{"id":"643989e7b9e1bd5d8e0c2d8f","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Ransom.Ekans","submit_name":"update.bin","analysis_start_time":"2023-04-14T17:14:16+00:00","indicators_count":{"informative":100,"suspicious":24,"malicious":5},"tags":["Extracted Files"],"is_in_unified_schema":true},{"id":"641cb38cb41e2d6cf90b796d","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Ransom.Ekans","submit_name":"e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60_unpacked","analysis_start_time":"2023-03-23T20:16:13+00:00","indicators_count":{"informative":95,"suspicious":24,"malicious":4},"tags":["Extracted Files"],"is_in_unified_schema":true},{"id":"5e39b4177476481e3a3953bb","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.Antavmu","submit_name":"e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60","analysis_start_time":"2020-02-04T18:12:47+00:00","indicators_count":{"informative":8,"suspicious":10,"malicious":4},"tags":["Extracted Files"],"is_in_unified_schema":true},{"id":"5e07cc4c8eab0d1af7401065","environment_id":100,"environment_description":"Windows 7 32 bit","state":"ERROR","error_type":"Internal error has occurred (Code: DSM:TIMED-OUT)","verdict":"undetected","threat_score":100,"malware_family":"Trojan.Antavmu","submit_name":"e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60","analysis_start_time":"2020-03-13T18:59:21+00:00","indicators_count":{"informative":7,"suspicious":10,"malicious":4},"is_in_unified_schema":false}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}],"processes":[{"pid":3828,"ppid":0,"name":"e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.exe","command_line":"","sha256":"e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60","normalized_path":"C:\\e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.exe","uid":"00012204-00003828","icon":"$41"}],"all_imported_dlls":["winmm.dll","nsi.dll","msctf.dll","kernel32.dll","usp10.dll","sechost.dll","sspicli.dll","ws2_32.dll","wow64cpu.dll","gdi32.dll","rsaenh.dll","wow64.dll","imm32.dll","cryptsp.dll","fastprox.dll","wow64win.dll","uxtheme.dll","wbemdisp.dll","RpcRtRemote.dll","ntdsapi.dll","ntdll.dll","msvcrt.dll","lpk.dll","rpcrt4.dll","cryptbase.dll","ole32.dll","wbemcomn.dll","wmiutils.dll","wshqos.dll","wbemprox.dll","sxs.dll","clbcatq.dll","wbemsvc.dll","user32.dll","KernelBase.dll","advapi32.dll","oleaut32.dll","bcryptprimitives.dll","fltLib.dll","ucrtbase.dll","win32u.dll","bcrypt.dll","gdi32full.dll","kernel.appcore.dll","msvcp_win.dll","apphelp.dll","winmmbase.dll","cfgmgr32.dll","combase.dll","WSHTCPIP.DLL","wship6.dll","api-ms-win-core-synch-l1-2-0.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"com.jrockit.mc.flightrecorder.controlpanel.ui_5.5.1.172852.jar","sha256":"f16c32dd14cdc821d941fbe46c9961801552a7099aaac4a077d539881cd97b25","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"com-sun-tools-visualvm-jvm.jar","sha256":"893c00a6a6cc947daf26bb19ffa3da028e08a907942030d33830d24dcf66249b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"AppStore_icon.svg","sha256":"b1fb8a808d58652503b240f3afa8f72cc85dd7e9f6272e894f675721f36a5ca7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"CAPSULES.INF","sha256":"5d494856e26b89595c7c201da8ed43c621fba20ffd709effe2a6337adcd6e5ac","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"com.jrockit.mc.ui_5.5.1.172852.jar","sha256":"c4d8bca112d8b0184a6d7e07855f616fd27c47af3d284f0579f094001b351f3e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"com.jrockit.mc.attach_5.5.1.172852.jar","sha256":"c921ada8114a348401998629986c04abcacc37e7ddd7bc44d28aed1c2302bbb6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"603jOLdO.exe","sha256":"25fa75c7d0c5b3c9d67a56e8eb41afc08fd86ba8d17704ff628987bfcea8e71b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"AUDIOSEARCHMAIN.DLL","sha256":"75721b4437be869e5c5d63053caa2ed2a0ae0ba5e407a395b00da221b303a1d9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"com-sun-tools-visualvm-charts_zh_CN.jar","sha256":"7179b1d81b2a68baf0a3a5c1c946422480511095dc0be51874383e1953c4d609","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"close.svg","sha256":"3404b2308bb96adc91e4cb5a589e05c92a4dc526ccd1047e0e02387b5748a69e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"com.jrockit.mc.components.ui.ja_5.5.1.172852.jar","sha256":"6e5631120a295449a73a9cfe159e5c99bf7418fe86d64817fab5021f55c4f423","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"com.jrockit.mc.rjmx.zh_CN_5.5.1.172852.jar","sha256":"6eb1755c0b7097d64ef69c9e580a60b3c243759ea67156b3ff0564d9ed6d429f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"CSS7DATA000C.DLL","sha256":"217c96b9b304d7ab9e6ebb1afafc40430207c407845564fdbafc00d15bf17934","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"access-bridge-32.jar","sha256":"79a3682113f882628889cec45bd13618bc1d4c94297e1e011942f04e019b1bc2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"com-sun-tools-visualvm-profiler.jar","sha256":"ee22b0e244eadd093db12f0607ea924097f515daae10d8397be6836172300191","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"com-sun-tools-visualvm-uisupport_ja.jar","sha256":"9fdf4bfec06ac20ab887d319cc6f59c9bc8d811331ad2599ac3efa5aa615d379","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"CZspj.doc","sha256":"fa9175c7f5a7b74f3ba7bd49e4ebb9d7435cded6a2379394d60510508de3b8a2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"com-sun-tools-visualvm-host-views.jar","sha256":"2a2c58d83c79e18dc49dd45e21fbb037a2b9af1369be91c78dc93f9fbfe86123","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"com-sun-tools-visualvm-profiling_zh_CN.jar","sha256":"22122984c2de20eb019954ea574e98137fdbac5c8c3940ce0973c83fa7b2c182","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"com.jrockit.mc.console.ui_5.5.1.172852.jar","sha256":"34766f0d860dfd88e4a62eeae3aea98dd72b2461eb033748ce725252c79f78b7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"com-sun-tools-visualvm-threaddump.jar","sha256":"bb27d5efda1dafcf04e5aaa99bb7fe0bc1b38fe3fc0fa88f805fc87e37622b2a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"com.jrockit.mc.browser.jdp.ja_5.5.1.172852.jar","sha256":"db723821c7aa08315625f4a7b968877b003281db1290c7d02be52ae12b8cc6d5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"com-sun-tools-visualvm-modules-appui.jar","sha256":"508bc3ac25f3cdc961b43ebb587b008cef22ef05417fda7c895677396ac1095e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"BREEZE.INF","sha256":"d378ccbe13309b881a9414eb54c052f4e13c500978599311395946e237532dd8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"com.jrockit.mc.browser.ja_5.5.1.172852.jar","sha256":"ed356255e88a96abe7e880b49094189b6e3f739a237a292a59a09a4151c5f128","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"com-sun-tools-visualvm-host-remote_zh_CN.jar","sha256":"57a52f04c9ecdff87fd7e797b4dbeadec561b826505711c49b2730b4910a7b8a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"5F7TBCLUxJG.doc","sha256":"1e0091045f7219fbcb3ded7133f1d5485f74bfd79b5a9db0871b6ea05578b6d6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"core_visualvm.jar","sha256":"e9849b1259da76593dd7e0afdfbfac5f6b73d5e23980d9a326b47abf07c4ca6f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"BLENDS.INF","sha256":"3dcfb5ce269b4c91d93357defa76065e231024a2b67b63539733e14f655ee299","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"BOLDSTRI.INF","sha256":"18f506087e69082417c1c4fbf2de9a80c098dc8aa96056c4bcb238c2ad5e106c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"com-sun-tools-visualvm-application-views_zh_CN.jar","sha256":"1eb89d83c106a487167f6406da43317f445e2d67a72e1cf52f4f9a9af1286422","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"com.jrockit.mc.console.ui.ja_5.5.1.172852.jar","sha256":"1ed29e372ab1cf295b5b4f117f72182f26d2c4a8b5d37813616dfad615ef04ba","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"CSS7DATA000A.DLL","sha256":"f0e2a53fc91b6cc3360bdbc028ad2a734df8fa09d50b5d8386ec6a40ee522de6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"derbyLocale_zh_CN.jar","sha256":"e8d9fceee78304b0b58b316cf289553410a3f0c09c7c8475adadc917c1be7853","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"com.jrockit.mc.flightrecorder.ui_5.5.1.172852.jar","sha256":"e7ea98b14441fb0f84060b36ca36ea6684f2ec369664efb57ae6873c70a6b9a5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"Adobe Root Certificate.cer","sha256":"f16c25dee2cd719644c3dee740c5e459b6e45a99cdf8832cabe6b856cf1033a3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"ACEWDAT.DLL","sha256":"7dd3a3f79cef08618abd59ec9af865b805ca745107587b662dd14a551d27aa4b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"AUTOSHAP.DLL","sha256":"de0624dc5265d4cb8f5539f60fa982a7c7c4560ddf64edda14bc5aae00745d22","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"Adobe AIR Application Installer.swf","sha256":"a908351c4e6315a9cb38683ba77db5efbedac02d8536ca8ab1f2acdfcf4d2838","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"com-sun-tools-visualvm-modules-appui_zh_CN.jar","sha256":"71de5a5c1e9d1f57af99275a4942576aabbcdafa61420ccb2dbf75b731faeb6e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"com.jrockit.mc.console.historicaldata_5.5.1.172852.jar","sha256":"b6e1801fb2a52ebaf479f5d97a1d3bd4eb9bc082c0cc1eb98cb88e36465de795","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"com.jrockit.mc.greychart.ui_5.5.1.172852.jar","sha256":"2bc7e780ff7c935e7cf21b824317bedfc555cdcfd059537c15fb5e66b1f2aff4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"com.jrockit.mc.alert_5.5.1.172852.jar","sha256":"e1a9d6beeaf0d8290548ea1ff6ea84f873a23b421b8d1334d3da047cc76c7d1a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"core_zh_CN.jar","sha256":"d0e88cd15b05a46062b3dc43db9c09ebd2c82edf405d550b1e59314d6e7e5569","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"BRANDING.DLL","sha256":"04830ad45a66dc6a1785412f691ae8f7f8a221d00e8477b107771114e2aa037a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"core.jar","sha256":"5ebabf21fa30a09651bac6640868fd0f42f2a6ee7c3dd5c7c90f2f93c96adaef","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"ant-javafx.jar","sha256":"e8f0ab60623e1d2506101a999fd67df3928273a623a0baefd5fb997a87f00991","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"derbyLocale_hu.jar","sha256":"2f5113eaf11d9a26ce426b0b2adc101c15ddc97cbce04d6b1e03322c07c978d1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"com-sun-tools-visualvm-host-remote.jar","sha256":"03faf0aa76828c8bc3b2342a793c48b31add4d628c5d0f73051a36151d3362fa","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"AXIS.INF","sha256":"fc85fd67b47d34aa45a9068a3aca257aa9a9418fc707c51384faa3412a8f3db3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"com.jrockit.mc.flightrecorder.ui.zh_CN_5.5.1.172852.jar","sha256":"f8a966bed064b82278128158c99712173fe8e2cbc08d3eed03e2ec34fcfe4de3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"com.jrockit.mc.flightrecorder.controlpanel.ui.zh_CN_5.5.1.172852.jar","sha256":"339c8d1fa85316219e0fe4c9f5bf57f5d4f77e1be0c21ab8b8de1848121bbd6b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"com-sun-tools-visualvm-threaddump_ja.jar","sha256":"01c80ae124643c43d7d71afa9a59f12c60783318747c2f64a35f7ebff1b1993f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"DBGHELP.DLL","sha256":"e8907b653468b25e9c1dd94b90b1ca9eb83e3d579f67fbc741d38fbe606aa167","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"com.jrockit.mc.console.ui.zh_CN_5.5.1.172852.jar","sha256":"57d26f939e80444bb00bdd4fd6a16a6392c5755ea8123ad68ec93f629c56662d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"com.jrockit.mc.console.ui.diagnostic.ja_5.5.1.172852.jar","sha256":"99f3990b964939b2b90fac7df7ba99508dbbba31f662087b527c118063ef5f61","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"com.sun.el_2.2.0.v201303151357.jar","sha256":"deea00fa0bb7048a6019c2586cad1ff9a0863182b12ad1958fc0353349ceec05","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"cldrdata.jar","sha256":"0f7ae11ef0ab3e6f060680f55795e7f0effefb767140784e8c31e531deabd9d3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"com-sun-tools-visualvm-modules-startup_ja.jar","sha256":"794125eec2536e0ce9bb5bf7d0cc6fd0c8f0b5def520d481864f2e94a844a56e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"Desktop.lnk","sha256":"f150eac547d31543502f83701efbba6dbb2ce1c631b3b0306a2f7908e1f44400","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"com.jrockit.mc.console.ui.notification.zh_CN_5.5.1.172852.jar","sha256":"63e6e0eb6e313e626935e43a7f8e5f05baced98a0a765fd4c325fe1cd8a747e0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"com-sun-tools-visualvm-profiling.jar","sha256":"3e7d84da49267796c275f588304a07c58d2521cb4daa8a8ee90bba6ddafddd0c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"ARCTIC.INF","sha256":"7a71b80ebde4219e891328253b399488593f12ee0e0efc3454372aecfef07a34","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"derbyLocale_de_DE.jar","sha256":"adbe7b6580b5edfc759033fd16908e0c8d02ee1aa3abf2654ed8a3356c89ee0b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"com-sun-tools-visualvm-tools_zh_CN.jar","sha256":"b198529feec16c392da123799d58a0e0961f3914e2c765f38a47dfd9a6b9132c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"derbytools.jar","sha256":"912e4abd6f00c0c54bbab5993c900130884c411143dd64c5ca76c486aab97655","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"com-sun-tools-visualvm-host-views_zh_CN.jar","sha256":"ef2be554fca4502556ec26bdc83cec5fd85e957cad2d065cf01cb935680e27eb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"com.jrockit.mc.browser.jdp_5.5.1.172852.jar","sha256":"4366df01f6b0a4744cabcc2308463a1b65903c5b040c85795fd27d16500c42e3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"com-sun-tools-visualvm-uisupport.jar","sha256":"50aea80b0ca217219043d41468861cc9ec1cb1e33359dad2216e97ecbf3c3c0f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"DEEPBLUE.INF","sha256":"7925774e0e821d59155f2873e6fecea096ac5508cc959d77c1ab0ca0b2dc309b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"derbyLocale_es.jar","sha256":"02a69a7983f5f95559a2fc200d2803dfd50bafd544448c7b46b9f9afef0ef539","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"CSS7DATA0009.DLL","sha256":"2054e03a3877a25df56f13d1359ace4e3ca1ec3d4a259ef4de1b344043e55e0d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"com-sun-tools-visualvm-api-caching_ja.jar","sha256":"e0fa07b308486a95d82cb784399226f36b69348ac83f0a7ee9f781495beac421","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"3LnBJn.doc","sha256":"21df29710dda6c259a58173dd539a378ae498895da55ac789a4bd7798b2ca47f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"com-sun-tools-visualvm-coredump.jar","sha256":"b1747229f33246c289be70d9f61afbb8ac024ef10a00edd885bb6f0828974778","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"com.jrockit.mc.rjmx.ext_5.5.1.172852.jar","sha256":"0da94cdfb493df069fca12e825fef64cb9e0362a6fe3c8e91d1c452bd1a06695","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"com-sun-tools-visualvm-jmx_zh_CN.jar","sha256":"e698021b5e2bf83a5be06c312838ea454b724b32d732d127f3c04666717d684f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"com.jrockit.mc.jdp_5.5.1.172852.jar","sha256":"fc5b8f02491299c5b8b511e9e4986abbfae344c1baa6ee5fe435df02c4c8381c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"com-sun-tools-visualvm-sampler_zh_CN.jar","sha256":"cdd1406cb8f4e44659bee017b6fd59084de75ca622e5b0e88617b5688bafce2e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"com-sun-tools-visualvm-modules-appui_ja.jar","sha256":"754b2a539d600bb500b56a3e87c5407abbe97935dfa68c74c8578c242528adb1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"com.jrockit.mc.flightrecorder.ui.ja_5.5.1.172852.jar","sha256":"e1063816b2b65442dc609ac77a1d51026b3b2f3fe13e6a27eb8cb0349809bab0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"ACEODEXL.DLL","sha256":"e228bfcd083b092d8f503d94bfa92703e028b3e534853dad49404c204db6b7b4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"com.jrockit.mc.docs.ja_5.5.1.172852.jar","sha256":"9776557dc085a60f0308ad2f4b41028b1f879fa6f1bed998d3187ff938506152","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"ACEODBC.DLL","sha256":"5fafbf43b5b7ab1f89ccd47bca4449bacac88a971da9eb3b63167fcf94628321","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"com-sun-tools-visualvm-heapdump_zh_CN.jar","sha256":"a471060a7082852be11e8686f969ced2309049f73725163be3d23e7d1b1d75ea","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"derbyLocale_pt_BR.jar","sha256":"ef09a68e2a771461a3313b9493a98893aead56f95a1eb639cc320250346dd15f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"com.jrockit.mc.rjmx.ui_5.5.1.172852.jar","sha256":"47d591f9ab1c61b0cd46299d3627db5825d4cbd0e900078fe0397beef58ae442","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"com-sun-tools-visualvm-charts.jar","sha256":"72b964a59586eab80857674a5b78f3e1b3a9656e329988423d44b4625b4e95ca","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"bMTL7.doc","sha256":"266dfba76011fbb939800496b8edb5cf63857bd6a63c6d813f386ec260a59d65","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"CONCRETE.INF","sha256":"2ef240d0a6a1e893d20c2279057c97d5f7fb7ff443c8cbb0f57dc420b677db4e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"com-sun-tools-visualvm-sampler_ja.jar","sha256":"5d9bd0c57a1700d846fa541e960245ede348e0e5061e6273e7a76483c6682551","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"com.jrockit.mc.browser.attach.zh_CN_5.5.1.172852.jar","sha256":"986d6e035a02294a026c7352eb6f664db0ef0f646193fd0e347e622901f2fb76","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"com.jrockit.mc.greychartplugin_5.5.1.172852.jar","sha256":"e48c74249dd45f3c5b51254530be75714585b137574dc26a6673c51a324161de","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"derbyclient.jar","sha256":"0760d52f116dbb5d2b3e8076a2ab73b05a41bec6c5c64c1256a8e3222042ab65","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"com.jrockit.mc.alert.ja_5.5.1.172852.jar","sha256":"ad8d551cc3703398b88d48c398348b89ee02fa805dbd5aeabb6a81335c5d5e19","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"CANYON.INF","sha256":"fe72fbf6f8201a5479dec28e57faf48e6610cab21704c00165597fbd28839a0a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"4RHcGmkB.exe","sha256":"81f47c1d36bc8be220717943ee79068a2417d8ffeeb04ef9d11a6fa285dc2d04","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"deploy.jar","sha256":"8741aed01be1d31714c44f75c76fd0b4029cf6a2187df9bf1467778c53c4a8a8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"ACEDAO.DLL","sha256":"fa65292d91c1c0c5c78e64d9dd1b5c499fd8bb0145d6a170d06f098b5dbc8edc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"com-sun-tools-visualvm-api-caching_zh_CN.jar","sha256":"75a3631f54fd89d1dcc0477bb1708a098869050669b02f6df552a22cbbd18019","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"com.jrockit.mc.greychart.ui.zh_CN_5.5.1.172852.jar","sha256":"39f0f0602df8de6cff85622d5e0aecb90d3a1cd4f8dac0ff2a859aba8d18a8e7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"boot_zh_CN.jar","sha256":"a33426cf835d6d07c91b75595e36fe89f4719a33f344b9dedd2f03ce3240c6ae","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"com-sun-tools-visualvm-host-remote_ja.jar","sha256":"288457591e18dc354a1c67b1b6f4e9cc2f82249e685adfe7e470bb8154a48c3b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"com-sun-tools-visualvm-application_zh_CN.jar","sha256":"25220b6c5f52012598d142e450cc865454b409827d7b27b42c3126fa91654877","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"com-sun-tools-visualvm-threaddump_zh_CN.jar","sha256":"9e2eb117459946d41ee9e56c11d9dd2abde9472a1cb86dd8d782de0c4472a763","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"boot_ja.jar","sha256":"57aab196bf8672e289f5e9cd0b7f160708f0da41f4149fb66e03c9db1140af7b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"com.jrockit.mc.ui.zh_CN_5.5.1.172852.jar","sha256":"7db805cd9030e11c8280df8b150a68393c94b111024aa02ebb628d139a1f73cd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"BLUECALM.INF","sha256":"57690b749706add50e1f325564aaaa94cb8c91b98199992eb6936d1f8d7a3854","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"ACEES.DLL","sha256":"22f9bd47603abb4e106aaf783674a6f2b374f4b7d3f86ecb15c115508868b3e0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"ACEOLEDB.DLL","sha256":"1cf647ee70b17546f135fe7d375100f113431b21b7443c272e790c0bee4548fd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"com-sun-tools-visualvm-heapdump.jar","sha256":"5859167462bd36ec4f9794812f09599e6250741b839d59f54f3cd644a3f8850d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"com.jrockit.mc.flightrecorder.controlpanel.ui.ja_5.5.1.172852.jar","sha256":"e0247594fa7c585ec43ab3eb150c0a8a8716ed9b107829c8e0d45d1fde263add","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"com-sun-tools-visualvm-host_zh_CN.jar","sha256":"7b02e6bff02443b55fc3339052542b08552df603f34467ca1a426542a5344e4c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"charsets.jar","sha256":"8c24c9f45d880cd64c0aca4574d754c8d9434cf72767aeb13727dec57262212f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"2VEV49vrsTLgZa.doc","sha256":"25b8ab23860efb614901f6631e5c6c8f45bdf3a8fe7f5acff19a1712f7769d84","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"com.jrockit.mc.console.ui.mbeanbrowser.ja_5.5.1.172852.jar","sha256":"c86e20d7c46d62c9355c8839b1ecdc92cd6bdee4a513e0fdd61572f4bc1b7292","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"com.jrockit.mc.console.historicaldata.ja_5.5.1.172852.jar","sha256":"84c63676d66acb2d1a803c699040b99198bc17ada41a1e4f48c1488695bb9c9d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"AUDIOSEARCHSAPIFE.DLL","sha256":"8870bf07bca1a9029910a7c074acb47f3bec98b398f05b485826000a05a9c8e5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"com.jrockit.mc.browser.attach.ja_5.5.1.172852.jar","sha256":"27e537ba0b7dbf017f1bdc73cf34955270196f3ce19ce2211607bb0af70a50ac","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"AFTRNOON.INF","sha256":"34e279a1148bf2fdd58f2b1b68f9f398e571b43a9f641e90d56217e163a2a38d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"com-sun-tools-visualvm-core_zh_CN.jar","sha256":"414d82ab580c271e0e1afcefb72e80c9a70b46cd15746c04af0ba10e327058c5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"derbyLocale_it.jar","sha256":"e9bbe50a1c5dcf61d890cdb6f62807fa43a730c5f9a950c5e096ef23adf9057e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"derby.jar","sha256":"41cf66a821a68a6b32a992b2845d68fede2fba02c1406fffc96249d8ce64fb44","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"com-sun-tools-visualvm-profiling_ja.jar","sha256":"d710034c487bfb08dc35852acbafec437e429de9866a92b2d7429bf2b9015f77","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"AUTHZAX.DLL","sha256":"1cd887ef1af339086daa3b392ea585a27dbbbe6848d4e5f68042c6de446d0960","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"com-sun-tools-visualvm-host.jar","sha256":"0b3d553e4a7cae300d58fc863d8d613d62e034bd90123ca2a54968e51853d88c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"com.jrockit.mc.rcp.intro.zh_CN_5.5.1.172852.jar","sha256":"4ceae2221c768fb40b22853a001f93f0f38b81cfa89852a9051c128a5f83bae6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"com-sun-tools-visualvm-jvmstat_ja.jar","sha256":"9781c81a9088700a930a91bcc8778bb733d6bfb7b806b9b79256a27a163d3c6b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"com-sun-tools-visualvm-core.jar","sha256":"1369c443cdaa054fc3a96954bb73d960d74d0ba3f1d9df6305b4fcdc8abdb8ee","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"com.jrockit.mc.commands_5.5.1.172852.jar","sha256":"d30dde5c65287e23f7bee00d80e5d9b8c53a05ec81d6fb2cb8d8f4387a8a719f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"AUDIOSEARCHLTS.DLL","sha256":"58414f576e9388c18874b1f4051a77e7536feabfe32127d420115b264bfadf5b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"ACEREP.DLL","sha256":"b46014df68f962da4f1dd0847c6d529357d31029aa65a14085bb4e5db894206a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"com.jrockit.mc.rjmx.ja_5.5.1.172852.jar","sha256":"fd2612e986357c174ff991265f6458a4e6efdb5d6c758c3f803465f0abb959b0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"Database1.LNK","sha256":"a98d959eddc8215fb5f06c01e1d842ec860315d72984fb0732006b8b2f404aea","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"com-sun-tools-visualvm-host_ja.jar","sha256":"8b3047c425db71aeb37b97cc6f9013c3ccbff1715c692a81ad549774e94814f4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"com-sun-tools-visualvm-profiler_ja.jar","sha256":"aac6d2f5efebd0444676dc60f1a721d9074d28faa7fd270f13f8c7002d21d251","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"com-sun-tools-visualvm-coredump_ja.jar","sha256":"e6eb3719ec2a1a7c2e6390ea7ad140c1819282047ada79f11d81027a2bcd356a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"ACEINTL.DLL","sha256":"a65f6d0e3c3d290f61ea66142206dfac6030012918ccabfab70024871d51b88d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"com-sun-tools-visualvm-jvmstat_zh_CN.jar","sha256":"88268a358ff5be99537d41040f9e85d46c4f173a4aca5db9727cce58a31044f9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"2f07Jm4brrx.exe","sha256":"ecddfdd896d35dfb7388e6b41b84f4d9e579950ff720e572067ad8f179e754b9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"BHOINTL.DLL","sha256":"6bec3ffb58935254d252937617bf13fb80d5676904ec5a1fc682771f0eca6de6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"com.jrockit.mc.p2.ui.overridden_5.5.1.172852.jar","sha256":"d2541a87b856be1bbbdba7da19b0653a0c655b620a79635a4635298a3bc35be9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"derbyLocale_ko_KR.jar","sha256":"c18dc90461a95fe55fda2eff9e209dff79f652a23d1986890338a8725fa285c3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"ACETXT.DLL","sha256":"cf38671616e92b3712fa59afff9f2797b7fb8e56db54895c3502fea8dac568cc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"com-sun-tools-visualvm-jvm_zh_CN.jar","sha256":"3a5b19c519dbc3d0efdbbe1583b8f8295e12e17483332b94a2cd3cb5404b3db4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"8L418Npib.exe","sha256":"60a366ecb88c9648e89442bc4609dd9bb8180226cc489b3f872440af993eccd7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"com-sun-tools-visualvm-tools_ja.jar","sha256":"7691900c91d111989a1f20e4e969ab2b0d8c0ad1069ff247fc9216ba3c88243c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"com-sun-tools-visualvm-modules-startup_zh_CN.jar","sha256":"6503295fb510d136f15551f61fe629cec99f22f5f7e423d6ec125e113fe6501c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"ALRTINTL.DLL","sha256":"89255878da2840066ee5446418c54c20fd46d091e42d47860265a2a309e76660","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"com.jrockit.mc.console.historicaldata.zh_CN_5.5.1.172852.jar","sha256":"4b94c11eda919871892d16eba9620f856afec2de7de59c5095387777ec98b82a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"com.jrockit.mc.rcp.intro.ja_5.5.1.172852.jar","sha256":"1fab7ffdc802473b0171a444057dc4aaaddb1bdbf02425c3299c258ce98408e3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"ACEEXCL.DLL","sha256":"94fdf627cbbdadfab2e8ad3a128812873f19dd036295a01eec61b89807b5e0e0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"com.jrockit.mc.rjmx.ui.ja_5.5.1.172852.jar","sha256":"b11fa9c36a90648e5a41ecf891db5af381350a296bfc58dfdf1247e64c893c48","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"derbyLocale_ja_JP.jar","sha256":"83a955e3edfba6171368fbe1f2c34b632631cd6149fa759775ce235c8a7d2141","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"7-zip.chm","sha256":"2554886aa52e0687c1a94be2c21e1553e28c6bc78b34a8ffd624c3c08ffae502","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"com.jrockit.mc.flightrecorder.controlpanel.ui.configuration_5.5.1.172852.jar","sha256":"723c71701555330a99dc85a7ffe2c3206ab96b947d7500fd1eaa132af50b0a95","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"com.jrockit.mc.console.ui.diagnostic.zh_CN_5.5.1.172852.jar","sha256":"fc56343d656a2d78e197d1c50bc62589d12090abc072a6e4d2ff4c7dc3bbe5a0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"CLVWINTL.DLL","sha256":"b3a1443aa68e02bbebe9f00ebbac15028c2b6643feb7e27dbe0c3177384313e4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"com.jrockit.mc.rcp.application_5.5.1.172852.jar","sha256":"ea6a6f9c0c20b434c3b0974f5dddfb522d3255b086a407a3278c677177e08ed4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"com-sun-tools-visualvm-profiler_zh_CN.jar","sha256":"2196f07f69107d2e3a748cb7bab9c213b28ffa8b41e4133c8f344967cbdf35e5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"derbyLocale_cs.jar","sha256":"a849dde1b1af831bfbfb609a70cfa17149d0fce1d5035d768120cf7f791866eb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"ACEODBCI.DLL","sha256":"8a600ed47ff63f27e9f7aa7fd89d0ca003b2dd738433e22b51dce869c93cbcc2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"com-sun-tools-visualvm-application-views.jar","sha256":"772209b6ab7affb3cfe6d839838f0a664bb9a014d4fe3a2938fad53a6e980041","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"ACEERR.DLL","sha256":"3a1bb553b3260abffeb53a7f0f28fb490837bc8d2a576371e14ba44ce3c95eed","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"ACEXBE.DLL","sha256":"3e744f782bffa1d921bec7e3771553ffa6f05e5cfe67ecd40d4a4c0e549970b0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"com.jrockit.mc.flightrecorder_5.5.1.172852.jar","sha256":"472030c86cd91c0fab845a3c1eddeb648a4b28de968babb7aef6f5bc7bfb82b9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"com-sun-tools-visualvm-modules-startup.jar","sha256":"d1457f0925cbf201590075d320ad381a0a591e2c88a8015104786169dc6c3a1c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"com-sun-tools-visualvm-jvmstat.jar","sha256":"094c6eede6f4791240e51ae53413847daeeccc0e3a36bc98bce60cb3d9a48fbc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"com.jrockit.mc.rcp.application.zh_CN_5.5.1.172852.jar","sha256":"89fd57f79d2961de55b747c6629d1d7ca7bea9d58beafc5bdf4cf21e92125343","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"com-sun-tools-visualvm-core_ja.jar","sha256":"e0c558093b4f0030174ebaacf1c5edd48c9650d3b4c48597f4fad0a240029f6c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"ACER3X.DLL","sha256":"2de8e8ab9394f7d11d6a25ee0552da867e602fff50af52c589384d236e0e769f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"ACEODTXT.DLL","sha256":"5474c429235f32cf5221342aa19d87156f9053a03d3b7da74d6c59aac6f27a6f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"derbyLocale_fr.jar","sha256":"2ba40fe8bc3c5fd6482547e4486ff2b812a963f2a609b451dd6a84d5b0a7e547","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"com-sun-tools-visualvm-heapdump_ja.jar","sha256":"c0cc9094a428828b5d9036d610af4c24b1a727191664d86f73a9d91c422abb3f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"com-sun-tools-visualvm-jmx_ja.jar","sha256":"6a20a40dcd5153f340e7cb80c9d50245ea0b370d807c7331fb8391ed6dc5b5d7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"Ae5I9Tp.doc","sha256":"6adcd24d4ffdcba78350f618cb4372e69f63598e3667c91e1d12bed80142945f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"com-sun-tools-visualvm-attach.jar","sha256":"7ae6930c3fe4477751d24f166ba535c7a6701d26f2ecf095ec4767136c95b467","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"BLUEPRNT.INF","sha256":"4e488d1f4b081816b55057468d6f211335197dc52d9d6bae548cde8066d8361c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"CNFNOT32.EXE","sha256":"b1788d273e9b90def79fc0bc134e29e76a7367a9f65bb78c406f3625b3c85652","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"com-sun-tools-visualvm-api-caching.jar","sha256":"e7e8b5c618777ea832a14b032bb4f05984bd7497016f8fa04eff7d5d8b36f67c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"com.jrockit.mc.rjmx.ui.zh_CN_5.5.1.172852.jar","sha256":"55cda3f6e5769e6a514528aa35333a9d0b480042dd453d95bba8970d3af9f26d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"CDLMSO.DLL","sha256":"2675ba8f5c8018b9fa4740de151fcc15e9131c5afea0c0d1a8dc2eae30bb07a0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"com.jrockit.mc.browser.attach_5.5.1.172852.jar","sha256":"279226e510721962263e675e6214384cf908ff67413336d87720f6ca3ada036f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"com-sun-tools-visualvm-application_ja.jar","sha256":"71e962581f8e72d29b7e6aca09614fc3efbf75e6ba2a707537073eaf24eaf886","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"com.jrockit.mc.console.ui.mbeanbrowser_5.5.1.172852.jar","sha256":"8727aebaa69f7abedaf2a51361b3c9f6c28f9bc3a1db17167baf2606c6a18b77","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"com.jrockit.mc.rcp.intro_5.5.1.172852.jar","sha256":"bce6df84280e053df857be6ddc3cb7d7ba56374e3ef7108a37344c6339e4a2d3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"AcroRead.msi","sha256":"076902f4293dc22bdecd9670fe798a3eeb516c14a9a0dd00ef8cbeec47f00330","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"derbynet.jar","sha256":"adcdfd0cdb89a1f1d328f85d4fbcd2897a2978a77cfa4f57671ad1a9e7fb5a64","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"com-sun-tools-visualvm-attach_zh_CN.jar","sha256":"73b6200d44ce30cdc7772eeadbe5ec8d88e42448363ea6262799eb24e9fe016a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"com.jrockit.mc.core_5.5.1.172852.jar","sha256":"af80d81b90777d7bcd82bde2abd8cd9d643898a32a17f9ff8aeb564c10b81871","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"core_ja.jar","sha256":"eb9281e50c76db9fb1d14f329bb793657d100e5f4c3cec33fcfbc87d9abaaffe","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"com-sun-tools-visualvm-sampler.jar","sha256":"abeef6e90e8b21014346055811bd5c29ff7be6b18e865cc8475a3f8a5631aea6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"derbyoptionaltools.jar","sha256":"b8685b685ea3bb038da7a986bf2a3f70f41529d41ed477bf9a755ee6a35ddc92","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"BULLETS.DLL","sha256":"d6da787a6136188dcab932b3f7917769e830ffe8e486afb1ce1d2e7b13f1006a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"com-sun-tools-visualvm-sa_ja.jar","sha256":"baf0de88ba7519ebc049affc0fa38d1c36bb85ab8fa4db3236077af01496c100","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"CERTINTL.DLL","sha256":"b55d2a54b5bcad1e793fb6395147b2f10966855d67cd79d418fc19b74e13462b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"7mOyQqezSRsEQhHm.exe","sha256":"7c411e2e859bb04a785cfe7d4f0c5a2913ded3e94f23c912931cf0ff661996ff","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"cQTUR.exe","sha256":"d485eb5224cabf3d0e879dbcb88661d10e21c8d5ad7f4cec5f3e9e3903d1310b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"com-sun-tools-visualvm-jmx.jar","sha256":"0083d155e90d996225ed86bd1fda6ec400ccfb0c531bea23f68e73b219c4d1bb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"com.jrockit.mc.common_5.5.1.172852.jar","sha256":"ecfbfc400d9c744fb2526e5e53bdf3d2686e396f6202b94168c23b2f8a7c9235","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"ACECORE.DLL","sha256":"8d1c170d95c0fc809a34565fb9ff71e89e72c01299f9c8d65f106239665db5f9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"CONTAB32.DLL","sha256":"d25325d7706327f71b95b3b98697de351b57c615730e88e21d7f1c81ab62e6e8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"com.jrockit.mc.components.ui_5.5.1.172852.jar","sha256":"17e54526e34eec15e4bc117de34b979a3fdf9be12b6e867859a84662b2acbffc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"com.jrockit.mc.greychart.ui.ja_5.5.1.172852.jar","sha256":"23a945a78cf888dac855854649b3e26c1ab25a2ed5cf9a0e417316013db89ba3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"derbyrun.jar","sha256":"904d79929f4a4858d8e900fd2598222d8b08defa8314c37153a3bbc85d09570e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"ACEEXCH.DLL","sha256":"678bbe1500a98a6e608f09ea57dee51c7a9443c5b8c533a9d772d313a80ce51a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"07c4.exe","sha256":"5d8abae306f68afbfc2d460df14bd4bf4c466991546a8244558a8c64437b8a52","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"com-sun-tools-visualvm-jvm_ja.jar","sha256":"09d303ecdad82d3246d33818a1dd3d7891f9a75ab781b488d20c8d65b7ddf632","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"AutoItX.chm","sha256":"c87db1da6691c3a3a3bdfd3dae43203ba0121c59029f537926a949c3039d4af2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"calculator.vbs","sha256":"785252d9dcbdc7203cc40b9f9f6930e96e765b64aa80a8d6eba932217db5dbc1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"com.jrockit.mc.ui.ja_5.5.1.172852.jar","sha256":"102d2eec6577a8c09d4cd09e775df030629b74994b697bf6c6b0ed7314e41a0f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"com.jrockit.mc.console.ui.notification.ja_5.5.1.172852.jar","sha256":"89c5b96845fd4f46161a24ff3b684b564fffaaa4394f997e1813b0a41c3c1fdf","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"Czkv.exe","sha256":"4ddbbbc2478c3b2ab0185679907d7a5cc2bd26306d50fe3f0f6e6d74f248b05a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"com-sun-tools-visualvm-tools.jar","sha256":"e48920d87189064dbea70a1e68155be7928ecc88eedddd71e4d05af4365eedc4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"com.jrockit.mc.docs.zh_CN_5.5.1.172852.jar","sha256":"4ad7f9d83dfa600f2d5f6a1a865b39e5665a1351e645ca67adaa5d27ba5baaeb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"com-sun-tools-visualvm-sa.jar","sha256":"0a0a553b4412937eeb177a0dcf7e7907d3c976e48158680d38b547ec3879e81e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"ACEODDBS.DLL","sha256":"c0ffb8fc737334f076d442358a30114df373a434e0c80d1b6e96457a13669f9d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"ACERECR.DLL","sha256":"3505f33039dc0c5f5e2a3e6cb5501eaccc87f703808ef7bb8bfc1a17497058f0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"com-sun-tools-visualvm-charts_ja.jar","sha256":"00c494957608ce62395cb3abada41eaada51f7fe0794ba880a827884f20b60ad","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"ACEWSTR.DLL","sha256":"8d4a08580fe9c4842e7ae5ce7fb79ad2950ed7052f7f286ec25b86ac337643ca","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"derbyLocale_zh_TW.jar","sha256":"5597fac89f93185a6db53b6e031813431278274eb4ed4c966c2e6702d88c81a0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"com.jrockit.mc.alert.zh_CN_5.5.1.172852.jar","sha256":"73cd0fbedd54f4d56aac25664b4d81104829d273ee551ae06363dcab724ec0d1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"com.jrockit.mc.components.ui.zh_CN_5.5.1.172852.jar","sha256":"db84f74af73fc6c059d04d4241a3cd8e5879e86718feee3559ac99648abde08a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"com-sun-tools-visualvm-uisupport_zh_CN.jar","sha256":"6c5d25c56f749f0ac02d8626d3c744f30b9357016063a3e86b434543ec6bd2c2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"com.jrockit.mc.flightrecorder.configuration_5.5.1.172852.jar","sha256":"74d403151c78b6d793698183d5b0ff22fa43ef753c24ce1fe4b0829ae783f342","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"com-sun-tools-visualvm-attach_ja.jar","sha256":"244799483414e2033575aef44a4a87cfbd92feb69bdd0c675b4bb5c5c9d16f01","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"CASCADE.INF","sha256":"458cca844648d8fc9c8e2674e2f417088f8094bf8dfd48f29732149dd8efc50a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"ADO210.CHM","sha256":"4bb94e8951f33a831b166b8d191c1f38115e9994e52f596708d353d1c30548a7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"CAGCAT10.DLL","sha256":"d0a6df8a72e96a2a23d1815ded0f8635c35c26fba17d39a05ccf24a914c9fa5e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"com-sun-tools-visualvm-host-views_ja.jar","sha256":"d9c5af07154d527d926bd8db342810d5e5fcbe3be38227d7b6fa6878e8391bee","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"com.jrockit.mc.docs_5.5.1.172852.jar","sha256":"a159d44e359ac0fe61a793269f963311b65fe0263c0d74ad16df5bd7dc1e5c67","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"com-sun-tools-visualvm-application.jar","sha256":"c655635472233c1ad709129b6636a4d425e1c2967238443eebdc0e7e6ae6167d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"ACERCLR.DLL","sha256":"d5b177628c45eb80e0fd2c74795457e1db8dc5a2d0b50d5bc19783a6599b94af","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"com-sun-tools-visualvm-application-views_ja.jar","sha256":"b330e16e6623882ac15fc515cfffa925b8a36c84d6d9dff72d1ea0ffdfa132ae","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"boot.jar","sha256":"68beef0cd854762629be58d5045db599a31caf953fdb047f10be5e8115bfe578","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"com-sun-tools-visualvm-coredump_zh_CN.jar","sha256":"30cef501e4e81817f7c0b8b0ca6ca8761b307264832e1308d749f0e01c4a0b1e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"CLVIEW.EXE","sha256":"5c926146d415ac42db2f1f67e82b7af17ee06d29aecbc10036dff0d296ccf3c6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"com.jrockit.mc.console.ui.diagnostic_5.5.1.172852.jar","sha256":"14cf3ed668b922b9dbe4d73a4f61eb3d9ee5f355e16893d562e172eec8c5c416","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"derbyLocale_ru.jar","sha256":"ec354baeeb8174d23bf0eae01fc548bca9265b9d90908522182b51c4082cca44","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"derbyLocale_pl.jar","sha256":"29c44b5dae47166a96d6bb54ad5bbf89fa2569734bd8931a49351eac993544eb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"COMPASS.INF","sha256":"1251930086f48b7ce9707b7e170092e9755a7e85769bf98139166da78617a430","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"com-sun-tools-visualvm-sa_zh_CN.jar","sha256":"51c886d7da525b370a184c5c7bdc7484d18fcb4dc499cf0d4ac55304949b1a1a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"access-bridge-64.jar","sha256":"52d1cc09162884902287af93353f91590f1045700b85fcdb597d20a64d33a868","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"com.jrockit.mc.browser.jdp.zh_CN_5.5.1.172852.jar","sha256":"62266f7779aa846909417d1e4b9fb09503d36c1d2a10b0e1db0a6639f607d4a2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"com.jrockit.mc.rcp.application.ja_5.5.1.172852.jar","sha256":"bf044b9e06ab6b8c8cef44140ca1029fefb589947f938973cd4efd7a10f73909","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"com.jrockit.mc.console.ui.mbeanbrowser.zh_CN_5.5.1.172852.jar","sha256":"daac7327c16b41b9b3ce99469e43ba963864e7ba5217a0a4a00be0607b021090","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"com.jrockit.mc.browser_5.5.1.172852.jar","sha256":"bb156d3fa90bd647a697b64076e7271ddc6cf5200f2dd6f52cbfc49efea8d529","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"com.jrockit.mc.browser.zh_CN_5.5.1.172852.jar","sha256":"53d4c2c84b57b9ed9a824c62ab6f305ea16a413aae6efd68a8241ff0001bbb9a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"Acrobat Reader DC.lnk","sha256":"b82ea9c69df73a1d3783ff44b6613f60edf7358c4c1c5aac88bb3ea9faac00f0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"ApothecaryMergeLetter.dotx","sha256":"3b93e92d43c03b1b22f962aa58db1fef653e9c92a2e241ccc71af97ac8af8bd8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"AdjacencyLetter.dotx","sha256":"a6829e94d6f65f5e0c7c40a94e313383e8ba8149bc8b353ea86d204c42bc82ff","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"Blog.dotx","sha256":"9d8d128df3c7d1b241c343633463843bbbbefde96a314f825c88c646b8f0cc05","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"AdjacencyMergeLetter.dotx","sha256":"016697950bbcff860f3865da78df053cae5f56a0dcfc59152bf14ee89608d09b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"BillingStatement.xltx","sha256":"a19f3d30e4cf9bb87a8ade5f17f3631752694550823b6e0169ab55c55bc1bed4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"BloodPressureTracker.xltx","sha256":"1b07773ca17e0db36af1264ec3c8761e1c1c0fd1880b852b5dc34bdd932b9459","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"ContemporaryPhotoAlbum.potx","sha256":"a50791c07ab6982a956b16db240f53e7a60367f4aeb31899f6e084c3ed391c8d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"ApothecaryNewsletter.dotx","sha256":"196307217e1f00d37931fb76804691c1281b6c58839e7e967543b1f8e6fe4f36","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"ATPVBAEN.XLAM","sha256":"74dc8442dade0d8215d9d122c7823c1d1d066fe5d648d2127e81793a0332df20","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"ApothecaryLetter.dotx","sha256":"95989d16be591079c7d75fdc40725d6b94dd78645a4fabe6e1ae94252ba8bf1a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"AdjacencyResume.dotx","sha256":"0762a72f219f6964b2cac62ab71b88e3bee17087e920b8df47fd33baca18dbee","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"DefaultBlackAndWhite.dotx","sha256":"19fae44e5b031ffb3d0047f49b51c2e5148b82248fd5671e7a9f3c367fc63728","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"Built-In Building Blocks.dotx","sha256":"508b9a9d0e17f565748b16eeea407d36ce3e1e8ddbed717940aaec19feb68c9e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"Default.dotx","sha256":"7870ecb389ecb9b6f4cdde1deec622d4e1117bdcb94e174fbc986371e290d803","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"ApothecaryResume.dotx","sha256":"3d057205707c82b98842f967f402de17fd9057f7c9008728de681dee1fa32d6e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"Classic.dotx","sha256":"458241790affa7da76341d50b3419f31d847a47bbce67bfd8b36f5447f7f70ce","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"AdjacencyReport.dotx","sha256":"4701e0704a0840de526a0ba1cffd04943347fe2a3ad76612b9bd90934ea0ee35","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"ClassicPhotoAlbum.potx","sha256":"e27a52cac2b243fa4e541da1009672f6d357ff762cda97679e1e9a4edc9050f1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"acmigration.dll","sha256":"e3bc9b4c756b217221a7f1a7d566ec8f4f87ed2306fe9dbd3a28683db6d87c51","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"}]},{"name":"microsoft-windows-advertisingid-replacement.man","sha256":"7f426e9403d325a3028ffa7da791f0f2c5698dc10e4ceb771abfff9bdc9c7fce","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"}]},{"name":"setupcore.dll","sha256":"5516ad9ccef65acef755e382d7ddd785db80c83b8e4e45f641faa9f49df94e6c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"}]},{"name":"setupmgr.dll","sha256":"c00598a14e8e5d49f09cec2cc636be1d5af4f784bc5a779e7ce258c55da4ad05","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"}]},{"name":"upgrade_bulk.xml","sha256":"9d49cc6c54b2d0e791e486441a8d18de6ec81463661d0ed632fbd77c142e5566","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"}]},{"name":"windlp.dll","sha256":"92f5975d9e1b56a1da6377fdfcc73695b4a5401ce6657ab3e95580c8a1cebf0b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"}]},{"name":"winsetup.dll","sha256":"5a943bfc560d4b27107a8ee404aef2e1e44c996024931f86fd657932fd1320c7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"}]},{"name":"AppraiserRes.dll","sha256":"a0e57529ae620b4b8ba650f054e8666d3cf1a2ed078d5b8ac22863a8e3762860","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"}]},{"name":"DU.dll","sha256":"02802283e92e158386934b8d3562d86bcf692f42312a94cf4a0524ead1aa6257","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"}]},{"name":"DiagTrackRunner.exe","sha256":"8f6b00e9c04bd38959022df3b0aa550ccc3ee00837ec968e9f937397b7404507","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"}]},{"name":"Diager.dll","sha256":"a1fe36351d28c37be6fd1fc2290522059157ee1709c0bb30e8d84882408d7401","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"}]},{"name":"GatherOsState.exe","sha256":"de792283912b07b5e410663311ab4c639aebf6bd2570206e48d817c7ebea051c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"}]},{"name":"Mitigation.dll","sha256":"ef60cd222339c3544517f2baebdd617192d025122934e7d1879d0ea28fc0fd4a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"}]},{"name":"NXQuery.sys","sha256":"1128fd88d297d3dd436494f0cc7c1bac231a1a2c5995a66683356050d3b5ac4d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"}]},{"name":"AltData.cab","sha256":"36aeadba0ec57138f71279716ea9f71053c8b216b48819282d9f54697e8acd30","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"}]},{"name":"Appraiser_Data.ini","sha256":"2cf58f143caf885ce420c59042d366e035198388864c8fc3b72da715f6e57c7a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"}]},{"name":"Appraiser_TelemetryRunList.xml","sha256":"780e0c742c9d1f45f60e6db78da36fb34a4111161507503307655af451dbbbc7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"}]},{"name":"CompatData_2018_06_15_02_37_58_3_00000021.xml","sha256":"dc9a94203a90d849b9829d07c89d598868b005a78b726cb209e7a721f0d0775a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"}]},{"name":"CompatData_2018_06_15_02_38_01_3_00000021.xml","sha256":"253d8580ae740a7c07435dac34235453c4d00b5b68727b07ff41728b277edf1b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"}]},{"name":"W162x7STtEKk-ZBa.1.1.1.7.29.1.4.0.0_APPRAISER_EverythingSys.bin","sha256":"fc3ba793c3fbd38796405833a72fadd327a501a18cb9d8e34fbf02bd645598b6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"}]},{"name":"SFPAT.INF","sha256":"a8922ea6dfd53d19e4ff4dadf8bcac5587ed3ca5768ad6ab692082a5bf2f9c01","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"}]},{"name":"SFPATRS1.INF","sha256":"278c09f414f84bc6779341b411ef6b5722ba60e871bfb4626d7fddba3f078b19","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"}]},{"name":"SFPATWT.INF","sha256":"7dd9154de03231ff65d98981c27725181cd39fb06cc5405ba24f1b5e9b397a6a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"}]},{"name":"SetupHost.exe","sha256":"cc660b8a5e41428fe52b528efec5446e3bdcb73083df7fc5e70c7ebf2aca426d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"}]},{"name":"UpdateSetupUIMgr.dll","sha256":"2bcd7962be910958f54e5552bce5e23ea81e4e1501bf2069de13ebd5d53f2ca8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"}]},{"name":"acres.dll","sha256":"18eb5625eb36286e96ac4207fdf0133885cb8a9f9f880eeef3c22c160bc6a17a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"}]},{"name":"aeinv.dll","sha256":"c2a1564ea26ebbf98ddf21984b185bbb5f6cc0dbca159deef372b4fc78ec95f6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"}]},{"name":"api-ms-win-core-apiquery-l1-1-0.dll","sha256":"3bf954f0936abfba7f32a9c81b61ff5973ec7a629c6bafe649d49024c4c1382f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"}]},{"name":"api-ms-win-downlevel-advapi32-l1-1-0.dll","sha256":"4080ec77f128fb1b25643c569056d713db2dd609fd5f1952f134f98a7a15f1a1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"}]},{"name":"api-ms-win-downlevel-advapi32-l1-1-1.dll","sha256":"b04bcc192c16eba5f6242d7dc8731936fce4217f8c5052b4747e66601e918269","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"}]},{"name":"api-ms-win-downlevel-advapi32-l2-1-0.dll","sha256":"ed193b0141b9c5c6e7b98df50cd25b2b61194e3ba224d380db98046d7f950c39","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"}]},{"name":"api-ms-win-downlevel-advapi32-l2-1-1.dll","sha256":"ce764e06209540f92e8153455738e61ee93f16357df3241aa34a7cd0ea320e2b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"}]},{"name":"api-ms-win-downlevel-advapi32-l3-1-0.dll","sha256":"8a4034946d76305dd6573d55c3e495ea41eb35fb6a82241841a87c11b40c6c14","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"}]},{"name":"api-ms-win-downlevel-advapi32-l4-1-0.dll","sha256":"aea0d8d769bfc0821b74043c6c00ce854095787c90b1b7ad88bfc88e8fe29d3d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"}]},{"name":"api-ms-win-downlevel-kernel32-l1-1-0.dll","sha256":"d0b19580599036f8bba8dfe04c830b68f0bf3de2210eee7005ceb22876b197a5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"}]},{"name":"api-ms-win-downlevel-kernel32-l2-1-0.dll","sha256":"28ecdd0483b23256299efa6dc9b6264a4a308070807f5eda524a4d397231f274","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"}]},{"name":"api-ms-win-downlevel-ole32-l1-1-0.dll","sha256":"2901284bdb7513968b2186be002b6c66636ecdc85d3a4f4db0acd5db9a83362a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"}]},{"name":"api-ms-win-downlevel-ole32-l1-1-1.dll","sha256":"9ecdda247fc4aedf9f4a6f5f2d6d232b3c76b9784a3a2054d4c78b1047245b9f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"}]},{"name":"api-ms-win-downlevel-shlwapi-l1-1-0.dll","sha256":"4ea46a951c7547dd6ac3c213d74db80145991d0b9da8e506f6eeda83234f2eb4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"}]},{"name":"api-ms-win-downlevel-shlwapi-l1-1-1.dll","sha256":"e7da4d0e276e662ff0f1268bde7effaec5798ecb2b7756e0c666a13e612394af","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"}]},{"name":"api-ms-win-downlevel-user32-l1-1-0.dll","sha256":"d380bfd3ac16bad0575fce62dcb12e743b0a317865516bb3507dd1f8a70e4cdd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"}]},{"name":"api-ms-win-downlevel-user32-l1-1-1.dll","sha256":"021ca27044c251bc39cd87209d8c96c0182e9bda709e42f4a09e82750cfb321b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"}]},{"name":"api-ms-win-downlevel-version-l1-1-0.dll","sha256":"23e4850603ffc772e1200f75762aa9a161be5cf48f918a2730a6dbcc2dcc7df4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"}]},{"name":"appraiser.dll","sha256":"337cce8e75b6fe4fa54806f3cda8cd98290df483c0544b59e1856767f4f99078","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"}]},{"name":"cmi2migxml.dll","sha256":"7e62369e1d84b410d5672cc78ec69c3365f9029403d66df48aea947bb1aab748","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"}]},{"name":"compatResources.dll","sha256":"41a8808625d60902bbf5040416e0d755fbc72d940400fd5849bbe1a0c882ed8c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"}]},{"name":"compatctrl.dll","sha256":"50d0d3c42084dc4406c18c1f388ffcea1cf07d63b6c98b8d208160978b8f7378","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"}]},{"name":"compatprovider.dll","sha256":"ddd3ca64d3b2e57c543bf20410581e69911154e6489aebfc7f463e6daa90af94","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"}]},{"name":"csiagent.dll","sha256":"37947a26789571abda8b735493bf512c35a94280a276793da9d67e683109bb55","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"}]},{"name":"devinv.dll","sha256":"2a26bd76577f665eee27a7e9572dea5211391b01003b71d163c6bf71a15745b1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"}]},{"name":"diagtrack.dll","sha256":"e718862a4b2e9068df7e6087fb955141ba941793efae3e875b6b6b23523e038d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"}]},{"name":"dismapi.dll","sha256":"9a418ea6c8d187dda5b117da6b5aec3d272573960c522410c0c7058fe4484f0f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"}]},{"name":"dismcore.dll","sha256":"577857b2a8b11f178590945b10d146f6e3dd51dd256872c7a33a470af46f8e31","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"}]},{"name":"dismcoreps.dll","sha256":"b9cd924f40b1957896bf021437264c990cbb3531101e1b283292682e394939e8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"}]},{"name":"dismprov.dll","sha256":"4b92201b8ef2f45aaaf8e916d3bc875cd0e84ba5aa0a62ad89f4548e68cc1f00","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"}]},{"name":"ext-ms-win-advapi32-encryptedfile-l1-1-0.dll","sha256":"65c3c27643206560f15e5a68bc29793bd68dda375f04fb2171127c525bafab42","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"}]},{"name":"folderprovider.dll","sha256":"1675642f2f93c5674a525097d323cc7fd216031c03417082afb67d5411b1b19d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"}]},{"name":"generaltel.dll","sha256":"991fe7c0d9feb283c3b80804b733eabc716078a88ebc8786ab048dc317b00e7e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"}]},{"name":"imagingprovider.dll","sha256":"877130a3398e29e4a30ec893c440f573e2c43b417b610058079b48cf57940a70","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"}]},{"name":"logprovider.dll","sha256":"4a6625ab60a55a57a35379e1b1b4bd9cc40e534a097cfc0f9e95a9771d36496b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"}]},{"name":"mighost.exe","sha256":"321c6749a2da669688b874012cac4f2cad9678e544570ab712f220e8d8d7e867","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"}]},{"name":"migres.dll","sha256":"0a992c7a09ebb927dc745a3513367c3f9a1b3691c384b0e2c28e0d6385398611","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"}]},{"name":"migstore.dll","sha256":"b04d2943643dc9fdac4dfd82e1ac830d1c85253c8dd9ea0e4db669cfb04b4875","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"}]},{"name":"nxquery.inf","sha256":"1b8decea80b89545ae42be17c1c09bbfab84e6478819837b57b8f0878e4e5c0e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"}]},{"name":"reagent.dll","sha256":"90049d51db4d8a21dc2044f97532e392f4fffa6f4b9872c36796f6aa5690712d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"}]},{"name":"reportgen.dll","sha256":"7c81becf6690687fe5c3863e1f2c692ec613bcabf3be944e2436e3f87b65b476","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"}]},{"name":"setupcompat.dll","sha256":"8daab8b0c5b3eee067a2a48e530b785bd1d8ba44b9091606323c439edb668f96","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"}]},{"name":"setupplatform.exe","sha256":"30c1253a9fb15c4fda6e049fd3fe398dad176ebcf49099643b45dc246b4b34a8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"}]},{"name":"unattend.dll","sha256":"d6285da27bf3501b8f24990814ae4eab3c458a445851f224b1369f6977f757ad","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"}]},{"name":"unbcl.dll","sha256":"6791860202dee8cf3ae5c2f9de0736d4446508828db58899e9bf8d92662a416f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"}]},{"name":"vhdprovider.dll","sha256":"164483b72c193703ae8fc459169276adb6cdb5f9cb38ce8d2eb988a98f6e3f57","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"}]},{"name":"wdsclientapi.dll","sha256":"c12d4b54ec7383fde7d5279170088c3263776de28ba730f00a183069505d0623","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"}]},{"name":"wdscore.dll","sha256":"95c631a604b46667e8c866406aca62635e97e2dcce20ad1eaffd2acdd1a3b57b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"}]},{"name":"wdscsl.dll","sha256":"e76eb55310f206742f43dec84257740a708a2c0c07ed5d5b032f8651cd515312","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"}]},{"name":"wdsimage.dll","sha256":"8c6d785e3ed56a63bf2c03b07e83b034d3bd881dad0a745cea894f2f664dbf54","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"}]},{"name":"wdstptc.dll","sha256":"8709fee889b9f35f92f72b117ec5a871285d85d03d13f7162b1445ded061dadf","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"}]},{"name":"wdsutil.dll","sha256":"e7f3ae7a83c2b88473a86a03a8683a4632db728717aff0c25eb82438e28b401e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"}]},{"name":"wimprovider.dll","sha256":"063c3ea4659e06ae59d1184d97bf8dd5f249eab0ca1b258459890ec8c6b3ac25","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"}]},{"name":"wpx.dll","sha256":"962dcd6d870716f9945da3a4aa6fd064e6722264205acaf4385364aea38002d4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"}]},{"name":"easpolicymanagerbrokerhost.exe","sha256":"ff16861bdf35676772078d6d7cd6884465bdf59c5d55f23e1ccd03da5197dced","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"}]},{"name":"easpolicymanagerbrokerps.dll","sha256":"e7d18e0ecb7ec07f30a83afbdd9f7123c91c395d2b20640d0c779d85c8f3e56a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"}]},{"name":"accountaccessor.dll","sha256":"2b1414dd4709d112990b3421d2a8c4661b99f8d2da7c5c11e3d80a1bb7319fc7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"}]},{"name":"accountsrt.dll","sha256":"3b102863709b88890ad67429076f9bd4b9b70cefb11dd487ea1b9633481b1ad1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"}]},{"name":"activesynccsp.dll","sha256":"d3948000170a89dba3f4874284bef37806b10dfca44fc70ded899409a72d2234","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"}]},{"name":"aphostres.dll","sha256":"42a9eb84bc1bf7ee7e05663de3ace90dbd8b2a83f0d3f3d3b84dd6fdd67a10a5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"}]},{"name":"aphostservice.dll","sha256":"e692fdd958a2009f96a47cabe9baea2c59a0775c45a37abe04a5e462bc06b733","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"}]},{"name":"davsyncprovider.dll","sha256":"a3d26e27bb373be37ad4c406d2b81e853d41819bbcdcc87e730ab83c2ed93d6d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"}]},{"name":"mccsengineshared.dll","sha256":"5590ca59935a10d2a42043e1a01041a856dad8679dd8a59d8663cd9596f46ee4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"}]},{"name":"inproclogger.dll","sha256":"dcd9165042620ff2c870d8b02797f3ab9c8403322b0752830b0c2685740faa21","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"}]},{"name":"internetmail.dll","sha256":"6633992d8e25ec4c0e2d2d5473381c21ca1f8964c8441d6766a13fa985ac9673","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"}]},{"name":"internetmailcsp.dll","sha256":"539a0c87f6d1c460377ead95b56637d62db7494554dd1bdfe9a1285ed56ffe88","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"}]},{"name":"mccspal.dll","sha256":"8e4b7c035aef3a41fc1902a679c084168b231bbdd8d31b5542444c96c5f92734","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"}]},{"name":"networkhelper.dll","sha256":"4efc293596a87a73641056142c31ba31719052af1ccbc656825cc3dc9cfb3d53","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"}]},{"name":"synccontroller.dll","sha256":"b5bc1c9ce0ad1eb821e5529c219f4ecda17a7246274c96906ff251ef2cff6823","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"}]},{"name":"syncproxy.dll","sha256":"a8decde8b8f028d299804a69157759eab74a7aa79df19e9cc9270513a84d4e65","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"}]},{"name":"syncres.dll","sha256":"0781b2692b9eb4c7d6af4056b9711778c78b136796e3131cac9b18ca2074ce21","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"}]},{"name":"microsoft-onecore-applicationmodel-sync-desktop-fod-package~31bf3856ad364e35~amd64~~10.0.17134.1.cat","sha256":"62bc08ceb31f7e1142e926cabcb6da3b26cde7a1fa0568f9764d81172fdef850","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"}]},{"name":"microsoft-onecore-applicationmodel-sync-desktop-fod-package~31bf3856ad364e35~wow64~~10.0.17134.1.cat","sha256":"3f269a6650dae8113780ef777c4b13b92d03a87da12e2da83769967e87fe42b9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"}]},{"name":"update.cat","sha256":"acb614b7b869082e42cf82a5ee6c169b7f8cf1b3372d340e2542dca7c1781560","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"}]},{"name":"activesyncprovider.dll","sha256":"3a4b5839fb295d6fe391bc6307a990523cedb1b11c8e86a83ddd54f1194d44de","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"}]},{"name":"TM02835233_fn_Text Sidebar _Annual Report Red and Black design_.docx","sha256":"ab77f2e26e8225dc6d62e86df22a1eb767a8571560267610e06d740c8fe0dcd5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"}]},{"name":"2 photo Red and White Panes.docx","sha256":"4b4ef58c7668440d14cb3348c5c49f39e0ba69b0a3f42f2c2873d786424ceda9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"name":"Black and White and Yellow Bold.docx","sha256":"55681db46e543c965958018222c0189d39ea3e916e608230696af4a412e240af","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"name":"Blue Bordered Modern Photo Frame.docx","sha256":"dc4bb0a49f9fcd1a591824291de838c1d77195a1f5c639165bf5433cd7056ea1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"name":"Blue Green Bubbles 10 image Ad.docx","sha256":"6e483090c7ace6e7fbd037431f81134cf953d9eba3ba7b359db764933cacdfd3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"name":"Blue Stamped Photo.docx","sha256":"76d1d7545ed9ac18fa41b4f4d420e079ef27747d27aaeef25ef8ce0a81840ca7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"name":"Bold Blue Curve.docx","sha256":"8f1fe30cb4f8df305235d7009cb4262409b6f5d6c16828b73e3555a4c3b0ac55","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"name":"Framed in Red Orange and Gray.docx","sha256":"4dfee28b95393b4e9062933b6c8f452f21c3a139683bde3a37d40db654c5de3a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"name":"High tech in Green and Blue.docx","sha256":"2a3f31287147457dc60330abe6a17a131554543217e49ba515caec183345a19e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"name":"Irregular One-shot.docx","sha256":"e5e15f918537a977740013ddb1feab3996eb1435531ab837c94a1803708959f7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"name":"Orbiting Text 7 photo Ad.docx","sha256":"a8fffbb2680ca1b9bc48de04ba6f05f091064e5203fa9b4a80d9a4342ce9932b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"name":"Red Sunset with a Headline.docx","sha256":"111617bf480654adcb60d27462ba7d5cef5b17441ac180b9248625bf7053d3a6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"name":"Award of Merit.docx","sha256":"1e72e1b793f2599a4c7f5ff2ebe571f1ca920cf85ed532e1aea3be781a460041","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"name":"Bordered Attendance Award.docx","sha256":"5ce954da2b1d52164aec31d4b499bc3047bdbf2eb237795b2e41794c90010d0a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"name":"Bordered Efficiency Award.docx","sha256":"a7fb85b769af2f6d2100df1744693078eb54b6cf9c95fcb863b075dc9b3ae453","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"name":"Bordered Leadership Award.docx","sha256":"863c7a2b77d1c723cb81cb272627f42e603de583261f38700b69b66bc8dc0886","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"name":"Honor Student Award.docx","sha256":"2edca91e8f3d1fd186fd9fb3603fa1caed0601e28514835b6d69565c05b3d9ca","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"name":"Sales Award.docx","sha256":"c553c7b7117dd26ad8860d41605f5fca71e208e405fe5e6639a1bf20a0db6306","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"name":"Sports Award.docx","sha256":"8c40fea6c1d2f2c09550a7ea30b3a53e626d380c01ff16e54283479e6fdd6dd8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"name":"123 Sockets Bifold Brochure.docx","sha256":"e2c41bdf678a48829b0b16bf61c0a3552395551ca2f67a6132a72afbe1bce957","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"name":"Bar Graph Socket Bifold Brochure.docx","sha256":"735d924c478dbef89dae0b524fdc90571f7a9dd0efe26ad35cc69630ab53d730","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"name":"Brushed Steel Bifold Brochure.docx","sha256":"2118de3dd9d72d2bd5be91131f301bc3de983982ebbbb367ebb00dc308452923","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"name":"Information and Picture Waves Trifold Brochure.docx","sha256":"11e3940491263e2d4aab0f2504f0944c5036ffa221a54e82a38c23ca9db6d9cf","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"name":"Professional Blue Grids Bifold Brochure.docx","sha256":"932b265d2ffcf2f948fdcdd7bd6c6960f701470b631150f24628bfb5188537a8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"name":"Rounded in Maroon Peach and Yellow Bifold Brochure.docx","sha256":"6bda2c622fc3ef4e078c2b5febf852c66f7feb9c84286e774bd55154b930e419","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"name":"Scorched Earth Trifold Brochure.docx","sha256":"7abe9fa104cc8994e14528fdbf5b45ecc32a13629fbf6ea51dd93fc13c1ad90b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"name":"Spring Checkered with Multiple Photos Trifold Brochure.docx","sha256":"6f4aebce9b5f70b3ccda36e2b967ed9d795aa822da8752c726f84f1aeae64cdb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"name":"Striking Blue with Black Accents Trifold Brochure.docx","sha256":"e70170fad8c111a60b908a576a6d12ff33e1e4ae8d18655cbe0cca857a388721","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"name":"Sunrise Colors with Large Image Bifold Brochure.docx","sha256":"c69e7b4c3c4d27901efec77bbdd0cba699c5a84b395d5f26079f8b95664ed712","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"name":"Vertical Photo Strip in Green and White Trifold Brochure.docx","sha256":"3ef46a03c0450874f3be5f9bb6e4a68a071f2b39c69b82c95a9ed8be16f7aaae","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"name":"Auto Expense Report.docx","sha256":"e360f9c9b325694fd314e8a782dac7c6bfc56a0248ce1cb7adf0cab65b645fdb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"name":"Basic Agenda.docx","sha256":"a56eb8b397c523513a41d72c4ca9062c48d5edcb04f95a8f359b9a8cd229435f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"name":"Conservative Gray Fax Cover.docx","sha256":"2b4a51b6e069281b5b82a420f78c123c18e0c0b4427bbc13a6333674652e1f78","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"name":"Conservative Gray Memo.docx","sha256":"fba9e327da584d410b1b34e28534c94e64c8ceb141b8a019731351bf6df73f50","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"name":"Credit Reminder.docx","sha256":"fce93a8fc76d22da460c25d1fc40a9945ba81c7442376fd7d94579bcdb73ddbd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"name":"Daily Planner.docx","sha256":"f09bde27cb50faa5fcbc9301c8e7df30810c44434c06f59cbe09a553d4f403fe","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"name":"Detailed Agenda.docx","sha256":"f9ed75d8f87e21d1d37b7642b4718fec18f3388ae246f0bca6ca4fb1dacf4f35","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"name":"Dotted Memo.docx","sha256":"0bd80a2caf5efff6e8a4221f1c46b8c58c6a1a278ae22b8321a78a7e1972bcf3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"name":"Expense Report.docx","sha256":"47ae6d9cc1f128931e633a9876efbd5a047ec0a8a6fc25e4b3e7b120b1e47297","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"name":"From the President Memo.docx","sha256":"5cef714ce7f0b81bf3c0a6edd28042f279ea952679efc00ba7221e6cf57becf0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"name":"Gray Circle Fax Cover.docx","sha256":"d3b75fbe40da5d59389217d851c4845116e631681fc5e92dfc871a16c09d8748","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"name":"Hourly Invoice.docx","sha256":"095da77d82b134254d7dd7d3d7772aa6a6049218ff6679410c883ebb87476c59","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"name":"Invoice.docx","sha256":"f07f038650f2702079769dd9c25bc881747f1046d50fa6c74b5120b9340d331c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"name":"Job Estimate.docx","sha256":"1e888cc3749310999e05d74652b64c7f21149e57315133d3948818a99ef8e1ac","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"name":"Non Disclosure Agreement.docx","sha256":"b796df5507bc480d16964ef7a43f568361e3101e2315310dbdd1c5d12a1780d1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"name":"Price List.docx","sha256":"7aaae172c41246e66a6564f5e86cf621b0d212f87345aba3196f3b924afa48c5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"name":"Product Data Sheet.docx","sha256":"a662d3a315bee45c6ae8e986b0af08dcdc7668bf664746629d6b609f458a15f4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"name":"Property Receipt.docx","sha256":"ec183e551eca56797d668668270ab95ba8328cfa6c53d222e75afa2a4245f638","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"name":"Purchase Order Log.docx","sha256":"086ae2b742b60487b06c1c82ae2e4a327dd8cd96f55d70e5204242b3e645350b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"name":"Purchase Order.docx","sha256":"17daf58cb576e508739749913d657f149b0930a8fb7364672aaf9c55b8c82f54","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"name":"Shipping Label.docx","sha256":"8b471d23b7c81133b5c83132114fe15d34e8ec3301d4331347e2d760603a9db8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"name":"Simple Gray Fax Cover1.docx","sha256":"f5aff54585600fa31448ce62ca8049743c0648aed09bea598c3d8a0f82f680ec","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"name":"Sleek Gray Fax Cover.docx","sha256":"b28033ac6b730551bd13920a5a728f34597666e2710371e4235a517e97b0390e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"name":"Statement of Services.docx","sha256":"7160031a767bcc5f10b4c99aab1fbd5dba01729a85b1708ec8b89a4f04a4112a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"name":"Subcontractor Agreement.docx","sha256":"630b66842b1e294f14092b807082cbfe6a3f46478255362bdb152b409128663e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"name":"Transmittal Letter.docx","sha256":"5e0cf024dc2c60d0cd96c73c6caedfb4901dd3f45604fc95f7a7b40071b94e0a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"name":"Weekly Goals and Objectives.docx","sha256":"cff0452397df965b8e1b39838be79c947dd86367bd3a6b936755d9f7f4fc73eb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"name":"Weekly Time Sheet.docx","sha256":"cf25a31cf977c9b7e51e3221d25b217526f4fb9df9ba5e9dfeb5b42ab9a4ee06","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"name":"Landscape Teal Calendar with Pic.docx","sha256":"bb45dd3e429ce4f9fad913ae80050a092d50181d6506a40132d49e6bf5f71804","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"name":"Landscape Yearly Calendar - Pic_2011.docx","sha256":"517240d07031e36648d3a5106b83d8d8043bc6e6a20be36609cbdc823cb2eb72","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"name":"Landscape Yearly Calendar - Pic_2012.docx","sha256":"1423798e56d4dc46ea8f19f9f4db92f4d31b1c9dd7befeed48565e5009b8a261","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"name":"Landscape Yearly Calendar - Pic_2013.docx","sha256":"989549b66e54b75475044c6951dd1cf7b77cf5754a3527c843ec83e6a750b266","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"name":"Landscape Yearly Calendar - Pic_2014.docx","sha256":"bcc9dcd4567f382d33ccbeb359c475644de2db95ade3342a4e2fbd431a4ca6c6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"name":"Landscape Yearly Calendar_2011.docx","sha256":"6d56133cb6a98c55036d3e9d0fb9eaf6fb52cb9a7cdf74224f466162bf4439d6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"name":"Landscape Yearly Calendar_2012.docx","sha256":"397ffe1cc5c4bade4a887f004fb944c87ec5a15a2acfe92e78bd53116109688e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"name":"Landscape Yearly Calendar_2013.docx","sha256":"0421346a8b98d9529509a0f8e5728d380f6256ff1bc2a856d6918a74fd5bf6f9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"name":"Landscape Yearly Calendar_2014.docx","sha256":"045e96df5e6654fb3f5d64ef1afec186840a6462f431a6f195d00a7aad020024","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"name":"Portrait Teal Calendar.docx","sha256":"4c67527cf2c19cfb1a735641209572cced8d8286dfb99acccb8946b828f81d70","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"name":"Beveled Layout.docx","sha256":"15ad4bc94e2cdb7e112a89701ea1397b1a2aa0ddabec2e6d6a436a770d48f678","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"name":"Bold Heading.docx","sha256":"a095339280b38c1060fbef3b6f33cd19c7a26a6475b4472d1a78892c6865e131","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"name":"Dark Red and Gray.docx","sha256":"04e80df6bb71358fcb5c44dabd49da2419c729c86e8a7c534cb69f6f9a6fb82c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"name":"Four Curve Sockets Flyer.docx","sha256":"4b7a24bab2a045a3c670c1da8324a99e85fc2713be67d5c4cbdfaae2e7a7a0b3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"name":"Gray Stripe.docx","sha256":"4ab7366a0b18973f173c2ef0862fe92692139a5718278dd96ae10a9af45b8209","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"name":"Grid Sockets.docx","sha256":"b85768b694d710974e8ba4f3e51b66b4f49426b032852bbd73fddbaaa109b14d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"name":"Large Socket Transparent.docx","sha256":"085d10f2093dfff986b0b1b4a8eb4a503a34a4dfa0d64650b3c24cc441ece7fa","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"name":"Multiple Sockets.docx","sha256":"364092db52e771818c77178eb71a8bb6ef372a672d1284a39e8149227a6b98da","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"name":"Overlays.docx","sha256":"83c62ce8571ed31cb6fdf48d534cd1ffac6d41d797ec1a71078668ccf6fe7b05","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"name":"Transparent Opening.docx","sha256":"bf15fe86cfd37ac7b5edef41364583bdbda02f6a00a6ecdc2b75980e2931a803","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"name":"A Walk in the Garden with Mom.docx","sha256":"4e4baabb2c0a30270fe18f6a55a9a44349d9aae3a17cfcf8ba1f0f63e56a1657","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"name":"Candy Hearts.docx","sha256":"34fe48cd7f7f522a6002b2d466c7e3da75f4f4dd51f74f7287008de9ef4090a6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"name":"Card with Rose.docx","sha256":"79c95ce1f8fcd40c91fc480a01defc8a57a12e613edc3f18cd205a64480a25d6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"name":"Cute Baby Greeting.docx","sha256":"5da265d862075a5dfac04e22c8e398690ab41b1186e3ceb4ee605526078413dc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"name":"Easter Bunny on Red Concentric Circles.docx","sha256":"f012a5fde8dd402a74977cdbd16aa5675aea22421feba25f693edcecbdc90ee7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"name":"Easter eggs in a basket.docx","sha256":"2a0a90cee2dbacb142124041462fe68c47f14d44d36898b02fb25452e622c8ca","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"name":"Holiday bells.docx","sha256":"f63adcfc68c4b48ab9c09efdc829c06887708e1df226d40be6f0f1399919dbbb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"name":"Absence Report.docx","sha256":"be9ed2ac6c510e8c84e6fec4aaa464d5c9853a716067411d72d0c90f0292361a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"name":"Employee Accident Report.docx","sha256":"57695f59cd9bfe443c1a1b970c1b2e7b461c8fd4d5a7b007d0faad461a787255","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"name":"Exit Interview Guide.docx","sha256":"5da3fe8c8c0fd94922c406d82e3466158c9a0c4f696515cfcb0d501ac40e60f4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"name":"Interview Checklist.docx","sha256":"d098a686dea578dcaf7b670950f104834557f1afee0d1670b7123c9b9cac38d1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"name":"Interview Rating Guide.docx","sha256":"54d3f8aa8b224f2da03d82f3ea54b27967773b15122f3a1ccac7beadda0fa9f9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"name":"Sample Rejection Letter 1.docx","sha256":"d9dee1a8a58aa61b39be51fc20f95f2602c8f5db31f41a2297a8542643c542ec","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"name":"Sample Rejection Letter 2.docx","sha256":"69cc6a9ef5bcf2bf0952dd5a074093a61e90d598ea9d29e655b549acea7ec3ee","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"name":"5 Reasons Poster.docx","sha256":"39f76507dc4ae92ebcf04fdb730ddb96e233a965c05afc25d9caf22331a9f146","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"name":"Black And White Poster.docx","sha256":"0411710284946ed339cc5dfadb5cb905de6e519c699abc1322bc07e3c86bfc08","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"name":"Picture Perfect.docx","sha256":"73a983540bc184911a80386d9376a3d4f365a436bcf75a184578efd2385c2160","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"name":"Rectilinear Design Poster.docx","sha256":"67ebd7e6c152fc1257e1550eeff733e71822d35f03e857ecb0f83c0ce01af300","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"name":"Simple Poster.docx","sha256":"f2e3efe50f34a1dea2f02ecb15ce0936da2ad907531b422a912ed3a584b16dca","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"name":"Tab Look.docx","sha256":"d3f20b632eb4663f64e78b8417deaa1cc83da17d52ea44a212707606425d053c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"name":"Three Frames.docx","sha256":"fb2b52b60773d1d266f2fe3c2c1c1ce175f34debb94555ab30d7bc1e679fe57e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"name":"Year Socket Poster.docx","sha256":"f93ca53795e642e616b443a16314e0cd78e906f7b10f9c3757b032c04385f63d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"name":"Beveled Blue.docx","sha256":"5145f360d967dc55f43de2984b71bcc16138a0e3da00811b7f39d6038826f34f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"name":"Bold Announcement.docx","sha256":"eadca6cf8f2b33d73bbd866534e816a565fc31582d8a191b0778962ef186a4a8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"name":"Bold Picture Top.docx","sha256":"1ed72c04c7b910ee9a6c4e97c9df0e0917e068690dae2fe6c137b74c0ec0d10b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"name":"Clean Look.docx","sha256":"bf5837e7bd678b03d300282bed68aa07fa3343dddc07d6e8ac82fbf687127919","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"name":"Blue Tabbed Folder.docx","sha256":"86234380aa5e261c69144d211940c10cb56198716ab8f78bbf8f793df0a3641f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"name":"Bold Hanging Tab.docx","sha256":"25f6e51c7af64ae0707c984ca4c9d3636b2cdf1928937ca8ca4415b37143cce1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"name":"Bold Photo Blobs in Red and Gray.docx","sha256":"4c5b2af9e7f358d2ece8ecf2f9b6280952f34012a248bd3de89d2d17e4199ae1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"name":"Film Strip Photos.docx","sha256":"b6a35973ae8332f4e11936cf32e4ac9913b73a049e02c4735d45b972767725bc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"name":"High-Contrast 8-Photo Spread.docx","sha256":"a1831a236a980384f9955374e327780cc12cf2dd6aa2a656f31cdefda021e940","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"name":"Alternating multi product.docx","sha256":"a7b4922225fc522c7b74d9da0b3700590adbdfa650e6e97d8a4472f7aead92aa","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"name":"Beveled suspense.docx","sha256":"feaed2fc4715a9903d2194e63b3ea0da343ef87719ec1980a65782ea3e63a78d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"name":"Bold Blue with Accented Touch.docx","sha256":"b5e506e2b4c33a35dae057c43a6a97e09ccc038229f9a5ddb90aadfc6c257b1b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"name":"Center Focused Picture.docx","sha256":"b46210acc931fe1bbcd16cb795c563ca8c165ae80724ef7e35b83b1436db519a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"name":"Circular intersection.docx","sha256":"92882752507067f6d100d78c371a26bbd90ed1c8d244b211e60d630a02d78624","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"name":"Clearly Separated.docx","sha256":"7e5f8247247fe21350edb3ebd549fa481b95f7477e310e56c300598ac9804427","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"name":"Contrasting Pastels.docx","sha256":"c7e3ada18981d9b00371d1105dd2902b22a693e22d26d5d42b5873dfe2049c49","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"name":"Contrasting Arrows and Blocks.docx","sha256":"ab9299f459623a2fed68b4cf43cbce9c9d3cc37fc0ef6ff98ae19cf18b47d644","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"name":"Contrasting bevel multi product.docx","sha256":"847222edf5248ebf16216d8239f17c417d81b73664035e545d94e9defba09352","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"name":"Dotted and beveled splendor.docx","sha256":"04d59969193dc0cdc5e58cab4d1ac01fc48020c7cd02b26b137cc3e75e1cd6f6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"name":"Production Schedule.docx","sha256":"61b28da05c0cff27d8b5677c8a81d10ac40094b1244496c2e2e7c77b25b0270b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"name":"Project Log.docx","sha256":"8176f14f52dca33fa0075c7ba2c86935058ba4d5a8077242fcce1d1e81f03224","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"name":"Project Plan.docx","sha256":"f7b2fbde7b53c2680350306804f2c793918b48aef4487d6ff5fec5c640da25a3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"name":"Beige Cover with Olive Interlude Annual Report.docx","sha256":"92f905c308ea613f3efecfdb533aed33a978404d6622f52e064d014c16743dd0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"name":"Bold Picture and Date Annual Report.docx","sha256":"6ec67f31ea64eaae74d626acad09e5b21e2e4f3210d813f13270010a0d3cb6d1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"name":"Bold Red Black Annual Report.docx","sha256":"5c560b7ec0adcc1890a2e2de95c2faad4e7c5973337777eac126aea7d91caa77","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"name":"Lime Green Stopwatch Annual Report.docx","sha256":"22da9bf6428752b2ed77dc09012d0340cd03b7fce9aafc3bb0dc835e32edff22","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"name":"Mauve Black and Bevels Annual Report.docx","sha256":"2818191fc489aa00b340b3fc1005627ef7144e86ffe0122d8f3c3eea72ee4137","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"name":"Shades of Green with Orange Accent Annual Report.docx","sha256":"47551aee6509e918974e3393c19cf9bedb2cad4b483986e2ef0ad8cc4d76a8d6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"name":"Springlike Tri picture Cover Annual Report.docx","sha256":"457aa7c31fdd1f709a5b658e00cb6226ca752a513a58e1c7a372e3abe48f48df","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"name":"Abstract.docx","sha256":"b5726f118b7f3bffe1d1084e7ec7d1df339daa5b62b8abce2f19ad9d0ba2fca8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"name":"Autumn Leaves.docx","sha256":"2b45e236dd40979fb20982583b79f048fc8c9af6cd33a4f3c1485dbc4cc7e76f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"name":"Childrens Activities.docx","sha256":"e6fbd74ca4f78317d57a06809c1a90247207427c0dfe33eb74d1995ff1f1f9ba","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"name":"Construction hard hat.docx","sha256":"2d09006583e3d2ab3bb2918003e956ad881a83ff25570cdd076ef20af9b81851","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"name":"Diagonally Blue.docx","sha256":"92f1c513fde385c3b6942d0a91ca12ef5a0ea40d30a6b7952d4e5c3aa12f9ca9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"name":"Easter Eggs.docx","sha256":"003caf2c5aee14699dbe795fe766748c0e5f2a8672aa5f27076f9b72095961b1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"name":"Flora.docx","sha256":"66d3e3dbb158647f9302305fb7020c2224c7fe11706ee46659eb995551916f43","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"name":"Lemon splash.docx","sha256":"47eb51bb72760827588800dbfb964f14023951653e69cab3c65bbed2ab96331c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"name":"Leopard Texture.docx","sha256":"ced082b9fc267d054c29605273daead7bfba4fc67cb88b897d0f326a99bfacaf","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"name":"Light bulbs.docx","sha256":"6f64eb6a3ad568e5384cba0b33de8e95b9128cb49a297c60ceadcbbefdf0e87a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"name":"Patriotic border.docx","sha256":"adf0cd6a7bc4c51e38244728fecd208d55c12691e6b2816335681238daee3aa4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"name":"Pinewood.docx","sha256":"ca1d70dcbf77d89f3035d87f576efeea5746ef5bab012853fadefb2bb05b083c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"name":"Pink Candy Hearts.docx","sha256":"299a95c92073dd8235e05b491fe288e84577346048fa19086676c8965a8ebc71","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"name":"Purple Chevy.docx","sha256":"4572cb7265fb2a85520472635d00e77e05fb9ff7dc0dd38b557d0f69b2fe96c4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"name":"Red Hearts on White.docx","sha256":"2e61895053f861379efc3d511c0662894fb8d1e1eeff8f89527f081561f1e013","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"name":"Sails in the sunset.docx","sha256":"76c405424e0cc36e6ceaba99f0e0539e3f88048217e0ef6839e2b0592620a751","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"name":"Splashes on Canvas.docx","sha256":"54baae47523df37659cfe6338c4693fa88c5caa0cccce16387332fab2e440965","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"name":"Stars and Bubbles.docx","sha256":"b98bfc7e94e7b6c770360355ce4f5dc548dd4c9628e2aa0b3ddc27fc0cf3686d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"name":"Watermelon pile.docx","sha256":"4744deebe59c37b6b48ae174c8a68e110b2a40f46adb78113588ae6057a2a6f7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"name":"Wooden Tree.docx","sha256":"90aaf15b952369f5c72c868e2788c27fe43667d5699ed6d57b68ac546bf29da2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"name":"Portrait Basketball Sports Poster.docx","sha256":"ed8eb1b53361b9d059861461aaf244078411b82eaa800dcbd06875a403dc65fd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"name":"Company Grid Envelope.docx","sha256":"5e69234961a174dcbe5fa7d271fc0ab465a136c05007e7d06c740887143f9c47","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"name":"Company Grid Letterhead with border.docx","sha256":"c19ad986d32bd5fa696bfbca47f913ee4ceffa346796e523fa47ba4f58b6dde0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"name":"Company Grid Letterhead without border.docx","sha256":"e9e2fa45d53ba932db3e602be1ac6807664ecc8f9aafb30cd442a5e169694a66","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"name":"Horizontal Fit Business Card.docx","sha256":"6ae8dcddc03178b35f572f699c796416c6c70f882e96017501ad82fc02771f37","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"name":"Horizontal Fit Envelope.docx","sha256":"d7106319256ba5b691e29ae7b02adf4bdd42eb1d873f1e12b20365ba38b82324","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"name":"Horizontal Fit Fax Cover Sheet.docx","sha256":"8680801459762a82fdd3672cf0d26a22d762ccb80e5e81733e0a0dfbeb7c627c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"name":"Horizontal Fit Letterhead with border.docx","sha256":"4f2c5781c4693483c14a20a4c5e2568edf41d02a5d4975735442e72f5d9ae18b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"name":"Horizontal Fit Letterhead without border.docx","sha256":"b113fc91e3ac8c12b4bc290e234163fb99eae55496526b21ca474d1c50bd1a32","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"name":"Staccato Color Business Card.docx","sha256":"09cbbbf5021bb8cd3fa9acb1554550e5266496023384c99aa7e7c1f6d80ef0f4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"name":"Staccato Color Envelope.docx","sha256":"8c4f100705ddeaa4f8ce4d090ec9a6d492eea67b0c4bde700e7122f027064850","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"name":"Staccato Color Fax Cover Sheet.docx","sha256":"3de7813ab7ae02b262acbad3d13588873b47a901f25885a1e25e333d84434c09","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"name":"Staccato Color Letterhead with border.docx","sha256":"7137ba8c0fe32eb62159dc9ff8d6bf4a6f6f14aff30c64ad768516fdbb382363","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"name":"Staccato Color Letterhead without border.docx","sha256":"abe36f56166c3b7118c5a1d9f92add36c11e19cd67282d7bb463bc9104c704b3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"name":"Office64WW.msi","sha256":"53e141f690a279613530c7d3f1e2dbfe4f59e3000f79a8dcec733d76a70d5818","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"name":"PidGenX.dll","sha256":"4947b91ffbe4c3377d0bb65e88de6236a9f086e87d31ff7109ffca44ba98e3c0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"name":"ose.exe","sha256":"78a31a63043a1d54d2d3a8be381afc9c39885020844ed81733e0af44ef758bd8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"name":"autoexec.bat","sha256":"f5d3c5e2207601e7a6553ae1475dd498854fdbbc160046164bee0ce33dac8ea4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"name":"Bordered President_s Award.docx","sha256":"f5ba101019b1df822a8423643075cb4b3bbea070bd3e7f8832fc70d5f2ef1715","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]}],"files_written":[{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"path":"%WINDIR%\\SysWOW64\\WSHTCPIP.DLL","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"path":"%WINDIR%\\SysWOW64\\wship6.dll","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"path":"%WINDIR%\\SysWOW64\\wshqos.dll","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"path":"C:\\share","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"path":"C:\\$Recycle.Bin","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"path":"C:\\$Recycle.Bin\\S-1-5-21-686412048-2446563785-1323799475-1001","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"path":"C:\\found.000","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"path":"C:\\found.000\\dir0000.chk","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"path":"C:\\MSOCache","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"path":"C:\\MSOCache\\All Users","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"path":"C:\\MSOCache\\All Users\\{91140000-0012-0000-1000-0000000FF1CE}-C","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"path":"C:\\PerfLogs","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"path":"C:\\PerfLogs\\Admin","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"path":"C:\\Program Files","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"path":"%PROGRAMFILES%\\7-Zip","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"path":"%PROGRAMFILES%\\Common Files","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"path":"%COMMONPROGRAMFILES%\\DESIGNER","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ClickToRun","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\DW","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\EQUATION","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\EQUATION\\1033","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\EURO","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\Filters","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\GRPHFLT","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\Help","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\ar-SA","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\bg-BG","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\cs-CZ","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\da-DK","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\de-DE","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\el-GR","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\en-US","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\es-ES","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\et-EE","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fi-FI","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fr-FR","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fsdefinitions","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fsdefinitions\\auxpad","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fsdefinitions\\keypad","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fsdefinitions\\main","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fsdefinitions\\numbers","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fsdefinitions\\oskpred","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fsdefinitions\\symbols","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fsdefinitions\\web","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\he-IL","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\hr-HR","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\hu-HU","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\HWRCustomization","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\it-IT","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\ja-JP","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\ko-KR","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\lt-LT","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\lv-LV","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\nb-NO","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\nl-NL","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\pl-PL","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\pt-BR","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\pt-PT","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\ro-RO","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\ru-RU","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\sk-SK","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\sl-SI","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\sr-Latn-CS","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\sv-SE","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\th-TH","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\tr-TR","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\uk-UA","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\zh-CN","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\zh-TW","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\MSInfo","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\MSInfo\\en-US","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"path":"\\FileSystem\\Filters\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WBEM\\CIMOM\\","sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WBEM\\CIMOM\\","sources":[{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\EKANS","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"}]},{"name":"Global\\EKANS","sources":[{"report_type":"sandbox","report_id":"5e39b4177476481e3a3953bb"},{"report_type":"sandbox","report_id":"641cb38cb41e2d6cf90b796d"}]},{"name":"SM0:7144:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"643989e7b9e1bd5d8e0c2d8f"}]}]}},"report_ids":{"sandbox_job_ids":["643989e7b9e1bd5d8e0c2d8f","641cb38cb41e2d6cf90b796d","5e39b4177476481e3a3953bb"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Win/malicious_confidence_100% Sample e5262db186c9… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample e5262db186c9…. Malware family: Win/malicious_confidence_100%. Threat score 100/100. 24/27 AV engines flagged this file. 6 malicious and 23 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60"}],["$","meta","4",{"property":"og:title","content":"Malicious Win/malicious_confidence_100% Sample e5262db186c9… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample e5262db186c9…. Malware family: Win/malicious_confidence_100%. Threat score 100/100. 24/27 AV engines flagged this file. 6 malicious and 23 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Win/malicious_confidence_100% Sample e5262db186c9… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample e5262db186c9…. Malware family: Win/malicious_confidence_100%. Threat score 100/100. 24/27 AV engines flagged this file. 6 malicious and 23 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L42","11",{}]]