24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 4e:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4bf,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Backdoor.Agent Sample 051463a14767… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 051463a14767…. Malware family: Backdoor.Agent. Threat score 100/100. 19/28 AV engines flagged this file. 9 malicious and 23 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00","keywords":["Malicious","Backdoor.Agent","malware analysis","sandbox report","threat intelligence","051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00"],"about":{"@type":"SoftwareApplication","name":"051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.exe","applicationCategory":["peexe","executable"],"identifier":"051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Backdoor.Agent","antivirusDetections":{"malicious":19,"total":28},"behavioralIndicators":{"malicious":9,"suspicious":23},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T839,".exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") ".exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") ".exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") ".exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") ".exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") ".exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") ".exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") ".exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") ".exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") ".exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") ".exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") ".exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") ".exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") ".exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") ".exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") ".exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") ".exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT"; Key: "") ".exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES"; Key: "") ".exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS"; Key: "") ".exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS"; Key: "")26:T789,".exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\MY"; Key: "") ".exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") ".exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") ".exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\27AC9369FAF25207BB2627CEFACCBE4EF9C319B8"; Key: "BLOB") ".exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\8AD5C9987E6F190BD6F5416E2DE44CCD641D8CDA"; Key: "BLOB") ".exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\FF67367C5CD4DE4AE18BCCE1D70FDABD7C866135"; Key: "BLOB") ".exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") ".exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") ".exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") ".exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") ".exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\109F1CAED645BB78B3EA2B94C0697C740733031C"; Key: "BLOB") ".exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\D559A586669B08F46A30A133F8A9ED3D038E2EA8"; Key: "BLOB") ".exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\FEE449EE0E3965A5246F000E87FDE2A065FD89D4"; Key: "BLOB") ".exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") ".exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS\A377D1B1C0538833035211F4083D00FECC414DAB"; Key: "BLOB") ".exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") ".exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "")27:T5a8,".exe" touched file "C:\Windows\Globalization\Sorting\SortDefault.nls" ".exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files" ".exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Cookies" ".exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\History" ".exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat" ".exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Cookies\index.dat" ".exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat" ".exe" touched file "C:\Windows\System32\rsaenh.dll" ".exe" touched file "C:\Windows\System32\en-US\urlmon.dll.mui" ".exe" touched file "C:\Windows\System32\en-US\crypt32.dll.mui" ".exe" touched file "C:\Windows\System32\en-US\KernelBase.dll.mui" ".exe" touched file "C:\Windows\System32\en-US\winhttp.dll.mui" ".exe" touched file "C:\Windows\System32\en-US\setupapi.dll.mui" ".exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Cookies\%OSUSER%@hulu[1].txt" ".exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Cookies\%OSUSER%@hulu[2].txt"28:T43c,"DES" (Indicator: "des"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.bin") "des" (Indicator: "des"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.bin") "blowfish" (Indicator: "blowfish"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.bin") "AES128" (Indicator: "aes128"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.bin") "aes128" (Indicator: "aes128"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.bin") "AES192" (Indicator: "aes192"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.bin") "aes192" (Indicator: "aes192"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.bin") "AES256" (Indicator: "aes256"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.bin") "aes256" (Indicator: "aes256"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.bin") "RC4" (Indicator: "rc4"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.bin")29:T8f9,".exe" monitors "\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9" (Filter: 1; Subtree: 0) ".exe" monitors "\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\NameSpace_Catalog5" (Filter: 1; Subtree: 0) ".exe" monitors "\REGISTRY\MACHINE\SOFTWARE\Microsoft\Tracing\RASAPI32" (Filter: 14; Subtree: 0) ".exe" monitors "\REGISTRY\MACHINE\SOFTWARE\Microsoft\Tracing\RASMANCS" (Filter: 14; Subtree: 0) ".exe" monitors "\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\crypt32" (Filter: 4; Subtree: 0) ".exe" monitors "\REGISTRY\USER\S-1-5-21-4162757579-3804539371-4239455898-1000\Software\Microsoft\SystemCertificates\Root" (Filter: 5; Subtree: 1) ".exe" monitors "\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT" (Filter: 5; Subtree: 1) ".exe" monitors "\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot" (Filter: 5; Subtree: 1) ".exe" monitors "\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\SystemCertificates" (Filter: 5; Subtree: 1) ".exe" monitors "\REGISTRY\MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\Root" (Filter: 5; Subtree: 1) ".exe" monitors "\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot" (Filter: 5; Subtree: 1) ".exe" monitors "\REGISTRY\USER\S-1-5-21-4162757579-3804539371-4239455898-1000\Software\Microsoft\SystemCertificates\SmartCardRoot" (Filter: 5; Subtree: 1) ".exe" monitors "\REGISTRY\USER\S-1-5-21-4162757579-3804539371-4239455898-1000\Software\Microsoft\SystemCertificates\trust" (Filter: 5; Subtree: 1) ".exe" monitors "\REGISTRY\USER\S-1-5-21-4162757579-3804539371-4239455898-1000\Software\Policies\Microsoft\SystemCertificates" (Filter: 5; Subtree: 1) ".exe" monitors "\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\trust" (Filter: 5; Subtree: 1) ".exe" monitors "\REGISTRY\MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\Trust" (Filter: 5; Subtree: 1) ".exe" monitors "\REGISTRY\USER\S-1-5-21-4162757579-3804539371-4239455898-1000\Software\Microsoft\SystemCertificates\CA" (Filter: 5; Subtree: 1)2a:T540,"C:\051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\Cab2B13.tmp" for deletion "C:\051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\Tar2B14.tmp" for deletion "C:\051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.exe" marked "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Cookies\%OSUSER%@hulu[1].txt" for deletion "C:\051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\Cab7E5D.tmp" for deletion "C:\051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\Tar7E5E.tmp" for deletion "C:\051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\CabA81D.tmp" for deletion "C:\051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\TarA81E.tmp" for deletion "C:\051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\Cab7936.tmp" for deletion "C:\051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\Tar7937.tmp" for deletion2b:T951,".exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") ".exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") ".exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") ".exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") ".exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") ".exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") ".exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") ".exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") ".exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") ".exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") ".exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") ".exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") ".exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") ".exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") ".exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") ".exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") ".exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT") ".exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES") ".exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS") ".exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS")2c:T771,Found string "zlib compression" (Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found string "run length compression" (Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found string "unsupported compression algorithm" (Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found string "sslv3 alert decompression failure" (Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found string "old session compression algorithm not returned" (Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found string "no compression specified" (Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found string "invalid compression algorithm" (Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found string "inconsistent compression" (Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found string "duplicate compression id" (Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found string "compression library error" (Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found string "compression id not within private range" (Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found string "compression failure" (Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found string "compression disabled" (Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found string "bad decompression" (Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found string "SSL_COMP_add_compression_method" (Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found string "invalid compression bit" (Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found string "compressionAlgorithm" (Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp")2d:T5fe,Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API "SleepEx" (Indicator: "SleepEx"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found reference to API "SleepEx" (Indicator: "SleepEx"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp")2e:T91a,Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00005544.00000000.196677.04550000.00000004.mdmp, 00000000-00005544.00000001.198597.04550000.00000004.mdmp, 00000000-00005544.00000002.200517.04550000.00000004.mdmp, 00000000-00005544.00000003.207944.0024D000.00000002.mdmp, 00000000-00005544.00000003.207944.04550000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00005544.00000000.196677.04550000.00000004.mdmp, 00000000-00005544.00000001.198597.04550000.00000004.mdmp, 00000000-00005544.00000002.200517.04550000.00000004.mdmp, 00000000-00005544.00000003.207944.0024D000.00000002.mdmp, 00000000-00005544.00000003.207944.04550000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp")2f:Td89,Found reference to "DlSHA512 block transform for x86, CRYPTOGAMS by " (Indicator: "SHA512"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to "RC2-CBC" (Indicator: "RC2"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to "SHA384" (Indicator: "SHA384"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to "RC4-HMAC-MD5" (Indicator: "HMAC"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to "AES-128-CBC-HMAC-SHA1" (Indicator: "HMAC"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to "AES-256-CBC-HMAC-SHA1" (Indicator: "HMAC"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to "HMAC-SHA1" (Indicator: "HMAC"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to "HMAC routines" (Indicator: "HMAC"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to "AES-192-CBC-HMAC-SHA1" (Indicator: "HMAC"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to "HMAC GOST 34.11-94" (Indicator: "HMAC"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to "id-HMACGostR3411-94" (Indicator: "HMAC"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to "hmacWithSHA512" (Indicator: "SHA512"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to "hmacWithSHA384" (Indicator: "SHA384"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to "ecdsa-with-SHA512" (Indicator: "SHA512"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to "ecdsa-with-SHA384" (Indicator: "SHA384"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to "HMAC-MD5" (Indicator: "HMAC"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to "SHA512" (Indicator: "SHA512"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to "RSA-SHA512" (Indicator: "SHA512"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to "RSA-SHA384" (Indicator: "SHA384"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to "id-smime-alg-CMSRC2wrap" (Indicator: "RC2"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to "id-smime-alg-RC2wrap" (Indicator: "RC2"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to "id-smime-alg-ESDHwithRC2" (Indicator: "RC2"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to "pbeWithMD5AndRC2-CBC" (Indicator: "RC2"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to "PBE-MD5-RC2-64" (Indicator: "RC2"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to "pbeWithMD2AndRC2-CBC" (Indicator: "RC2"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll")30:Tfc2,Assembly shows XOR instruction xor eax ebp in Stream UID: 47646-92-004123AF Assembly shows XOR instruction xor ecx ebp in Stream UID: 47646-92-004123AF Assembly shows XOR instruction xor eax ebp in Stream UID: 47646-1637-0040E161 Assembly shows XOR instruction xor ecx ebp in Stream UID: 47646-1637-0040E161 Assembly shows XOR instruction xor eax ebp in Stream UID: 47646-3731-0040B6F0 Assembly shows XOR instruction xor eax ebp in Stream UID: 47646-4091-004DEDD5 Assembly shows XOR instruction xor ecx ebp in Stream UID: 47646-4091-004DEDD5 Assembly shows XOR instruction xor eax esp in Stream UID: 47646-4127-004C8BF0 Assembly shows XOR instruction xor ecx esp in Stream UID: 47646-4127-004C8BF0 Assembly shows XOR instruction xor eax esp in Stream UID: 47646-4128-004C89F0 Assembly shows XOR instruction xor ecx esp in Stream UID: 47646-4128-004C89F0 Assembly shows XOR instruction xor eax ebp in Stream UID: 47646-4392-00472CA0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 47646-4392-00472CA0 Assembly shows XOR instruction xor cl byte ptr [ebp-02h] in Stream UID: 47646-4406-004162B4 Assembly shows XOR instruction xor byte ptr [eax] cl in Stream UID: 47646-4406-004162B4 Assembly shows XOR instruction xor dword ptr [ebp-08h] eax in Stream UID: 47646-5106-004957C0 Assembly shows XOR instruction xor eax ebp in Stream UID: 47646-5106-004957C0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 47646-5106-004957C0 Assembly shows XOR instruction xor eax ebp in Stream UID: 47646-5117-004DE6B4 Assembly shows XOR instruction xor ecx ebp in Stream UID: 47646-5117-004DE6B4 Assembly shows XOR instruction xor eax esp in Stream UID: 47646-5307-0043BFC0 Assembly shows XOR instruction xor ecx esp in Stream UID: 47646-5307-0043BFC0 Assembly shows XOR instruction xor eax esp in Stream UID: 47646-5319-0043BC90 Assembly shows XOR instruction xor ecx esp in Stream UID: 47646-5319-0043BC90 Assembly shows XOR instruction xor eax esp in Stream UID: 47646-5338-0042CF90 Assembly shows XOR instruction xor ecx esp in Stream UID: 47646-5338-0042CF90 Assembly shows XOR instruction xor eax esp in Stream UID: 47646-5369-0043ACB0 Assembly shows XOR instruction xor ecx esp in Stream UID: 47646-5369-0043ACB0 Assembly shows XOR instruction xor eax esp in Stream UID: 47646-5400-004382F0 Assembly shows XOR instruction xor ecx esp in Stream UID: 47646-5400-004382F0 Assembly shows XOR instruction xor eax esp in Stream UID: 47646-5409-004386F0 Assembly shows XOR instruction xor ecx esp in Stream UID: 47646-5409-004386F0 Assembly shows XOR instruction xor eax esp in Stream UID: 47646-5557-0042F2E0 Assembly shows XOR instruction xor ecx esp in Stream UID: 47646-5557-0042F2E0 Assembly shows XOR instruction xor eax esp in Stream UID: 47646-5558-0042F180 Assembly shows XOR instruction xor ecx esp in Stream UID: 47646-5558-0042F180 Assembly shows XOR instruction xor eax esp in Stream UID: 47646-5575-0041C480 Assembly shows XOR instruction xor ecx esp in Stream UID: 47646-5575-0041C480 Assembly shows XOR instruction xor eax ebp in Stream UID: 47646-5616-00407681 Assembly shows XOR instruction xor ecx ebp in Stream UID: 47646-5616-00407681 Assembly shows XOR instruction xor eax ebp in Stream UID: 47646-5617-00407013 Assembly shows XOR instruction xor ecx ebp in Stream UID: 47646-5617-00407013 Assembly shows XOR instruction xor eax ebp in Stream UID: 47646-5618-00406AF7 Assembly shows XOR instruction xor ecx ebp in Stream UID: 47646-5618-00406AF7 Assembly shows XOR instruction xor eax esp in Stream UID: 47646-5637-0040164A Assembly shows XOR instruction xor ecx esp in Stream UID: 47646-5637-0040164A Assembly shows XOR instruction xor eax ebp in Stream UID: 47646-5729-00406CA5 Assembly shows XOR instruction xor ecx ebp in Stream UID: 47646-5729-00406CA5 Assembly shows XOR instruction xor eax esp in Stream UID: 47646-6284-0043A140 Assembly shows XOR instruction xor ecx esp in Stream UID: 47646-6284-0043A14031:Tf5e,Found string "-----END PUBLIC KEY-----" (Indicator: "public key"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found string "-----BEGIN PUBLIC KEY-----" (Indicator: "public key"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found string "public key hash: sha256//%s" (Indicator: "public key"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found string "SSL public key does not match pinned public key" (Indicator: "public key"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found string "not supported file type for private key" (Indicator: "private key"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found string "Private key does not match the certificate public key" (Indicator: "private key"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found string "Private key does not match the certificate public key" (Indicator: "public key"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found string "file type P12 for private key not supported" (Indicator: "private key"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found string "file type ENG for private key not supported" (Indicator: "private key"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found string "unable to set private key file: '%s' type %s" (Indicator: "private key"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found string "RSA Public Key" (Indicator: "public key"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found string "Unable to load public key" (Indicator: "public key"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found string "Public Key Algorithm" (Indicator: "public key"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found string "SSL: public key does not match pinned public key!" (Indicator: "public key"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found string "unable to decode issuer public key" (Indicator: "public key"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found string "ANY PRIVATE KEY" (Indicator: "private key"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found string "ENCRYPTED PRIVATE KEY" (Indicator: "private key"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found string "RSA PRIVATE KEY" (Indicator: "private key"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found string "DSA PRIVATE KEY" (Indicator: "private key"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found string "EC PRIVATE KEY" (Indicator: "private key"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found string "X509v3 Private Key Usage Period" (Indicator: "private key"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found string "unable to find public key parameters" (Indicator: "public key"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found string "unable to extract public key" (Indicator: "public key"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found string "public key not rsa" (Indicator: "public key"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found string "public key is not rsa" (Indicator: "public key"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found string "public key encrypt error" (Indicator: "public key"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll")32:T2dfd,Found XOR loop in file "sample.bin" at offset 23978; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 36364; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 38974; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 39115; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 48397; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 56898; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 63525; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 66953; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 67280; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 67506; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 67664; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 68037; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 68406; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 73192; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 73288; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 73814; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 78026; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 78591; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 81494; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 82268; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 83156; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 83221; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 84244; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 87256; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 88387; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 88452; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 89476; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 93396; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 95203; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 113964; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 166279; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 166359; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 167517; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 178789; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 178978; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 240462; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 240514; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 240573; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 240632; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 240668; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 241531; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 298008; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 299815; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 382839; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 467186; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 467231; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 467636; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 468136; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 468710; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 904009; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 904234; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 905075; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 907793; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 908918; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 918114; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 920681; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1373089; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1376325; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1380211; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1393721; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1394747; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1397019; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1402041; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1402355; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 42692; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 43313; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 97780; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 98520; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 98899; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 99340; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 99725; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 316054; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 479610; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 479631; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 689399; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 690655; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 690881; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 809187; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 809931; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 810009; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 810607; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 811132; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 811208; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 816689; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 898584; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 963945; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 964258; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 964277; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 971813; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 971830; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 972054; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 972215; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 981221; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 981325; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 981710; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 981814; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 991718; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 991738; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 991905; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 992042; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 992059; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 992119; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 992243; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 992263; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 992430; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 995988; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 996100; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 998596; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 998708; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1006056; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1006094; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1006166; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1006199; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1006276; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1006314; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1007000; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1007319; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1008277; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1008638; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1008957; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1009724; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1010044; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1010815; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1010848; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1010925; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1010963; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1011034; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1011067; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1011764; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1011814; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1011864; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1011914; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1292555; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1368943; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1369589; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1373485; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1375871; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1381423; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1384801; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1388177; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 122225; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 141780; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1045850; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1225194; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1226601; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1227240; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1304567; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1324684; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1339472; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1364594; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1373050; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1374238; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1383194; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1384324; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1389432; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1389714; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1390232; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1392680; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1393702; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1395704; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1397512; code bytes = 803033:T563,Found system information discovery API: "GetEnvironmentStrings" in file "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll" Found system information discovery API: "GetEnvironmentStringsW" in file "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll" Found system information discovery API: "ExpandEnvironmentStringsA" in file "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll" Found system information discovery API: "GetUserObjectInformationW" in file "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll" Found system information discovery API: "GetUserObjectInformationA" in file "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll" Found system information discovery API: "GetUserObjectInformationA" in "00000000-00005544.00000003.207944.0024D000.00000002.mdmp" Found system information discovery API: "GetEnvironmentStrings" in "00000000-00005544.00000003.207944.0024D000.00000002.mdmp" Found system information discovery API: "GetEnvironmentStringsW" in "00000000-00005544.00000003.207944.0024D000.00000002.mdmp" Found system information discovery API: "ExpandEnvironmentStringsA" in "00000000-00005544.00000003.207944.0024D000.00000002.mdmp" Found system information discovery API: "GetUserObjectInformationW" in "00000000-00005544.00000003.207944.0024D000.00000002.mdmp"34:T81a,"051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005544) "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005544) "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll.exe" called "RtlGetVersion" with parameter 240100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005544)35:T5a2,Found reference to API "VerifyVersionInfoA" (Indicator: "VerifyVersionInfo"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API "VerSetConditionMask" (Indicator: "VerSetConditionMask"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API "GetVersion" (Indicator: "GetVersion"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API "VerSetConditionMask" (Indicator: "VerSetConditionMask"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found reference to API "VerifyVersionInfoA" (Indicator: "VerifyVersionInfo"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found reference to API "GetVersion" (Indicator: "GetVersion"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp")36:T2067,"051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00005544) "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00005544) "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00005544) "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005544) "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00005544) "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00005544) "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00005544) "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00005544) "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00005544) "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00005544) "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00005544) "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00005544) "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00005544) "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00005544) "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00005544) "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00005544) "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00005544) "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00005544) "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00005544) "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00005544) "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00005544) "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00005544) "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00005544) "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00005544) "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00005544) "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00005544) "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00005544) "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00005544) "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00005544) "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00005544) "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00005544) "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00005544) "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00005544) "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00005544) "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00005544) "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00005544) "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00005544) "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00005544) "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00005544) "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00005544) "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00005544) "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00005544) "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00005544) "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00005544) "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00005544) "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00005544) "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00005544) "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00005544) "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00005544) "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll.exe" called "GetProcAddress" with a parameter IsProcessorFeaturePresent (UID: 00000000-00005544) "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll.exe" called "GetProcAddress" with a parameter NtQueryInformationProcess (UID: 00000000-00005544)37:Tad3a,Found reference to API (Indicator: "GetUserNameA"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API (Indicator: "DeregisterEventSource"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API (Indicator: "FindFirstFileA"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API (Indicator: "WriteConsoleA"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API (Indicator: "EnterCriticalSection"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API (Indicator: "FileTimeToLocalFileTime"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API (Indicator: "CreateDirectoryA"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API (Indicator: "GetConsoleCP"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API (Indicator: "LCMapStringW"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API (Indicator: "ReadConsoleInputA"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API (Indicator: "ReadFile"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API (Indicator: "RemoveDirectoryA"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API (Indicator: "GetCurrentProcessId"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API (Indicator: "FlushFileBuffers"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API (Indicator: "WriteFile"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API (Indicator: "WideCharToMultiByte"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API (Indicator: "HeapSize"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API (Indicator: "SetHandleCount"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API (Indicator: "VerifyVersionInfoA"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API (Indicator: "OpenProcess"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API (Indicator: "GetCurrentDirectoryA"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API (Indicator: "FileTimeToSystemTime"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API (Indicator: "GetFileType"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API (Indicator: "ExitProcess"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API (Indicator: "GetCPInfo"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API (Indicator: "GetCommandLineA"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API (Indicator: "MultiByteToWideChar"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API (Indicator: "CompareStringA"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API (Indicator: "TerminateProcess"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API (Indicator: "UnhandledExceptionFilter"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API (Indicator: "GetVersionExA"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API (Indicator: "GetCurrentThreadId"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API (Indicator: "GetModuleHandleW"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API (Indicator: "GetEnvironmentStrings"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API (Indicator: "GetEnvironmentStringsW"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API (Indicator: "IsValidCodePage"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API (Indicator: "GetStartupInfoA"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API (Indicator: "QueryPerformanceCounter"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API (Indicator: "lstrlenA"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API (Indicator: "FormatMessageA"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API (Indicator: "GetEnvironmentVariableA"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API (Indicator: "WriteConsoleW"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API (Indicator: "SleepEx"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API (Indicator: "GetFullPathNameA"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API (Indicator: "InterlockedExchange"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API (Indicator: "lstrcpyA"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API (Indicator: "GetTimeZoneInformation"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API (Indicator: "VirtualFree"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API (Indicator: "FreeEnvironmentStringsA"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API (Indicator: "GetFileInformationByHandle"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API (Indicator: "RtlUnwind"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API (Indicator: "WaitForSingleObject"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API (Indicator: "ExitThread"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API (Indicator: "CreateFileA"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API (Indicator: "RaiseException"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API (Indicator: "GetLastError"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API (Indicator: "GetLocaleInfoA"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API (Indicator: "GetWindowsDirectoryA"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API (Indicator: "TlsGetValue"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API (Indicator: "GlobalMemoryStatus"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API (Indicator: "CreateFileW"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API (Indicator: "SetConsoleCtrlHandler"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API (Indicator: "GetTickCount"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API (Indicator: "SetStdHandle"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API (Indicator: "Sleep"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API (Indicator: "SetFilePointer"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API (Indicator: "FreeEnvironmentStringsW"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API (Indicator: "GetFileAttributesA"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API (Indicator: "PeekNamedPipe"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API (Indicator: "LCMapStringA"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API (Indicator: "Process32Next"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API (Indicator: "VirtualAlloc"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API (Indicator: "GetACP"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API (Indicator: "InterlockedDecrement"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API (Indicator: "HeapAlloc"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API (Indicator: "HeapFree"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API (Indicator: "GetComputerNameA"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API (Indicator: "SetConsoleMode"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API (Indicator: "FindNextFileA"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API (Indicator: "GetProcessHeap"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API (Indicator: "LeaveCriticalSection"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API (Indicator: "IsDebuggerPresent"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API (Indicator: "SetEndOfFile"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API (Indicator: "SetLastError"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API (Indicator: "ExpandEnvironmentStringsA"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API (Indicator: "WaitForMultipleObjects"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API (Indicator: "CreateThread"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API (Indicator: "GetConsoleMode"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API (Indicator: "VerSetConditionMask"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API (Indicator: "GetModuleHandleA"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API (Indicator: "SetFileAttributesA"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API (Indicator: "GetProcAddress"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API (Indicator: "GetModuleFileNameA"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API (Indicator: "CloseHandle"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API (Indicator: "GetStringTypeW"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API (Indicator: "GetVersion"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API (Indicator: "GetStringTypeA"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API (Indicator: "GetDriveTypeA"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API (Indicator: "TlsSetValue"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API (Indicator: "HeapCreate"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API (Indicator: "FlushConsoleInputBuffer"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API (Indicator: "SetEnvironmentVariableA"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API (Indicator: "GetCurrentProcess"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API (Indicator: "GetOEMCP"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API (Indicator: "TlsFree"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API (Indicator: "TlsAlloc"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API (Indicator: "GetTempPathA"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API (Indicator: "InterlockedIncrement"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API (Indicator: "GetStdHandle"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API (Indicator: "LoadLibraryA"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API (Indicator: "OutputDebugStringA"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API (Indicator: "MoveFileA"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API (Indicator: "DeleteFileA"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API (Indicator: "CompareStringW"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API (Indicator: "DeleteCriticalSection"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API (Indicator: "GetConsoleOutputCP"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API (Indicator: "FindClose"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API (Indicator: "HeapReAlloc"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API (Indicator: "InitializeCriticalSection"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API (Indicator: "FreeLibrary"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API (Indicator: "CreateToolhelp32Snapshot"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API (Indicator: "ShellExecuteA"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API (Indicator: "GetWindowThreadProcessId"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API (Indicator: "CharNextA"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API (Indicator: "GetProcessWindowStation"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API (Indicator: "GetUserObjectInformationW"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API (Indicator: "GetShellWindow"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API (Indicator: "MessageBoxA"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API (Indicator: "InternetCloseHandle"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API (Indicator: "DeleteUrlCacheEntryA"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API (Indicator: "InternetOpenA"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API (Indicator: "InternetOpenUrlA"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API (Indicator: "InternetReadFile"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API (Indicator: "WSASetLastError"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API (Indicator: "gethostname"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API (Indicator: "getsockopt"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API (Indicator: "closesocket"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API (Indicator: "ioctlsocket"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API (Indicator: "htons"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API (Indicator: "WSAGetLastError"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API (Indicator: "ntohs"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API (Indicator: "WSAStartup"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API (Indicator: "getsockname"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API (Indicator: "getpeername"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API (Indicator: "__WSAFDIsSet"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API (Indicator: "recvfrom"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API (Indicator: "WSAIoctl"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API (Indicator: "WSACleanup"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API (Indicator: "EncodePointer"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API (Indicator: "DecodePointer"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API (Indicator: "FlsFree"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API (Indicator: "FlsSetValue"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API (Indicator: "FlsGetValue"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API (Indicator: "FlsAlloc"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API (Indicator: "GetUserObjectInformationA"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API (Indicator: "GetLastActivePopup"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API (Indicator: "GetActiveWindow"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API (Indicator: "NtQueryInformationProcess"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API (Indicator: "IsWow64Process"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API (Indicator: "Module32First"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API (Indicator: "NetStatisticsGet"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API (Indicator: "NetApiBufferFree"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API (Indicator: "CryptAcquireContextW"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API (Indicator: "CryptGenRandom"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API (Indicator: "CryptReleaseContext"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API (Indicator: "GetForegroundWindow"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API (Indicator: "GetCursorInfo"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API (Indicator: "Heap32First"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API (Indicator: "Heap32Next"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API (Indicator: "Heap32ListFirst"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API (Indicator: "Heap32ListNext"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API (Indicator: "Process32First"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API (Indicator: "Thread32First"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API (Indicator: "Thread32Next"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API (Indicator: "getservbyname"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API (Indicator: "gethostbyname"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API (Indicator: "EncodePointer"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found reference to API (Indicator: "DecodePointer"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found reference to API (Indicator: "FlsFree"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found reference to API (Indicator: "FlsSetValue"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found reference to API (Indicator: "FlsGetValue"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found reference to API (Indicator: "FlsAlloc"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found reference to API (Indicator: "GetProcessWindowStation"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found reference to API (Indicator: "GetUserObjectInformationA"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found reference to API (Indicator: "GetLastActivePopup"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found reference to API (Indicator: "GetActiveWindow"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found reference to API (Indicator: "MessageBoxA"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found reference to API (Indicator: "getservbyname"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found reference to API (Indicator: "gethostbyname"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found reference to API (Indicator: "ioctlsocket"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found reference to API (Indicator: "Module32First"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found reference to API (Indicator: "Thread32Next"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found reference to API (Indicator: "Thread32First"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found reference to API (Indicator: "Process32Next"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found reference to API (Indicator: "Process32First"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found reference to API (Indicator: "Heap32ListNext"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found reference to API (Indicator: "Heap32ListFirst"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found reference to API (Indicator: "Heap32Next"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found reference to API (Indicator: "Heap32First"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found reference to API (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found reference to API (Indicator: "GetCursorInfo"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found reference to API (Indicator: "GetForegroundWindow"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found reference to API (Indicator: "CryptReleaseContext"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found reference to API (Indicator: "CryptGenRandom"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found reference to API (Indicator: "CryptAcquireContextW"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found reference to API (Indicator: "NetApiBufferFree"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found reference to API (Indicator: "NetStatisticsGet"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found reference to API (Indicator: "WSAStartup"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found reference to API (Indicator: "IsWow64Process"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found reference to API (Indicator: "NtQueryInformationProcess"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found reference to API (Indicator: "GetComputerNameA"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found reference to API (Indicator: "GetEnvironmentVariableA"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found reference to API (Indicator: "CreateDirectoryA"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found reference to API (Indicator: "VirtualAlloc"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found reference to API (Indicator: "OutputDebugStringA"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found reference to API (Indicator: "GetTempPathA"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found reference to API (Indicator: "lstrlenA"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found reference to API (Indicator: "VerSetConditionMask"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found reference to API (Indicator: "GetWindowsDirectoryA"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found reference to API (Indicator: "OpenProcess"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleCP"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesA"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found reference to API (Indicator: "VerifyVersionInfoA"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found reference to API (Indicator: "FileTimeToSystemTime"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileA"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found reference to API (Indicator: "RemoveDirectoryA"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found reference to API (Indicator: "SetFileAttributesA"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found reference to API (Indicator: "MoveFileA"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found reference to API (Indicator: "FindNextFileA"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleA"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExA"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found reference to API (Indicator: "GetVersion"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found reference to API (Indicator: "DeleteFileA"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found reference to API (Indicator: "lstrcpyA"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found reference to API (Indicator: "GetShellWindow"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found reference to API (Indicator: "GetWindowThreadProcessId"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found reference to API (Indicator: "CharNextA"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found reference to API (Indicator: "GetUserNameA"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found reference to API (Indicator: "ShellExecuteA"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found reference to API (Indicator: "InternetOpenUrlA"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found reference to API (Indicator: "InternetReadFile"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found reference to API (Indicator: "DeleteUrlCacheEntryA"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found reference to API (Indicator: "InternetOpenA"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found reference to API (Indicator: "InternetCloseHandle"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found reference to API (Indicator: "WSAIoctl"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found reference to API (Indicator: "InterlockedIncrement"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found reference to API (Indicator: "InterlockedDecrement"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found reference to API (Indicator: "InterlockedExchange"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSection"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found reference to API (Indicator: "HeapReAlloc"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found reference to API (Indicator: "GetCommandLineA"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoA"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found reference to API (Indicator: "RtlUnwind"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found reference to API (Indicator: "GetCPInfo"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found reference to API (Indicator: "LCMapStringA"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found reference to API (Indicator: "LCMapStringW"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found reference to API (Indicator: "GetACP"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found reference to API (Indicator: "GetOEMCP"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found reference to API (Indicator: "IsValidCodePage"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found reference to API (Indicator: "TlsGetValue"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found reference to API (Indicator: "TlsAlloc"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found reference to API (Indicator: "TlsSetValue"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found reference to API (Indicator: "TlsFree"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found reference to API (Indicator: "SetHandleCount"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameA"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found reference to API (Indicator: "SetConsoleCtrlHandler"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found reference to API (Indicator: "HeapSize"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointer"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found reference to API (Indicator: "HeapCreate"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found reference to API (Indicator: "VirtualFree"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleMode"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found reference to API (Indicator: "FlushFileBuffers"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found reference to API (Indicator: "FreeEnvironmentStringsA"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found reference to API (Indicator: "GetEnvironmentStrings"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found reference to API (Indicator: "FreeEnvironmentStringsW"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found reference to API (Indicator: "GetEnvironmentStringsW"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found reference to API (Indicator: "GetStringTypeA"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found reference to API (Indicator: "GetStringTypeW"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found reference to API (Indicator: "GetLocaleInfoA"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found reference to API (Indicator: "CreateFileA"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found reference to API (Indicator: "SetStdHandle"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleA"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleOutputCP"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found reference to API (Indicator: "GetTimeZoneInformation"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found reference to API (Indicator: "SetEndOfFile"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found reference to API (Indicator: "CompareStringA"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found reference to API (Indicator: "CompareStringW"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found reference to API (Indicator: "SetEnvironmentVariableA"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found reference to API (Indicator: "SleepEx"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageA"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found reference to API (Indicator: "PeekNamedPipe"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found reference to API (Indicator: "WaitForMultipleObjects"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found reference to API (Indicator: "ExpandEnvironmentStringsA"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found reference to API (Indicator: "GlobalMemoryStatus"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found reference to API (Indicator: "FlushConsoleInputBuffer"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found reference to API (Indicator: "GetUserObjectInformationW"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found reference to API (Indicator: "DeregisterEventSource"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found reference to API (Indicator: "ExitThread"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found reference to API (Indicator: "FileTimeToLocalFileTime"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found reference to API (Indicator: "GetFileInformationByHandle"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found reference to API (Indicator: "GetDriveTypeA"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found reference to API (Indicator: "ReadConsoleInputA"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found reference to API (Indicator: "SetConsoleMode"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found reference to API (Indicator: "GetFullPathNameA"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentDirectoryA"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp")38:T8d1,"051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 76310000 "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 76310000 "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 76310000 "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll.exe" loaded module "KERNEL32" at base 75060000 "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll.exe" loaded module "KERNEL32.DLL" at base 75060000 "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll.exe" loaded module "RPCRT4.DLL" at base 77b20000 "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll.exe" loaded module "SSPICLI.DLL" at base 74660000 "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll.exe" loaded module "USER32.DLL" at base 74c40000 "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll.exe" loaded module "ONDEMANDCONNROUTEHELPER.DLL" at base 72ef0000 "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll.exe" loaded module "WINHTTP.DLL" at base 72e40000 "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll.exe" loaded module "%WINDIR%\SYSTEM32\ONDEMANDCONNROUTEHELPER.DLL" at base 72ef0000 "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 73360000 "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll.exe" loaded module "API-MS-WIN-CORE-PROCESSTHREADS-L1-1-2.DLL" at base 75060000 "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll.exe" loaded module "MSISO.DLL" at base 72dd0000 "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 72dc0000 "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 72d70000 "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll.exe" loaded module "%WINDIR%\SYSTEM32\WS2_32" at base 778c000039:Tcde,"051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: ""; Value: "") "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN\FEATURECONTROL\FEATURE_IGNORE_POLICIES_ZONEMAP_IF_ESC_ENABLED_KB918915"; Key: ""; Value: "") "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\MAIN\FEATURECONTROL\FEATURE_IGNORE_POLICIES_ZONEMAP_IF_ESC_ENABLED_KB918915"; Key: ""; Value: "") "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP\DOMAINS"; Key: ""; Value: "") "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP\DOMAINS\"; Key: ""; Value: "") "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll.exe" (Access type: "OPEN"; Path: "HKLM\ZONEMAP\RANGES\"; Key: ""; Value: "") "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll.exe" (Access type: "OPEN"; Path: "HKCU\ZONEMAP\RANGES\"; Key: ""; Value: "") "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN\FEATURECONTROL\FEATURE_ZONES_CHECK_ZONEMAP_POLICY_KB941001"; Key: ""; Value: "") "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\MAIN\FEATURECONTROL\FEATURE_ZONES_CHECK_ZONEMAP_POLICY_KB941001"; Key: ""; Value: "") "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: ""; Value: "") "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: ""; Value: "") "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP\"; Key: ""; Value: "") "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP\"; Key: ""; Value: "") "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\INTERNET EXPLORER"; Key: ""; Value: "") "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\INTERNET EXPLORER\SECURITY"; Key: ""; Value: "") "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SECURITY"; Key: ""; Value: "")3a:T1092,"051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "SECURITY_HKLM_ONLY"; Value: "") "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SECURITY"; Key: "DISABLESECURITYSETTINGSCHECK"; Value: "") "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\SETUP"; Key: "SYSTEMSETUPINPROGRESS"; Value: "") "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONES\0"; Key: "FLAGS"; Value: "") "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONES\1"; Key: "FLAGS"; Value: "") "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONES\2"; Key: "FLAGS"; Value: "") "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONES\3"; Key: "FLAGS"; Value: "") "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONES\4"; Key: "FLAGS"; Value: "") "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN\FEATURECONTROL\FEATURE_LOCALMACHINE_LOCKDOWN"; Key: "051463A14767C6477B6DACD639F30A8A5B9E126FF31532B58FC29C8364604D00.DLL.EXE"; Value: "") "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN\FEATURECONTROL\FEATURE_LOCALMACHINE_LOCKDOWN"; Key: "*"; Value: "") "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\MAIN\FEATURECONTROL\FEATURE_LOCALMACHINE_LOCKDOWN"; Key: "051463A14767C6477B6DACD639F30A8A5B9E126FF31532B58FC29C8364604D00.DLL.EXE"; Value: "") "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\MAIN\FEATURECONTROL\FEATURE_LOCALMACHINE_LOCKDOWN"; Key: "*"; Value: "") "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "CREATEURICACHESIZE"; Value: "") "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "CREATEURICACHESIZE"; Value: "") "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "CREATEURICACHESIZE"; Value: "") "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "CREATEURICACHESIZE"; Value: "") "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "ENABLEPUNYCODE"; Value: "") "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "ENABLEPUNYCODE"; Value: "") "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "ENABLEPUNYCODE"; Value: "")3b:T5bd,"051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll.exe" trying to touch file "C:\Windows\System32\WOW64LOG.DLL" "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll.exe" trying to touch file "C:\Windows\SysWOW64\apphelp.dll" "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll.exe" trying to touch file "C:\051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll.exe" "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll.exe" trying to touch file "C:\Windows\SysWOW64\ntdll.dll" "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll.exe" trying to touch file "C:\Windows\SysWOW64\kernel32.dll" "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll.exe" trying to touch file "C:\Windows\SysWOW64\KernelBase.dll" "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll.exe" trying to touch file "C:\Windows\apppatch\sysmain.sdb" "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll.exe" trying to touch file "C:\WININET.DLL" "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll.exe" trying to touch file "C:\Windows\SysWOW64\wininet.dll" "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll.exe" trying to touch file "C:\Windows\SysWOW64\win32u.dll" "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll.exe" trying to touch file "C:\Windows\SysWOW64\ucrtbase.dll"3c:T50d,"051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll.exe" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL" "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll.exe" trying to access non-existent file "C:\WININET.DLL" "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll.exe" trying to access non-existent file "C:\FLTLIB.DLL" "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll.exe" trying to access non-existent file "C:\CRYPTSP.DLL" "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll.exe" trying to access non-existent file "C:\IERTUTIL.DLL" "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll.exe" trying to access non-existent file "C:\iertutil.dll" "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll.exe" trying to access non-existent file "C:\URLMON.DLL" "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll.exe" trying to access non-existent file "C:\urlmon.dll" "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll.exe" trying to access non-existent file "C:\BCRYPT.DLL" "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll.exe" trying to access non-existent file "C:\bcrypt.dll"3d:T116f,Found reference to API "InternetOpenA" (Indicator: "InternetOpen"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API "InternetOpenUrlA" (Indicator: "InternetOpen"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API "InternetReadFile" (Indicator: "InternetReadFile"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API "WSAStartup" (Indicator: "WSAStartup"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API "WSAStartup failed (%d)" (Indicator: "WSAStartup"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API "83417506212,5172,3236,,InternetReadFile,Wininet.dll,"00:51:43.078",RX=0,PX=0" (Indicator: "InternetReadFile"; Source: "00000000-00005544.00000001.198597.02710000.00000004.mdmp") Found reference to API "155275572778,5172,3236,,InternetReadFile,Wininet.dll,"00:52:13.015",RX=0,PX=0" (Indicator: "InternetReadFile"; Source: "00000000-00005544.00000002.200517.02710000.00000004.mdmp") Found reference to API "155402953358,5172,3236,,InternetReadFile,Wininet.dll,"00:52:13.062",RX=0,PX=0" (Indicator: "InternetReadFile"; Source: "00000000-00005544.00000002.200517.02710000.00000004.mdmp") Found reference to API "155275159922,5172,3236,,InternetReadFile,Wininet.dll,"00:52:13.015",RX=0,PX=0" (Indicator: "InternetReadFile"; Source: "00000000-00005544.00000002.200517.02710000.00000004.mdmp") Found reference to API "154817291226,5172,3236,,InternetReadFile,Wininet.dll,"00:52:12.828",RX=0,PX=0" (Indicator: "InternetReadFile"; Source: "00000000-00005544.00000002.200517.02710000.00000004.mdmp") Found reference to API "154853006829,5172,3228,,InternetOpenA,Wininet.dll,"00:52:12.843",RX=0,PX=0" (Indicator: "InternetOpen"; Source: "00000000-00005544.00000002.200517.02710000.00000004.mdmp") Found reference to API "155403359390,5172,3236,,InternetReadFile,Wininet.dll,"00:52:13.062",RX=0,PX=0" (Indicator: "InternetReadFile"; Source: "00000000-00005544.00000002.200517.02710000.00000004.mdmp") Found reference to API "155097862571,5172,3236,,InternetReadFile,Wininet.dll,"00:52:12.937",RX=0,PX=0" (Indicator: "InternetReadFile"; Source: "00000000-00005544.00000002.200517.02710000.00000004.mdmp") Found reference to API "154817716438,5172,3236,,InternetReadFile,Wininet.dll,"00:52:12.828",RX=0,PX=0" (Indicator: "InternetReadFile"; Source: "00000000-00005544.00000002.200517.02710000.00000004.mdmp") Found reference to API "153615922652,5172,3228,,InternetOpenA,Wininet.dll,"00:52:12.328",RX=0,PX=0" (Indicator: "InternetOpen"; Source: "00000000-00005544.00000002.200517.02710000.00000004.mdmp") Found reference to API "155098338409,5172,3236,,InternetReadFile,Wininet.dll,"00:52:12.937",RX=0,PX=0" (Indicator: "InternetReadFile"; Source: "00000000-00005544.00000002.200517.02710000.00000004.mdmp") Found reference to API "154365523447,5172,3228,,InternetOpenA,Wininet.dll,"00:52:12.640",RX=0,PX=0" (Indicator: "InternetOpen"; Source: "00000000-00005544.00000002.200517.02710000.00000004.mdmp") Found reference to API "155153243892,5172,3228,,InternetOpenA,Wininet.dll,"00:52:12.968",RX=0,PX=0" (Indicator: "InternetOpen"; Source: "00000000-00005544.00000002.200517.02710000.00000004.mdmp") Found reference to API "154689869156,5172,3236,,InternetReadFile,Wininet.dll,"00:52:12.765",RX=0,PX=0" (Indicator: "InternetReadFile"; Source: "00000000-00005544.00000002.200517.02710000.00000004.mdmp") Found reference to API "154976354849,5172,3236,,InternetReadFile,Wininet.dll,"00:52:12.890",RX=0,PX=0" (Indicator: "InternetReadFile"; Source: "00000000-00005544.00000002.200517.02710000.00000004.mdmp") Found reference to API "WSAStartup failed (%d)" (Indicator: "WSAStartup"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found reference to API "WSAStartup" (Indicator: "WSAStartup"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found reference to API "InternetOpenUrlA" (Indicator: "InternetOpen"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found reference to API "InternetReadFile" (Indicator: "InternetReadFile"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found reference to API "InternetOpenA" (Indicator: "InternetOpen"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp")3e:T1049,Found reference to API "InternetReadFile" (Indicator: "InternetReadFile"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API "83417506212,5172,3236,,InternetReadFile,Wininet.dll,"00:51:43.078",RX=0,PX=0" (Indicator: "InternetReadFile"; Source: "00000000-00005544.00000001.198597.02710000.00000004.mdmp") Found reference to API "155275572778,5172,3236,,InternetReadFile,Wininet.dll,"00:52:13.015",RX=0,PX=0" (Indicator: "InternetReadFile"; Source: "00000000-00005544.00000002.200517.02710000.00000004.mdmp") Found reference to API "155402953358,5172,3236,,InternetReadFile,Wininet.dll,"00:52:13.062",RX=0,PX=0" (Indicator: "InternetReadFile"; Source: "00000000-00005544.00000002.200517.02710000.00000004.mdmp") Found reference to API "155275159922,5172,3236,,InternetReadFile,Wininet.dll,"00:52:13.015",RX=0,PX=0" (Indicator: "InternetReadFile"; Source: "00000000-00005544.00000002.200517.02710000.00000004.mdmp") Found reference to API "154817291226,5172,3236,,InternetReadFile,Wininet.dll,"00:52:12.828",RX=0,PX=0" (Indicator: "InternetReadFile"; Source: "00000000-00005544.00000002.200517.02710000.00000004.mdmp") Found reference to API "155403359390,5172,3236,,InternetReadFile,Wininet.dll,"00:52:13.062",RX=0,PX=0" (Indicator: "InternetReadFile"; Source: "00000000-00005544.00000002.200517.02710000.00000004.mdmp") Found reference to API "155097862571,5172,3236,,InternetReadFile,Wininet.dll,"00:52:12.937",RX=0,PX=0" (Indicator: "InternetReadFile"; Source: "00000000-00005544.00000002.200517.02710000.00000004.mdmp") Found reference to API "154817716438,5172,3236,,InternetReadFile,Wininet.dll,"00:52:12.828",RX=0,PX=0" (Indicator: "InternetReadFile"; Source: "00000000-00005544.00000002.200517.02710000.00000004.mdmp") Found reference to API "155098338409,5172,3236,,InternetReadFile,Wininet.dll,"00:52:12.937",RX=0,PX=0" (Indicator: "InternetReadFile"; Source: "00000000-00005544.00000002.200517.02710000.00000004.mdmp") Found reference to API "154689869156,5172,3236,,InternetReadFile,Wininet.dll,"00:52:12.765",RX=0,PX=0" (Indicator: "InternetReadFile"; Source: "00000000-00005544.00000002.200517.02710000.00000004.mdmp") Found reference to API "154976354849,5172,3236,,InternetReadFile,Wininet.dll,"00:52:12.890",RX=0,PX=0" (Indicator: "InternetReadFile"; Source: "00000000-00005544.00000002.200517.02710000.00000004.mdmp") Found reference to API "InternetReadFile" (Indicator: "InternetReadFile"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found reference to API "433904966352,5172,3236,,InternetReadFile,Wininet.dll,"00:54:09.109",RX=0,PX=0" (Indicator: "InternetReadFile"; Source: "00000000-00005544.00000003.207944.02710000.00000004.mdmp") Found reference to API "429442801712,5172,3236,,InternetReadFile,Wininet.dll,"00:54:07.250",RX=0,PX=0" (Indicator: "InternetReadFile"; Source: "00000000-00005544.00000003.207944.02710000.00000004.mdmp") Found reference to API "433791519824,5172,3236,,InternetReadFile,Wininet.dll,"00:54:09.062",RX=0,PX=0" (Indicator: "InternetReadFile"; Source: "00000000-00005544.00000003.207944.02710000.00000004.mdmp") Found reference to API "433683635803,5172,3236,,InternetReadFile,Wininet.dll,"00:54:09.015",RX=0,PX=0" (Indicator: "InternetReadFile"; Source: "00000000-00005544.00000003.207944.02710000.00000004.mdmp") Found reference to API "433905055376,5172,3236,,InternetReadFile,Wininet.dll,"00:54:09.109",RX=0,PX=0" (Indicator: "InternetReadFile"; Source: "00000000-00005544.00000003.207944.02710000.00000004.mdmp") Found reference to API "432113894362,5172,3236,,InternetReadFile,Wininet.dll,"00:54:08.359",RX=0,PX=0" (Indicator: "InternetReadFile"; Source: "00000000-00005544.00000003.207944.02710000.00000004.mdmp") Found reference to API "433346900909,5172,3236,,InternetReadFile,Wininet.dll,"00:54:08.875",RX=0,PX=0" (Indicator: "InternetReadFile"; Source: "00000000-00005544.00000003.207944.02710000.00000004.mdmp") Found reference to API "433465605571,5172,3236,,InternetReadFile,Wininet.dll,"00:54:08.921",RX=0,PX=0" (Indicator: "InternetReadFile"; Source: "00000000-00005544.00000003.207944.02710000.00000004.mdmp")3f:T9ea,Found reference to API "InternetOpenA" (Indicator: "InternetOpen"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API "InternetOpenUrlA" (Indicator: "InternetOpen"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API "154853006829,5172,3228,,InternetOpenA,Wininet.dll,"00:52:12.843",RX=0,PX=0" (Indicator: "InternetOpen"; Source: "00000000-00005544.00000002.200517.02710000.00000004.mdmp") Found reference to API "153615922652,5172,3228,,InternetOpenA,Wininet.dll,"00:52:12.328",RX=0,PX=0" (Indicator: "InternetOpen"; Source: "00000000-00005544.00000002.200517.02710000.00000004.mdmp") Found reference to API "154365523447,5172,3228,,InternetOpenA,Wininet.dll,"00:52:12.640",RX=0,PX=0" (Indicator: "InternetOpen"; Source: "00000000-00005544.00000002.200517.02710000.00000004.mdmp") Found reference to API "155153243892,5172,3228,,InternetOpenA,Wininet.dll,"00:52:12.968",RX=0,PX=0" (Indicator: "InternetOpen"; Source: "00000000-00005544.00000002.200517.02710000.00000004.mdmp") Found reference to API "InternetOpenUrlA" (Indicator: "InternetOpen"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found reference to API "InternetOpenA" (Indicator: "InternetOpen"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found reference to API "433740837565,5172,3228,,InternetOpenA,Wininet.dll,"00:54:09.046",RX=0,PX=0" (Indicator: "InternetOpen"; Source: "00000000-00005544.00000003.207944.02710000.00000004.mdmp") Found reference to API "433628403167,5172,3228,,InternetOpenA,Wininet.dll,"00:54:09.000",RX=0,PX=0" (Indicator: "InternetOpen"; Source: "00000000-00005544.00000003.207944.02710000.00000004.mdmp") Found reference to API "433403851062,5172,3228,,InternetOpenA,Wininet.dll,"00:54:08.906",RX=0,PX=0" (Indicator: "InternetOpen"; Source: "00000000-00005544.00000003.207944.02710000.00000004.mdmp") Found reference to API "433103535328,5172,3228,,InternetOpenA,Wininet.dll,"00:54:08.781",RX=0,PX=0" (Indicator: "InternetOpen"; Source: "00000000-00005544.00000003.207944.02710000.00000004.mdmp") Found reference to API "432878715368,5172,3228,,InternetOpenA,Wininet.dll,"00:54:08.687",RX=0,PX=0" (Indicator: "InternetOpen"; Source: "00000000-00005544.00000003.207944.02710000.00000004.mdmp") Found reference to API "433853498953,5172,3228,,InternetOpenA,Wininet.dll,"00:54:09.093",RX=0,PX=0" (Indicator: "InternetOpen"; Source: "00000000-00005544.00000003.207944.02710000.00000004.mdmp")40:T115f,Found reference to API "gethostname" (Indicator: "gethostname"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API "WSAGetLastError" (Indicator: "wsagetlasterror"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API "WSAStartup" (Indicator: "wsastartup"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API "__WSAFDIsSet" (Indicator: "__wsafdisset"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API "WSACleanup" (Indicator: "wsacleanup"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API "Couldn't bind to '%s'" (Indicator: " bind "; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API "Couldn't bind to interface '%s'" (Indicator: " bind "; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API "Immediate connect fail for %s: %s" (Indicator: " connect "; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API "Failed to connect to %s port %ld: %s" (Indicator: " connect "; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API "After %ldms connect time, move on!" (Indicator: " connect "; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API "SSL connect error" (Indicator: " connect "; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API "FTP: The server did not accept the PRET command." (Indicator: " accept "; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API "FTP: Accepting server connect has timed out" (Indicator: " connect "; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API "FTP: The server failed to connect to data port" (Indicator: " connect "; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API "Couldn't connect to server" (Indicator: " connect "; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API "SSL shutdown timeout" (Indicator: " shutdown "; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API "SOCKS4 connect to %s (locally resolved)" (Indicator: " connect "; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API "Failed to send SOCKS4 connect request." (Indicator: " connect "; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API "Failed to send SOCKS4 connect request." (Indicator: " send "; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API "Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), request rejected because SOCKS server cannot connect to identd on the client." (Indicator: " connect "; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API "Failed to receive SOCKS4 connect request ack." (Indicator: " connect "; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API "Failed to receive SOCKS5 connect request ack." (Indicator: " connect "; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API "Failed to send SOCKS5 connect request." (Indicator: " connect "; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API "Failed to send SOCKS5 connect request." (Indicator: " send "; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API "Failed to send SOCKS5 sub-negotiation request." (Indicator: " send "; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API "Unable to send initial SOCKS5 request." (Indicator: " send "; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API "Failed sending CONNECT to proxy" (Indicator: " connect "; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll")41:T9ca,Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00005544.00000000.196677.02710000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00005544.00000001.198597.02710000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00005544.00000002.200517.02710000.00000004.mdmp") Found URL "http://www.winimage.com/zlibdll" - Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found URL "https://curl.haxx.se/docs/http-cookies.html" - Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found URL "ftp://%s:%s@%scontent-range:" - Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found URL "ftp://transfer-encoding:" - Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found URL "http://www.openssl.org/support/faq.html....................lhash" - Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found URL "http://https://target_screen_name=target_id=since_id=trim_user=trueinclude_rts=truecount=cursor=skip_status=include_entities=stringify_ids=in_reply_to_status_id=api.twitter.com/1.1/search/tweetsstatuses/updatestatuses/show/statuses/destroy/statuses/retweet/statuses/home_timelinestatuses/public_timelinestatuses/featuredstatuses/friends_timelinestatuses/mentions_timelinestatuses/user_timelineusers/lookupusers/showstatuses/friendsstatuses/followersdirect_messagesdirect_messages/newdirect_messages/sentdirect_messages/destroy/friendships/createfriendships/destroyfriendships/showfriends/idsfollowers/idsaccount/rate_limit_statusaccount/verify_credentialsfavoritesfavorites/create/favorites/destroy/blocks/create/blocks/destroy/blocks/listblocks/idssaved_searchessaved_searches/show/saved_searches/createsaved_searches/destroy/trendstrends/dailytrends/currenttrends/weeklytrends/availableoauth_consumer_keyoauth_callbackoauth_versionoauth_signature_methodoauth_signatureoauth_timestampoauth_nonceoauth_tokenoauth_token_secretoauth_verifierscreen_nameauthenticity_tokensession[username_or_email]session[password]authenticity_token" - Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found URL "https://www.amazon.com/men-war-pc/dp/b001qzgvec/esoftteam/watchcom.jpghttp://www.hulu.com/watch/559035/episode3.mp4openntqueryinformationprocessntdll.dll0123456789abcdefinit<%s>%s%s%sdatainfoexpect:strongstargetlastwebresponse" - Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp")42:Te23,Found string "HTTP/1.0 proxy connection set to keep alive!" (Indicator: "HTTP/1.0"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found string "HTTP/1.1 proxy connection set close!" (Indicator: "HTTP/1.1"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found string "HTTP/1.0 connection set to keep alive!" (Indicator: "HTTP/1.0"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found string "GET /watch/559035/episode3.mp4 HTTP/1.1" (Indicator: "HTTP/1.1"; Source: "00000000-00005544.00000000.196677.02710000.00000004.mdmp, 00000000-00005544.00000001.198597.02710000.00000004.mdmp, 00000000-00005544.00000002.200517.02710000.00000004.mdmp, 00000000-00005544.00000003.207944.02710000.00000004.mdmp") Found string "9035/episode3.mp4 HTTP/1.1" (Indicator: "HTTP/1.1"; Source: "00000000-00005544.00000000.196677.02710000.00000004.mdmp, 00000000-00005544.00000001.198597.02710000.00000004.mdmp, 00000000-00005544.00000003.207944.02710000.00000004.mdmp") Found string "Hostwww.hulu.comGET /watch/559035/episode3.mp4 HTTP/1.1" (Indicator: "HTTP/1.1"; Source: "00000000-00005544.00000000.196677.02710000.00000004.mdmp, 00000000-00005544.00000001.198597.02710000.00000004.mdmp, 00000000-00005544.00000002.200517.02710000.00000004.mdmp, 00000000-00005544.00000003.207944.02710000.00000004.mdmp") Found string "GET /watch/559035/episode3.mp4 HTTP/1.1o" (Indicator: "HTTP/1.1"; Source: "00000000-00005544.00000001.198597.02710000.00000004.mdmp") Found string "HTTP/1.1 406 Not AcceptableC" (Indicator: "HTTP/1.1"; Source: "00000000-00005544.00000001.198597.02710000.00000004.mdmp") Found string "HTTP/1.1 406 Not Acceptable" (Indicator: "HTTP/1.1"; Source: "00000000-00005544.00000002.200517.02710000.00000004.mdmp, 00000000-00005544.00000003.207944.02710000.00000004.mdmp") Found string "GET /watch/559035/episode3.mp4 HTTP/1.1/" (Indicator: "HTTP/1.1"; Source: "00000000-00005544.00000002.200517.02710000.00000004.mdmp") Found string "HTTP/1.1 406 Not Acceptable+" (Indicator: "HTTP/1.1"; Source: "00000000-00005544.00000002.200517.02710000.00000004.mdmp") Found string "GET /watch/559035/episode3.mp4 HTTP/1.1?" (Indicator: "HTTP/1.1"; Source: "00000000-00005544.00000002.200517.02710000.00000004.mdmp, 00000000-00005544.00000003.207944.02710000.00000004.mdmp") Found string "HTTP/1.1 406 Not Acceptable;" (Indicator: "HTTP/1.1"; Source: "00000000-00005544.00000002.200517.02710000.00000004.mdmp, 00000000-00005544.00000003.207944.02710000.00000004.mdmp") Found string "HTTP/1.1 406 Not AcceptableC.x" (Indicator: "HTTP/1.1"; Source: "00000000-00005544.00000002.200517.02710000.00000004.mdmp, 00000000-00005544.00000003.207944.02710000.00000004.mdmp") Found string "HTTP/1.0 connection set to keep alive!" (Indicator: "HTTP/1.0"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found string "HTTP/1.1 proxy connection set close!" (Indicator: "HTTP/1.1"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found string "HTTP/1.0 proxy connection set to keep alive!" (Indicator: "HTTP/1.0"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found string "HTTP/1.1 406 Not Acceptable#" (Indicator: "HTTP/1.1"; Source: "00000000-00005544.00000003.207944.02710000.00000004.mdmp") Found string "GET /watch/559035/episode3.mp4 HTTP/1.17" (Indicator: "HTTP/1.1"; Source: "00000000-00005544.00000003.207944.02710000.00000004.mdmp") Found string "HTTP/1.1 406 Not AcceptableK?x" (Indicator: "HTTP/1.1"; Source: "00000000-00005544.00000003.207944.02710000.00000004.mdmp")43:T86a,Observed string: "SHA-256 part of OpenSSL 1.0.1t 3 May 2016" (Indicator: "OpenSSL 1.") Observed string: "SHA1 part of OpenSSL 1.0.1t 3 May 2016" (Indicator: "OpenSSL 1.") Observed string: "OpenSSL 1.0.1t 3 May 2016" (Indicator: "OpenSSL 1.") Observed string: "ASN.1 part of OpenSSL 1.0.1t 3 May 2016" (Indicator: "OpenSSL 1.") Observed string: "Stack part of OpenSSL 1.0.1t 3 May 2016" (Indicator: "OpenSSL 1.") Observed string: "Big Number part of OpenSSL 1.0.1t 3 May 2016" (Indicator: "OpenSSL 1.") Observed string: "MD5 part of OpenSSL 1.0.1t 3 May 2016" (Indicator: "OpenSSL 1.") Observed string: "RAND part of OpenSSL 1.0.1t 3 May 2016" (Indicator: "OpenSSL 1.") Observed string: "lhash part of OpenSSL 1.0.1t 3 May 2016" (Indicator: "OpenSSL 1.") Observed string: "Diffie-Hellman part of OpenSSL 1.0.1t 3 May 2016" (Indicator: "OpenSSL 1.") Observed string: "EVP part of OpenSSL 1.0.1t 3 May 2016" (Indicator: "OpenSSL 1.") Observed string: "RSA part of OpenSSL 1.0.1t 3 May 2016" (Indicator: "OpenSSL 1.") Observed string: "DSA part of OpenSSL 1.0.1t 3 May 2016" (Indicator: "OpenSSL 1.") Observed string: "CONF part of OpenSSL 1.0.1t 3 May 2016" (Indicator: "OpenSSL 1.") Observed string: "PEM part of OpenSSL 1.0.1t 3 May 2016" (Indicator: "OpenSSL 1.") Observed string: "TLSv1 part of OpenSSL 1.0.1t 3 May 2016" (Indicator: "OpenSSL 1.") Observed string: "X.509 part of OpenSSL 1.0.1t 3 May 2016" (Indicator: "OpenSSL 1.") Observed string: "SSLv3 part of OpenSSL 1.0.1t 3 May 2016" (Indicator: "OpenSSL 1.") Observed string: "EC part of OpenSSL 1.0.1t 3 May 2016" (Indicator: "OpenSSL 1.") Observed string: "libdes part of OpenSSL 1.0.1t 3 May 2016" (Indicator: "OpenSSL 1.") Observed string: "DES part of OpenSSL 1.0.1t 3 May 2016" (Indicator: "OpenSSL 1.") Observed string: "MD4 part of OpenSSL 1.0.1t 3 May 2016" (Indicator: "OpenSSL 1.") Observed string: "SHA-512 part of OpenSSL 1.0.1t 3 May 2016" (Indicator: "OpenSSL 1.") Observed string: "AES part of OpenSSL 1.0.1t 3 May 2016" (Indicator: "OpenSSL 1.") Observed string: "RC2 part of OpenSSL 1.0.1t 3 May 2016" (Indicator: "OpenSSL 1.")44:Tc95,Found string "libcurl/7.48.0" (Indicator: "libcurl"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found string "Protocol "%s" not supported or disabled in libcurl" (Indicator: "libcurl"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found string "## Fatal libcurl error" (Indicator: "libcurl"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found string "# Netscape HTTP Cookie File# https://curl.haxx.se/docs/http-cookies.html# This file was generated by libcurl! Edit at your own risk." (Indicator: "libcurl"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found string "An unknown option was passed in to libcurl" (Indicator: "libcurl"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found string "A libcurl function was given a bad argument" (Indicator: "libcurl"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found string "A requested feature, protocol or option was not found built-in in this libcurl due to a build-time decision." (Indicator: "libcurl"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found string "libcurl is now using a weak random seed!" (Indicator: "libcurl"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found string "CLIENT libcurl 7.48.0%sQUIT" (Indicator: "libcurl"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found string "CLIENT libcurl 7.48.0DEFINE %s %sQUIT" (Indicator: "libcurl"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found string "CLIENT libcurl 7.48.0MATCH %s %s %sQUIT" (Indicator: "libcurl"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found string "libcurl/7.48.0" (Indicator: "libcurl"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found string "Protocol "%s" not supported or disabled in libcurl" (Indicator: "libcurl"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found string "# Fatal libcurl error" (Indicator: "libcurl"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found string "# This file was generated by libcurl! Edit at your own risk." (Indicator: "libcurl"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found string "An unknown option was passed in to libcurl" (Indicator: "libcurl"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found string "A libcurl function was given a bad argument" (Indicator: "libcurl"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found string "A requested feature, protocol or option was not found built-in in this libcurl due to a build-time decision." (Indicator: "libcurl"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found string "libcurl is now using a weak random seed!" (Indicator: "libcurl"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found string "CLIENT libcurl 7.48.0" (Indicator: "libcurl"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp")45:T10e1,Found string "AES for Intel AES-NI, CRYPTOGAMS by " (Indicator: "aes"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found string "P~AeS~AeS" (Indicator: "aes"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found string "AES for x86, CRYPTOGAMS by " (Indicator: "aes"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found string "Vector Permutation AES for x86/SSSE3, Mike Hamburg (Stanford University)" (Indicator: "aes"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found string "blowfish" (Indicator: "blowfish"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found string "CAST5-CBC" (Indicator: "cast5"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found string "AES-128-CBC" (Indicator: "aes"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found string "AES128" (Indicator: "aes"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found string "AES128" (Indicator: "aes128"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found string "aes128" (Indicator: "aes"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found string "aes128" (Indicator: "aes128"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found string "AES-192-CBC" (Indicator: "aes"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found string "AES192" (Indicator: "aes"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found string "AES192" (Indicator: "aes192"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found string "aes192" (Indicator: "aes"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found string "aes192" (Indicator: "aes192"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found string "AES-256-CBC" (Indicator: "aes"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found string "AES256" (Indicator: "aes"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found string "AES256" (Indicator: "aes256"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found string "aes256" (Indicator: "aes"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found string "aes256" (Indicator: "aes256"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found string "id-aes128-GCM" (Indicator: "aes"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found string "id-aes128-GCM" (Indicator: "aes128"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found string "id-aes256-GCM" (Indicator: "aes"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found string "id-aes256-GCM" (Indicator: "aes256"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found string ".\crypto\ecdsa\ecs_lib.c" (Indicator: "ecdsa"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found string ".\crypto\ecdsa\ecs_ossl.c" (Indicator: "ecdsa"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found string "AES-128-CBC-HMAC-SHA1" (Indicator: "aes"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found string "AES-256-CBC-HMAC-SHA1" (Indicator: "aes"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found string ".\crypto\evp\e_aes.c" (Indicator: "aes"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found string "ECDSA-Parameters" (Indicator: "ecdsa"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found string "ecdsa" (Indicator: "ecdsa"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found string "Diffie-Hellman routines" (Indicator: "diffie-hellman"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll")46:Tac3,Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00005544.00000000.196677.02710000.00000004.mdmp, 00000000-00005544.00000001.198597.02710000.00000004.mdmp, 00000000-00005544.00000002.200517.02710000.00000004.mdmp, 00000000-00005544.00000003.207944.02710000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00005544.00000000.196677.02710000.00000004.mdmp, 00000000-00005544.00000001.198597.02710000.00000004.mdmp, 00000000-00005544.00000002.200517.02710000.00000004.mdmp, 00000000-00005544.00000003.207944.02710000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00005544.00000000.196677.02710000.00000004.mdmp, 00000000-00005544.00000001.198597.02710000.00000004.mdmp, 00000000-00005544.00000002.200517.02710000.00000004.mdmp, 00000000-00005544.00000003.207944.02710000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00005544.00000000.196677.02710000.00000004.mdmp, 00000000-00005544.00000001.198597.02710000.00000004.mdmp, 00000000-00005544.00000002.200517.02710000.00000004.mdmp, 00000000-00005544.00000003.207944.02710000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00005544.00000000.196677.02710000.00000004.mdmp, 00000000-00005544.00000001.198597.02710000.00000004.mdmp, 00000000-00005544.00000002.200517.02710000.00000004.mdmp, 00000000-00005544.00000003.207944.02710000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00005544.00000000.196677.02710000.00000004.mdmp, 00000000-00005544.00000001.198597.02710000.00000004.mdmp, 00000000-00005544.00000002.200517.02710000.00000004.mdmp, 00000000-00005544.00000003.207944.02710000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00005544.00000000.196677.02710000.00000004.mdmp, 00000000-00005544.00000001.198597.02710000.00000004.mdmp, 00000000-00005544.00000002.200517.02710000.00000004.mdmp, 00000000-00005544.00000003.207944.02710000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00005544.00000000.196677.02710000.00000004.mdmp, 00000000-00005544.00000001.198597.02710000.00000004.mdmp, 00000000-00005544.00000002.200517.02710000.00000004.mdmp, 00000000-00005544.00000003.207944.02710000.00000004.mdmp")47:Te90,Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API "GetEnvironmentStrings" (Indicator: "GetEnvironmentStrings"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API "Process32Next" (Indicator: "Process32Next"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API "NtQueryInformationProcess" (Indicator: "QueryInformationProcess"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API "Module32First" (Indicator: "Module32First"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API "Process32First" (Indicator: "Process32First"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API "Thread32First" (Indicator: "Thread32First"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API "Thread32Next" (Indicator: "Thread32Next"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API "@Module32Next" (Indicator: "Module32Next"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API "@Module32Next" (Indicator: "Module32Next"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found reference to API "Module32First" (Indicator: "Module32First"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found reference to API "Thread32Next" (Indicator: "Thread32Next"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found reference to API "Thread32First" (Indicator: "Thread32First"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found reference to API "Process32Next" (Indicator: "Process32Next"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found reference to API "Process32First" (Indicator: "Process32First"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found reference to API "NtQueryInformationProcess" (Indicator: "QueryInformationProcess"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp")48:T4c8,Found reference to API "GetCurrentDirectoryA" (Indicator: "GetCurrentDirectory"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API "GetFileInformationByHandle" (Indicator: "GetFileInformationByHandle"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found reference to API "GetFileInformationByHandle" (Indicator: "GetFileInformationByHandle"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found reference to API "GetCurrentDirectoryA" (Indicator: "GetCurrentDirectory"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp")49:T638,Found reference to API "GetUserNameA" (Indicator: "GetUserName"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API "GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API "GetUserObjectInformationW" (Indicator: "GetUserObjectInformation"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API "GetUserObjectInformationA" (Indicator: "GetUserObjectInformation"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API "NtQueryInformationProcess" (Indicator: "NtQueryInformationProcess"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found reference to API "GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found reference to API "GetUserObjectInformationA" (Indicator: "GetUserObjectInformation"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found reference to API "NtQueryInformationProcess" (Indicator: "NtQueryInformationProcess"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found reference to API "GetUserNameA" (Indicator: "GetUserName"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found reference to API "GetUserObjectInformationW" (Indicator: "GetUserObjectInformation"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp")4a:T108c,Found string "ssl_mac_secret_size[SSL_MD_MD5_IDX] >= 0" (Indicator: "secret"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found string "ssl_mac_secret_size[SSL_MD_SHA1_IDX] >= 0" (Indicator: "secret"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found string "ssl_mac_secret_size[SSL_MD_GOST94_IDX] >= 0" (Indicator: "secret"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found string "password" (Indicator: "password"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found string "No authentication method was acceptable. (It is quite likely that the SOCKS5 server wanted a username/password, since none was supplied to the server on this connection.)" (Indicator: "password"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found string "mac_secret_length <= sizeof(hmac_pad)" (Indicator: "secret"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found string "master secret" (Indicator: "secret"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found string "password based MAC" (Indicator: "password"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found string "secretary" (Indicator: "secret"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found string "secretBag" (Indicator: "secret"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found string "ssl3_generate_master_secret" (Indicator: "secret"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found string "no password" (Indicator: "password"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found string "CMS_RecipientInfo_set0_password" (Indicator: "password"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found string "CMS_decrypt_set1_password" (Indicator: "password"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found string "CMS_add0_recipient_password" (Indicator: "password"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found string "bad password read" (Indicator: "password"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found string "problems getting password" (Indicator: "password"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found string "oauth_token_secret" (Indicator: "secret"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found string "session[password]" (Indicator: "password"; File: "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll") Found string "oauth_token_secret" (Indicator: "secret"; Source: "00000000-00005544.00000000.196677.04550000.00000004.mdmp, 00000000-00005544.00000001.198597.04550000.00000004.mdmp, 00000000-00005544.00000002.200517.04550000.00000004.mdmp, 00000000-00005544.00000003.207944.0024D000.00000002.mdmp, 00000000-00005544.00000003.207944.04550000.00000004.mdmp") Found string "session[password]" (Indicator: "password"; Source: "00000000-00005544.00000000.196677.04550000.00000004.mdmp, 00000000-00005544.00000001.198597.04550000.00000004.mdmp, 00000000-00005544.00000002.200517.04550000.00000004.mdmp, 00000000-00005544.00000003.207944.0024D000.00000002.mdmp, 00000000-00005544.00000003.207944.04550000.00000004.mdmp") Found string "No authentication method was acceptable. (It is quite likely that the SOCKS5 server wanted a username/password, since none was supplied to the server on this connection.)" (Indicator: "password"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found string "password" (Indicator: "password"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found string "ssl_mac_secret_size[SSL_MD_GOST94_IDX] >= 0" (Indicator: "secret"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp") Found string "ssl_mac_secret_size[SSL_MD_SHA1_IDX] >= 0" (Indicator: "secret"; Source: "00000000-00005544.00000003.207944.0024D000.00000002.mdmp")4b:Ta67,"051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\PARAMETERS"; Key: "TRANSPORTS"; Value: "") "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\VMBUS\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\PSCHED\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS\PSCHED"; Key: "WINSOCK 2.0 PROVIDER ID"; Value: "") "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS\TCPIP"; Key: "WINSOCK 2.0 PROVIDER ID"; Value: "") "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "MINSOCKADDRLENGTH"; Value: "") "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "MAXSOCKADDRLENGTH"; Value: "") "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "USEDELAYEDACCEPTANCE"; Value: "") "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "HOSTNAME"; Value: "") "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "DOMAIN"; Value: "") "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "QUERYADAPTERNAME"; Value: "") "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "DISABLEADAPTERDOMAINNAME"; Value: "")4c:T402,Found string "FlsFree" (Source: 051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll, API is part of module: KERNELBASE.DLL) Found string "FlsSetValue" (Source: 051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll, API is part of module: KERNELBASE.DLL) Found string "FlsGetValue" (Source: 051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll, API is part of module: KERNELBASE.DLL) Found string "FlsAlloc" (Source: 051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll, API is part of module: KERNELBASE.DLL) Found string "GetUserObjectInformationA" (Source: 051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll, API is part of module: USER32.DLL) Found string "GetLastActivePopup" (Source: 051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll, API is part of module: USER32.DLL) Found string "GetActiveWindow" (Source: 051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll, API is part of module: USER32.DLL)4d:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790727449337,"unified_at":"2026-09-30T00:17:29.337Z","metadata":{"hashes":{"sha256":"051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00","sha1":"75d7f88e010e5c7d9a4617157034cff16da0733f","md5":"c909ca40d1124fc86662a12d72e0fb78","sha512":"c0c6ae4fad454ae1f1c083301813c97cb93995f80320f363d1fc7109b3fa310fbc3d62e7471366086df4cf460eba19d858a5545053755c453c33aa4654cd9556","ssdeep":"24576:LZtbvYMelZzxdJusjdLn+D02xlHt5fXyw8YZSXm8PCBnrVfTrelp/xlNSL+q:9hghvJusR+AKlDX6LKT6lp/xPSL+q","ssdeep_chunks":["24576:LZtbvYM","24576:ZtbvYMe","24576:tbvYMel","24576:bvYMelZ","24576:vYMelZz","24576:YMelZzx","24576:MelZzxd","24576:elZzxdJ","24576:lZzxdJu","24576:ZzxdJus","24576:zxdJusj","24576:xdJusjd","24576:dJusjdL","24576:JusjdLn","24576:usjdLn+","24576:sjdLn+D","24576:jdLn+D0","24576:dLn+D02","24576:Ln+D02x","24576:n+D02xl","24576:+D02xlH","24576:D02xlHt","24576:02xlHt5","24576:2xlHt5f","24576:xlHt5fX","24576:lHt5fXy","24576:Ht5fXyw","24576:t5fXyw8","24576:5fXyw8Y","24576:fXyw8YZ","24576:Xyw8YZS","24576:yw8YZSX","24576:w8YZSXm","24576:8YZSXm8","24576:YZSXm8P","24576:ZSXm8PC","24576:SXm8PCB","24576:Xm8PCBn","24576:m8PCBnr","24576:8PCBnrV","24576:PCBnrVf","24576:CBnrVfT","24576:BnrVfTr","24576:nrVfTre","24576:rVfTrel","24576:VfTrelp","24576:fTrelp/","24576:Trelp/x","24576:relp/xl","24576:elp/xlN","24576:lp/xlNS","24576:p/xlNSL","24576:/xlNSL+","24576:xlNSL+q","49152:LZtbvYM","49152:ZtbvYMe","49152:tbvYMel","49152:bvYMelZ","49152:vYMelZz","49152:YMelZzx","49152:MelZzxd","49152:elZzxdJ","49152:lZzxdJu","49152:ZzxdJus","49152:zxdJusj","49152:xdJusjd","49152:dJusjdL","49152:JusjdLn","49152:usjdLn+","49152:sjdLn+D","49152:jdLn+D0","49152:dLn+D02","49152:Ln+D02x","49152:n+D02xl","49152:+D02xlH","49152:D02xlHt","49152:02xlHt5","49152:2xlHt5f","49152:xlHt5fX","49152:lHt5fXy","49152:Ht5fXyw","49152:t5fXyw8","49152:5fXyw8Y","49152:fXyw8YZ","49152:Xyw8YZS","49152:yw8YZSX","49152:w8YZSXm","49152:8YZSXm8","49152:YZSXm8P","49152:ZSXm8PC","49152:SXm8PCB","49152:Xm8PCBn","49152:m8PCBnr","49152:8PCBnrV","49152:PCBnrVf","49152:CBnrVfT","49152:BnrVfTr","49152:nrVfTre","49152:rVfTrel","49152:VfTrelp","49152:fTrelp/","49152:Trelp/x","49152:relp/xl","49152:elp/xlN","49152:lp/xlNS","49152:p/xlNSL","49152:/xlNSL+","49152:xlNSL+q","24576:9hghvJu","24576:hghvJus","24576:ghvJusR","24576:hvJusR+","24576:vJusR+A","24576:JusR+AK","24576:usR+AKl","24576:sR+AKlD","24576:R+AKlDX","24576:+AKlDX6","24576:AKlDX6L","24576:KlDX6LK","24576:lDX6LKT","24576:DX6LKT6","24576:X6LKT6l","24576:6LKT6lp","24576:LKT6lp/","24576:KT6lp/x","24576:T6lp/xP","24576:6lp/xPS","24576:lp/xPSL","24576:p/xPSL+","24576:/xPSL+q"],"imphash":"cdd269415cf4f3a9ae32e8475a8a4667"},"file_info":{"file_name":"051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":8386487,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1541355672000,"last_seen":1759996652000,"last_multi_scan":1759996652000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["cainabel","coinminer","floxif","installmonstr","miner","ricochetchollima","rokrat","targeted","maldoc","backdoor","ligzoc","plugx","sendsafe","rat"]},"stats":{"av":{"malicious_count":19,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":74},"sandbox_signatures":{"informative_count":175,"suspicious_count":23,"malicious_count":9,"total":207},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Hwdoor","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan[APT]/Win32.Lazarus","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"malicious","threat_name":"Malware_-10","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"BDS/Agent.kevoq","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"malicious","threat_name":"Trojan_Win32_AgentTesla_MSR","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"crowdstrikefalconml":{"name":"CrowdStrike Falcon ML","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win32/Agent.SVR trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"malicious","threat_name":"Malware.Win32.Gen.cc!s1","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"Backdoor/Rokrat.a","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 0050a9b51 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Agent.tprE","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Rokrat.exwdrb","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/Rokrat-A","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"malicious","threat_name":"Trojan-FMGU!C909CA40D112","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/ABTrojan.CPKW-4126","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"Backdoor.Agent","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware_52.6","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Backdoor.Agent.Win32.60789","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Backdoor.Agent","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Service Execution","attack_id":"T1035","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1035","identifiers":[{"type":"suspicious","value":"Opened the service control manager"}],"sources":[{"report_type":"sandbox","report_id":"5bdf36af7ca3e1784055edfd"},{"report_type":"sandbox","report_id":"5bdf36b37ca3e1784055ee02"}]},{"tactic":"Persistence","technique":"Kernel Modules and Extensions","attack_id":"T1215","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1215","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"},{"type":"suspicious","value":"Contains ability to enumerate processes/modules/threads"}],"sources":[{"report_type":"sandbox","report_id":"5bdf36af7ca3e1784055edfd"},{"report_type":"sandbox","report_id":"5bdf36b37ca3e1784055ee02"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1112","identifiers":[{"type":"informative","value":"Accesses System Certificates Settings"},{"type":"malicious","value":"Modifies System Certificates Settings"},{"type":"malicious","value":"Modifies file/console tracing settings (often used to hide footprints on system)"},{"type":"suspicious","value":"Modifies proxy settings"},{"type":"suspicious","value":"Modifies Software Policy Settings"},{"type":"informative","value":"Creates or modifies windows services"}],"sources":[{"report_type":"sandbox","report_id":"5bdf36af7ca3e1784055edfd"},{"report_type":"sandbox","report_id":"5bdf36b37ca3e1784055ee02"},{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1107","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1107","identifiers":[{"type":"suspicious","value":"Marks file for deletion"}],"sources":[{"report_type":"sandbox","report_id":"5bdf36af7ca3e1784055edfd"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1124","identifiers":[{"type":"informative","value":"Contains ability to query the machine timezone"},{"type":"informative","value":"Contains ability to query machine time"},{"type":"informative","value":"Contains ability to retrieve machine time (API string)"},{"type":"informative","value":"Contains ability to retrieve machine timezone (API string)"}],"sources":[{"report_type":"sandbox","report_id":"5bdf36af7ca3e1784055edfd"},{"report_type":"sandbox","report_id":"5bdf36b37ca3e1784055ee02"},{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1012","identifiers":[{"type":"suspicious","value":"Queries sensitive IE security settings"},{"type":"suspicious","value":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)"},{"type":"informative","value":"Accesses Software Policy Settings"},{"type":"suspicious","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Reads Windows Trust Settings"},{"type":"suspicious","value":"Checks warning level of secure to non-secure traffic redirection"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Found registry location strings in memory"},{"type":"suspicious","value":"Monitors specific registry key for changes"}],"sources":[{"report_type":"sandbox","report_id":"5bdf36af7ca3e1784055edfd"},{"report_type":"sandbox","report_id":"5bdf36b37ca3e1784055ee02"},{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1114","identifiers":[{"type":"suspicious","value":"Found a potential E-Mail address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"5bdf36af7ca3e1784055edfd"},{"report_type":"sandbox","report_id":"5bdf36b37ca3e1784055ee02"},{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"tactic":"Exfiltration","technique":"Data Compressed","attack_id":"T1002","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"5bdf36af7ca3e1784055edfd"},{"report_type":"sandbox","report_id":"5bdf36b37ca3e1784055ee02"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to dynamically load libraries"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Input file contains API references not part of its Import Address Table (IAT)"}],"sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Contains ability to create/connect to a named pipe (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Able to retrieve command line parameters of the running process"},{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"},{"type":"informative","value":"Able to import GetCommandLine API, which retrieves the command line string for the current process"}],"sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"}],"sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"tactic":"Persistence","technique":"Socket Filters","attack_id":"T1205.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1205/002","identifiers":[{"type":"informative","value":"Able to monitor socket connection"}],"sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Creates or modifies windows services"}],"sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Able to inject code into another process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"tactic":"Privilege Escalation","technique":"Asynchronous Procedure Call","attack_id":"T1055.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/004","identifiers":[{"type":"informative","value":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)"}],"sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"},{"type":"informative","value":"Contains ability to query local/system time as file time"}],"sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to check debugger is running (API string)"},{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"},{"type":"informative","value":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)"}],"sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"tactic":"Defense Evasion","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"suspicious","value":"CRC value set in PE header does not match actual value"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Contains ability to perform AES/RC4 encryption (API string)"},{"type":"informative","value":"Contains reference to licensed c/c++ library"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"YARA signature match – ROR algorithm"},{"type":"informative","value":"YARA signature match - Djb2 Hash Algorithm"},{"type":"informative","value":"YARA signature match - RC4 Encryption"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"YARA signature match - AES encryption"},{"type":"informative","value":"Shows ability to obfuscate file or information"}],"sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"suspicious","value":"Contains ability to remove directories"},{"type":"informative","value":"Contains ability to delete files/directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"},{"type":"informative","value":"Contains ability to delay the execution of current thread"}],"sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Creates mutants"},{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"},{"type":"informative","value":"Contains ability to show a graphical window (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"tactic":"Defense Evasion","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"suspicious","value":"Section contains high entropy"}],"sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Makes a code branch decision directly after an API that is environment aware"},{"type":"informative","value":"Contains ability to detect virtual environment (API)"},{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"},{"type":"informative","value":"The input sample contains a known anti-VM trick"}],"sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"tactic":"Defense Evasion","technique":"Encrypted/Encoded File","attack_id":"T1027.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/013","identifiers":[{"type":"suspicious","value":"YARA signature match – cryptographic algorithms"},{"type":"informative","value":"YARA signature match - Medium entropy File"}],"sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"},{"type":"informative","value":"XOR operations in executable file detected"}],"sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"tactic":"Defense Evasion","technique":"Dynamic API Resolution","attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","identifiers":[{"type":"informative","value":"Contains ability to dynamically determine API calls"}],"sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Contains ability to enumerate files inside a directory"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Able to rename or move file/directory (API string)"},{"type":"informative","value":"Contains ability to enumerates all mounted drives"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Contains references to file movement (imports API)"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Contains ability to retrieve path in which Windows is installed (API string)"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Touches files"}],"sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Contains ability to retrieve data about the local computer (API string)"},{"type":"informative","value":"Contains ability to retrieve the NetBIOS name of the local computer (API string)"},{"type":"informative","value":"Contains ability to retrieve environment variable settings"},{"type":"informative","value":"Able to gather system information (.NET)"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Able to query volume/memory size (API string)"},{"type":"informative","value":"Able to retrieve geographical location information"},{"type":"informative","value":"Calls an APIs used to retrieve geographical location information"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Contains ability to query the machine version"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Contains ability to determine disk drive type (API string)"},{"type":"informative","value":"Contains ability to retrieve the host name of a computer (API string)"},{"type":"informative","value":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Able to query system locale information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Contains ability to retrieve/open a process"},{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Contains ability to retrieve/open a process (API string)"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Queries basic information of the specified process"}],"sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"tactic":"Discovery","technique":"Domain Groups","attack_id":"T1069.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1069/002","identifiers":[{"type":"informative","value":"References Windows LDAP client module"},{"type":"informative","value":"Imports a library used to perform LDAP operation"},{"type":"informative","value":"Loads Windows LDAP client module"}],"sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Contains ability to retrieve usernames and/or user information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Contains ability to retrieve the local name for a socket (API string)"},{"type":"informative","value":"Contains ability to free the memory used by network management functions (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"tactic":"Discovery","technique":"Internet Connection Discovery","attack_id":"T1016.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1016/001","sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Contains ability to move file or directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Contains ability to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"tactic":"Collection","technique":"Archive Collected Data","attack_id":"T1560","attack_id_wiki":"https://attack.mitre.org/techniques/T1560","sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"tactic":"Collection","technique":"Archive via Library","attack_id":"T1560.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1560/002","identifiers":[{"type":"informative","value":"Able to compress/decompress content at runtime"}],"sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"tactic":"Collection","technique":"Automated Collection","attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","identifiers":[{"type":"informative","value":"Shows ability to send encrypted data to the internet"}],"sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"informative","value":"Contains ability to communicate with C2 using Sockets (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Found potential URLs in memory dumps"}],"sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve the URL data"},{"type":"informative","value":"Contains ability to transfer data using curl"},{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"informative","value":"Contains ability to download a file from a URL (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Uses cURL to communicate over HTTPS"},{"type":"informative","value":"Found user-agent related strings"},{"type":"informative","value":"Found string related to HTTP headers"},{"type":"informative","value":"Calls an API used to connect to internet"},{"type":"informative","value":"Contains reference to Windows internet services (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"tactic":"Command and Control","technique":"Internal Proxy","attack_id":"T1090.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1090/001","identifiers":[{"type":"suspicious","value":"Modifies proxy settings"}],"sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"informative","value":"Contains ability to open a port and listen for incoming connection (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","identifiers":[{"type":"informative","value":"References OpenSSL library string"},{"type":"informative","value":"Shows ability to use asymmetric encryption algorithm"}],"sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"tactic":"Command and Control","technique":"Mail Protocols","attack_id":"T1071.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/003","identifiers":[{"type":"informative","value":"Contains reference to Mail transfer protocol"},{"type":"informative","value":"Found mail related domain names"}],"sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"}],"sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"Contains ability to perform Base64 encoding/decoding"}],"sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"tactic":"Command and Control","technique":"Remote Access Tools","attack_id":"T1219","attack_id_wiki":"https://attack.mitre.org/techniques/T1219","identifiers":[{"type":"informative","value":"Able to use IDE tunneling for remote connection"}],"sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Contains ability to use AES encryption instructions"},{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over C2 Channel","attack_id":"T1041","attack_id_wiki":"https://attack.mitre.org/techniques/T1041","identifiers":[{"type":"informative","value":"Contains ability to upload file/data"}],"sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Contains ability to terminate a process (API string)"},{"type":"informative","value":"Calls an API used to open a process handle"}],"sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to shutdown system"}],"sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains reference to cryptographic keys"}],"sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"tactic":"Impact","technique":"Disk Content Wipe","attack_id":"T1561.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1561/001","identifiers":[{"type":"informative","value":"Contains ability to format disks"}],"sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.dll at 53410-3731-0040B6F0\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00030274-00002076-51231-16-00348F24\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00030274-00002076-51231-17-00347D22","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"5bdf36af7ca3e1784055edfd"},{"report_type":"sandbox","report_id":"5bdf36b37ca3e1784055ee02"},{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetSystemTimeAsFileTime@KERNEL32.dll at 53410-4091-004DEDD5\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00030274-00002076-51231-206-00349276\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00030274-00002076-51231-1663-00353DCD","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1124","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"5bdf36af7ca3e1784055edfd"},{"report_type":"sandbox","report_id":"5bdf36b37ca3e1784055ee02"},{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine timezone","description":"GetTimeZoneInformation@KERNEL32.dll at 53410-4091-004DEDD5\n GetTimeZoneInformation@KERNEL32.DLL at 00030274-00002076-51231-1459-00356EE2","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1124","relevance":1,"id":"stream-48","sources":[{"report_type":"sandbox","report_id":"5bdf36af7ca3e1784055edfd"},{"report_type":"sandbox","report_id":"5bdf36b37ca3e1784055ee02"},{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"GetVersion@KERNEL32.dll at 53410-5106-004957C0\n GetVersion@KERNEL32.DLL at 00030274-00002076-51231-59-0034188B\n GetVersion@KERNEL32.DLL at 00030274-00002076-51231-283-00389FE0","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"5bdf36af7ca3e1784055edfd"},{"report_type":"sandbox","report_id":"5bdf36b37ca3e1784055ee02"},{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"level":"informative","category":"Environment Awareness","name":"Makes a code branch decision directly after an API that is environment aware","description":"Found API call GetTimeZoneInformation@KERNEL32.dll directly followed by \"cmp eax, FFFFFFFFh\" and \"je 004DED52h\" at 53410-4091-004DEDD5\n Found API call GetVersion@KERNEL32.dll directly followed by \"cmp eax, 80000000h\" and \"jnc 00495A33h\" at 53410-5106-004957C0\n Found API call GetVersion@KERNEL32.DLL directly followed by \"cmp al, 05h\" and \"jne 003418D2h\" at 00030274-00002076-51231-59-0034188B\n Found API call GetVersion@KERNEL32.DLL directly followed by \"cmp eax, 80000000h\" and \"jnc 0038A0D8h\" at 00030274-00002076-51231-283-00389FE0\n Found API call GetTimeZoneInformation@KERNEL32.DLL directly followed by \"cmp eax, edi\" and \"je 003570FEh\" at 00030274-00002076-51231-1459-00356EE2","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-39","sources":[{"report_type":"sandbox","report_id":"5bdf36af7ca3e1784055edfd"},{"report_type":"sandbox","report_id":"5bdf36b37ca3e1784055ee02"},{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"level":"informative","category":"Environment Awareness","name":"Possibly tries to detect the presence of a debugger","description":"GetProcessHeap@KERNEL32.DLL at 00030274-00002076-51231-170-00357757","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"5bdf36af7ca3e1784055edfd"},{"report_type":"sandbox","report_id":"5bdf36b37ca3e1784055ee02"}]},{"level":"informative","category":"General","name":"Accesses Software Policy Settings","description":"$25","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-18","sources":[{"report_type":"sandbox","report_id":"5bdf36af7ca3e1784055edfd"},{"report_type":"sandbox","report_id":"5bdf36b37ca3e1784055ee02"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"$26","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"5bdf36af7ca3e1784055edfd"},{"report_type":"sandbox","report_id":"5bdf36b37ca3e1784055ee02"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"www.hulu.com\"","origin":"Network Traffic","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"5bdf36af7ca3e1784055edfd"},{"report_type":"sandbox","report_id":"5bdf36b37ca3e1784055ee02"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"172.227.96.141:80\"\n \"172.227.96.141:443\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"5bdf36af7ca3e1784055edfd"}]},{"level":"informative","category":"General","name":"Creates a writable file in a temporary directory","description":"\".exe\" created file \"c:\\temp\\esoftscrap.jpg\"\n \".exe\" created file \"%TEMP%\\Cab2B13.tmp\"\n \".exe\" created file \"%TEMP%\\Tar2B14.tmp\"\n \".exe\" created file \"c:\\temp\\episode3.mp4\"\n \".exe\" created file \"%TEMP%\\Cab7E5D.tmp\"\n \".exe\" created file \"%TEMP%\\Tar7E5E.tmp\"\n \".exe\" created file \"%TEMP%\\CabA81D.tmp\"\n \".exe\" created file \"%TEMP%\\TarA81E.tmp\"","origin":"API Call","relevance":1,"id":"api-4","sources":[{"report_type":"sandbox","report_id":"5bdf36af7ca3e1784055edfd"},{"report_type":"sandbox","report_id":"5bdf36b37ca3e1784055ee02"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\DBWinMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetStartupMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetConnectionMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetProxyRegistryMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\RasPbFile\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZoneAttributeCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\IESQMMUTEX_0_208\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"5bdf36af7ca3e1784055edfd"},{"report_type":"sandbox","report_id":"5bdf36b37ca3e1784055ee02"},{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"level":"informative","category":"General","name":"GETs files from a webserver","description":"\"GET /watch/559035/episode3.mp4 HTTP/1.1Host: www.hulu.com\"","origin":"Network Traffic","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"5bdf36af7ca3e1784055edfd"}]},{"level":"informative","category":"General","name":"Reads Windows Trust Settings","description":"\".exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-20","sources":[{"report_type":"sandbox","report_id":"5bdf36af7ca3e1784055edfd"},{"report_type":"sandbox","report_id":"5bdf36b37ca3e1784055ee02"}]},{"level":"informative","category":"Installation/Persistance","name":"Contains ability to lookup the windows account name","description":"GetUserNameA@ADVAPI32.DLL at 00030274-00002076-51231-705-00341000","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-28","sources":[{"report_type":"sandbox","report_id":"5bdf36af7ca3e1784055edfd"},{"report_type":"sandbox","report_id":"5bdf36b37ca3e1784055ee02"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"Tar7937.tmp\" has type \"data\"\n \"7423F88C7F265F0DEFC08EA88C3BDE45_D975BBA8033175C8D112023D8A7A8AD6\" has type \"data\"\n \"CabA81D.tmp\" has type \"Microsoft Cabinet archive data 50939 bytes 1 file\"\n \"Cab7E5D.tmp\" has type \"Microsoft Cabinet archive data 50939 bytes 1 file\"\n \"pspubws@hulu[1].txt\" has type \"ASCII text with very long lines\"\n \"94308059B57B3142E455B38A6EB92015\" has type \"data\"\n \"pspubws@hulu[2].txt\" has type \"ASCII text with very long lines\"\n \"Cab2B13.tmp\" has type \"Microsoft Cabinet archive data 50939 bytes 1 file\"\n \"Cab7936.tmp\" has type \"Microsoft Cabinet archive data 55745 bytes 1 file\"\n \"Tar7E5E.tmp\" has type \"data\"\n \"Tar2B14.tmp\" has type \"data\"\n \"TarA81E.tmp\" has type \"data\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"5bdf36af7ca3e1784055edfd"},{"report_type":"sandbox","report_id":"5bdf36b37ca3e1784055ee02"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"$27","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"5bdf36af7ca3e1784055edfd"},{"report_type":"sandbox","report_id":"5bdf36b37ca3e1784055ee02"},{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"http://www.winimage.com/zLibDll\"\n Heuristic match: \"ftp@example.com\"\n Pattern match: \"https://curl.haxx.se/docs/http-cookies.html\"\n Pattern match: \"http://www.openssl.org/support/faq.html\"\n Pattern match: \"http://www.hulu.com/watch/559035/episode3.mp4\"\n Pattern match: \"www.hulu.com\"\n Pattern match: \"http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAH9o%2BtuynXIi\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"5bdf36af7ca3e1784055edfd"},{"report_type":"sandbox","report_id":"5bdf36b37ca3e1784055ee02"},{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\".exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"5bdf36af7ca3e1784055edfd"},{"report_type":"sandbox","report_id":"5bdf36b37ca3e1784055ee02"},{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\".exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1215","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"5bdf36af7ca3e1784055edfd"},{"report_type":"sandbox","report_id":"5bdf36b37ca3e1784055ee02"},{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.bin\" was detected as \"VC8 -> Microsoft Corporation\"","origin":"Static Parser","mitre_attack_id":"T1002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"5bdf36af7ca3e1784055edfd"},{"report_type":"sandbox","report_id":"5bdf36b37ca3e1784055ee02"},{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries kernel debugger information","description":"\".exe\" at 00030274-00002076-00000105-50682193640","origin":"API Call","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"5bdf36af7ca3e1784055edfd"},{"report_type":"sandbox","report_id":"5bdf36b37ca3e1784055ee02"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)","description":"\".exe\" (Access type: \"QUERYVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"DISABLECACHINGOFSSLPAGES\"; Value: \"00000000040000000400000000000000\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":3,"id":"registry-29","sources":[{"report_type":"sandbox","report_id":"5bdf36af7ca3e1784055edfd"},{"report_type":"sandbox","report_id":"5bdf36b37ca3e1784055ee02"}]},{"level":"suspicious","category":"Cryptographic Related","name":"Found a cryptographic related string","description":"$28","origin":"File/Memory","relevance":10,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"5bdf36af7ca3e1784055edfd"},{"report_type":"sandbox","report_id":"5bdf36b37ca3e1784055ee02"}]},{"level":"suspicious","category":"Environment Awareness","name":"Possibly tries to implement anti-virtualization techniques","description":"\"vbox\" (Indicator: \"vbox\")","origin":"File/Memory","relevance":4,"id":"string-1","sources":[{"report_type":"sandbox","report_id":"5bdf36af7ca3e1784055edfd"},{"report_type":"sandbox","report_id":"5bdf36b37ca3e1784055ee02"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\".exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"5bdf36af7ca3e1784055edfd"},{"report_type":"sandbox","report_id":"5bdf36b37ca3e1784055ee02"}]},{"level":"suspicious","category":"General","name":"Found a potential E-Mail address in binary/memory","description":"Pattern match: \"appro@openssl.org\"\n Pattern match: \"ftp@example.com\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"5bdf36af7ca3e1784055edfd"},{"report_type":"sandbox","report_id":"5bdf36b37ca3e1784055ee02"},{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"level":"suspicious","category":"General","name":"Opened the service control manager","description":"\".exe\" called \"OpenSCManager\" requesting access rights \"SC_MANAGER_CONNECT\" (0x1)\n \".exe\" called \"OpenSCManager\" requesting access rights \"0XE0000000L\"","origin":"API Call","mitre_attack_id":"T1035","relevance":10,"id":"api-77","sources":[{"report_type":"sandbox","report_id":"5bdf36af7ca3e1784055edfd"},{"report_type":"sandbox","report_id":"5bdf36b37ca3e1784055ee02"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Contains ability to download files from the internet","description":"recv@WS2_32.DLL at 00030274-00002076-51231-872-003697D0\n recv@WS2_32.DLL at 00030274-00002076-51231-916-00366FF0","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-17","sources":[{"report_type":"sandbox","report_id":"5bdf36af7ca3e1784055edfd"},{"report_type":"sandbox","report_id":"5bdf36b37ca3e1784055ee02"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Monitors specific registry key for changes","description":"$29","origin":"API Call","mitre_attack_id":"T1012","relevance":4,"id":"api-12","sources":[{"report_type":"sandbox","report_id":"5bdf36af7ca3e1784055edfd"},{"report_type":"sandbox","report_id":"5bdf36b37ca3e1784055ee02"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 172.227.96.141 on port 80 is sent without HTTP header\n TCP traffic to 172.227.96.141 on port 443 is sent without HTTP header","origin":"Network Traffic","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"5bdf36af7ca3e1784055edfd"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Accesses potentially sensitive information from local browsers","description":"\".exe\" had access to \"%APPDATA%\\Microsoft\\Windows\\Cookies\\index.dat\" (Type: \"FileHandle\")\n \".exe\" had access to \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat\" (Type: \"FileHandle\")","origin":"Touched Handle","relevance":7,"id":"handle-0","sources":[{"report_type":"sandbox","report_id":"5bdf36af7ca3e1784055edfd"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate processes/modules/threads","description":"CreateToolhelp32Snapshot@KERNEL32.DLL at 00030274-00002076-51231-446-00347095","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1215","relevance":5,"id":"stream-20","sources":[{"report_type":"sandbox","report_id":"5bdf36af7ca3e1784055edfd"},{"report_type":"sandbox","report_id":"5bdf36b37ca3e1784055ee02"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"$2a","origin":"API Call","mitre_attack_id":"T1107","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"5bdf36af7ca3e1784055edfd"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\".exe\" opened \"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@hulu[1].txt\" with delete access\n \".exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\Cab7E5D.tmp\" with delete access\n \".exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\Tar7E5E.tmp\" with delete access\n \".exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\CabA81D.tmp\" with delete access\n \".exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\TarA81E.tmp\" with delete access\n \".exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\Cab7936.tmp\" with delete access\n \".exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\Tar7937.tmp\" with delete access","origin":"API Call","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"5bdf36af7ca3e1784055edfd"}]},{"level":"suspicious","category":"System Security","name":"Modifies Software Policy Settings","description":"$2b","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-19","sources":[{"report_type":"sandbox","report_id":"5bdf36af7ca3e1784055edfd"},{"report_type":"sandbox","report_id":"5bdf36b37ca3e1784055ee02"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\".exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYENABLE\"; Value: \"00000000\")\n \".exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYSERVER\")\n \".exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYOVERRIDE\")\n \".exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \".exe\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"5bdf36af7ca3e1784055edfd"},{"report_type":"sandbox","report_id":"5bdf36b37ca3e1784055ee02"},{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"level":"suspicious","category":"System Security","name":"Queries sensitive IE security settings","description":"\".exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":8,"id":"registry-36","sources":[{"report_type":"sandbox","report_id":"5bdf36af7ca3e1784055edfd"},{"report_type":"sandbox","report_id":"5bdf36b37ca3e1784055ee02"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.bin\" claimed CRC 1479392 while the actual is CRC 8448496","origin":"Static Parser","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"5bdf36af7ca3e1784055edfd"},{"report_type":"sandbox","report_id":"5bdf36b37ca3e1784055ee02"},{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"GetUserNameA\n GetFileAttributesA\n GetDriveTypeA\n GetTempPathA\n WriteFile\n OutputDebugStringA\n IsDebuggerPresent\n GetVersionExA\n GetModuleFileNameA\n UnhandledExceptionFilter\n CreateThread\n ExitThread\n SleepEx\n CreateToolhelp32Snapshot\n GetTickCount\n LoadLibraryA\n Process32Next\n GetStartupInfoA\n OpenProcess\n CreateDirectoryA\n DeleteFileA\n GetProcAddress\n FindFirstFileA\n GetComputerNameA\n FindNextFileA\n TerminateProcess\n CreateFileW\n CreateFileA\n GetCommandLineA\n GetModuleHandleA\n GetModuleHandleW\n Sleep\n VirtualAlloc\n ShellExecuteA\n GetWindowThreadProcessId\n InternetReadFile\n InternetCloseHandle\n InternetOpenA\n InternetOpenUrlA\n accept\n WSAStartup\n connect\n closesocket\n send\n listen\n recv\n socket\n bind\n recvfrom\n sendto","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"5bdf36af7ca3e1784055edfd"},{"report_type":"sandbox","report_id":"5bdf36b37ca3e1784055ee02"},{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Modifies file/console tracing settings (often used to hide footprints on system)","description":"\".exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\RASAPI32\"; Key: \"ENABLEFILETRACING\"; Value: \"00000000\")\n \".exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\RASAPI32\"; Key: \"ENABLECONSOLETRACING\"; Value: \"00000000\")\n \".exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\RASAPI32\"; Key: \"FILETRACINGMASK\"; Value: \"0000FFFF\")\n \".exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\RASAPI32\"; Key: \"CONSOLETRACINGMASK\"; Value: \"0000FFFF\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":5,"id":"registry-30","sources":[{"report_type":"sandbox","report_id":"5bdf36af7ca3e1784055edfd"}]},{"level":"malicious","category":"Environment Awareness","name":"The input sample contains a known anti-VM trick","description":"Found VM detection artifact \"CPUID trick\" in \"051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.bin\" (Offset: 930402)","origin":"Binary File","relevance":5,"id":"binary-8","sources":[{"report_type":"sandbox","report_id":"5bdf36af7ca3e1784055edfd"},{"report_type":"sandbox","report_id":"5bdf36b37ca3e1784055ee02"},{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"47/67 Antivirus vendors marked sample as malicious (70% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"5bdf36af7ca3e1784055edfd"},{"report_type":"sandbox","report_id":"5bdf36b37ca3e1784055ee02"},{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"47/67 Antivirus vendors marked sample as malicious (70% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"5bdf36af7ca3e1784055edfd"},{"report_type":"sandbox","report_id":"5bdf36b37ca3e1784055ee02"},{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"level":"malicious","category":"Pattern Matching","name":"YARA signature match","description":"Internal YARA signature matched on file \"all.bstring\"","origin":"YARA Signature","relevance":10,"id":"yara-0","sources":[{"report_type":"sandbox","report_id":"5bdf36af7ca3e1784055edfd"},{"report_type":"sandbox","report_id":"5bdf36b37ca3e1784055ee02"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Found strings in conjunction with a procedure lookup that resolve to a known API export symbol","description":"Found reference to API NtQueryInformationProcess@NTDLL.DLL at 00011530-00001192-10016-447-012B73C0\n Found reference to API IsWow64Process@KERNEL32.DLL at 00011530-00001192-10016-705-012B1000","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-41","sources":[{"report_type":"sandbox","report_id":"5bdf36b37ca3e1784055ee02"}]},{"level":"malicious","category":"System Security","name":"Modifies System Certificates Settings","description":"\".exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\"; Key: \"1FB86B1168EC743154062E8C9CC5B171A4B7CCB4\")\n \".exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\1FB86B1168EC743154062E8C9CC5B171A4B7CCB4\"; Key: \"BLOB\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":8,"id":"registry-38","sources":[{"report_type":"sandbox","report_id":"5bdf36b37ca3e1784055ee02"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Checks for a resource fork (ADS) file","description":"\".exe\" checked file \"C:\"","origin":"API Call","relevance":5,"id":"api-35","sources":[{"report_type":"sandbox","report_id":"5bdf36b37ca3e1784055ee02"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Contains native function calls","description":"NtQueryInformationProcess@NTDLL.DLL at 00011530-00001192-10016-447-012B73C0","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-22","sources":[{"report_type":"sandbox","report_id":"5bdf36b37ca3e1784055ee02"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to compress/decompress content at runtime","description":"$2c","origin":"File/Memory","mitre_attack_id":"T1560.002","relevance":1,"id":"string-935","sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"Found reference to API \"VirtualFree\" (Indicator: \"VirtualFree\"; File: \"051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll\")\n Found reference to API \"VirtualAlloc\" (Indicator: \"VirtualAlloc\"; File: \"051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll\")\n Found reference to API \"VirtualAlloc\" (Indicator: \"VirtualAlloc\"; Source: \"00000000-00005544.00000003.207944.0024D000.00000002.mdmp\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00005544.00000003.207944.0024D000.00000002.mdmp\")\n Found reference to API \"VirtualFree\" (Indicator: \"VirtualFree\"; Source: \"00000000-00005544.00000003.207944.0024D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"$2d","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll\")\n Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; File: \"051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll\")\n Found reference to API \"FreeLibrary(wsock2) failed (%d)\" (Indicator: \"FreeLibrary\"; File: \"051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll\")\n Found reference to API \"FreeLibrary(wsock2) failed (%d)\" (Indicator: \"FreeLibrary\"; Source: \"00000000-00005544.00000003.207944.0024D000.00000002.mdmp\")\n Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; Source: \"00000000-00005544.00000003.207944.0024D000.00000002.mdmp\")\n Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00005544.00000003.207944.0024D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to pass information to a window procedure (API string)","description":"Found reference to API \"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00005544.00000000.196677.02710000.00000004.mdmp, 00000000-00005544.00000001.198597.02710000.00000004.mdmp, 00000000-00005544.00000002.200517.02710000.00000004.mdmp, 00000000-00005544.00000003.207944.02710000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to perform Base64 encoding/decoding","description":"$2e","origin":"File/Memory","mitre_attack_id":"T1132","relevance":1,"id":"string-338","sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"$2f","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"\"051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll.exe\" queried SystemProcessInformation at 00000000-00005544-00000C15-2072024577 [PID: 5544]\n \"051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll.exe\" queried SystemProcessInformation at 00000000-00005544-00000C15-2072033486 [PID: 5544]\n \"051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll.exe\" queried SystemProcessInformation at 00000000-00005544-00000C15-2072228995 [PID: 5544]\n \"051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll.exe\" queried SystemProcessInformation at 00000000-00005544-00000C15-2072237983 [PID: 5544]","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll\")\n Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; File: \"051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll\")\n Found reference to API \"OutputDebugStringA\" (Indicator: \"OutputDebugString\"; File: \"051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll\")\n Found reference to API \"NtQueryInformationProcess\" (Indicator: \"NtQueryInformationProcess\"; File: \"051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll\")\n Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-148","sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"$30","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform AES/RC4 encryption (API string)","description":"Found reference to API \"CryptAcquireContextW\" (Indicator: \"CryptAcquireContext\"; File: \"051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll\")\n Found reference to API \"CryptReleaseContext\" (Indicator: \"CryptReleaseContext\"; File: \"051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-438","sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to use AES encryption instructions","description":"Found string \"AESNI_XTS_CIPHER\" (Indicator: \"AESNI\"; File: \"051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll\")\n Found string \"AESNI_INIT_KEY\" (Indicator: \"AESNI\"; File: \"051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll\")\n Found string \"AESNI_XTS_CIPHER\" (Indicator: \"AESNI\"; Source: \"00000000-00005544.00000003.207944.0024D000.00000002.mdmp\")\n Found string \"AESNI_INIT_KEY\" (Indicator: \"AESNI\"; Source: \"00000000-00005544.00000003.207944.0024D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1573.001","relevance":3,"id":"string-584","sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to cryptographic keys","description":"$31","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-280","sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: YARA signature match - RC4 Encryption\n Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: YARA signature match - AES encryption","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings\n Matched sigs: Contains ability to use Cryptographic classes\n Matched sigs: Contains key cryptographic functions (API string)\n Matched sigs: Contains ability to perform AES/RC4 encryption (API string)\n Matched sigs: Possibly contains Public/Private key (encryption)\n Matched sigs: Contains reference to cryptographic keys\n Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: Contains ability to use Microsoft's Enhanced Cryptographic Provider\n Matched sigs: Contains ability to use AES encryption instructions\n Matched sigs: YARA signature match - RC4 Encryption\n Matched sigs: YARA signature match – cryptographic algorithms\n Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: YARA signature match - AES encryption","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use asymmetric encryption algorithm","description":"The analysis found public/private key which shows ability to use asymmetric encryption algorithm. Matched sigs: Possibly contains Public/Private key (encryption)","origin":"Indicator Combinations","mitre_attack_id":"T1573.002","relevance":1,"id":"summary-33","sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: YARA signature match - RC4 Encryption\n Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: YARA signature match - AES encryption","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$32","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system information (.NET)","description":"Found string \"GetUserNameA\" (Source: \"00000000-00005544.00000003.207944.0024D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-937","sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll\")\n Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00005544.00000003.207944.0024D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"Found reference to API \"GetLocaleInfoA\" (Indicator: \"GetLocaleInfo\"; File: \"051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll\")\n Found reference to API \"GetLocaleInfoA\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00005544.00000003.207944.0024D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query volume/memory size (API string)","description":"Found reference to API \"GlobalMemoryStatus\" (Indicator: \"GlobalMemoryStatus\"; File: \"051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll\")\n Found reference to API \"GlobalMemoryStatus\" (Indicator: \"GlobalMemoryStatus\"; Source: \"00000000-00005544.00000003.207944.0024D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-193","sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve geographical location information","description":"Found reference to API \"getaddrinfo\" (Indicator: \"getaddrinfo\"; File: \"051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll\")\n Found reference to API \"getaddrinfo() failed for %s:%d; %s\" (Indicator: \"getaddrinfo\"; File: \"051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll\")\n Found reference to API \"getaddrinfo() failed for %s:%d; %s\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00005544.00000003.207944.0024D000.00000002.mdmp\")\n Found reference to API \"getaddrinfo\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00005544.00000003.207944.0024D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-739","sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"$33","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"Found reference to API \"\" (Indicator: \"enumchildwindows\"; Source: \"00000000-00005544.00000000.196677.02710000.00000004.mdmp, 00000000-00005544.00000001.198597.02710000.00000004.mdmp, 00000000-00005544.00000002.200517.02710000.00000004.mdmp, 00000000-00005544.00000003.207944.02710000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00005544)","origin":"API Call","mitre_attack_id":"T1497","relevance":3,"id":"api-296","sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll.exe\" called \"QueryPerformanceCounter\" (UID: 00000000-00005544)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00005544)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00005544)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$34","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an APIs used to retrieve geographical location information","description":"Observed import api \"getaddrinfo\" which can be \"used to convert host name to address\" [Source: 051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll]","origin":"Static Parser","mitre_attack_id":"T1082","relevance":5,"id":"static-190","sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to detect virtual environment (API)","description":"GetTickCount@KERNEL32.dll at 47646-5106-004957C0\n GetTickCount@KERNEL32.dll at 47646-5107-00495740\n GetTickCount@KERNEL32.dll at 47646-5637-0040164A\n GetTickCount@KERNEL32.dll at 47646-5729-00406CA5","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497","relevance":3,"id":"stream-87","sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to determine if process is running under WOW64 (API string)","description":"Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; File: \"051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll\")\n Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00005544.00000003.207944.0024D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-450","sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to enumerate files inside a directory","description":"FindFirstFileA@KERNEL32.dll at 47646-5117-004DE6B4\n FindNextFileA@KERNEL32.dll at 47646-5618-00406AF7","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1083","relevance":3,"id":"stream-89","sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to enumerates all mounted drives","description":"GetDriveTypeA@KERNEL32.dll at 47646-5117-004DE6B4","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1083","relevance":3,"id":"stream-66","sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform scheduled transfer (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00005544.00000003.207944.0024D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query local/system time as file time","description":"GetSystemTimeAsFileTime@KERNEL32.dll at 47646-4091-004DEDD5\n FileTimeToLocalFileTime@KERNEL32.dll at 47646-5117-004DE6B4\n FileTimeToLocalFileTime@KERNEL32.dll at 47646-5393-004DDA61","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1070.006","relevance":1,"id":"stream-71","sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve environment variable settings","description":"Found string \"set timeouts for state %d; Total %ld, retry %d maxtry %d\" (Indicator: \"set \"; File: \"051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll\")\n Found string \"set filename failed\" (Indicator: \"set \"; File: \"051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-326","sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"FileTimeToLocalFileTime\" (Indicator: \"FileTimeToLocalFileTime\"; File: \"051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll\")\n Found reference to API \"FileTimeToSystemTime\" (Indicator: \"FileTimeToSystemTime\"; File: \"051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; File: \"051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll\")\n Found reference to API \"FileTimeToSystemTime\" (Indicator: \"FileTimeToSystemTime\"; Source: \"00000000-00005544.00000003.207944.0024D000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00005544.00000003.207944.0024D000.00000002.mdmp\")\n Found reference to API \"FileTimeToLocalFileTime\" (Indicator: \"FileTimeToLocalFileTime\"; Source: \"00000000-00005544.00000003.207944.0024D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00005544.00000003.207944.0024D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine timezone (API string)","description":"Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; File: \"051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll\")\n Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; Source: \"00000000-00005544.00000003.207944.0024D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-248","sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"Found reference to API \"GetActiveWindow\" (Indicator: \"GetActiveWindow\"; File: \"051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll\")\n Found reference to API \"GetForegroundWindow\" (Indicator: \"GetForegroundWindow\"; File: \"051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll\")\n Found reference to API \"GetActiveWindow\" (Indicator: \"GetActiveWindow\"; Source: \"00000000-00005544.00000003.207944.0024D000.00000002.mdmp\")\n Found reference to API \"GetForegroundWindow\" (Indicator: \"GetForegroundWindow\"; Source: \"00000000-00005544.00000003.207944.0024D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve path in which Windows is installed (API string)","description":"Found reference to API \"GetWindowsDirectoryA\" (Indicator: \"GetWindowsDirectory\"; File: \"051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll\")\n Found reference to API \"GetWindowsDirectoryA\" (Indicator: \"GetWindowsDirectory\"; Source: \"00000000-00005544.00000003.207944.0024D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-312","sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"$35","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Found reference to API \"GetStartupInfoA\" (Indicator: \"GetStartupInfo\"; File: \"051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll\")","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-167","sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve/open a process","description":"OpenProcess@KERNEL32.dll at 47646-5615-004012DE","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1057","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"level":"informative","category":"General","name":"Able to rename or move file/directory (API string)","description":"Found string \"MoveFileA\" (Indicator: \"MoveFileA\"; File: \"051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll\")\n Found string \"MoveFileA\" (Indicator: \"MoveFileA\"; Source: \"00000000-00005544.00000003.207944.0024D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-884","sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"level":"informative","category":"General","name":"Able to retrieve command line parameters of the running process","description":"Found string \"GetCommandLineA\" (Source: \"00000000-00005544.00000003.207944.0024D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-930","sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"\"051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005544)\n \"051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005544)\n \"051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005544)\n \"051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll.exe\" called \"LoadLibrary\" with a parameter kernel32 (UID: 00000000-00005544)","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$36","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \"CreateDirectoryA\" (Indicator: \"CreateDirectory\"; File: \"051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll\")\n Found reference to API \"CreateDirectoryA\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00005544.00000003.207944.0024D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1074.001","relevance":1,"id":"string-423","sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFileA\" (Indicator: \"CreateFile\"; File: \"051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll\")\n Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; File: \"051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll\")\n Found reference to API \"CreateFileA\" (Indicator: \"CreateFile\"; Source: \"00000000-00005544.00000003.207944.0024D000.00000002.mdmp\")\n Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"00000000-00005544.00000003.207944.0024D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"level":"informative","category":"General","name":"Contains ability to delay the execution of current thread","description":"Sleep@KERNEL32.dll at 47646-5638-00407A6A\n WaitForMultipleObjects@KERNEL32.dll at 47646-6280-0043B6D2","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497.003","relevance":3,"id":"stream-103","sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically determine API calls","description":"Found GetProcAddress() and LoadLibraryA() in an import section (Source: 051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll)","origin":"Static Parser","mitre_attack_id":"T1027.007","relevance":1,"id":"static-79","sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically load libraries","description":"LoadLibraryA@KERNEL32.dll at 47646-4127-004C8BF0\n LoadLibraryA@KERNEL32.dll at 47646-4128-004C89F0\n LoadLibraryA@KERNEL32.dll at 47646-4132-004C8380\n LoadLibraryA@KERNEL32.dll at 47646-6280-0043B6D2","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":3,"id":"stream-108","sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$37","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Found reference to API \"ShellExecuteA\" (Indicator: \"ShellExecute\"; File: \"051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll\")\n Found reference to API \"ShellExecuteA\" (Indicator: \"ShellExecute\"; Source: \"00000000-00005544.00000003.207944.0024D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-240","sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"level":"informative","category":"General","name":"Contains ability to move file or directory (API string)","description":"Found reference to API \"MoveFileA\" (Indicator: \"MoveFile\"; File: \"051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll\")\n Found reference to API \"MoveFileA\" (Indicator: \"MoveFile\"; Source: \"00000000-00005544.00000003.207944.0024D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1570","relevance":1,"id":"string-322","sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll\")\n Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00005544.00000003.207944.0024D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00005544.00000003.207944.0024D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/open a process (API string)","description":"Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; File: \"051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; File: \"051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll\")\n Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00005544.00000003.207944.0024D000.00000002.mdmp\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00005544.00000003.207944.0024D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; File: \"051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; File: \"051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll\")\n Found reference to API \"WSASetLastError\" (Indicator: \"SetLastError\"; File: \"051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll\")\n Found reference to API \"WSAGetLastError\" (Indicator: \"GetLastError\"; File: \"051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00005544.00000003.207944.0024D000.00000002.mdmp\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"00000000-00005544.00000003.207944.0024D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"GetWindowThreadProcessId\" (Indicator: \"GetWindowThreadProcessId\"; File: \"051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll\")\n Found reference to API \"GetShellWindow\" (Indicator: \"GetShellWindow\"; File: \"051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll\")\n Found reference to API \"GetShellWindow\" (Indicator: \"GetShellWindow\"; Source: \"00000000-00005544.00000003.207944.0024D000.00000002.mdmp\")\n Found reference to API \"GetWindowThreadProcessId\" (Indicator: \"GetWindowThreadProcessId\"; Source: \"00000000-00005544.00000003.207944.0024D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-208","sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"level":"informative","category":"General","name":"Contains reference to licensed c/c++ library","description":"Found string \"Copyright (c) 1992-2004 by P.J. Plauger, licensed by Dinkumware, Ltd. ALL RIGHTS RESERVED.\" (Indicator: \"Copyright (c) 1992-2004 by P.J. Plauger\n licensed by Dinkumware\n Ltd. ALL RIGHTS RESERVED.\"; File: \"051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-462","sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"level":"informative","category":"General","name":"Contains references to file movement (imports API)","description":"Found MoveFileA in import section (Source: 051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll)","origin":"Static Parser","mitre_attack_id":"T1083","relevance":1,"id":"static-205","sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"\"Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\\" in Source: 00000000-00005544.00000000.196677.02710000.00000004.mdmp\n 00000000-00005544.00000001.198597.02710000.00000004.mdmp\n 00000000-00005544.00000002.200517.02710000.00000004.mdmp\n 00000000-00005544.00000003.207944.02710000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"level":"informative","category":"General","name":"Found a reference to a known community page","description":"Found string \"api.twitter.com/1.1/\" (Indicator: \"twitter\"; File: \"051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll\")\n Found string \"api.twitter.com/oauth/request_token\" (Indicator: \"twitter\"; File: \"051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll\")\n Found string \"api.twitter.com/oauth/authorize?oauth_token=\" (Indicator: \"twitter\"; File: \"051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll\")\n Found string \"api.twitter.com/oauth/access_token\" (Indicator: \"twitter\"; File: \"051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll\")","origin":"File/Memory","relevance":2,"id":"string-10","sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"\"Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\\" in Source: 00000000-00005544.00000000.196677.02710000.00000004.mdmp\n \"Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\\" in Source: 00000000-00005544.00000001.198597.02710000.00000004.mdmp\n \"Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\\" in Source: 00000000-00005544.00000002.200517.02710000.00000004.mdmp\n \"Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\\" in Source: 00000000-00005544.00000003.207944.02710000.00000004.mdmp","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"level":"informative","category":"General","name":"Found user-agent related strings","description":"Found string \"User-Agent: %s\" (Indicator: \"user-agent: \"; File: \"051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll\")\n Found string \"User-Agent: %s\" (Indicator: \"user-agent: \"; Source: \"00000000-00005544.00000003.207944.0024D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-127","sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"level":"informative","category":"General","name":"Loads Windows LDAP client module","description":"\"051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll.exe\" loaded module \"%WINDIR%\\SysWOW64\\Wldap32.dll\" at 75710000","origin":"Loaded Module","mitre_attack_id":"T1069.002","relevance":3,"id":"module-17","sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$38","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 77860000\n \"051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 73430000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 77B20000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll\" was detected as \"EP:Microsoft Visual C/C++\" and name: \"Compiler\"\n \"051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll\" was detected as \"Microsoft Visual C/C++\" and name: \"Compiler\"\n \"051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll\" was detected as \"Microsoft Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll\" has an writable section named \".data\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"\"051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll\" file has an entrypoint instructions - \"call\t0x413dcd,jmp\t0x40af29,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,mov\tecx, dword ptr [esp + 4],test\tecx, 3,je\t0x40b0f0,mov\tal, byte ptr [ecx],add\tecx, 1,test\tal, al,je\t0x40b123,test\tecx, 3,jne\t0x40b0cc,add\teax, 0,lea\tesp, [esp],lea\tesp, [esp],mov\teax, dword ptr [ecx],mov\tedx, 0x7efefeff,add\tedx, eax,xor\teax, 0xffffffff,xor\teax, edx,add\tecx, 4,test\teax, 0x81010100,je\t0x40b0f0,mov\teax, dword ptr [ecx - 4],\"","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")\n \"051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"level":"informative","category":"General","name":"References Windows LDAP client module","description":"Found string \"WLDAP32.dll\" (File: \"051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll\")\n Found string \":\\WINDOWS\\System32\\WLDAP32.dll\" (Source: \"00000000-00005544.00000000.196677.02710000.00000004.mdmp, 00000000-00005544.00000001.198597.02710000.00000004.mdmp, 00000000-00005544.00000002.200517.02710000.00000004.mdmp, 00000000-00005544.00000003.207944.02710000.00000004.mdmp\")\n Found string \"WLDAP32.dll\" (Source: \"00000000-00005544.00000003.207944.0024D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1069.002","relevance":1,"id":"string-987","sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll\")\n Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00005544.00000003.207944.0024D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$39","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll.exe\" queries basic process information of the \"C:\\051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll.exe\" (UID: 5544)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$3a","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"level":"informative","category":"Installation/Persistence","name":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)","description":"\"051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll.exe\" called \"NtQueueApcThread\" (UID: 00000000-00005544)","origin":"API Call","mitre_attack_id":"T1055.004","relevance":3,"id":"api-85","sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Able to identify virtual environment by using user activity (API string)\n Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: Makes a code branch decision directly after an API that is environment aware\n Matched sigs: Contains ability to detect virtual environment (API)\n Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques\n Matched sigs: Possibly tries to evade analysis by sleeping many times\n Matched sigs: The input sample contains a known anti-VM trick\n Matched sigs: Triggers a burst of requests to the same API (API Hammering)\n Matched sigs: Contains ability to delay the execution of current thread","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$3b","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$3c","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"\"051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll.exe\" trying to access non-existent file \"\\Device\\RasAcd\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"level":"informative","category":"Network Related","name":"Able to monitor socket connection","description":"Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; File: \"051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll\")","origin":"File/Memory","mitre_attack_id":"T1205.002","relevance":1,"id":"string-879","sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to retrieve the URL data","description":"\"051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll.exe\" called \"InternetReadFile\" with parameter 1024 (UID: 00000000-00005544)","origin":"API Call","mitre_attack_id":"T1105","relevance":3,"id":"api-118","sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"level":"informative","category":"Network Related","name":"Calls an API used to connect to internet","description":"\"051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll.exe\" called \"InternetOpenA\" (UID: 00000000-00005544)","origin":"API Call","mitre_attack_id":"T1071.001","relevance":1,"id":"api-199","sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with C2 using Sockets (API string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; File: \"051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll\")\n Found reference to API \"WSAStartup failed (%d)\" (Indicator: \"WSAStartup\"; File: \"051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll\")\n Found reference to API \"WSAStartup failed (%d)\" (Indicator: \"WSAStartup\"; Source: \"00000000-00005544.00000003.207944.0024D000.00000002.mdmp\")\n Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; Source: \"00000000-00005544.00000003.207944.0024D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1095","relevance":1,"id":"string-228","sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"$3d","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create/connect to a named pipe (API string)","description":"Found reference to API \"PeekNamedPipe\" (Indicator: \"PeekNamedPipe\"; File: \"051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll\")\n Found reference to API \"PeekNamedPipe\" (Indicator: \"PeekNamedPipe\"; Source: \"00000000-00005544.00000003.207944.0024D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-210","sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"level":"informative","category":"Network Related","name":"Contains ability to download a file from a URL (API string)","description":"$3e","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-241","sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"level":"informative","category":"Network Related","name":"Contains ability to open a port and listen for incoming connection (API string)","description":"Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; File: \"051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll\")","origin":"File/Memory","mitre_attack_id":"T1571","relevance":1,"id":"string-419","sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"level":"informative","category":"Network Related","name":"Contains ability to transfer data using curl","description":"Observed string: \"curl\" (Indicator: \"curl\") in Source: 00000000-00005544.00000003.207944.0024D000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-576","sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"level":"informative","category":"Network Related","name":"Contains ability to upload file/data","description":"Found string \"Content-Type: multipart/form-data\"; File: \"051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll\")\n Found string \"Content-Disposition: form-data; name=\"\"; File: \"051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll\"), Found string \"Content-Disposition: form-data; name=\"\"; Source: \"00000000-00005544.00000003.207944.0024D000.00000002.mdmp\")\n Found string \"Content-Type: multipart/form-data\"; Source: \"00000000-00005544.00000003.207944.0024D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1041","relevance":1,"id":"string-511","sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"level":"informative","category":"Network Related","name":"Contains reference to Mail transfer protocol","description":"Found string \"smtps\" (Indicator: \"smtp\"; File: \"051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll\")\n Found string \"SMTP.\" (Indicator: \"smtp\"; File: \"051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll\")\n Found string \"SMTPS\" (Indicator: \"smtp\"; File: \"051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll\")\n Found string \"Got unexpected smtp-server response: %d\" (Indicator: \"smtp\"; File: \"051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll\")","origin":"File/Memory","mitre_attack_id":"T1071.003","relevance":1,"id":"string-499","sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"level":"informative","category":"Network Related","name":"Contains reference to Windows internet services (API string)","description":"$3f","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-539","sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"$40","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"level":"informative","category":"Network Related","name":"Found mail related domain names","description":"Observed email domain:\"pop3.\" [Source: 051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll]\n Observed email domain:\"smtp.\" [Source: 051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll]\n Observed email domain:\"imap.\" [Source: 051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll]\n Observed email domain:\"pop3.\" [Source: 00000000-00005544.00000003.207944.0024D000.00000002.mdmp]\n Observed email domain:\"smtp.\" [Source: 00000000-00005544.00000003.207944.0024D000.00000002.mdmp]\n Observed email domain:\"imap.\" [Source: 00000000-00005544.00000003.207944.0024D000.00000002.mdmp]","origin":"File/Memory","mitre_attack_id":"T1071.003","relevance":1,"id":"string-169","sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$41","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"level":"informative","category":"Network Related","name":"Found string related to HTTP headers","description":"$42","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-457","sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"Found HTTPS url \"https://curl.haxx.se\"\n Found HTTPS url \"https://www.amazon.com\"","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-98","sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"level":"informative","category":"Network Related","name":"References OpenSSL library string","description":"$43","origin":"File/Memory","mitre_attack_id":"T1573.002","relevance":1,"id":"string-5003","sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"level":"informative","category":"Network Related","name":"Shows ability to send encrypted data to the internet","description":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network","origin":"Indicator Combinations","mitre_attack_id":"T1119","relevance":2,"id":"summary-27","sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"level":"informative","category":"Network Related","name":"Uses cURL to communicate over HTTPS","description":"$44","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-722","sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - AES encryption","description":"YARA signature for AES encryption matched on process \"00000000-00005544\"\n YARA signature for AES encryption matched on file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-103","sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - Djb2 Hash Algorithm","description":"YARA signature for Djb2 Hash Algorithm matched on file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-542","sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - Medium entropy File","description":"YARA signature to detect medium entropy file process \"00000000-00005544\"","origin":"YARA Signature","mitre_attack_id":"T1027.013","relevance":5,"id":"yara-606","sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - RC4 Encryption","description":"YARA signature for RC4 encryption matched on process \"00000000-00005544\"\n YARA signature for RC4 encryption matched on file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1027","id":"yara-104","sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match – ROR algorithm","description":"YARA signature matched on R0R instruction used in file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":1,"id":"yara-209","sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"level":"informative","category":"Remote Access Related","name":"Able to use IDE tunneling for remote connection","description":"Found string \"Error in the SSH layer\" (Indicator: \" ssh \"; File: \"051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll\")\n Found string \"SSL peer certificate or SSH remote key was not OK\" (Indicator: \" ssh \"; File: \"051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll\")\n Found string \"Error in the SSH layer\" (Indicator: \" ssh \"; Source: \"00000000-00005544.00000003.207944.0024D000.00000002.mdmp\")\n Found string \"SSL peer certificate or SSH remote key was not OK\" (Indicator: \" ssh \"; Source: \"00000000-00005544.00000003.207944.0024D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1219","relevance":1,"id":"string-883","sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to import GetCommandLine API, which retrieves the command line string for the current process","description":"Observed import api \"GetCommandLineA\" which can \"retrieve the command-line string for the current process\" [Source: 051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll]","origin":"Static Parser","mitre_attack_id":"T1059.003","relevance":1,"id":"static-88","sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$45","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to capture screen (API string)","description":"$46","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to determine disk drive type (API string)","description":"Found reference to API \"GetDriveTypeA\" (Indicator: \"GetDriveType\"; File: \"051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll\")\n Found reference to API \"GetDriveTypeA\" (Indicator: \"GetDriveType\"; Source: \"00000000-00005544.00000003.207944.0024D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-80","sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"Found reference to API \"FindFirstFileA\" (Indicator: \"FindFirstFile\"; File: \"051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll\")\n Found reference to API \"FindNextFileA\" (Indicator: \"FindNextFile\"; File: \"051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll\")\n Found reference to API \"FindFirstFileA\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00005544.00000003.207944.0024D000.00000002.mdmp\")\n Found reference to API \"FindNextFileA\" (Indicator: \"FindNextFile\"; Source: \"00000000-00005544.00000003.207944.0024D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$47","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; File: \"051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll\")\n Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00005544.00000003.207944.0024D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; File: \"051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll\")\n Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; File: \"051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll\")\n Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00005544.00000003.207944.0024D000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00005544.00000003.207944.0024D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00005544.00000003.207944.0024D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve data about the local computer (API string)","description":"Found reference to API \"InterlockedExchange\" (Indicator: \"InterlockedExchange\"; File: \"051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll\")\n Found reference to API \"InterlockedExchange\" (Indicator: \"InterlockedExchange\"; Source: \"00000000-00005544.00000003.207944.0024D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":3,"id":"string-115","sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"$48","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the NetBIOS name of the local computer (API string)","description":"Found reference to API \"GetComputerNameA\" (Indicator: \"GetComputerName\"; File: \"051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll\")\n Found reference to API \"GetComputerNameA\" (Indicator: \"GetComputerName\"; Source: \"00000000-00005544.00000003.207944.0024D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-122","sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; File: \"051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll\")\n Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00005544.00000003.207944.0024D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host name of a computer (API string)","description":"Found reference to API \"gethostname\" (Indicator: \"gethostname\"; File: \"051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll\")\n Found reference to API \"gethostname() failed, continuing without!\" (Indicator: \"gethostname\"; File: \"051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll\")\n Found reference to API \"gethostname() failed, continuing without!\" (Indicator: \"gethostname\"; Source: \"00000000-00005544.00000003.207944.0024D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-532","sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"Found reference to API \"GetEnvironmentVariableA\" (Indicator: \"GetEnvironmentVariable\"; File: \"051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll\")\n Found reference to API \"GetEnvironmentVariableA\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00005544.00000003.207944.0024D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-107","sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the local name for a socket (API string)","description":"Found reference to API \"getsockname\" (Indicator: \"getsockname\"; File: \"051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll\")\n Found reference to API \"getsockname() failed with errno %d: %s\" (Indicator: \"getsockname\"; File: \"051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll\")\n Found reference to API \"getsockname() failed: %s\" (Indicator: \"getsockname\"; File: \"051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll\")\n Found reference to API \"getsockname() failed with errno %d: %s\" (Indicator: \"getsockname\"; Source: \"00000000-00005544.00000003.207944.0024D000.00000002.mdmp\")\n Found reference to API \"getsockname() failed: %s\" (Indicator: \"getsockname\"; Source: \"00000000-00005544.00000003.207944.0024D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-224","sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00005544.00000003.207944.0024D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve usernames and/or user information (API string)","description":"$49","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"$4a","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"level":"informative","category":"System Security","name":"Able to retrieve/open a process (API string)","description":"Found string \"OpenProcess\" (Indicator: \"OpenProcess\"; File: \"051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll\")\n Found string \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00005544.00000003.207944.0024D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-729","sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"level":"informative","category":"System Security","name":"Calls an API used to open a process handle","description":"Observed import api \"OpenProcess\" which can be \"used to open a process handle\" [Source: 051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll]","origin":"Static Parser","mitre_attack_id":"T1489","relevance":5,"id":"static-191","sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"Found string \":\\WINDOWS\\system32\\DRIVERS\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00005544.00000000.196677.02710000.00000004.mdmp, 00000000-00005544.00000001.198597.02710000.00000004.mdmp, 00000000-00005544.00000002.200517.02710000.00000004.mdmp, 00000000-00005544.00000003.207944.02710000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"RemoveDirectoryA\" (Indicator: \"RemoveDirectory\"; File: \"051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll\")\n Found reference to API \"DeleteFileA\" (Indicator: \"DeleteFile\"; File: \"051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll\")\n Found reference to API \"RemoveDirectoryA\" (Indicator: \"RemoveDirectory\"; Source: \"00000000-00005544.00000003.207944.0024D000.00000002.mdmp\")\n Found reference to API \"DeleteFileA\" (Indicator: \"DeleteFile\"; Source: \"00000000-00005544.00000003.207944.0024D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"level":"informative","category":"System Security","name":"Contains ability to format disks","description":"Found string \"format error in certificate's notBefore field\" (Indicator: \"format \"; File: \"051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll\")\n Found string \"format error in certificate's notAfter field\" (Indicator: \"format \"; File: \"051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll\")\n Found string \"format error in CRL's lastUpdate field\" (Indicator: \"format \"; File: \"051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll\")\n Found string \"format error in CRL's nextUpdate field\" (Indicator: \"format \"; File: \"051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll\")","origin":"File/Memory","mitre_attack_id":"T1561.001","relevance":1,"id":"string-407","sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify file attributes (API string)","description":"Found reference to API \"SetFileAttributesA\" (Indicator: \"SetFileAttributes\"; File: \"051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll\")\n Found reference to API \"SetFileAttributesA\" (Indicator: \"SetFileAttributes\"; Source: \"00000000-00005544.00000003.207944.0024D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1222","relevance":1,"id":"string-426","sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"level":"informative","category":"System Security","name":"Contains ability to shutdown system","description":"Observed string: \"shutdown\" (Indicator: \"shutdown\") in Source: 051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll","origin":"File/Memory","mitre_attack_id":"T1529","relevance":1,"id":"string-406","sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; File: \"051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; File: \"051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll\")\n Found reference to API \"CorExitProcess\" (Indicator: \"ExitProcess\"; File: \"051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll\")\n Found reference to API \"CorExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00005544.00000003.207944.0024D000.00000002.mdmp\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00005544.00000003.207944.0024D000.00000002.mdmp\")\n Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00005544.00000003.207944.0024D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00005544.00000003.207944.0024D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"level":"informative","category":"System Security","name":"Imports a library used to perform LDAP operation","description":"Observed import dll \"wldap32.dll\" which can perform LDAP operation [Source: 051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll]","origin":"Static Parser","mitre_attack_id":"T1069.002","relevance":3,"id":"static-225","sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$4b","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to free the memory used by network management functions (API string)","description":"Found reference to API \"NetApiBufferFree\" (Indicator: \"NetApiBufferFree\"; File: \"051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll\")\n Found reference to API \"NetApiBufferFree\" (Indicator: \"NetApiBufferFree\"; Source: \"00000000-00005544.00000003.207944.0024D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-223","sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"level":"informative","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"$4c","origin":"File/Memory","mitre_attack_id":"T1106","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Section contains high entropy","description":"\"051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll\" has section name .text with entropy \"6.650653156342335\"","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match – cryptographic algorithms","description":"YARA signature matched on AES instruction used in file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1027.013","relevance":3,"id":"yara-155","sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Checks warning level of secure to non-secure traffic redirection","description":"\"051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"WARNONHTTPSTOHTTPREDIRECT\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":7,"id":"registry-9","sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"level":"suspicious","category":"System Destruction","name":"Contains ability to remove directories","description":"RemoveDirectoryA@KERNEL32.dll at 47646-5618-00406AF7","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1070.004","relevance":3,"id":"stream-109","sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]}],"incidents":[{"name":"Spyware","details_count":1,"details":[{"detail":"Accesses potentially sensitive information from local browsers"}],"sources":[{"report_type":"sandbox","report_id":"5bdf36af7ca3e1784055edfd"},{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"name":"Fingerprint","details_count":6,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Found a dropped file containing the Windows username (possible fingerprint attempt)"},{"detail":"Reads the cryptographic machine GUID"},{"detail":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)"},{"detail":"Reads the active computer name"},{"detail":"Queries sensitive IE security settings"}],"sources":[{"report_type":"sandbox","report_id":"5bdf36af7ca3e1784055edfd"},{"report_type":"sandbox","report_id":"5bdf36b37ca3e1784055ee02"},{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"name":"Evasive","details_count":4,"details":[{"detail":"Marks file for deletion"},{"detail":"The input sample contains a known anti-VM trick"},{"detail":"Modifies file/console tracing settings (often used to hide footprints on system)"},{"detail":"Possibly tries to implement anti-virtualization techniques"}],"sources":[{"report_type":"sandbox","report_id":"5bdf36af7ca3e1784055edfd"},{"report_type":"sandbox","report_id":"5bdf36b37ca3e1784055ee02"},{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 1 domain and 1 host"}],"sources":[{"report_type":"sandbox","report_id":"5bdf36af7ca3e1784055edfd"},{"report_type":"sandbox","report_id":"5bdf36b37ca3e1784055ee02"}]},{"name":"Persistence","details_count":1,"details":[{"detail":"Modifies System Certificates Settings"}],"sources":[{"report_type":"sandbox","report_id":"5bdf36b37ca3e1784055ee02"}]}]},"activity":{"stats":{"process_count":1,"spawned_processes_count":1,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":17,"imported_dlls_count":100,"dropped_files_count":0,"extracted_files_count":15,"files_written_count":45,"files_deleted_count":0,"registry_keys_created_count":8,"registry_keys_modified_count":0,"registry_keys_deleted_count":4,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":12,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":2,"dns_resolutions_count":1,"contacted_urls_count":1,"http_requests_count":1},"behavior_tags":["cainabel","coinminer","floxif","installmonstr","miner","ricochetchollima","rokrat","targeted","maldoc","backdoor","ligzoc","plugx","sendsafe","rat"],"sample_flags":["Network Traffic","Extracted Files","Sample not shared","TOR analysis"],"sandbox_reports":[{"id":"68e76aeb45f1e9b9820db4cc","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"submit_name":"051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.dll","analysis_start_time":"2025-10-09T07:57:32+00:00","indicators_count":{"informative":165,"suspicious":31,"malicious":2},"is_in_unified_schema":true},{"id":"5bdf36b37ca3e1784055ee02","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Backdoor.Agent","contacted_countries":["USA"],"submit_name":"051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.exe","analysis_start_time":"2018-11-04T19:15:54+00:00","indicators_count":{"informative":20,"suspicious":19,"malicious":8},"tags":["Network Traffic","Extracted Files","Sample not shared","TOR analysis"],"is_in_unified_schema":true},{"id":"5bdf36af7ca3e1784055edfd","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Backdoor.Agent","contacted_countries":["USA"],"submit_name":"051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.exe","analysis_start_time":"2018-11-04T19:15:53+00:00","indicators_count":{"informative":21,"suspicious":24,"malicious":6},"tags":["Network Traffic","Extracted Files","Sample not shared","TOR analysis"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"172.227.96.141","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5bdf36af7ca3e1784055edfd"}]},{"address":"172.227.96.141","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5bdf36af7ca3e1784055edfd"}]}],"dns_resolutions":[{"domain":"www.hulu.com","address":"172.227.96.141","ttl":300,"country":"United States","registrar_name":"CSC CORPORATE DOMAINS, INC.","registrar_organization":"Hulu, LLC","registrar_name_servers":"ASIA1.AKAM.NET","registrar_creation_date":"1997-02-21T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"5bdf36af7ca3e1784055edfd"},{"report_type":"sandbox","report_id":"5bdf36b37ca3e1784055ee02"}]}],"http_requests":[{"host":"www.hulu.com","host_ip":"172.227.96.141:80","url":"/watch/559035/episode3.mp4","method":"GET","header":"GET /watch/559035/episode3.mp4 HTTP/1.1\nHost: www.hulu.com","sources":[{"report_type":"sandbox","report_id":"5bdf36af7ca3e1784055edfd"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"5bdf36af7ca3e1784055edfd"}],"processes":[{"pid":2076,"ppid":0,"name":"051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.exe","command_line":"","sha256":"051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00","normalized_path":"C:\\051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.exe","uid":"00030274-00002076","icon":"$4d"}],"all_imported_dlls":["ntdll.dll","usp10.dll","urlmon.dll","imm32.dll","pnrpnsp.dll","wship6.dll","ncrypt.dll","schannel.dll","lpk.dll","winnsi.dll","winrnr.dll","rasadhlp.dll","clbcatq.dll","webio.dll","version.dll","WSHTCPIP.DLL","advapi32.dll","msvcrt.dll","sechost.dll","rpcrt4.dll","iertutil.dll","dnsapi.dll","rsaenh.dll","credssp.dll","setupapi.dll","user32.dll","msasn1.dll","comctl32.dll","IPHLPAPI.DLL","dhcpcsvc.dll","bcrypt.dll","cabinet.dll","devobj.dll","shlwapi.dll","oleaut32.dll","gdi32.dll","RpcRtRemote.dll","npmproxy.dll","gpapi.dll","winhttp.dll","KernelBase.dll","NapiNSP.dll","netprofm.dll","wininet.dll","ole32.dll","crypt32.dll","msctf.dll","profapi.dll","rtutils.dll","cryptbase.dll","bcryptprimitives.dll","dhcpcsvc6.dll","sspicli.dll","FWPUCLNT.DLL","cryptsp.dll","cryptnet.dll","devrtl.dll","kernel32.dll","ws2_32.dll","nsi.dll","Wldap32.dll","ntmarta.dll","SensApi.dll","rasapi32.dll","userenv.dll","wintrust.dll","shell32.dll","secur32.dll","cfgmgr32.dll","rasman.dll","nlaapi.dll","mswsock.dll","api-ms-win-downlevel-shlwapi-l2-1-0.dll","api-ms-win-downlevel-version-l1-1-0.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","normaliz.dll","wow64cpu.dll","api-ms-win-downlevel-user32-l1-1-0.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","wshqos.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll","wow64.dll","api-ms-win-downlevel-ole32-l1-1-0.dll","wow64win.dll","api-ms-win-downlevel-advapi32-l2-1-0.dll","apphelp.dll","fltLib.dll","imagehlp.dll","combase.dll","msIso.dll","VxSSL32.dll","gdi32full.dll","OnDemandConnRouteHelper.dll","windows.storage.dll","kernel.appcore.dll","win32u.dll","msvcp_win.dll","ucrtbase.dll","SHCore.dll","powrprof.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"Cab2B13.tmp","sha256":"c929701c67a05f90827563eedccf5eba8e65b2da970189a0371f28cd896708b8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5bdf36af7ca3e1784055edfd"}]},{"name":"Cab7E5D.tmp","sha256":"c929701c67a05f90827563eedccf5eba8e65b2da970189a0371f28cd896708b8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5bdf36af7ca3e1784055edfd"}]},{"name":"pspubws@hulu[1].txt","sha256":"0fa7b681a45ba53f3c980fec508457f43fb8aa83fef01e7fdc7010502214441a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5bdf36af7ca3e1784055edfd"}]},{"name":"pspubws@hulu[2].txt","sha256":"aabd0a90c64cfbc2377f3bff1eda71644241d6250efd40a12aa9178c50dc40fa","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5bdf36af7ca3e1784055edfd"}]},{"name":"7423F88C7F265F0DEFC08EA88C3BDE45_D975BBA8033175C8D112023D8A7A8AD6","sha256":"661d5c1d9f4e75bf56368bba581d5d75f32dd49d830e078aaf637648f3f41e62","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5bdf36af7ca3e1784055edfd"},{"report_type":"sandbox","report_id":"5bdf36b37ca3e1784055ee02"}]},{"name":"94308059B57B3142E455B38A6EB92015","sha256":"34fc241110e467426f07f77834e7b4a99371c9d3474c10be99b86d7826e897c5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5bdf36af7ca3e1784055edfd"}]},{"name":"Cab7936.tmp","sha256":"10632f5e8df34d4641f11aa0ad917a629bf75f7c0eaa77506c5a27919e7b12aa","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5bdf36af7ca3e1784055edfd"}]},{"name":"CabA81D.tmp","sha256":"c929701c67a05f90827563eedccf5eba8e65b2da970189a0371f28cd896708b8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5bdf36af7ca3e1784055edfd"}]},{"name":"Tar2B14.tmp","sha256":"7e58975a4e1e86940f84e744709426939b85ae174dbbf020da3c893a54fd1da2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5bdf36af7ca3e1784055edfd"}]},{"name":"Tar7937.tmp","sha256":"114e885ba63cf9ff16cbc3aff1134aa44f0b31de68d391d5eb2c50756ca83af8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5bdf36af7ca3e1784055edfd"}]},{"name":"Tar7E5E.tmp","sha256":"7e58975a4e1e86940f84e744709426939b85ae174dbbf020da3c893a54fd1da2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5bdf36af7ca3e1784055edfd"}]},{"name":"TarA81E.tmp","sha256":"7e58975a4e1e86940f84e744709426939b85ae174dbbf020da3c893a54fd1da2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5bdf36af7ca3e1784055edfd"}]},{"name":"3FYI60TH.txt","sha256":"9adedf6d3eac9dd0023f5d53810797e9a842c2d2baadc6fc25c1278e9c318ba3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5bdf36b37ca3e1784055ee02"}]},{"name":"L47CHLN0.txt","sha256":"9feb3c21d335f41fa3d0f7fa63b49dd48fdc307612ee31e67603a7882153b760","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5bdf36b37ca3e1784055ee02"}]},{"name":"57C8EDB95DF3F0AD4EE2DC2B8CFD4157","sha256":"eb4191fa47c5ca2fc363fd0f39f67ddc21bfa875a0431d54ac960492fe56f35f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5bdf36b37ca3e1784055ee02"}]}],"files_written":[{"path":"c:\\temp\\esoftscrap.jpg","sources":[{"report_type":"sandbox","report_id":"5bdf36af7ca3e1784055edfd"},{"report_type":"sandbox","report_id":"5bdf36b37ca3e1784055ee02"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"5bdf36af7ca3e1784055edfd"},{"report_type":"sandbox","report_id":"5bdf36b37ca3e1784055ee02"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"5bdf36af7ca3e1784055edfd"},{"report_type":"sandbox","report_id":"5bdf36b37ca3e1784055ee02"},{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"5bdf36af7ca3e1784055edfd"},{"report_type":"sandbox","report_id":"5bdf36b37ca3e1784055ee02"},{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files","sources":[{"report_type":"sandbox","report_id":"5bdf36af7ca3e1784055edfd"},{"report_type":"sandbox","report_id":"5bdf36b37ca3e1784055ee02"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"5bdf36af7ca3e1784055edfd"},{"report_type":"sandbox","report_id":"5bdf36b37ca3e1784055ee02"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies","sources":[{"report_type":"sandbox","report_id":"5bdf36af7ca3e1784055edfd"},{"report_type":"sandbox","report_id":"5bdf36b37ca3e1784055ee02"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"5bdf36af7ca3e1784055edfd"},{"report_type":"sandbox","report_id":"5bdf36b37ca3e1784055ee02"},{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat","sources":[{"report_type":"sandbox","report_id":"5bdf36af7ca3e1784055edfd"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\index.dat","sources":[{"report_type":"sandbox","report_id":"5bdf36af7ca3e1784055edfd"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History\\History.IE5\\index.dat","sources":[{"report_type":"sandbox","report_id":"5bdf36af7ca3e1784055edfd"}]},{"path":"%WINDIR%\\System32\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"5bdf36af7ca3e1784055edfd"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{E29AC6C2-7037-11DE-816D-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"5bdf36af7ca3e1784055edfd"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{9C9C1D9A-E45A-41F9-8D98-D3B6EA5D768D}","sources":[{"report_type":"sandbox","report_id":"5bdf36af7ca3e1784055edfd"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{72D885C2-0AEC-4510-95D5-BF120A963535}","sources":[{"report_type":"sandbox","report_id":"5bdf36af7ca3e1784055edfd"}]},{"path":"%WINDIR%\\System32\\en-US\\urlmon.dll.mui","sources":[{"report_type":"sandbox","report_id":"5bdf36af7ca3e1784055edfd"}]},{"path":"%WINDIR%\\System32\\en-US\\crypt32.dll.mui","sources":[{"report_type":"sandbox","report_id":"5bdf36af7ca3e1784055edfd"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\7423F88C7F265F0DEFC08EA88C3BDE45_1374AC543829516A5CA56081CD00C32A","sources":[{"report_type":"sandbox","report_id":"5bdf36af7ca3e1784055edfd"},{"report_type":"sandbox","report_id":"5bdf36b37ca3e1784055ee02"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\69C6F6EC64E114822DF688DC12CDD86C","sources":[{"report_type":"sandbox","report_id":"5bdf36af7ca3e1784055edfd"},{"report_type":"sandbox","report_id":"5bdf36b37ca3e1784055ee02"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\6DB145CFEEC544B1582FED1ADA3370DD","sources":[{"report_type":"sandbox","report_id":"5bdf36af7ca3e1784055edfd"},{"report_type":"sandbox","report_id":"5bdf36b37ca3e1784055ee02"}]},{"path":"%WINDIR%\\System32\\en-US\\KernelBase.dll.mui","sources":[{"report_type":"sandbox","report_id":"5bdf36af7ca3e1784055edfd"}]},{"path":"%WINDIR%\\System32\\en-US\\winhttp.dll.mui","sources":[{"report_type":"sandbox","report_id":"5bdf36af7ca3e1784055edfd"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\7423F88C7F265F0DEFC08EA88C3BDE45_D975BBA8033175C8D112023D8A7A8AD6","sources":[{"report_type":"sandbox","report_id":"5bdf36af7ca3e1784055edfd"},{"report_type":"sandbox","report_id":"5bdf36b37ca3e1784055ee02"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\7423F88C7F265F0DEFC08EA88C3BDE45_D975BBA8033175C8D112023D8A7A8AD6","sources":[{"report_type":"sandbox","report_id":"5bdf36af7ca3e1784055edfd"},{"report_type":"sandbox","report_id":"5bdf36b37ca3e1784055ee02"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\94308059B57B3142E455B38A6EB92015","sources":[{"report_type":"sandbox","report_id":"5bdf36af7ca3e1784055edfd"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\94308059B57B3142E455B38A6EB92015","sources":[{"report_type":"sandbox","report_id":"5bdf36af7ca3e1784055edfd"}]},{"path":"%WINDIR%\\System32\\en-US\\setupapi.dll.mui","sources":[{"report_type":"sandbox","report_id":"5bdf36af7ca3e1784055edfd"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@hulu[1].txt","sources":[{"report_type":"sandbox","report_id":"5bdf36af7ca3e1784055edfd"}]},{"path":"c:\\temp\\episode3.mp4","sources":[{"report_type":"sandbox","report_id":"5bdf36af7ca3e1784055edfd"},{"report_type":"sandbox","report_id":"5bdf36b37ca3e1784055ee02"}]},{"path":"C:","sources":[{"report_type":"sandbox","report_id":"5bdf36b37ca3e1784055ee02"}]},{"path":"%WINDIR%\\SysWOW64\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"5bdf36b37ca3e1784055ee02"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\BK8VDDFX.txt","sources":[{"report_type":"sandbox","report_id":"5bdf36b37ca3e1784055ee02"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\4PJAPWJP.txt","sources":[{"report_type":"sandbox","report_id":"5bdf36b37ca3e1784055ee02"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\counters.dat","sources":[{"report_type":"sandbox","report_id":"5bdf36b37ca3e1784055ee02"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{846EE342-7039-11DE-9D20-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"5bdf36b37ca3e1784055ee02"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{C3450F58-7060-4AEA-B0A0-C245927D78D0}","sources":[{"report_type":"sandbox","report_id":"5bdf36b37ca3e1784055ee02"}]},{"path":"%WINDIR%\\SysWOW64\\wshqos.dll","sources":[{"report_type":"sandbox","report_id":"5bdf36b37ca3e1784055ee02"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\KernelBase.dll.mui","sources":[{"report_type":"sandbox","report_id":"5bdf36b37ca3e1784055ee02"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\57C8EDB95DF3F0AD4EE2DC2B8CFD4157","sources":[{"report_type":"sandbox","report_id":"5bdf36b37ca3e1784055ee02"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\57C8EDB95DF3F0AD4EE2DC2B8CFD4157","sources":[{"report_type":"sandbox","report_id":"5bdf36b37ca3e1784055ee02"}]},{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"path":"C:\\TEMP\\ESOFTSCRAP.JPG","sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache","sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCookies","sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"path":"C:\\TEMP\\EPISODE3.MP4","sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\","sources":[{"report_type":"sandbox","report_id":"5bdf36af7ca3e1784055edfd"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\RASAPI32\\","sources":[{"report_type":"sandbox","report_id":"5bdf36af7ca3e1784055edfd"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\RASMANCS\\","sources":[{"report_type":"sandbox","report_id":"5bdf36af7ca3e1784055edfd"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\","sources":[{"report_type":"sandbox","report_id":"5bdf36af7ca3e1784055edfd"},{"report_type":"sandbox","report_id":"5bdf36b37ca3e1784055ee02"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\CONNECTIONS\\","sources":[{"report_type":"sandbox","report_id":"5bdf36b37ca3e1784055ee02"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\\\","sources":[{"report_type":"sandbox","report_id":"5bdf36b37ca3e1784055ee02"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\\\","sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]}],"keys_modified":null,"keys_deleted":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\PROXYSERVER\\PROXYSERVER","sources":[{"report_type":"sandbox","report_id":"5bdf36b37ca3e1784055ee02"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\PROXYOVERRIDE\\PROXYOVERRIDE","sources":[{"report_type":"sandbox","report_id":"5bdf36b37ca3e1784055ee02"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\AUTOCONFIGURL\\AUTOCONFIGURL","sources":[{"report_type":"sandbox","report_id":"5bdf36b37ca3e1784055ee02"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\AUTODETECT\\AUTODETECT","sources":[{"report_type":"sandbox","report_id":"5bdf36b37ca3e1784055ee02"}]}]},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\DBWinMutex","sources":[{"report_type":"sandbox","report_id":"5bdf36af7ca3e1784055edfd"},{"report_type":"sandbox","report_id":"5bdf36b37ca3e1784055ee02"},{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetStartupMutex","sources":[{"report_type":"sandbox","report_id":"5bdf36af7ca3e1784055edfd"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetConnectionMutex","sources":[{"report_type":"sandbox","report_id":"5bdf36af7ca3e1784055edfd"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetProxyRegistryMutex","sources":[{"report_type":"sandbox","report_id":"5bdf36af7ca3e1784055edfd"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\RasPbFile","sources":[{"report_type":"sandbox","report_id":"5bdf36af7ca3e1784055edfd"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"5bdf36af7ca3e1784055edfd"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5bdf36af7ca3e1784055edfd"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5bdf36af7ca3e1784055edfd"},{"report_type":"sandbox","report_id":"5bdf36b37ca3e1784055ee02"},{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5bdf36af7ca3e1784055edfd"},{"report_type":"sandbox","report_id":"5bdf36b37ca3e1784055ee02"},{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IESQMMUTEX_0_208","sources":[{"report_type":"sandbox","report_id":"5bdf36af7ca3e1784055edfd"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"name":"SM0:5544:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"name":"DBWinMutex","sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"name":"Local\\SM0:5544:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5544:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5544:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"68e76aeb45f1e9b9820db4cc"}]}]}},"report_ids":{"sandbox_job_ids":["68e76aeb45f1e9b9820db4cc","5bdf36b37ca3e1784055ee02","5bdf36af7ca3e1784055edfd"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Backdoor.Agent Sample 051463a14767… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 051463a14767…. Malware family: Backdoor.Agent. Threat score 100/100. 19/28 AV engines flagged this file. 9 malicious and 23 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00"}],["$","meta","4",{"property":"og:title","content":"Malicious Backdoor.Agent Sample 051463a14767… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 051463a14767…. Malware family: Backdoor.Agent. Threat score 100/100. 19/28 AV engines flagged this file. 9 malicious and 23 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Backdoor.Agent Sample 051463a14767… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 051463a14767…. Malware family: Backdoor.Agent. Threat score 100/100. 19/28 AV engines flagged this file. 9 malicious and 23 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L4e","11",{}]]