26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 66:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T480,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Zusy.Generic Sample 05cc7a32e5a0… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 05cc7a32e5a0…. Malware family: Zusy.Generic. Threat score 100/100. 15/27 AV engines flagged this file. 16 malicious and 23 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/05cc7a32e5a0023f9e1c790f97b069ccd27ada59ea8b9864f7f9069e3049663c","keywords":["Malicious","Zusy.Generic","malware analysis","sandbox report","threat intelligence","05cc7a32e5a0023f9e1c790f97b069ccd27ada59ea8b9864f7f9069e3049663c"],"about":{"@type":"SoftwareApplication","name":"???????.exe","applicationCategory":["peexe","executable"],"identifier":"05cc7a32e5a0023f9e1c790f97b069ccd27ada59ea8b9864f7f9069e3049663c","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Zusy.Generic","antivirusDetections":{"malicious":15,"total":27},"behavioralIndicators":{"malicious":16,"suspicious":23},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T468,"gamesetup.exe" called "FindResourceA" with parameter "85816352" - (UID: 00000000-00007100) "gamesetup.exe" called "FindResourceA" with parameter "3" - (UID: 00000000-00007100) "gamesetup.exe" called "FindResourceA" with parameter "4" - (UID: 00000000-00007100) "gamesetup.exe" called "FindResourceA" with parameter "5" - (UID: 00000000-00007100) "gamesetup.exe" called "FindResourceA" with parameter "6" - (UID: 00000000-00007100) "gamesetup.exe" called "FindResourceA" with parameter "7" - (UID: 00000000-00007100) "gamesetup.exe" called "FindResourceA" with parameter "8" - (UID: 00000000-00007100) "gamesetup.exe" called "FindResourceA" with parameter "9" - (UID: 00000000-00007100) "gamesetup.exe" called "FindResourceA" with parameter "10" - (UID: 00000000-00007100) "gamesetup.exe" called "FindResourceA" with parameter "11" - (UID: 00000000-00007100) "gamesetup.exe" called "FindResourceA" with parameter "12" - (UID: 00000000-00007100) "gamesetup.exe" called "FindResourceA" with parameter "13" - (UID: 00000000-00007100) "gamesetup.exe" called "FindResourceA" with parameter "14" - (UID: 00000000-00007100)28:T657,"gamesetup.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '4869304'}" (UID: 00000000-00007100) "gamesetup.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '4868696'}" (UID: 00000000-00007100) "gamesetup.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '4868712'}" (UID: 00000000-00007100) "gamesetup.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '4868728'}" (UID: 00000000-00007100) "gamesetup.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '4868744'}" (UID: 00000000-00007100) "gamesetup.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '4868760'}" (UID: 00000000-00007100) "gamesetup.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '4868776'}" (UID: 00000000-00007100) "gamesetup.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '4868792'}" (UID: 00000000-00007100) "gamesetup.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '4868808'}" (UID: 00000000-00007100) "gamesetup.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '4868824'}" (UID: 00000000-00007100) "gamesetup.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '4868840'}" (UID: 00000000-00007100) "gamesetup.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '4868856'}" (UID: 00000000-00007100) "gamesetup.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '4868872'}" (UID: 00000000-00007100)29:T82a,Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "???????.exe") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "???????.exe") Found reference to API "SetTimer" (Indicator: "SetTimer"; File: "???????.exe") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "???????.exe") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "???????.exe") Found reference to API "MsgWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "???????.exe") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; File: "???????.exe") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00002304.00000000.146996.4C448000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00002304.00000000.146996.4C448000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00002304.00000000.146996.4C448000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00002304.00000000.146996.4C448000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00002304.00000000.146996.4C448000.00000002.mdmp") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00002304.00000000.146996.4C448000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API "SetTimer" (Indicator: "SetTimer"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp")2a:T6b6,".exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}\INPROCSERVER32") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}\INPROCSERVER32") ".exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}\INPROCHANDLER32") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}\INPROCHANDLER32") ".exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}\INPROCHANDLER") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}\INPROCHANDLER") ".exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}\TREATAS") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}\TREATAS") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}\INPROCSERVER32") ".exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}\LOCALSERVER32") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}\LOCALSERVER32") ".exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}\LOCALSERVER") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}\LOCALSERVER") ".exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}\ELEVATION")2b:T953,".exe" queried SystemProcessInformation at 00000000-00000668-00000C15-1271293459 [PID: 668] ".exe" queried SystemProcessInformation at 00000000-00000668-00000C15-1271301739 [PID: 668] ".exe" queried SystemProcessInformation at 00000000-00000668-00000C15-1271501973 [PID: 668] ".exe" queried SystemProcessInformation at 00000000-00000668-00000C15-1271511077 [PID: 668] ".exe" queried SystemProcessInformation at 00000000-00000668-00000C15-1271730916 [PID: 668] ".exe" queried SystemProcessInformation at 00000000-00000668-00000C15-1271738713 [PID: 668] ".exe" queried SystemProcessInformation at 00000000-00000668-00000C15-1273721265 [PID: 668] ".exe" queried SystemProcessInformation at 00000000-00000668-00000C15-1273729673 [PID: 668] ".exe" queried SystemProcessInformation at 00000000-00000668-00000C15-1276961307 [PID: 668] ".exe" queried SystemProcessInformation at 00000000-00000668-00000C15-1276970077 [PID: 668] ".exe" queried SystemProcessInformation at 00000000-00000668-00000C15-1279218507 [PID: 668] ".exe" queried SystemProcessInformation at 00000000-00000668-00000C15-1279231705 [PID: 668] "gamesetup.exe" queried SystemProcessInformation at 00000000-00007100-00000C15-1278415329 [PID: 7100] "gamesetup.exe" queried SystemProcessInformation at 00000000-00007100-00000C15-1278423972 [PID: 7100] "cmd.exe" queried SystemProcessInformation at 00000000-00004776-00000C15-1279812003 [PID: 4776] "cmd.exe" queried SystemProcessInformation at 00000000-00004776-00000C15-1279824459 [PID: 4776] "cmd.exe" queried SystemProcessInformation at 00000000-00004776-00000C15-1280623191 [PID: 4776] "cmd.exe" queried SystemProcessInformation at 00000000-00004776-00000C15-1280632536 [PID: 4776] "cmd.exe" queried SystemProcessInformation at 00000000-00004144-00000C15-1280461828 [PID: 4144] "cmd.exe" queried SystemProcessInformation at 00000000-00004144-00000C15-1280475870 [PID: 4144] "cmd.exe" queried SystemProcessInformation at 00000000-00004144-00000C15-1280933976 [PID: 4144] "cmd.exe" queried SystemProcessInformation at 00000000-00004144-00000C15-1280976595 [PID: 4144] "cmd.exe" queried SystemProcessInformation at 00000000-00007712-00000C15-1280815346 [PID: 7712] "cmd.exe" queried SystemProcessInformation at 00000000-00007712-00000C15-1280824525 [PID: 7712] "cmd.exe" queried SystemProcessInformation at 00000000-00007712-00000C15-1281232971 [PID: 7712]2c:T2617,Found XOR loop in file "gamesetup.exe" at offset 442900; code bytes = 30d0 Found XOR loop in file "gamesetup.exe" at offset 80681; code bytes = 33c1 Found XOR loop in file "gamesetup.exe" at offset 220103; code bytes = 33c1 Found XOR loop in file "gamesetup.exe" at offset 220134; code bytes = 33c1 Found XOR loop in file "gamesetup.exe" at offset 220283; code bytes = 33c1 Found XOR loop in file "gamesetup.exe" at offset 80052; code bytes = 8030 Found XOR loop in file "gamesetup.exe" at offset 416009; code bytes = 8030 Found XOR loop in file "gamesetup.exe" at offset 552879; code bytes = 8030 Found XOR loop in file "panda.exe" at offset 127022; code bytes = 33c1 Found XOR loop in file "panda.exe" at offset 137756; code bytes = 33c1 Found XOR loop in file "panda.exe" at offset 138355; code bytes = 33c1 Found XOR loop in file "panda.exe" at offset 163269; code bytes = 33c1 Found XOR loop in file "panda.exe" at offset 213328; code bytes = 33c1 Found XOR loop in file "panda.exe" at offset 264767; code bytes = 8030 Found XOR loop in file "panda.exe" at offset 394500; code bytes = 8030 Found XOR loop in file "panda.exe" at offset 395921; code bytes = 8030 Found XOR loop in file "krnln.fnr" at offset 15742; code bytes = 30d0 Found XOR loop in file "krnln.fnr" at offset 248595; code bytes = 30d0 Found XOR loop in file "krnln.fnr" at offset 271696; code bytes = 30d0 Found XOR loop in file "krnln.fnr" at offset 281023; code bytes = 30d0 Found XOR loop in file "krnln.fnr" at offset 324223; code bytes = 30d0 Found XOR loop in file "krnln.fnr" at offset 384730; code bytes = 30d0 Found XOR loop in file "krnln.fnr" at offset 475875; code bytes = 30d0 Found XOR loop in file "krnln.fnr" at offset 475964; code bytes = 30d0 Found XOR loop in file "krnln.fnr" at offset 778974; code bytes = 30d0 Found XOR loop in file "krnln.fnr" at offset 977268; code bytes = 30d0 Found XOR loop in file "krnln.fnr" at offset 1036312; code bytes = 30d0 Found XOR loop in file "krnln.fnr" at offset 1222169; code bytes = 30d0 Found XOR loop in file "krnln.fnr" at offset 1223643; code bytes = 30d0 Found XOR loop in file "krnln.fnr" at offset 1228333; code bytes = 30d0 Found XOR loop in file "krnln.fnr" at offset 1243425; code bytes = 30d0 Found XOR loop in file "krnln.fnr" at offset 1247263; code bytes = 30d0 Found XOR loop in file "krnln.fnr" at offset 1248733; code bytes = 30d0 Found XOR loop in file "krnln.fnr" at offset 1249527; code bytes = 30d0 Found XOR loop in file "krnln.fnr" at offset 1251583; code bytes = 30d0 Found XOR loop in file "krnln.fnr" at offset 1253595; code bytes = 30d0 Found XOR loop in file "krnln.fnr" at offset 1255103; code bytes = 30d0 Found XOR loop in file "krnln.fnr" at offset 1259249; code bytes = 30d0 Found XOR loop in file "krnln.fnr" at offset 1266725; code bytes = 30d0 Found XOR loop in file "krnln.fnr" at offset 1268907; code bytes = 30d0 Found XOR loop in file "krnln.fnr" at offset 1269697; code bytes = 30d0 Found XOR loop in file "krnln.fnr" at offset 1271107; code bytes = 30d0 Found XOR loop in file "krnln.fnr" at offset 52601; code bytes = 33c1 Found XOR loop in file "krnln.fnr" at offset 56057; code bytes = 33c1 Found XOR loop in file "krnln.fnr" at offset 59086; code bytes = 33c1 Found XOR loop in file "krnln.fnr" at offset 59351; code bytes = 33c1 Found XOR loop in file "krnln.fnr" at offset 59768; code bytes = 33c1 Found XOR loop in file "krnln.fnr" at offset 60947; code bytes = 33c1 Found XOR loop in file "krnln.fnr" at offset 520631; code bytes = 33c1 Found XOR loop in file "krnln.fnr" at offset 520662; code bytes = 33c1 Found XOR loop in file "krnln.fnr" at offset 520811; code bytes = 33c1 Found XOR loop in file "krnln.fnr" at offset 578075; code bytes = 33c1 Found XOR loop in file "krnln.fnr" at offset 634211; code bytes = 33c1 Found XOR loop in file "krnln.fnr" at offset 732111; code bytes = 33c1 Found XOR loop in file "krnln.fnr" at offset 733136; code bytes = 33c1 Found XOR loop in file "krnln.fnr" at offset 1224291; code bytes = 33c1 Found XOR loop in file "krnln.fnr" at offset 1235991; code bytes = 33c1 Found XOR loop in file "krnln.fnr" at offset 1245427; code bytes = 33c1 Found XOR loop in file "krnln.fnr" at offset 1245997; code bytes = 33c1 Found XOR loop in file "krnln.fnr" at offset 354679; code bytes = 8030 Found XOR loop in file "krnln.fnr" at offset 595340; code bytes = 8030 Found XOR loop in file "krnln.fnr" at offset 750869; code bytes = 8030 Found XOR loop in file "krnln.fnr" at offset 811913; code bytes = 8030 Found XOR loop in file "krnln.fnr" at offset 1150687; code bytes = 8030 Found XOR loop in file "krnln.fnr" at offset 1219752; code bytes = 8030 Found XOR loop in file "krnln.fnr" at offset 1219816; code bytes = 8030 Found XOR loop in file "krnln.fnr" at offset 1220948; code bytes = 8030 Found XOR loop in file "krnln.fnr" at offset 1222736; code bytes = 8030 Found XOR loop in file "krnln.fnr" at offset 1224240; code bytes = 8030 Found XOR loop in file "krnln.fnr" at offset 1231946; code bytes = 8030 Found XOR loop in file "krnln.fnr" at offset 1232408; code bytes = 8030 Found XOR loop in file "krnln.fnr" at offset 1234760; code bytes = 8030 Found XOR loop in file "krnln.fnr" at offset 1242356; code bytes = 8030 Found XOR loop in file "krnln.fnr" at offset 1247224; code bytes = 8030 Found XOR loop in file "krnln.fnr" at offset 1248694; code bytes = 8030 Found XOR loop in file "krnln.fnr" at offset 1249488; code bytes = 8030 Found XOR loop in file "krnln.fnr" at offset 1251544; code bytes = 8030 Found XOR loop in file "krnln.fnr" at offset 1253556; code bytes = 8030 Found XOR loop in file "krnln.fnr" at offset 1255064; code bytes = 8030 Found XOR loop in file "krnln.fnr" at offset 1260856; code bytes = 8030 Found XOR loop in file "krnln.fnr" at offset 1266192; code bytes = 8030 Found XOR loop in file "krnln.fnr" at offset 1267102; code bytes = 8030 Found XOR loop in file "krnln.fnr" at offset 1268892; code bytes = 8030 Found XOR loop in file "krnln.fnr" at offset 1271068; code bytes = 8030 Found XOR loop in file "iext2.fne" at offset 470207; code bytes = 30d0 Found XOR loop in file "iext2.fne" at offset 472979; code bytes = 30d0 Found XOR loop in file "iext2.fne" at offset 477377; code bytes = 30d0 Found XOR loop in file "iext2.fne" at offset 478219; code bytes = 30d0 Found XOR loop in file "iext2.fne" at offset 479449; code bytes = 30d0 Found XOR loop in file "iext2.fne" at offset 482565; code bytes = 30d0 Found XOR loop in file "iext2.fne" at offset 485805; code bytes = 30d0 Found XOR loop in file "iext2.fne" at offset 13278; code bytes = 33c1 Found XOR loop in file "iext2.fne" at offset 13543; code bytes = 33c1 Found XOR loop in file "iext2.fne" at offset 13960; code bytes = 33c1 Found XOR loop in file "iext2.fne" at offset 15139; code bytes = 33c1 Found XOR loop in file "iext2.fne" at offset 302197; code bytes = 8030 Found XOR loop in file "iext2.fne" at offset 471068; code bytes = 8030 Found XOR loop in file "iext2.fne" at offset 479410; code bytes = 8030 Found XOR loop in file "iext2.fne" at offset 480752; code bytes = 8030 Found XOR loop in file "iext2.fne" at offset 481306; code bytes = 8030 Found XOR loop in file "iext2.fne" at offset 483482; code bytes = 8030 Found XOR loop in file "iext2.fne" at offset 483976; code bytes = 8030 Found XOR loop in file "iext2.fne" at offset 485240; code bytes = 8030 Found XOR loop in file "iext2.fne" at offset 485790; code bytes = 8030 Found XOR loop in file "eGrid.fne" at offset 190161; code bytes = 30d0 Found XOR loop in file "eGrid.fne" at offset 255697; code bytes = 30d0 Found XOR loop in file "eGrid.fne" at offset 391415; code bytes = 30d0 Found XOR loop in file "eGrid.fne" at offset 393809; code bytes = 30d0 Found XOR loop in file "eGrid.fne" at offset 388335; code bytes = 33c1 Found XOR loop in file "eGrid.fne" at offset 191676; code bytes = 8030 Found XOR loop in file "eGrid.fne" at offset 386098; code bytes = 8030 Found XOR loop in file "eGrid.fne" at offset 391376; code bytes = 8030 Found XOR loop in file "eGrid.fne" at offset 392668; code bytes = 8030 Found XOR loop in file "eGrid.fne" at offset 393792; code bytes = 8030 Found XOR loop in file "eGrid.fne" at offset 398470; code bytes = 8030 Found XOR loop in file "eAPI.fne" at offset 287339; code bytes = 30d0 Found XOR loop in file "eAPI.fne" at offset 290391; code bytes = 30d0 Found XOR loop in file "eAPI.fne" at offset 298699; code bytes = 30d0 Found XOR loop in file "eAPI.fne" at offset 287308; code bytes = 8030 Found XOR loop in file "eAPI.fne" at offset 290182; code bytes = 8030 Found XOR loop in file "eAPI.fne" at offset 296652; code bytes = 8030 Found XOR loop in file "eAPI.fne" at offset 299026; code bytes = 8030 Found XOR loop in file "iext.fnr" at offset 196007; code bytes = 30d0 Found XOR loop in file "iext.fnr" at offset 196553; code bytes = 30d0 Found XOR loop in file "iext.fnr" at offset 192415; code bytes = 33c1 Found XOR loop in file "iext.fnr" at offset 195968; code bytes = 8030 Found XOR loop in file "iext.fnr" at offset 197786; code bytes = 8030 Found XOR loop in file "iext.fnr" at offset 198628; code bytes = 8030 Found XOR loop in file "mp3.run" at offset 74071; code bytes = 33c1 Found XOR loop in file "mp3.run" at offset 74102; code bytes = 33c1 Found XOR loop in file "mp3.run" at offset 74251; code bytes = 33c1 Found XOR loop in file "mp3.run" at offset 87538; code bytes = 8030 Found XOR loop in file "spec.fne" at offset 67070; code bytes = 8030 Found XOR loop in file "EThread.fne" at offset 58931; code bytes = 30d0 Found XOR loop in file "shell.fne" at offset 58758; code bytes = 80302d:T4f1,file/memory contains long string with (Indicator: "GetCommandLine"; File: "panda.exe") file/memory contains long string with (Indicator: "GetCursorPos"; File: "eGrid.fne") file/memory contains long string with (Indicator: "GetCursorPos"; File: "iext.fnr") file/memory contains long string with (Indicator: "GetCommandLine"; File: "mp3.run") file/memory contains long string with (Indicator: "GetCommandLine"; File: "spec.fne") file/memory contains long string with (Indicator: "GetCommandLine"; File: "EThread.fne") file/memory contains long string with (Indicator: "GetCommandLine"; File: "shell.fne") Found string "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00000668-00000C2B-1273516917") Found string "GetCursorPos" (Indicator: "GetCursorPos"; File: "???????.exe") Found string "GetCommandLineW" (Indicator: "GetCommandLine"; File: "???????.exe") Found string "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00002304.00000000.146996.4C448000.00000002.mdmp") Found string "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found string "GetCursorPos" (Indicator: "GetCursorPos"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp")2e:T962,file/memory contains long string with (Indicator: "sendmessage"; File: "panda.exe") file/memory contains long string with (Indicator: "sendmessage"; File: "eGrid.fne") file/memory contains long string with (Indicator: "sendmessage"; File: "iext.fnr") file/memory contains long string with (Indicator: "postmessage"; File: "mp3.run") Found reference to API "SendMessageA" (Indicator: "sendmessage"; File: "???????.exe") Found reference to API "FindWindowExA" (Indicator: "findwindow"; File: "???????.exe") Found reference to API "PostMessageA" (Indicator: "postmessage"; File: "???????.exe") Found reference to API "EnumChildWindows" (Indicator: "enumchildwindows"; File: "???????.exe") Found reference to API "SendMessageW" (Indicator: "sendmessage"; File: "???????.exe") Found reference to API "FindWindowExW" (Indicator: "findwindow"; File: "???????.exe") Found reference to API "FindWindowW" (Indicator: "findwindow"; File: "???????.exe") Found reference to API "PostMessageW" (Indicator: "postmessage"; File: "???????.exe") Found reference to API "FindWindowA" (Indicator: "findwindow"; File: "???????.exe") Found reference to API "SendMessageTimeoutA" (Indicator: "sendmessage"; File: "???????.exe") Found reference to API "EnumWindows" (Indicator: "enumwindows"; File: "???????.exe") Found reference to API "ShellWindowFindWindowOptions" (Indicator: "findwindow"; Source: "00000000-00000732.00000000.146875.59010000.00000004.mdmp, 00000000-00000732.00000001.148798.59010000.00000004.mdmp, 00000000-00000732.00000002.150715.59010000.00000004.mdmp") Found reference to API "aFindWindowSW" (Indicator: "findwindow"; Source: "00000000-00000732.00000000.146875.59010000.00000004.mdmp, 00000000-00000732.00000001.148798.59010000.00000004.mdmp, 00000000-00000732.00000002.150715.59010000.00000004.mdmp") Found reference to API "SendMessageA" (Indicator: "sendmessage"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API "PostMessageA" (Indicator: "postmessage"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API "FindWindowExA" (Indicator: "findwindow"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API "" (Indicator: "enumchildwindows"; Source: "00000000-00007100.00000000.146549.030B0000.00000004.mdmp")2f:T1fae,".exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000018000000fcd009ea64e05a74b8ecef01687d8076b8f4ef01401ed97288d93c99feffffffd4f3ef01f77ed77278f3ef0100002f7570f4ef01107fd772e0df5a7408000000000000000000000000000000000000000000000000000000000000000100000000000000ffffffffffffffff340000000000000000f4ef010000000008000000000000000000000000000000000000000000000000000000c4d009ea0000000040f4ef0169921375ffffffff3400000000f4ef01080000000000000000002f7570f4ef012794137508f4ef010b0000000000000058f4ef01 (UID: 00000000-00000668) ".exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00000668) ".exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00000668) ".exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000e02c5675ecf3ef01226e267400001f06000000002d6e2674f78432892d000000ecb74c7570f4ef01b1ce980098a30d0438c50c040e00000080000000b0f3ef010000020434f4ef0170c82774e306f1fcfeffffff2d000000d0cc5b752700000004f4ef01856a28741c232d7444f4ef01f85f287408000000bb692774b26927745f8332892d000000ecb74c7527000000d0cc5b7518f4ef012d000000d0cc5b752700000048f4ef01856a28741c232d7490f4ef017e8a5a75ee8c5a75738a5a754bdb52702d000000ecb74c7527000000d0cc5b752c111f06c0101f064bdb527058f4ef01fc52987544f5ef01e0845a75e3de2b04feffffff738a5a75 (UID: 00000000-00000668) ".exe" called "RtlGetVersion" with parameter 240100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00000668) ".exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00000668) ".exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000ffff00000000c8cdef0138cf16774c360c0434ceef010100000000360c044c360c0400360c04040000000400000000e01d750010000034ceef010100000000360c04cd9716779c971677f3b0db0fb50f147500360c040000167700000000c4142e730000000080ee1a750100000000000000f8e21d75000000000400000080a9ab7348401c75f8e21d7538ceef0180e8d07338d50d0480e8d07334ceef010000000080e8d07360ceef011b800800e8ceef015806000088d5ef01642a8773a1e01ff9f30b0000faffffffa0d5ef0100000000180000000000000020ed09ea0000000000000000ffffffff000000000000000000000000168519042c851904 (UID: 00000000-00000668) ".exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000ef011b80080000000000e958d700f4000000000000000000000000000000c8ceef011b80080050cfef0158060000f0d5ef011800000020ed09eaf400000000000000c259d772f4000000f400000000000000000000000000ef010000000018000000f0d5ef0150cfef011b8008000000000088ed09ea60cdef01c259d77278ceef01401ed97280d43c99feffffff88ceef01222a8773f400000000000000000000000000000060ceef011b800800e8ceef015806000088d5ef01642a8773a1e01ff9f30b0000faffffffa0d5ef0100000000180000000000000020ed09ea0000000000000000ffffffff0000000000000000000000009e961904b6961904 (UID: 00000000-00000668) ".exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000ef011b80080000000000e958d700f4000000000000000000000000000000c8ceef011b80080050cfef0158060000f0d5ef011800000020ed09eaf400000000000000c259d772f4000000f400000000000000000000000000ef010000000018000000f0d5ef0150cfef011b8008000000000088ed09ea60cdef01c259d77278ceef01401ed97280d43c99feffffff88ceef01222a8773f400000000000000000000000000000060ceef011b800800e8ceef015806000088d5ef01642a8773a1e01ff9f30b0000faffffffa0d5ef0100000000180000000000000020ed09ea0000000000000000ffffffff000000000000000000000000a6961904ba961904 (UID: 00000000-00000668) ".exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000ef011b80080000000000e958d700f4000000000000000000000000000000c8ceef011b80080050cfef0158060000f0d5ef011800000020ed09eaf400000000000000c259d772f4000000f400000000000000000000000000ef010000000018000000f0d5ef0150cfef011b8008000000000088ed09ea60cdef01c259d77278ceef01401ed97280d43c99feffffff88ceef01222a8773f400000000000000000000000000000060ceef011b800800e8ceef015806000088d5ef01642a8773a1e01ff9f30b0000faffffffa0d5ef0100000000180000000000000020ed09ea0000000000000000ffffffff0000000000000000000000007e458f0696458f06 (UID: 00000000-00000668) ".exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000ef011b80080000000000e958d700f4000000000000000000000000000000c8ceef011b80080050cfef0158060000f0d5ef011800000020ed09eaf400000000000000c259d772f4000000f400000000000000000000000000ef010000000018000000f0d5ef0150cfef011b8008000000000088ed09ea60cdef01c259d77278ceef01401ed97280d43c99feffffff88ceef01222a8773f400000000000000000000000000000060ceef011b800800e8ceef015806000088d5ef01642a8773a1e01ff9f30b0000faffffffa0d5ef0100000000180000000000000020ed09ea0000000000000000ffffffff000000000000000000000000c6951904dc951904 (UID: 00000000-00000668) ".exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000ef011b80080000000000e958d700f4000000000000000000000000000000c8ceef011b80080050cfef0158060000f0d5ef011800000020ed09eaf400000000000000c259d772f4000000f400000000000000000000000000ef010000000018000000f0d5ef0150cfef011b8008000000000088ed09ea60cdef01c259d77278ceef01401ed97280d43c99feffffff88ceef01222a8773f400000000000000000000000000000060ceef011b800800e8ceef015806000088d5ef01642a8773a1e01ff9f30b0000faffffffa0d5ef0100000000180000000000000020ed09ea0000000000000000ffffffff0000000000000000000000007e518f0696518f06 (UID: 00000000-00000668) ".exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000ef011b80080000000000e958d700f4000000000000000000000000000000c8ceef011b80080050cfef0158060000f0d5ef011800000020ed09eaf400000000000000c259d772f4000000f400000000000000000000000000ef010000000018000000f0d5ef0150cfef011b8008000000000088ed09ea60cdef01c259d77278ceef01401ed97280d43c99feffffff88ceef01222a8773f400000000000000000000000000000060ceef011b800800e8ceef015806000088d5ef01642a8773a1e01ff9f30b0000faffffffa0d5ef0100000000180000000000000020ed09ea0000000000000000ffffffff000000000000000000000000368a8f064e8a8f06 (UID: 00000000-00000668)30:T457,".exe" called "GetVersionExA" with parameter 940000000600000002000000f023000002000000000000000000000000000000c8eaef01506a19779f941579feffffff20e9ef010dfa1577000000003819220700a10e0480e9ef01cce9ef01af89db0f04e8ef0150f51577c0e9ef01506a19773f8e1579fefffffff9de1477a59913750210000000000000000000000010000000000000000000000100000064e9ef01f9de1477 (UID: 00000000-00000668) ".exe" called "GetVersionExA" with parameter 940000000600000002000000f023000002000000000000000000000000000000b0eaef01506a19779f941579feffffff08e9ef010dfa157700000000581d2207c0a10e0468e9ef01b4e9ef015788db0fece7ef0150f51577a8e9ef01506a19773f8e1579fefffffff9de1477a5991375021000000000000000000000001000000000000000000000010000004ce9ef01f9de1477 (UID: 00000000-00000668) "gamesetup.exe" called "GetVersionExA" with parameter 940000000600000002000000f0230000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000814c4b22f4f7cf00000000009cf9cf00506a1977e15aa555fefffffff9de1477a59913750210000000000000000000000010000000000000000000008c924400acf9cf00f9de1477 (UID: 00000000-00007100)31:T518,".exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") ".exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "gamesetup.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "gamesetup.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LEVELS") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "DEFAULTLEVEL") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "SAFERFLAGS") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "POLICYSCOPE") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LOGFILENAME") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "rundll32.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED")32:T8da,Found reference to API "GetActiveWindow" (Indicator: "GetActiveWindow"; File: "00000000-00007100.00000000.146549.00401000.00000020.mdmp") Found reference to API "GetWindowTextA" (Indicator: "GetWindowText"; File: "???????.exe") Found reference to API "GetWindowTextLengthA" (Indicator: "GetWindowText"; File: "???????.exe") Found reference to API "GetForegroundWindow" (Indicator: "GetForegroundWindow"; File: "???????.exe") Found reference to API "FindWindowExA" (Indicator: "FindWindow"; File: "???????.exe") Found reference to API "GetWindowTextLengthW" (Indicator: "GetWindowText"; File: "???????.exe") Found reference to API "GetWindowTextW" (Indicator: "GetWindowText"; File: "???????.exe") Found reference to API "FindWindowExW" (Indicator: "FindWindow"; File: "???????.exe") Found reference to API "FindWindowW" (Indicator: "FindWindow"; File: "???????.exe") Found reference to API "FindWindowA" (Indicator: "FindWindow"; File: "???????.exe") Found reference to API "EnumWindows" (Indicator: "EnumWindows"; File: "???????.exe") Found reference to API "ShellWindowFindWindowOptions" (Indicator: "FindWindow"; Source: "00000000-00000732.00000000.146875.59010000.00000004.mdmp, 00000000-00000732.00000001.148798.59010000.00000004.mdmp, 00000000-00000732.00000002.150715.59010000.00000004.mdmp") Found reference to API "aFindWindowSW" (Indicator: "FindWindow"; Source: "00000000-00000732.00000000.146875.59010000.00000004.mdmp, 00000000-00000732.00000001.148798.59010000.00000004.mdmp, 00000000-00000732.00000002.150715.59010000.00000004.mdmp") Found reference to API "GetActiveWindow" (Indicator: "GetActiveWindow"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API "FindWindowExA" (Indicator: "FindWindow"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API "GetWindowTextA" (Indicator: "GetWindowText"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API "GetWindowTextLengthA" (Indicator: "GetWindowText"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API "GetForegroundWindow" (Indicator: "GetForegroundWindow"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp")33:T754,".exe" queries volume information of an entire harddrive"C:\" at 00000000-00000668-00000C17-1279737205 ".exe" queries volume information of an entire harddrive"C:\" at 00000000-00000668-00000C17-1280205644 ".exe" queries volume information of an entire harddrive"C:\" at 00000000-00000668-00000C17-1280711325 ".exe" queries volume information of an entire harddrive"C:\" at 00000000-00000668-00000C17-1281205247 ".exe" queries volume information of an entire harddrive"C:\" at 00000000-00000668-00000C17-1281709478 ".exe" queries volume information of an entire harddrive"C:\" at 00000000-00000668-00000C17-1282237262 ".exe" queries volume information of an entire harddrive"C:\" at 00000000-00000668-00000C17-1282704982 ".exe" queries volume information of an entire harddrive"C:\" at 00000000-00000668-00000C17-1283209736 ".exe" queries volume information of an entire harddrive"C:\" at 00000000-00000668-00000C17-1283797310 ".exe" queries volume information of an entire harddrive"C:\" at 00000000-00000668-00000C17-1284204492 ".exe" queries volume information of an entire harddrive"C:\" at 00000000-00000668-00000C17-1284794345 ".exe" queries volume information of an entire harddrive"C:\" at 00000000-00000668-00000C17-1285203711 ".exe" queries volume information of an entire harddrive"C:\" at 00000000-00000668-00000C17-1285704951 ".exe" queries volume information of an entire harddrive"C:\" at 00000000-00000668-00000C17-1286214219 ".exe" queries volume information of an entire harddrive"C:\" at 00000000-00000668-00000C17-1286736413 ".exe" queries volume information of an entire harddrive"C:\" at 00000000-00000668-00000C17-1287269244 "cmd.exe" queries volume information of an entire harddrive"C:\" at 00000000-00004776-00000C17-1281348699 "cmd.exe" queries volume information of an entire harddrive"C:\" at 00000000-00007712-00000C17-128134569134:T1925,".exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00000668) ".exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00000668) ".exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00000668) ".exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00000668) ".exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00000668) ".exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00000668) ".exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00000668) ".exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00000668) ".exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00000668) ".exe" called "LoadLibrary" with a parameter user32 (UID: 00000000-00000668) ".exe" called "LoadLibrary" with a parameter %TEMP%\E_N60005\krnln.fnr (UID: 00000000-00000668) ".exe" called "LoadLibrary" with a parameter C:\kernel32.dll (UID: 00000000-00000668) ".exe" called "LoadLibrary" with a parameter %TEMP%\E_N60005\kernel32.dll (UID: 00000000-00000668) ".exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00000668) ".exe" called "LoadLibrary" with a parameter C:\ntdll.dll (UID: 00000000-00000668) ".exe" called "LoadLibrary" with a parameter %TEMP%\E_N60005\ntdll.dll (UID: 00000000-00000668) ".exe" called "LoadLibrary" with a parameter C:\GdiPlus.dll (UID: 00000000-00000668) ".exe" called "LoadLibrary" with a parameter %TEMP%\E_N60005\GdiPlus.dll (UID: 00000000-00000668) ".exe" called "LoadLibrary" with a parameter GdiPlus.dll (UID: 00000000-00000668) ".exe" called "LoadLibrary" with a parameter Kernel32.dll (UID: 00000000-00000668) ".exe" called "LoadLibrary" with a parameter C:\ole32.dll (UID: 00000000-00000668) ".exe" called "LoadLibrary" with a parameter %TEMP%\E_N60005\ole32.dll (UID: 00000000-00000668) ".exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00000668) ".exe" called "LoadLibrary" with a parameter C:\kernel32 (UID: 00000000-00000668) ".exe" called "LoadLibrary" with a parameter %TEMP%\E_N60005\kernel32 (UID: 00000000-00000668) ".exe" called "LoadLibrary" with a parameter C:\user32 (UID: 00000000-00000668) ".exe" called "LoadLibrary" with a parameter %TEMP%\E_N60005\user32 (UID: 00000000-00000668) ".exe" called "LoadLibrary" with a parameter C:\User32.dll (UID: 00000000-00000668) ".exe" called "LoadLibrary" with a parameter %TEMP%\E_N60005\User32.dll (UID: 00000000-00000668) ".exe" called "LoadLibrary" with a parameter User32.dll (UID: 00000000-00000668) ".exe" called "LoadLibrary" with a parameter C:\user32.dll (UID: 00000000-00000668) ".exe" called "LoadLibrary" with a parameter %TEMP%\E_N60005\user32.dll (UID: 00000000-00000668) ".exe" called "LoadLibrary" with a parameter %TEMP%\E_N60005\eAPI.fnr (UID: 00000000-00000668) ".exe" called "LoadLibrary" with a parameter %TEMP%\E_N60005\eAPI.fne (UID: 00000000-00000668) ".exe" called "LoadLibrary" with a parameter %TEMP%\E_N60005\EThread.fnr (UID: 00000000-00000668) ".exe" called "LoadLibrary" with a parameter %TEMP%\E_N60005\EThread.fne (UID: 00000000-00000668) ".exe" called "LoadLibrary" with a parameter %TEMP%\E_N60005\shell.fnr (UID: 00000000-00000668) ".exe" called "LoadLibrary" with a parameter %TEMP%\E_N60005\shell.fne (UID: 00000000-00000668) ".exe" called "LoadLibrary" with a parameter %TEMP%\E_N60005\iext.fnr (UID: 00000000-00000668) ".exe" called "LoadLibrary" with a parameter %TEMP%\E_N60005\spec.fnr (UID: 00000000-00000668) ".exe" called "LoadLibrary" with a parameter %TEMP%\E_N60005\spec.fne (UID: 00000000-00000668) ".exe" called "LoadLibrary" with a parameter krnln.fne (UID: 00000000-00000668) ".exe" called "LoadLibrary" with a parameter krnln.fnr (UID: 00000000-00000668) "gamesetup.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007100) "gamesetup.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007100) "gamesetup.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007100) "gamesetup.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007100) "gamesetup.exe" called "LoadLibrary" with a parameter C:\gamesetup.exe (UID: 00000000-00007100) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004776) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004776) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004776) "cmd.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004776) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004144) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004144) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004144) "cmd.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004144) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007712) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007712) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007712) "cmd.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007712) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00000732) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00000732) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00000732) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00000732) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002304) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002304) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002304) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002304)35:T99e5,".exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00000668) ".exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00000668) ".exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00000668) ".exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00000668) ".exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00000668) ".exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00000668) ".exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00000668) ".exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00000668) ".exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00000668) ".exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00000668) ".exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00000668) ".exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00000668) ".exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00000668) ".exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00000668) ".exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00000668) ".exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00000668) ".exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00000668) ".exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00000668) ".exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00000668) ".exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00000668) ".exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00000668) ".exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00000668) ".exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00000668) ".exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00000668) ".exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00000668) ".exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00000668) ".exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00000668) ".exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00000668) ".exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00000668) ".exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00000668) ".exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00000668) ".exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00000668) ".exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00000668) ".exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00000668) ".exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00000668) ".exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00000668) ".exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00000668) ".exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00000668) ".exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00000668) ".exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00000668) ".exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00000668) ".exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00000668) ".exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00000668) ".exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00000668) ".exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00000668) ".exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00000668) ".exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00000668) ".exe" called "GetProcAddress" with a parameter SetLastError (UID: 00000000-00000668) ".exe" called "GetProcAddress" with a parameter GetLastError (UID: 00000000-00000668) ".exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00000668) ".exe" called "GetProcAddress" with a parameter IsUserAnAdmin (UID: 00000000-00000668) ".exe" called "GetProcAddress" with a parameter ExitProcess (UID: 00000000-00000668) ".exe" called "GetProcAddress" with a parameter GetModuleHandleA (UID: 00000000-00000668) ".exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00000668) ".exe" called "GetProcAddress" with a parameter OpenProcess (UID: 00000000-00000668) ".exe" called "GetProcAddress" with a parameter VirtualProtect (UID: 00000000-00000668) ".exe" called "GetProcAddress" with a parameter MessageBoxA (UID: 00000000-00000668) ".exe" called "GetProcAddress" with a parameter wsprintfA (UID: 00000000-00000668) ".exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00000668) ".exe" called "GetProcAddress" with a parameter LoadLibraryA (UID: 00000000-00000668) ".exe" called "GetProcAddress" with a parameter WriteFile (UID: 00000000-00000668) ".exe" called "GetProcAddress" with a parameter CreateDirectoryA (UID: 00000000-00000668) ".exe" called "GetProcAddress" with a parameter GetTempPathA (UID: 00000000-00000668) ".exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00000668) ".exe" called "GetProcAddress" with a parameter SetFilePointer (UID: 00000000-00000668) ".exe" called "GetProcAddress" with a parameter CreateFileA (UID: 00000000-00000668) ".exe" called "GetProcAddress" with a parameter GetModuleFileNameA (UID: 00000000-00000668) ".exe" called "GetProcAddress" with a parameter GetStringTypeA (UID: 00000000-00000668) ".exe" called "GetProcAddress" with a parameter LCMapStringW (UID: 00000000-00000668) ".exe" called "GetProcAddress" with a parameter LCMapStringA (UID: 00000000-00000668) ".exe" called "GetProcAddress" with a parameter HeapAlloc (UID: 00000000-00000668) ".exe" called "GetProcAddress" with a parameter HeapFree (UID: 00000000-00000668) ".exe" called "GetProcAddress" with a parameter GetStartupInfoA (UID: 00000000-00000668) ".exe" called "GetProcAddress" with a parameter GetCommandLineA (UID: 00000000-00000668) ".exe" called "GetProcAddress" with a parameter GetVersion (UID: 00000000-00000668) ".exe" called "GetProcAddress" with a parameter HeapDestroy (UID: 00000000-00000668) ".exe" called "GetProcAddress" with a parameter HeapCreate (UID: 00000000-00000668) ".exe" called "GetProcAddress" with a parameter VirtualFree (UID: 00000000-00000668) ".exe" called "GetProcAddress" with a parameter VirtualAlloc (UID: 00000000-00000668) ".exe" called "GetProcAddress" with a parameter HeapReAlloc (UID: 00000000-00000668) ".exe" called "GetProcAddress" with a parameter TerminateProcess (UID: 00000000-00000668) ".exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00000668) ".exe" called "GetProcAddress" with a parameter UnhandledExceptionFilter (UID: 00000000-00000668) ".exe" called "GetProcAddress" with a parameter FreeEnvironmentStringsA (UID: 00000000-00000668) ".exe" called "GetProcAddress" with a parameter FreeEnvironmentStringsW (UID: 00000000-00000668) ".exe" called "GetProcAddress" with a parameter WideCharToMultiByte (UID: 00000000-00000668) ".exe" called "GetProcAddress" with a parameter GetEnvironmentStrings (UID: 00000000-00000668) ".exe" called "GetProcAddress" with a parameter GetEnvironmentStringsW (UID: 00000000-00000668) ".exe" called "GetProcAddress" with a parameter SetHandleCount (UID: 00000000-00000668) ".exe" called "GetProcAddress" with a parameter GetStdHandle (UID: 00000000-00000668) ".exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00000668) ".exe" called "GetProcAddress" with a parameter RtlUnwind (UID: 00000000-00000668) ".exe" called "GetProcAddress" with a parameter GetCPInfo (UID: 00000000-00000668) ".exe" called "GetProcAddress" with a parameter GetACP (UID: 00000000-00000668) ".exe" called "GetProcAddress" with a parameter GetOEMCP (UID: 00000000-00000668) ".exe" called "GetProcAddress" with a parameter MultiByteToWideChar (UID: 00000000-00000668) ".exe" called "GetProcAddress" with a parameter GetStringTypeW (UID: 00000000-00000668) ".exe" called "GetProcAddress" with a parameter OleIconToCursor (UID: 00000000-00000668) ".exe" called "GetProcAddress" with a parameter OleCreateFontIndirect (UID: 00000000-00000668) ".exe" called "GetProcAddress" with a parameter OleCreatePictureIndirect (UID: 00000000-00000668) ".exe" called "GetProcAddress" with a parameter OleLoadPicture (UID: 00000000-00000668) ".exe" called "GetProcAddress" with a parameter OleTranslateColor (UID: 00000000-00000668) ".exe" called "GetProcAddress" with a parameter OleCreatePropertyFrame (UID: 00000000-00000668) ".exe" called "GetProcAddress" with a parameter OleCreatePropertyFrameIndirect (UID: 00000000-00000668) ".exe" called "GetProcAddress" with a parameter IsProcessorFeaturePresent (UID: 00000000-00000668) ".exe" called "GetProcAddress" with a parameter GetNewSock (UID: 00000000-00000668) ".exe" called "GetProcAddress" with a parameter GetNewInf (UID: 00000000-00000668) ".exe" called "GetProcAddress" with a parameter LocalAlloc (UID: 00000000-00000668) ".exe" called "GetProcAddress" with a parameter NtQueryInformationProcess (UID: 00000000-00000668) ".exe" called "GetProcAddress" with a parameter LocalFree (UID: 00000000-00000668) ".exe" called "GetProcAddress" with a parameter GdiplusStartup (UID: 00000000-00000668) ".exe" called "GetProcAddress" with a parameter CLSIDFromString (UID: 00000000-00000668) ".exe" called "GetProcAddress" with a parameter LocalSize (UID: 00000000-00000668) ".exe" called "GetProcAddress" with a parameter LoadCursorA (UID: 00000000-00000668) ".exe" called "GetProcAddress" with a parameter RegisterClassExA (UID: 00000000-00000668) ".exe" called "GetProcAddress" with a parameter GetSystemMetrics (UID: 00000000-00000668) ".exe" called "GetProcAddress" with a parameter LoadImageA (UID: 00000000-00000668) ".exe" called "GetProcAddress" with a parameter GetDC (UID: 00000000-00000668) "gamesetup.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00007100) "gamesetup.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00007100) "gamesetup.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00007100) "gamesetup.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00007100) "gamesetup.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00007100) "gamesetup.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00007100) "gamesetup.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00007100) "gamesetup.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00007100) "gamesetup.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00007100) "gamesetup.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00007100) "gamesetup.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00007100) "gamesetup.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00007100) "gamesetup.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00007100) "gamesetup.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00007100) "gamesetup.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00007100) "gamesetup.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00007100) "gamesetup.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00007100) "gamesetup.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00007100) "gamesetup.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00007100) "gamesetup.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00007100) "gamesetup.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00007100) "gamesetup.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00007100) "gamesetup.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00007100) "gamesetup.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00007100) "gamesetup.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00007100) "gamesetup.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00007100) "gamesetup.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00007100) "gamesetup.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00007100) "gamesetup.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00007100) "gamesetup.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00007100) "gamesetup.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00007100) "gamesetup.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00007100) "gamesetup.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00007100) "gamesetup.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00007100) "gamesetup.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00007100) "gamesetup.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00007100) "gamesetup.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00007100) "gamesetup.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00007100) "gamesetup.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00007100) "gamesetup.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00007100) "gamesetup.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00007100) "gamesetup.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00007100) "gamesetup.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00007100) "gamesetup.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00007100) "gamesetup.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00007100) "gamesetup.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00007100) "gamesetup.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00007100) "gamesetup.exe" called "GetProcAddress" with a parameter IsProcessorFeaturePresent (UID: 00000000-00007100) "gamesetup.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00007100) "gamesetup.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00007100) "cmd.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00004776) "cmd.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00004776) "cmd.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00004776) "cmd.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004776) "cmd.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00004776) "cmd.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00004776) "cmd.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00004776) "cmd.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00004776) "cmd.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00004776) "cmd.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00004776) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00004776) "cmd.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00004776) "cmd.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00004776) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00004776) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00004776) "cmd.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00004776) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00004776) "cmd.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00004776) "cmd.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00004776) "cmd.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00004776) "cmd.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00004776) "cmd.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00004776) "cmd.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00004776) "cmd.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00004776) "cmd.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00004776) "cmd.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00004776) "cmd.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00004776) "cmd.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00004776) "cmd.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00004776) "cmd.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00004776) "cmd.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00004776) "cmd.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00004776) "cmd.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00004776) "cmd.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00004776) "cmd.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00004776) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00004776) "cmd.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00004776) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00004776) "cmd.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00004776) "cmd.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00004776) "cmd.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00004776) "cmd.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00004776) "cmd.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00004776) "cmd.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00004776) "cmd.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00004776) "cmd.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00004776) "cmd.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00004776) "cmd.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00004144) "cmd.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00004144) "cmd.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00004144) "cmd.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004144) "cmd.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00004144) "cmd.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00004144) "cmd.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00004144) "cmd.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00004144) "cmd.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00004144) "cmd.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00004144) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00004144) "cmd.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00004144) "cmd.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00004144) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00004144) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00004144) "cmd.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00004144) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00004144) "cmd.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00004144) "cmd.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00004144) "cmd.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00004144) "cmd.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00004144) "cmd.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00004144) "cmd.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00004144) "cmd.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00004144) "cmd.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00004144) "cmd.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00004144) "cmd.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00004144) "cmd.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00004144) "cmd.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00004144) "cmd.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00004144) "cmd.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00004144) "cmd.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00004144) "cmd.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00004144) "cmd.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00004144) "cmd.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00004144) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00004144) "cmd.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00004144) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00004144) "cmd.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00004144) "cmd.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00004144) "cmd.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00004144) "cmd.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00004144) "cmd.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00004144) "cmd.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00004144) "cmd.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00004144) "cmd.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00004144) "cmd.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00004144) "cmd.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00007712) "cmd.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00007712) "cmd.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00007712) "cmd.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00007712) "cmd.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00007712) "cmd.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00007712) "cmd.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00007712) "cmd.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00007712) "cmd.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00007712) "cmd.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00007712) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00007712) "cmd.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00007712) "cmd.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00007712) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00007712) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00007712) "cmd.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00007712) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00007712) "cmd.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00007712) "cmd.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00007712) "cmd.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00007712) "cmd.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00007712) "cmd.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00007712) "cmd.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00007712) "cmd.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00007712) "cmd.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00007712) "cmd.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00007712) "cmd.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00007712) "cmd.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00007712) "cmd.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00007712) "cmd.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00007712) "cmd.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00007712) "cmd.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00007712) "cmd.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00007712) "cmd.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00007712) "cmd.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00007712) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00007712) "cmd.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00007712) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00007712) "cmd.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00007712) "cmd.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00007712) "cmd.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00007712) "cmd.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00007712) "cmd.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00007712) "cmd.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00007712) "cmd.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00007712) "cmd.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00007712) "cmd.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00007712) "rundll32.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00000732) "rundll32.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00000732) "rundll32.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00000732) "rundll32.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00000732) "rundll32.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00000732) "rundll32.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00000732) "rundll32.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00000732) "rundll32.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00000732) "rundll32.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00000732) "rundll32.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00000732) "rundll32.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00000732) "rundll32.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00000732) "rundll32.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00000732) "rundll32.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00000732) "rundll32.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00000732) "rundll32.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00000732) "rundll32.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00000732) "rundll32.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00000732) "rundll32.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00000732) "rundll32.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00000732) "rundll32.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00000732) "rundll32.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00000732) "rundll32.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00000732) "rundll32.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00000732) "rundll32.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00000732) "rundll32.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00000732) "rundll32.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00000732) "rundll32.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00000732) "rundll32.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00000732) "rundll32.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00000732) "rundll32.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00000732) "rundll32.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00000732) "rundll32.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00000732) "rundll32.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00000732) "rundll32.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00000732) "rundll32.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00000732) "rundll32.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00000732) "rundll32.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00000732) "rundll32.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00000732) "rundll32.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00000732) "rundll32.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00000732) "rundll32.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00000732) "rundll32.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00000732) "rundll32.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00000732) "rundll32.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00000732) "rundll32.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00000732) "rundll32.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00000732) "rundll32.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00002304) "rundll32.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00002304) "rundll32.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00002304) "rundll32.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00002304) "rundll32.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00002304) "rundll32.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00002304) "rundll32.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00002304) "rundll32.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00002304) "rundll32.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00002304) "rundll32.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00002304) "rundll32.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00002304) "rundll32.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00002304) "rundll32.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00002304) "rundll32.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00002304) "rundll32.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00002304) "rundll32.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00002304) "rundll32.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00002304) "rundll32.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00002304) "rundll32.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00002304) "rundll32.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00002304) "rundll32.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00002304) "rundll32.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00002304) "rundll32.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00002304) "rundll32.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00002304) "rundll32.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00002304) "rundll32.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00002304) "rundll32.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00002304) "rundll32.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00002304) "rundll32.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00002304) "rundll32.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00002304) "rundll32.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00002304) "rundll32.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00002304) "rundll32.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00002304) "rundll32.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00002304) "rundll32.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00002304) "rundll32.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00002304) "rundll32.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00002304) "rundll32.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00002304) "rundll32.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00002304) "rundll32.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00002304) "rundll32.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00002304) "rundll32.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00002304) "rundll32.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00002304) "rundll32.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00002304) "rundll32.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00002304) "rundll32.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00002304) "rundll32.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00002304)36:T15a89,Found reference to API (Indicator: "GetModuleHandleA"; File: "???????.exe") Found reference to API (Indicator: "MessageBoxA"; File: "00000000-00007100.00000000.146549.00401000.00000020.mdmp") Found reference to API (Indicator: "GetActiveWindow"; File: "00000000-00007100.00000000.146549.00401000.00000020.mdmp") Found reference to API (Indicator: "GetLastActivePopup"; File: "00000000-00007100.00000000.146549.00401000.00000020.mdmp") Found reference to API (Indicator: "RegOpenKeyExA"; File: "???????.exe") Found reference to API (Indicator: "RegCreateKeyExA"; File: "???????.exe") Found reference to API (Indicator: "RegCloseKey"; File: "???????.exe") Found reference to API (Indicator: "RegSetValueExA"; File: "???????.exe") Found reference to API (Indicator: "RegCreateKeyA"; File: "???????.exe") Found reference to API (Indicator: "CreateDCA"; File: "???????.exe") Found reference to API (Indicator: "GetDeviceCaps"; File: "???????.exe") Found reference to API (Indicator: "GetTextMetricsA"; File: "???????.exe") Found reference to API (Indicator: "StretchBlt"; File: "???????.exe") Found reference to API (Indicator: "GetTextColor"; File: "???????.exe") Found reference to API (Indicator: "GetTextExtentPoint32A"; File: "???????.exe") Found reference to API (Indicator: "TextOutA"; File: "???????.exe") Found reference to API (Indicator: "GetObjectA"; File: "???????.exe") Found reference to API (Indicator: "SetStretchBltMode"; File: "???????.exe") Found reference to API (Indicator: "DPtoLP"; File: "???????.exe") Found reference to API (Indicator: "CreateCompatibleBitmap"; File: "???????.exe") Found reference to API (Indicator: "SetMapMode"; File: "???????.exe") Found reference to API (Indicator: "GetDIBits"; File: "???????.exe") Found reference to API (Indicator: "CreateRoundRectRgn"; File: "???????.exe") Found reference to API (Indicator: "DeleteObject"; File: "???????.exe") Found reference to API (Indicator: "GetCurrentObject"; File: "???????.exe") Found reference to API (Indicator: "SelectObject"; File: "???????.exe") Found reference to API (Indicator: "ExtTextOutA"; File: "???????.exe") Found reference to API (Indicator: "GetBkColor"; File: "???????.exe") Found reference to API (Indicator: "CreateFontIndirectA"; File: "???????.exe") Found reference to API (Indicator: "CreateCompatibleDC"; File: "???????.exe") Found reference to API (Indicator: "DeleteDC"; File: "???????.exe") Found reference to API (Indicator: "RoundRect"; File: "???????.exe") Found reference to API (Indicator: "GetStockObject"; File: "???????.exe") Found reference to API (Indicator: "BitBlt"; File: "???????.exe") Found reference to API (Indicator: "CreateSolidBrush"; File: "???????.exe") Found reference to API (Indicator: "CompareStringW"; File: "???????.exe") Found reference to API (Indicator: "LeaveCriticalSection"; File: "???????.exe") Found reference to API (Indicator: "EnumResourceNamesA"; File: "???????.exe") Found reference to API (Indicator: "GetFullPathNameA"; File: "???????.exe") Found reference to API (Indicator: "GlobalGetAtomNameA"; File: "???????.exe") Found reference to API (Indicator: "GlobalFlags"; File: "???????.exe") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; File: "???????.exe") Found reference to API (Indicator: "GetFileSize"; File: "???????.exe") Found reference to API (Indicator: "GlobalLock"; File: "???????.exe") Found reference to API (Indicator: "GlobalAlloc"; File: "???????.exe") Found reference to API (Indicator: "GetProcessHeap"; File: "???????.exe") Found reference to API (Indicator: "lstrcatA"; File: "???????.exe") Found reference to API (Indicator: "FlushFileBuffers"; File: "???????.exe") Found reference to API (Indicator: "LocalReAlloc"; File: "???????.exe") Found reference to API (Indicator: "TlsSetValue"; File: "???????.exe") Found reference to API (Indicator: "FindNextFileA"; File: "???????.exe") Found reference to API (Indicator: "IsBadWritePtr"; File: "???????.exe") Found reference to API (Indicator: "CreateSemaphoreA"; File: "???????.exe") Found reference to API (Indicator: "FindClose"; File: "???????.exe") Found reference to API (Indicator: "IsBadReadPtr"; File: "???????.exe") Found reference to API (Indicator: "MulDiv"; File: "???????.exe") Found reference to API (Indicator: "GetLocalTime"; File: "???????.exe") Found reference to API (Indicator: "InitializeCriticalSection"; File: "???????.exe") Found reference to API (Indicator: "LoadLibraryExA"; File: "???????.exe") Found reference to API (Indicator: "CompareStringA"; File: "???????.exe") Found reference to API (Indicator: "InterlockedDecrement"; File: "???????.exe") Found reference to API (Indicator: "FileTimeToSystemTime"; File: "???????.exe") Found reference to API (Indicator: "RaiseException"; File: "???????.exe") Found reference to API (Indicator: "CreateEventA"; File: "???????.exe") Found reference to API (Indicator: "lstrcmpiA"; File: "???????.exe") Found reference to API (Indicator: "SizeofResource"; File: "???????.exe") Found reference to API (Indicator: "ResumeThread"; File: "???????.exe") Found reference to API (Indicator: "GlobalFree"; File: "???????.exe") Found reference to API (Indicator: "GlobalFindAtomA"; File: "???????.exe") Found reference to API (Indicator: "GlobalAddAtomA"; File: "???????.exe") Found reference to API (Indicator: "SetStdHandle"; File: "???????.exe") Found reference to API (Indicator: "CreateThread"; File: "???????.exe") Found reference to API (Indicator: "GetVersionExA"; File: "???????.exe") Found reference to API (Indicator: "UnlockFile"; File: "???????.exe") Found reference to API (Indicator: "WaitForSingleObject"; File: "???????.exe") Found reference to API (Indicator: "lstrcmpA"; File: "???????.exe") Found reference to API (Indicator: "TlsGetValue"; File: "???????.exe") Found reference to API (Indicator: "TlsFree"; File: "???????.exe") Found reference to API (Indicator: "InterlockedExchange"; File: "???????.exe") Found reference to API (Indicator: "CreateProcessA"; File: "???????.exe") Found reference to API (Indicator: "lstrcpyA"; File: "???????.exe") Found reference to API (Indicator: "TlsAlloc"; File: "???????.exe") Found reference to API (Indicator: "WinExec"; File: "???????.exe") Found reference to API (Indicator: "GlobalReAlloc"; File: "???????.exe") Found reference to API (Indicator: "GlobalDeleteAtom"; File: "???????.exe") Found reference to API (Indicator: "SetEndOfFile"; File: "???????.exe") Found reference to API (Indicator: "GetProfileStringA"; File: "???????.exe") Found reference to API (Indicator: "GetProcessVersion"; File: "???????.exe") Found reference to API (Indicator: "FileTimeToLocalFileTime"; File: "???????.exe") Found reference to API (Indicator: "Sleep"; File: "???????.exe") Found reference to API (Indicator: "DuplicateHandle"; File: "???????.exe") Found reference to API (Indicator: "SetCurrentDirectoryA"; File: "???????.exe") Found reference to API (Indicator: "GetEnvironmentVariableA"; File: "???????.exe") Found reference to API (Indicator: "WritePrivateProfileStringA"; File: "???????.exe") Found reference to API (Indicator: "FindFirstFileA"; File: "???????.exe") Found reference to API (Indicator: "HeapSize"; File: "???????.exe") Found reference to API (Indicator: "FindResourceA"; File: "???????.exe") Found reference to API (Indicator: "SetEvent"; File: "???????.exe") Found reference to API (Indicator: "GetSystemTime"; File: "???????.exe") Found reference to API (Indicator: "GlobalUnlock"; File: "???????.exe") Found reference to API (Indicator: "LoadResource"; File: "???????.exe") Found reference to API (Indicator: "ReleaseSemaphore"; File: "???????.exe") Found reference to API (Indicator: "GetFileAttributesA"; File: "???????.exe") Found reference to API (Indicator: "GetTimeZoneInformation"; File: "???????.exe") Found reference to API (Indicator: "lstrlenA"; File: "???????.exe") Found reference to API (Indicator: "WaitForMultipleObjects"; File: "???????.exe") Found reference to API (Indicator: "lstrcpynA"; File: "???????.exe") Found reference to API (Indicator: "GetTickCount"; File: "???????.exe") Found reference to API (Indicator: "LockResource"; File: "???????.exe") Found reference to API (Indicator: "GetVolumeInformationA"; File: "???????.exe") Found reference to API (Indicator: "InterlockedIncrement"; File: "???????.exe") Found reference to API (Indicator: "IsBadCodePtr"; File: "???????.exe") Found reference to API (Indicator: "GetCurrentThread"; File: "???????.exe") Found reference to API (Indicator: "SetErrorMode"; File: "???????.exe") Found reference to API (Indicator: "GlobalHandle"; File: "???????.exe") Found reference to API (Indicator: "GetFileTime"; File: "???????.exe") Found reference to API (Indicator: "GlobalSize"; File: "???????.exe") Found reference to API (Indicator: "EnterCriticalSection"; File: "???????.exe") Found reference to API (Indicator: "SetEnvironmentVariableA"; File: "???????.exe") Found reference to API (Indicator: "DeleteCriticalSection"; File: "???????.exe") Found reference to API (Indicator: "GetCurrentThreadId"; File: "???????.exe") Found reference to API (Indicator: "FreeLibrary"; File: "???????.exe") Found reference to API (Indicator: "LockFile"; File: "???????.exe") Found reference to API (Indicator: "Shell_NotifyIconA"; File: "???????.exe") Found reference to API (Indicator: "ShellExecuteA"; File: "???????.exe") Found reference to API (Indicator: "GetWindowTextA"; File: "???????.exe") Found reference to API (Indicator: "InflateRect"; File: "???????.exe") Found reference to API (Indicator: "ReleaseDC"; File: "???????.exe") Found reference to API (Indicator: "CreateWindowExA"; File: "???????.exe") Found reference to API (Indicator: "IsDialogMessageA"; File: "???????.exe") Found reference to API (Indicator: "RedrawWindow"; File: "???????.exe") Found reference to API (Indicator: "GetClipboardData"; File: "???????.exe") Found reference to API (Indicator: "DestroyIcon"; File: "???????.exe") Found reference to API (Indicator: "LoadIconA"; File: "???????.exe") Found reference to API (Indicator: "SetScrollPos"; File: "???????.exe") Found reference to API (Indicator: "MoveWindow"; File: "???????.exe") Found reference to API (Indicator: "OpenClipboard"; File: "???????.exe") Found reference to API (Indicator: "UnregisterClassA"; File: "???????.exe") Found reference to API (Indicator: "IsZoomed"; File: "???????.exe") Found reference to API (Indicator: "SendMessageA"; File: "???????.exe") Found reference to API (Indicator: "GetKeyState"; File: "???????.exe") Found reference to API (Indicator: "AdjustWindowRectEx"; File: "???????.exe") Found reference to API (Indicator: "GetMenuCheckMarkDimensions"; File: "???????.exe") Found reference to API (Indicator: "GetClassNameA"; File: "???????.exe") Found reference to API (Indicator: "DestroyWindow"; File: "???????.exe") Found reference to API (Indicator: "PostQuitMessage"; File: "???????.exe") Found reference to API (Indicator: "GetFocus"; File: "???????.exe") Found reference to API (Indicator: "EqualRect"; File: "???????.exe") Found reference to API (Indicator: "ShowWindow"; File: "???????.exe") Found reference to API (Indicator: "SetTimer"; File: "???????.exe") Found reference to API (Indicator: "SetWindowLongA"; File: "???????.exe") Found reference to API (Indicator: "DrawFrameControl"; File: "???????.exe") Found reference to API (Indicator: "GetForegroundWindow"; File: "???????.exe") Found reference to API (Indicator: "SetMenuItemBitmaps"; File: "???????.exe") Found reference to API (Indicator: "GetMessageTime"; File: "???????.exe") Found reference to API (Indicator: "DeleteMenu"; File: "???????.exe") Found reference to API (Indicator: "FillRect"; File: "???????.exe") Found reference to API (Indicator: "SystemParametersInfoA"; File: "???????.exe") Found reference to API (Indicator: "PeekMessageA"; File: "???????.exe") Found reference to API (Indicator: "GetWindow"; File: "???????.exe") Found reference to API (Indicator: "DrawIconEx"; File: "???????.exe") Found reference to API (Indicator: "CreateAcceleratorTableA"; File: "???????.exe") Found reference to API (Indicator: "InvalidateRect"; File: "???????.exe") Found reference to API (Indicator: "CloseClipboard"; File: "???????.exe") Found reference to API (Indicator: "SetActiveWindow"; File: "???????.exe") Found reference to API (Indicator: "SetForegroundWindow"; File: "???????.exe") Found reference to API (Indicator: "GetCursorPos"; File: "???????.exe") Found reference to API (Indicator: "DispatchMessageA"; File: "???????.exe") Found reference to API (Indicator: "SetWindowPos"; File: "???????.exe") Found reference to API (Indicator: "DrawFocusRect"; File: "???????.exe") Found reference to API (Indicator: "DestroyMenu"; File: "???????.exe") Found reference to API (Indicator: "GetSysColorBrush"; File: "???????.exe") Found reference to API (Indicator: "IsWindow"; File: "???????.exe") Found reference to API (Indicator: "RegisterClipboardFormatA"; File: "???????.exe") Found reference to API (Indicator: "SetParent"; File: "???????.exe") Found reference to API (Indicator: "DestroyCursor"; File: "???????.exe") Found reference to API (Indicator: "OffsetRect"; File: "???????.exe") Found reference to API (Indicator: "SetPropA"; File: "???????.exe") Found reference to API (Indicator: "ClientToScreen"; File: "???????.exe") Found reference to API (Indicator: "GetMenuState"; File: "???????.exe") Found reference to API (Indicator: "RemovePropA"; File: "???????.exe") Found reference to API (Indicator: "CopyRect"; File: "???????.exe") Found reference to API (Indicator: "RegisterWindowMessageA"; File: "???????.exe") Found reference to API (Indicator: "IsRectEmpty"; File: "???????.exe") Found reference to API (Indicator: "DrawTextA"; File: "???????.exe") Found reference to API (Indicator: "EnableMenuItem"; File: "???????.exe") Found reference to API (Indicator: "CharUpperA"; File: "???????.exe") Found reference to API (Indicator: "MapWindowPoints"; File: "???????.exe") Found reference to API (Indicator: "SetCursor"; File: "???????.exe") Found reference to API (Indicator: "WinHelpA"; File: "???????.exe") Found reference to API (Indicator: "CallWindowProcA"; File: "???????.exe") Found reference to API (Indicator: "GetClassInfoA"; File: "???????.exe") Found reference to API (Indicator: "UnhookWindowsHookEx"; File: "???????.exe") Found reference to API (Indicator: "DefWindowProcA"; File: "???????.exe") Found reference to API (Indicator: "ModifyMenuA"; File: "???????.exe") Found reference to API (Indicator: "RegisterClassA"; File: "???????.exe") Found reference to API (Indicator: "SetCursorPos"; File: "???????.exe") Found reference to API (Indicator: "PtInRect"; File: "???????.exe") Found reference to API (Indicator: "CallNextHookEx"; File: "???????.exe") Found reference to API (Indicator: "SetCapture"; File: "???????.exe") Found reference to API (Indicator: "LoadStringA"; File: "???????.exe") Found reference to API (Indicator: "GetDesktopWindow"; File: "???????.exe") Found reference to API (Indicator: "SetMenu"; File: "???????.exe") Found reference to API (Indicator: "GetClientRect"; File: "???????.exe") Found reference to API (Indicator: "GetCapture"; File: "???????.exe") Found reference to API (Indicator: "ReleaseCapture"; File: "???????.exe") Found reference to API (Indicator: "GetScrollPos"; File: "???????.exe") Found reference to API (Indicator: "TabbedTextOutA"; File: "???????.exe") Found reference to API (Indicator: "GrayStringA"; File: "???????.exe") Found reference to API (Indicator: "FindWindowExA"; File: "???????.exe") Found reference to API (Indicator: "IsWindowVisible"; File: "???????.exe") Found reference to API (Indicator: "EmptyClipboard"; File: "???????.exe") Found reference to API (Indicator: "ScreenToClient"; File: "???????.exe") Found reference to API (Indicator: "CheckMenuItem"; File: "???????.exe") Found reference to API (Indicator: "DestroyAcceleratorTable"; File: "???????.exe") Found reference to API (Indicator: "PostMessageA"; File: "???????.exe") Found reference to API (Indicator: "CreatePopupMenu"; File: "???????.exe") Found reference to API (Indicator: "GetWindowRect"; File: "???????.exe") Found reference to API (Indicator: "SetFocus"; File: "???????.exe") Found reference to API (Indicator: "DrawEdge"; File: "???????.exe") Found reference to API (Indicator: "SetRect"; File: "???????.exe") Found reference to API (Indicator: "UpdateWindow"; File: "???????.exe") Found reference to API (Indicator: "SetWindowsHookExA"; File: "???????.exe") Found reference to API (Indicator: "GetMenuItemID"; File: "???????.exe") Found reference to API (Indicator: "GetSystemMenu"; File: "???????.exe") Found reference to API (Indicator: "IsChild"; File: "???????.exe") Found reference to API (Indicator: "GetSubMenu"; File: "???????.exe") Found reference to API (Indicator: "GetMenu"; File: "???????.exe") Found reference to API (Indicator: "LoadBitmapA"; File: "???????.exe") Found reference to API (Indicator: "GetWindowLongA"; File: "???????.exe") Found reference to API (Indicator: "GetMenuItemCount"; File: "???????.exe") Found reference to API (Indicator: "GetSysColor"; File: "???????.exe") Found reference to API (Indicator: "CreateIconFromResource"; File: "???????.exe") Found reference to API (Indicator: "CreateIconFromResourceEx"; File: "???????.exe") Found reference to API (Indicator: "GetPropA"; File: "???????.exe") Found reference to API (Indicator: "AppendMenuA"; File: "???????.exe") Found reference to API (Indicator: "BeginPaint"; File: "???????.exe") Found reference to API (Indicator: "IntersectRect"; File: "???????.exe") Found reference to API (Indicator: "GetTopWindow"; File: "???????.exe") Found reference to API (Indicator: "GetWindowDC"; File: "???????.exe") Found reference to API (Indicator: "SetWindowTextA"; File: "???????.exe") Found reference to API (Indicator: "SetWindowRgn"; File: "???????.exe") Found reference to API (Indicator: "TranslateMessage"; File: "???????.exe") Found reference to API (Indicator: "CopyAcceleratorTableA"; File: "???????.exe") Found reference to API (Indicator: "GetWindowPlacement"; File: "???????.exe") Found reference to API (Indicator: "SetClipboardData"; File: "???????.exe") Found reference to API (Indicator: "GetParent"; File: "???????.exe") Found reference to API (Indicator: "SetScrollRange"; File: "???????.exe") Found reference to API (Indicator: "IsIconic"; File: "???????.exe") Found reference to API (Indicator: "GetScrollRange"; File: "???????.exe") Found reference to API (Indicator: "TranslateAcceleratorA"; File: "???????.exe") Found reference to API (Indicator: "IsWindowEnabled"; File: "???????.exe") Found reference to API (Indicator: "EnableWindow"; File: "???????.exe") Found reference to API (Indicator: "GetMessageA"; File: "???????.exe") Found reference to API (Indicator: "WindowFromPoint"; File: "???????.exe") Found reference to API (Indicator: "KillTimer"; File: "???????.exe") Found reference to API (Indicator: "CreateMenu"; File: "???????.exe") Found reference to API (Indicator: "recvfrom"; File: "???????.exe") Found reference to API (Indicator: "closesocket"; File: "???????.exe") Found reference to API (Indicator: "WSAAsyncSelect"; File: "???????.exe") Found reference to API (Indicator: "ioctlsocket"; File: "???????.exe") Found reference to API (Indicator: "WSACleanup"; File: "???????.exe") Found reference to API (Indicator: "inet_ntoa"; File: "???????.exe") Found reference to API (Indicator: "getpeername"; File: "???????.exe") Found reference to API (Indicator: "OleUninitialize"; File: "???????.exe") Found reference to API (Indicator: "OleInitialize"; File: "???????.exe") Found reference to API (Indicator: "RegQueryInfoKeyW"; File: "???????.exe") Found reference to API (Indicator: "RegEnumKeyExW"; File: "???????.exe") Found reference to API (Indicator: "RegOpenKeyExW"; File: "???????.exe") Found reference to API (Indicator: "RegQueryValueExA"; File: "???????.exe") Found reference to API (Indicator: "RegCreateKeyExW"; File: "???????.exe") Found reference to API (Indicator: "RegDeleteKeyW"; File: "???????.exe") Found reference to API (Indicator: "RegQueryValueExW"; File: "???????.exe") Found reference to API (Indicator: "RegSetValueExW"; File: "???????.exe") Found reference to API (Indicator: "RegDeleteValueW"; File: "???????.exe") Found reference to API (Indicator: "GetObjectW"; File: "???????.exe") Found reference to API (Indicator: "lstrcpynW"; File: "???????.exe") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; File: "???????.exe") Found reference to API (Indicator: "GetTempPathW"; File: "???????.exe") Found reference to API (Indicator: "lstrlenW"; File: "???????.exe") Found reference to API (Indicator: "lstrcmpW"; File: "???????.exe") Found reference to API (Indicator: "GetCurrentProcessId"; File: "???????.exe") Found reference to API (Indicator: "EnumSystemLocalesA"; File: "???????.exe") Found reference to API (Indicator: "lstrcpyW"; File: "???????.exe") Found reference to API (Indicator: "LoadLibraryExW"; File: "???????.exe") Found reference to API (Indicator: "DeleteFileW"; File: "???????.exe") Found reference to API (Indicator: "GetCommandLineW"; File: "???????.exe") Found reference to API (Indicator: "WriteConsoleA"; File: "???????.exe") Found reference to API (Indicator: "TerminateThread"; File: "???????.exe") Found reference to API (Indicator: "FlushInstructionCache"; File: "???????.exe") Found reference to API (Indicator: "CreateDirectoryW"; File: "???????.exe") Found reference to API (Indicator: "LoadLibraryW"; File: "???????.exe") Found reference to API (Indicator: "GetVersionExW"; File: "???????.exe") Found reference to API (Indicator: "FindResourceExW"; File: "???????.exe") Found reference to API (Indicator: "GetConsoleMode"; File: "???????.exe") Found reference to API (Indicator: "GetThreadLocale"; File: "???????.exe") Found reference to API (Indicator: "GetModuleHandleExW"; File: "???????.exe") Found reference to API (Indicator: "InterlockedCompareExchange"; File: "???????.exe") Found reference to API (Indicator: "IsValidLocale"; File: "???????.exe") Found reference to API (Indicator: "IsValidCodePage"; File: "???????.exe") Found reference to API (Indicator: "WriteConsoleW"; File: "???????.exe") Found reference to API (Indicator: "GetLocaleInfoA"; File: "???????.exe") Found reference to API (Indicator: "CreateProcessW"; File: "???????.exe") Found reference to API (Indicator: "GetPrivateProfileIntW"; File: "???????.exe") Found reference to API (Indicator: "GetUserDefaultLCID"; File: "???????.exe") Found reference to API (Indicator: "GetFileAttributesW"; File: "???????.exe") Found reference to API (Indicator: "GetModuleHandleW"; File: "???????.exe") Found reference to API (Indicator: "OpenMutexW"; File: "???????.exe") Found reference to API (Indicator: "CreateFileW"; File: "???????.exe") Found reference to API (Indicator: "Process32NextW"; File: "???????.exe") Found reference to API (Indicator: "GetConsoleCP"; File: "???????.exe") Found reference to API (Indicator: "CreateToolhelp32Snapshot"; File: "???????.exe") Found reference to API (Indicator: "QueryPerformanceCounter"; File: "???????.exe") Found reference to API (Indicator: "ExitThread"; File: "???????.exe") Found reference to API (Indicator: "GetLocaleInfoW"; File: "???????.exe") Found reference to API (Indicator: "GetEnvironmentVariableW"; File: "???????.exe") Found reference to API (Indicator: "GetConsoleOutputCP"; File: "???????.exe") Found reference to API (Indicator: "GetStartupInfoW"; File: "???????.exe") Found reference to API (Indicator: "lstrcmpiW"; File: "???????.exe") Found reference to API (Indicator: "WritePrivateProfileStringW"; File: "???????.exe") Found reference to API (Indicator: "FindFirstFileW"; File: "???????.exe") Found reference to API (Indicator: "GetUserDefaultUILanguage"; File: "???????.exe") Found reference to API (Indicator: "Process32FirstW"; File: "???????.exe") Found reference to API (Indicator: "CreateMutexW"; File: "???????.exe") Found reference to API (Indicator: "GetModuleFileNameW"; File: "???????.exe") Found reference to API (Indicator: "IsDebuggerPresent"; File: "???????.exe") Found reference to API (Indicator: "FindResourceW"; File: "???????.exe") Found reference to API (Indicator: "lstrcatW"; File: "???????.exe") Found reference to API (Indicator: "SysAllocString"; File: "???????.exe") Found reference to API (Indicator: "SysFreeString"; File: "???????.exe") Found reference to API (Indicator: "VariantInit"; File: "???????.exe") Found reference to API (Indicator: "GetErrorInfo"; File: "???????.exe") Found reference to API (Indicator: "VariantChangeType"; File: "???????.exe") Found reference to API (Indicator: "VariantClear"; File: "???????.exe") Found reference to API (Indicator: "SysStringLen"; File: "???????.exe") Found reference to API (Indicator: "VariantCopy"; File: "???????.exe") Found reference to API (Indicator: "SysAllocStringLen"; File: "???????.exe") Found reference to API (Indicator: "ShellExecuteW"; File: "???????.exe") Found reference to API (Indicator: "PathFileExistsW"; File: "???????.exe") Found reference to API (Indicator: "SystemParametersInfoW"; File: "???????.exe") Found reference to API (Indicator: "EnumChildWindows"; File: "???????.exe") Found reference to API (Indicator: "UnregisterClassW"; File: "???????.exe") Found reference to API (Indicator: "GetWindowTextLengthW"; File: "???????.exe") Found reference to API (Indicator: "GetWindowTextW"; File: "???????.exe") Found reference to API (Indicator: "LoadImageW"; File: "???????.exe") Found reference to API (Indicator: "LoadCursorW"; File: "???????.exe") Found reference to API (Indicator: "GetWindowThreadProcessId"; File: "???????.exe") Found reference to API (Indicator: "DispatchMessageW"; File: "???????.exe") Found reference to API (Indicator: "SetWindowTextW"; File: "???????.exe") Found reference to API (Indicator: "DefWindowProcW"; File: "???????.exe") Found reference to API (Indicator: "CharNextW"; File: "???????.exe") Found reference to API (Indicator: "CreateAcceleratorTableW"; File: "???????.exe") Found reference to API (Indicator: "CreateWindowExW"; File: "???????.exe") Found reference to API (Indicator: "UpdateLayeredWindow"; File: "???????.exe") Found reference to API (Indicator: "GetFileVersionInfoSizeW"; File: "???????.exe") Found reference to API (Indicator: "GetFileVersionInfoW"; File: "???????.exe") Found reference to API (Indicator: "VerQueryValueW"; File: "???????.exe") Found reference to API (Indicator: "WSAStartup"; File: "???????.exe") Found reference to API (Indicator: "CoCreateGuid"; File: "???????.exe") Found reference to API (Indicator: "CoTaskMemRealloc"; File: "???????.exe") Found reference to API (Indicator: "CoTaskMemFree"; File: "???????.exe") Found reference to API (Indicator: "CoUninitialize"; File: "???????.exe") Found reference to API (Indicator: "CoTaskMemAlloc"; File: "???????.exe") Found reference to API (Indicator: "StringFromGUID2"; File: "???????.exe") Found reference to API (Indicator: "StringFromCLSID"; File: "???????.exe") Found reference to API (Indicator: "CoInitialize"; File: "???????.exe") Found reference to API (Indicator: "CreateStreamOnHGlobal"; File: "???????.exe") Found reference to API (Indicator: "OleDraw"; File: "???????.exe") Found reference to API (Indicator: "RegDeleteValueA"; File: "???????.exe") Found reference to API (Indicator: "RegDeleteKeyA"; File: "???????.exe") Found reference to API (Indicator: "CreatePatternBrush"; File: "???????.exe") Found reference to API (Indicator: "CreatePipe"; File: "???????.exe") Found reference to API (Indicator: "WaitCommEvent"; File: "???????.exe") Found reference to API (Indicator: "GetLogicalDriveStringsA"; File: "???????.exe") Found reference to API (Indicator: "SetCommMask"; File: "???????.exe") Found reference to API (Indicator: "GetCommModemStatus"; File: "???????.exe") Found reference to API (Indicator: "ReleaseMutex"; File: "???????.exe") Found reference to API (Indicator: "ClearCommError"; File: "???????.exe") Found reference to API (Indicator: "FormatMessageA"; File: "???????.exe") Found reference to API (Indicator: "SuspendThread"; File: "???????.exe") Found reference to API (Indicator: "GetCurrentDirectoryA"; File: "???????.exe") Found reference to API (Indicator: "GetDriveTypeA"; File: "???????.exe") Found reference to API (Indicator: "CreateMutexA"; File: "???????.exe") Found reference to API (Indicator: "RemoveDirectoryA"; File: "???????.exe") Found reference to API (Indicator: "GetPrivateProfileSectionNamesA"; File: "???????.exe") Found reference to API (Indicator: "GetDiskFreeSpaceA"; File: "???????.exe") Found reference to API (Indicator: "GetOverlappedResult"; File: "???????.exe") Found reference to API (Indicator: "SetVolumeLabelA"; File: "???????.exe") Found reference to API (Indicator: "SetCommState"; File: "???????.exe") Found reference to API (Indicator: "ExpandEnvironmentStringsA"; File: "???????.exe") Found reference to API (Indicator: "GetPrivateProfileStringA"; File: "???????.exe") Found reference to API (Indicator: "SetEnvironmentVariableW"; File: "???????.exe") Found reference to API (Indicator: "GetCommState"; File: "???????.exe") Found reference to API (Indicator: "MoveFileA"; File: "???????.exe") Found reference to API (Indicator: "DeviceIoControl"; File: "???????.exe") Found reference to API (Indicator: "GetComputerNameA"; File: "???????.exe") Found reference to API (Indicator: "PeekNamedPipe"; File: "???????.exe") Found reference to API (Indicator: "CopyFileA"; File: "???????.exe") Found reference to API (Indicator: "DeleteFileA"; File: "???????.exe") Found reference to API (Indicator: "SetCommTimeouts"; File: "???????.exe") Found reference to API (Indicator: "PurgeComm"; File: "???????.exe") Found reference to API (Indicator: "SetFileAttributesA"; File: "???????.exe") Found reference to API (Indicator: "GetExitCodeProcess"; File: "???????.exe") Found reference to API (Indicator: "EscapeCommFunction"; File: "???????.exe") Found reference to API (Indicator: "ResetEvent"; File: "???????.exe") Found reference to API (Indicator: "SetThreadPriority"; File: "???????.exe") Found reference to API (Indicator: "SetLocalTime"; File: "???????.exe") Found reference to API (Indicator: "SetConsoleMode"; File: "???????.exe") Found reference to API (Indicator: "OutputDebugStringA"; File: "???????.exe") Found reference to API (Indicator: "ReadConsoleInputA"; File: "???????.exe") Found reference to API (Indicator: "SafeArrayAccessData"; File: "???????.exe") Found reference to API (Indicator: "VariantCopyInd"; File: "???????.exe") Found reference to API (Indicator: "SafeArrayGetUBound"; File: "???????.exe") Found reference to API (Indicator: "SafeArrayUnaccessData"; File: "???????.exe") Found reference to API (Indicator: "GetActiveObject"; File: "???????.exe") Found reference to API (Indicator: "SafeArrayGetElement"; File: "???????.exe") Found reference to API (Indicator: "SafeArrayGetLBound"; File: "???????.exe") Found reference to API (Indicator: "SafeArrayPutElement"; File: "???????.exe") Found reference to API (Indicator: "SafeArrayCreate"; File: "???????.exe") Found reference to API (Indicator: "TrackPopupMenu"; File: "???????.exe") Found reference to API (Indicator: "MessageBeep"; File: "???????.exe") Found reference to API (Indicator: "htonl"; File: "???????.exe") Found reference to API (Indicator: "gethostname"; File: "???????.exe") Found reference to API (Indicator: "inet_addr"; File: "???????.exe") Found reference to API (Indicator: "htons"; File: "???????.exe") Found reference to API (Indicator: "gethostbyname"; File: "???????.exe") Found reference to API (Indicator: "gethostbyaddr"; File: "???????.exe") Found reference to API (Indicator: "RegOpenKeyA"; File: "???????.exe") Found reference to API (Indicator: "RegEnumKeyA"; File: "???????.exe") Found reference to API (Indicator: "OpenFile"; File: "???????.exe") Found reference to API (Indicator: "ExtractIconA"; File: "???????.exe") Found reference to API (Indicator: "OemToCharA"; File: "???????.exe") Found reference to API (Indicator: "MsgWaitForMultipleObjects"; File: "???????.exe") Found reference to API (Indicator: "CharToOemA"; File: "???????.exe") Found reference to API (Indicator: "FrameRect"; File: "???????.exe") Found reference to API (Indicator: "CreateFontA"; File: "???????.exe") Found reference to API (Indicator: "GetProfileIntA"; File: "???????.exe") Found reference to API (Indicator: "wvsprintfA"; File: "???????.exe") Found reference to API (Indicator: "ScrollWindow"; File: "???????.exe") Found reference to API (Indicator: "ShowScrollBar"; File: "???????.exe") Found reference to API (Indicator: "ClipCursor"; File: "???????.exe") Found reference to API (Indicator: "GetCursor"; File: "???????.exe") Found reference to API (Indicator: "SetScrollInfo"; File: "???????.exe") Found reference to API (Indicator: "GetScrollInfo"; File: "???????.exe") Found reference to API (Indicator: "InitializeAcl"; File: "???????.exe") Found reference to API (Indicator: "GetSidIdentifierAuthority"; File: "???????.exe") Found reference to API (Indicator: "GetSidSubAuthority"; File: "???????.exe") Found reference to API (Indicator: "FreeSid"; File: "???????.exe") Found reference to API (Indicator: "RegQueryInfoKeyA"; File: "???????.exe") Found reference to API (Indicator: "RegGetKeySecurity"; File: "???????.exe") Found reference to API (Indicator: "InitializeSecurityDescriptor"; File: "???????.exe") Found reference to API (Indicator: "RegSetKeySecurity"; File: "???????.exe") Found reference to API (Indicator: "AllocateAndInitializeSid"; File: "???????.exe") Found reference to API (Indicator: "GetSidSubAuthorityCount"; File: "???????.exe") Found reference to API (Indicator: "GetLengthSid"; File: "???????.exe") Found reference to API (Indicator: "SetSecurityDescriptorDacl"; File: "???????.exe") Found reference to API (Indicator: "AddAce"; File: "???????.exe") Found reference to API (Indicator: "GetTokenInformation"; File: "???????.exe") Found reference to API (Indicator: "GetUserNameA"; File: "???????.exe") Found reference to API (Indicator: "OpenProcessToken"; File: "???????.exe") Found reference to API (Indicator: "CopySid"; File: "???????.exe") Found reference to API (Indicator: "GlobalMemoryStatus"; File: "???????.exe") Found reference to API (Indicator: "Process32First"; File: "???????.exe") Found reference to API (Indicator: "GetWindowsDirectoryA"; File: "???????.exe") Found reference to API (Indicator: "Process32Next"; File: "???????.exe") Found reference to API (Indicator: "Module32Next"; File: "???????.exe") Found reference to API (Indicator: "QueryPerformanceFrequency"; File: "???????.exe") Found reference to API (Indicator: "WriteProfileStringA"; File: "???????.exe") Found reference to API (Indicator: "GetSystemDirectoryA"; File: "???????.exe") Found reference to API (Indicator: "Module32First"; File: "???????.exe") Found reference to API (Indicator: "WNetCloseEnum"; File: "???????.exe") Found reference to API (Indicator: "WNetAddConnection2A"; File: "???????.exe") Found reference to API (Indicator: "WNetOpenEnumA"; File: "???????.exe") Found reference to API (Indicator: "WNetCancelConnection2A"; File: "???????.exe") Found reference to API (Indicator: "WNetEnumResourceA"; File: "???????.exe") Found reference to API (Indicator: "SHGetSpecialFolderPathA"; File: "???????.exe") Found reference to API (Indicator: "PathFileExistsA"; File: "???????.exe") Found reference to API (Indicator: "FindWindowA"; File: "???????.exe") Found reference to API (Indicator: "SendMessageTimeoutA"; File: "???????.exe") Found reference to API (Indicator: "GetKeyboardState"; File: "???????.exe") Found reference to API (Indicator: "EnumWindows"; File: "???????.exe") Found reference to API (Indicator: "GetKeyboardLayout"; File: "???????.exe") Found reference to API (Indicator: "GetFileVersionInfoA"; File: "???????.exe") Found reference to API (Indicator: "VerQueryValueA"; File: "???????.exe") Found reference to API (Indicator: "GetFileVersionInfoSizeA"; File: "???????.exe") Found reference to API (Indicator: "VerLanguageNameA"; File: "???????.exe") Found reference to API (Indicator: "InternetCloseHandle"; File: "???????.exe") Found reference to API (Indicator: "DeleteUrlCacheEntry"; File: "???????.exe") Found reference to API (Indicator: "FindNextUrlCacheEntryA"; File: "???????.exe") Found reference to API (Indicator: "InternetGetConnectedState"; File: "???????.exe") Found reference to API (Indicator: "FindFirstUrlCacheEntryA"; File: "???????.exe") Found reference to API (Indicator: "InternetOpenA"; File: "???????.exe") Found reference to API (Indicator: "InternetOpenUrlA"; File: "???????.exe") Found reference to API (Indicator: "GetAdaptersInfo"; File: "???????.exe") Found reference to API (Indicator: "SendARP"; File: "???????.exe") Found reference to API (Indicator: "ntohl"; File: "???????.exe") Found reference to API (Indicator: "timeSetEvent"; File: "???????.exe") Found reference to API (Indicator: "LookupPrivilegeValueA"; File: "???????.exe") Found reference to API (Indicator: "AdjustTokenPrivileges"; File: "???????.exe") Found reference to API (Indicator: "SetSystemPowerState"; File: "???????.exe") Found reference to API (Indicator: "SHGetFileInfoA"; File: "???????.exe") Found reference to API (Indicator: "SHGetPathFromIDListA"; File: "???????.exe") Found reference to API (Indicator: "SHFileOperationA"; File: "???????.exe") Found reference to API (Indicator: "SHBrowseForFolderA"; File: "???????.exe") Found reference to API (Indicator: "SHGetMalloc"; File: "???????.exe") Found reference to API (Indicator: "ExitWindowsEx"; File: "???????.exe") Found reference to API (Indicator: "InitializeConditionVariable"; Source: "00000000-00002304.00000000.146996.4C448000.00000002.mdmp") Found reference to API (Indicator: "SleepConditionVariableCS"; Source: "00000000-00002304.00000000.146996.4C448000.00000002.mdmp") Found reference to API (Indicator: "WakeAllConditionVariable"; Source: "00000000-00002304.00000000.146996.4C448000.00000002.mdmp") Found reference to API (Indicator: "RtlDllShutdownInProgress"; Source: "00000000-00002304.00000000.146996.4C448000.00000002.mdmp") Found reference to API (Indicator: "MessageBoxW"; Source: "00000000-00002304.00000000.146996.4C448000.00000002.mdmp") Found reference to API (Indicator: "LoadIconW"; Source: "00000000-00002304.00000000.146996.4C448000.00000002.mdmp") Found reference to API (Indicator: "TranslateMessage"; Source: "00000000-00002304.00000000.146996.4C448000.00000002.mdmp") Found reference to API (Indicator: "DispatchMessageW"; Source: "00000000-00002304.00000000.146996.4C448000.00000002.mdmp") Found reference to API (Indicator: "RegisterClassW"; Source: "00000000-00002304.00000000.146996.4C448000.00000002.mdmp") Found reference to API (Indicator: "DestroyWindow"; Source: "00000000-00002304.00000000.146996.4C448000.00000002.mdmp") Found reference to API (Indicator: "CreateWindowExW"; Source: "00000000-00002304.00000000.146996.4C448000.00000002.mdmp") Found reference to API (Indicator: "GetWindow"; Source: "00000000-00002304.00000000.146996.4C448000.00000002.mdmp") Found reference to API (Indicator: "DefWindowProcW"; Source: "00000000-00002304.00000000.146996.4C448000.00000002.mdmp") Found reference to API (Indicator: "LoadCursorW"; Source: "00000000-00002304.00000000.146996.4C448000.00000002.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00002304.00000000.146996.4C448000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameA"; Source: "00000000-00002304.00000000.146996.4C448000.00000002.mdmp") Found reference to API (Indicator: "IsWow64Process2"; Source: "00000000-00002304.00000000.146996.4C448000.00000002.mdmp") Found reference to API (Indicator: "CreateSemaphoreExW"; Source: "00000000-00002304.00000000.146996.4C448000.00000002.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00002304.00000000.146996.4C448000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00002304.00000000.146996.4C448000.00000002.mdmp") Found reference to API (Indicator: "GetCommandLineW"; Source: "00000000-00002304.00000000.146996.4C448000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00002304.00000000.146996.4C448000.00000002.mdmp") Found reference to API (Indicator: "ReleaseSemaphore"; Source: "00000000-00002304.00000000.146996.4C448000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00002304.00000000.146996.4C448000.00000002.mdmp") Found reference to API (Indicator: "GetSystemWow64Directory2W"; Source: "00000000-00002304.00000000.146996.4C448000.00000002.mdmp") Found reference to API (Indicator: "CoUninitialize"; Source: "00000000-00002304.00000000.146996.4C448000.00000002.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00002304.00000000.146996.4C448000.00000002.mdmp") Found reference to API (Indicator: "EncodePointer"; Source: "00000000-00002304.00000000.146996.4C448000.00000002.mdmp") Found reference to API (Indicator: "SetErrorMode"; Source: "00000000-00002304.00000000.146996.4C448000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointer"; Source: "00000000-00002304.00000000.146996.4C448000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00002304.00000000.146996.4C448000.00000002.mdmp") Found reference to API (Indicator: "LocalAlloc"; Source: "00000000-00002304.00000000.146996.4C448000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00002304.00000000.146996.4C448000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00002304.00000000.146996.4C448000.00000002.mdmp") Found reference to API (Indicator: "ReleaseMutex"; Source: "00000000-00002304.00000000.146996.4C448000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDirectoryW"; Source: "00000000-00002304.00000000.146996.4C448000.00000002.mdmp") Found reference to API (Indicator: "CreateEventW"; Source: "00000000-00002304.00000000.146996.4C448000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00002304.00000000.146996.4C448000.00000002.mdmp") Found reference to API (Indicator: "CoInitializeSecurity"; Source: "00000000-00002304.00000000.146996.4C448000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00002304.00000000.146996.4C448000.00000002.mdmp") Found reference to API (Indicator: "AttachConsole"; Source: "00000000-00002304.00000000.146996.4C448000.00000002.mdmp") Found reference to API (Indicator: "ReleaseSRWLockExclusive"; Source: "00000000-00002304.00000000.146996.4C448000.00000002.mdmp") Found reference to API (Indicator: "OutputDebugStringW"; Source: "00000000-00002304.00000000.146996.4C448000.00000002.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00002304.00000000.146996.4C448000.00000002.mdmp") Found reference to API (Indicator: "AcquireSRWLockExclusive"; Source: "00000000-00002304.00000000.146996.4C448000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00002304.00000000.146996.4C448000.00000002.mdmp") Found reference to API (Indicator: "OpenSemaphoreW"; Source: "00000000-00002304.00000000.146996.4C448000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00002304.00000000.146996.4C448000.00000002.mdmp") Found reference to API (Indicator: "ReleaseSRWLockShared"; Source: "00000000-00002304.00000000.146996.4C448000.00000002.mdmp") Found reference to API (Indicator: "FreeConsole"; Source: "00000000-00002304.00000000.146996.4C448000.00000002.mdmp") Found reference to API (Indicator: "HeapSetInformation"; Source: "00000000-00002304.00000000.146996.4C448000.00000002.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00002304.00000000.146996.4C448000.00000002.mdmp") Found reference to API (Indicator: "LoadStringW"; Source: "00000000-00002304.00000000.146996.4C448000.00000002.mdmp") Found reference to API (Indicator: "DecodePointer"; Source: "00000000-00002304.00000000.146996.4C448000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00002304.00000000.146996.4C448000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00002304.00000000.146996.4C448000.00000002.mdmp") Found reference to API (Indicator: "CreateMutexExW"; Source: "00000000-00002304.00000000.146996.4C448000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00002304.00000000.146996.4C448000.00000002.mdmp") Found reference to API (Indicator: "AcquireSRWLockShared"; Source: "00000000-00002304.00000000.146996.4C448000.00000002.mdmp") Found reference to API (Indicator: "CLSIDFromString"; Source: "00000000-00002304.00000000.146996.4C448000.00000002.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00002304.00000000.146996.4C448000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00002304.00000000.146996.4C448000.00000002.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00002304.00000000.146996.4C448000.00000002.mdmp") Found reference to API (Indicator: "CreateProcessW"; Source: "00000000-00002304.00000000.146996.4C448000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00002304.00000000.146996.4C448000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00002304.00000000.146996.4C448000.00000002.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00002304.00000000.146996.4C448000.00000002.mdmp") Found reference to API (Indicator: "CoInitializeEx"; Source: "00000000-00002304.00000000.146996.4C448000.00000002.mdmp") Found reference to API (Indicator: "DebugBreak"; Source: "00000000-00002304.00000000.146996.4C448000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00002304.00000000.146996.4C448000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00002304.00000000.146996.4C448000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00002304.00000000.146996.4C448000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00002304.00000000.146996.4C448000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00002304.00000000.146996.4C448000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00002304.00000000.146996.4C448000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00002304.00000000.146996.4C448000.00000002.mdmp") Found reference to API (Indicator: "ResetEvent"; Source: "00000000-00002304.00000000.146996.4C448000.00000002.mdmp") Found reference to API (Indicator: "RtlCaptureContext"; Source: "00000000-00002304.00000000.146996.4C448000.00000002.mdmp") Found reference to API (Indicator: "RtlLookupFunctionEntry"; Source: "00000000-00002304.00000000.146996.4C448000.00000002.mdmp") Found reference to API (Indicator: "RtlVirtualUnwind"; Source: "00000000-00002304.00000000.146996.4C448000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00002304.00000000.146996.4C448000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00002304.00000000.146996.4C448000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00002304.00000000.146996.4C448000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00002304.00000000.146996.4C448000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00002304.00000000.146996.4C448000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00002304.00000000.146996.4C448000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00002304.00000000.146996.4C448000.00000002.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00002304.00000000.146996.4C448000.00000002.mdmp") Found reference to API (Indicator: "SearchPathW"; Source: "00000000-00002304.00000000.146996.4C448000.00000002.mdmp") Found reference to API (Indicator: "CompareStringW"; Source: "00000000-00002304.00000000.146996.4C448000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesW"; Source: "00000000-00002304.00000000.146996.4C448000.00000002.mdmp") Found reference to API (Indicator: "CharNextW"; Source: "00000000-00002304.00000000.146996.4C448000.00000002.mdmp") Found reference to API (Indicator: "Wow64EnableWow64FsRedirection"; Source: "00000000-00002304.00000000.146996.4C448000.00000002.mdmp") Found reference to API (Indicator: "CreateActCtxW"; Source: "00000000-00002304.00000000.146996.4C448000.00000002.mdmp") Found reference to API (Indicator: "ActivateActCtx"; Source: "00000000-00002304.00000000.146996.4C448000.00000002.mdmp") Found reference to API (Indicator: "DeactivateActCtx"; Source: "00000000-00002304.00000000.146996.4C448000.00000002.mdmp") Found reference to API (Indicator: "ReleaseActCtx"; Source: "00000000-00002304.00000000.146996.4C448000.00000002.mdmp") Found reference to API (Indicator: "QueryActCtxW"; Source: "00000000-00002304.00000000.146996.4C448000.00000002.mdmp") Found reference to API (Indicator: "PathIsRelativeW"; Source: "00000000-00002304.00000000.146996.4C448000.00000002.mdmp") Found reference to API (Indicator: "NtQuerySystemInformation"; Source: "00000000-00002304.00000000.146996.4C448000.00000002.mdmp") Found reference to API (Indicator: "RtlImageNtHeader"; Source: "00000000-00002304.00000000.146996.4C448000.00000002.mdmp") Found reference to API (Indicator: "NtQueryInformationToken"; Source: "00000000-00002304.00000000.146996.4C448000.00000002.mdmp") Found reference to API (Indicator: "RtlNtStatusToDosError"; Source: "00000000-00002304.00000000.146996.4C448000.00000002.mdmp") Found reference to API (Indicator: "NtOpenProcessToken"; Source: "00000000-00002304.00000000.146996.4C448000.00000002.mdmp") Found reference to API (Indicator: "NtClose"; Source: "00000000-00002304.00000000.146996.4C448000.00000002.mdmp") Found reference to API (Indicator: "DelayLoadFailureHook"; Source: "00000000-00002304.00000000.146996.4C448000.00000002.mdmp") Found reference to API (Indicator: "GetSystemMetrics"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "GetLastActivePopup"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "GetActiveWindow"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "MessageBoxA"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "CreateProcessA"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "GetCommandLineA"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "MulDiv"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleA"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "GetVolumeInformationA"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "SetCurrentDirectoryA"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesA"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileA"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "GlobalUnlock"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "GlobalLock"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "GlobalAlloc"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "CreateEventA"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "WritePrivateProfileStringA"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExA"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "lstrlenA"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "GetFullPathNameA"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "HeapReAlloc"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "GlobalReAlloc"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "FindNextFileA"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "lstrcpyA"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "WinExec"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "lstrcatA"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSection"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "GlobalFree"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "GlobalSize"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameA"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "SizeofResource"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "LockResource"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "FindResourceA"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "CreateFileA"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "WaitForMultipleObjects"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "GetProfileStringA"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "ReleaseSemaphore"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "ResumeThread"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "CreateSemaphoreA"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointer"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "GetFileSize"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "EnumResourceNamesA"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExA"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "GetTimeZoneInformation"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "GetVersion"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "wsprintfA"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "CloseClipboard"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "GetClipboardData"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "OpenClipboard"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "SetClipboardData"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "EmptyClipboard"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "GetCursorPos"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "SetWindowPos"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "SendMessageA"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "DestroyCursor"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "SetParent"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "IsWindow"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "PostMessageA"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "GetTopWindow"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "GetParent"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "GetFocus"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "GetClientRect"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "InvalidateRect"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "UpdateWindow"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "EqualRect"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "GetWindowRect"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "SetForegroundWindow"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "DestroyMenu"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "IsChild"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "ReleaseDC"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "IsRectEmpty"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "FillRect"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "GetDC"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "SetCursor"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "LoadCursorA"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "SetCursorPos"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "SetActiveWindow"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "GetSysColor"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "SetWindowLongA"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "GetWindowLongA"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "RedrawWindow"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "EnableWindow"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "IsWindowVisible"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "OffsetRect"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "PtInRect"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "DestroyIcon"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "IntersectRect"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "SetRect"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "InflateRect"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "SetScrollPos"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "SetScrollRange"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "GetScrollRange"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "SetCapture"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "GetCapture"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "ReleaseCapture"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "SetTimer"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "KillTimer"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "WinHelpA"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "LoadBitmapA"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "CopyRect"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "ScreenToClient"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "SetWindowRgn"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "DestroyAcceleratorTable"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "GetWindow"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "SetFocus"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "IsIconic"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "PeekMessageA"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "SetMenu"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "GetMenu"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "DefWindowProcA"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "GetClassInfoA"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "DeleteMenu"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "GetSystemMenu"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "IsZoomed"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "PostQuitMessage"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "CopyAcceleratorTableA"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "GetKeyState"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "TranslateAcceleratorA"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "IsWindowEnabled"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "ShowWindow"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "LoadImageA"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "ClientToScreen"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "EnableMenuItem"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "GetSubMenu"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "CreateAcceleratorTableA"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "CreateMenu"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "ModifyMenuA"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "AppendMenuA"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "CreatePopupMenu"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "DrawIconEx"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "CreateIconFromResource"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "CreateIconFromResourceEx"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "RegisterClipboardFormatA"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "DispatchMessageA"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "GetMessageA"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "WindowFromPoint"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "DrawFocusRect"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "DrawEdge"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "DrawFrameControl"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "LoadIconA"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "TranslateMessage"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "SystemParametersInfoA"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "GetDesktopWindow"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "GetClassNameA"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "FindWindowExA"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "GetWindowTextA"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "GetDeviceCaps"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "GetTextExtentPoint32A"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "RoundRect"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentObject"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "DPtoLP"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "CreateCompatibleDC"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "BitBlt"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "DeleteDC"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "CreateFontIndirectA"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "GetStockObject"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "CreateSolidBrush"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "GetObjectA"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "SelectObject"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "CreateDCA"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "GetBkColor"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "GetTextColor"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "CreateRoundRectRgn"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "GetDIBits"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "StretchBlt"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "DeleteObject"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "SetStretchBltMode"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExA"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "RegSetValueExA"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "RegCreateKeyA"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "RegCreateKeyExA"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "ShellExecuteA"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "Shell_NotifyIconA"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "CLSIDFromString"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "OleUninitialize"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "OleInitialize"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "InterlockedIncrement"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "InterlockedDecrement"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "FileTimeToSystemTime"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "FileTimeToLocalFileTime"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "lstrcpynA"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "DuplicateHandle"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "FlushFileBuffers"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "LockFile"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "UnlockFile"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "SetEndOfFile"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "lstrcmpiA"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "GlobalDeleteAtom"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "GlobalFindAtomA"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "GlobalAddAtomA"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "GlobalGetAtomNameA"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "lstrcmpA"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "LocalAlloc"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "TlsAlloc"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "GlobalHandle"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "TlsFree"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "TlsSetValue"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "LocalReAlloc"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "TlsGetValue"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "GetFileTime"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThread"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "GlobalFlags"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "SetErrorMode"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "GetProcessVersion"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "GetCPInfo"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "GetOEMCP"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoA"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "RtlUnwind"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTime"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "GetLocalTime"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "HeapSize"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "GetACP"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "FreeEnvironmentStringsA"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "FreeEnvironmentStringsW"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "GetEnvironmentStrings"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "GetEnvironmentStringsW"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "SetHandleCount"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "GetEnvironmentVariableA"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "HeapDestroy"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "HeapCreate"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "VirtualFree"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "SetEnvironmentVariableA"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "LCMapStringA"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "LCMapStringW"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "VirtualAlloc"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "IsBadWritePtr"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "GetStringTypeA"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "GetStringTypeW"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "CompareStringA"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "CompareStringW"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "IsBadReadPtr"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "IsBadCodePtr"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "SetStdHandle"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "InterlockedExchange"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "CharUpperA"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "GetWindowDC"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "BeginPaint"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "TabbedTextOutA"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "DrawTextA"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "GrayStringA"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "DestroyWindow"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "GetWindowPlacement"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "RegisterWindowMessageA"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "GetForegroundWindow"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "GetMessageTime"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "RemovePropA"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "CallWindowProcA"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "GetPropA"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "UnhookWindowsHookEx"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "SetPropA"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "CallNextHookEx"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "SetWindowsHookExA"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "CreateWindowExA"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "GetMenuItemID"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "GetMenuItemCount"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "RegisterClassA"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "GetScrollPos"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "AdjustWindowRectEx"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "MapWindowPoints"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "IsDialogMessageA"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "SetWindowTextA"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "MoveWindow"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "CheckMenuItem"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "SetMenuItemBitmaps"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "GetMenuState"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "GetMenuCheckMarkDimensions"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "LoadStringA"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "GetSysColorBrush"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "SetMapMode"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "TextOutA"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "ExtTextOutA"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "GetTextMetricsA"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API (Indicator: "UnregisterClassA"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp")37:T416,Found string "%WINDIR%\system32\cmd.exe /c C:\ddel.bat" (Indicator: "\system32\cmd.exe /c "; File: "cmd.exe") Found string "%WINDIR%\system32\cmd.exe /c C:\ddel.bat" (Indicator: "cmd.exe /c"; File: "cmd.exe") Found string "%WINDIR%\system32\cmd.exe /c C:\del.bat" (Indicator: "\system32\cmd.exe /c "; File: "cmd.exe") Found string "%WINDIR%\system32\cmd.exe /c C:\del.bat" (Indicator: "cmd.exe /c"; File: "cmd.exe") Found string ":\WINDOWS\system32\cmd.exe /c C:\del.bat" (Indicator: "\system32\cmd.exe /c "; Source: "00000000-00007100.00000000.146549.030E2000.00000004.mdmp") Found string ":\WINDOWS\system32\cmd.exe /c C:\del.bat" (Indicator: "cmd.exe /c"; Source: "00000000-00007100.00000000.146549.030E2000.00000004.mdmp") Found string ":\WINDOWS\system32\cmd.exe /c C:\ddel.bat" (Indicator: "\system32\cmd.exe /c "; Source: "00000000-00007100.00000000.146549.030E2000.00000004.mdmp") Found string ":\WINDOWS\system32\cmd.exe /c C:\ddel.bat" (Indicator: "cmd.exe /c"; Source: "00000000-00007100.00000000.146549.030E2000.00000004.mdmp")38:T438,Found reference to API "SizeofResource" (Indicator: "SizeofResource"; File: "???????.exe") Found reference to API "FindResourceA" (Indicator: "FindResource"; File: "???????.exe") Found reference to API "LoadResource" (Indicator: "LoadResource"; File: "???????.exe") Found reference to API "LockResource" (Indicator: "LockResource"; File: "???????.exe") Found reference to API "FindResourceExW" (Indicator: "FindResource"; File: "???????.exe") Found reference to API "FindResourceW" (Indicator: "FindResource"; File: "???????.exe") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API "FindResourceA" (Indicator: "FindResource"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp")39:T7d3,"krnln.fnr" contains export function called "GetNewInf" at ordinal 6 "krnln.fnr" contains export function called "GetNewSock" at ordinal 7 "krnln.fnr" contains export function called "IsEPKLoaded" at ordinal 1 "krnln.fnr" contains export function called "LoadEPKData" at ordinal 2 "krnln.fnr" contains export function called "LoadEPKFile" at ordinal 3 "krnln.fnr" contains export function called "LoadEPKFromCmdLine" at ordinal 4 "krnln.fnr" contains export function called "UnloadEPK" at ordinal 5 "krnln.fnr" contains export function called "png_access_version_number" at ordinal 8 "krnln.fnr" contains export function called "png_benign_error" at ordinal 9 "krnln.fnr" contains export function called "png_build_grayscale_palette" at ordinal 10 "krnln.fnr" contains export function called "png_calloc" at ordinal 11 "krnln.fnr" contains export function called "png_chunk_benign_error" at ordinal 12 "krnln.fnr" contains export function called "png_chunk_error" at ordinal 13 "krnln.fnr" contains export function called "png_chunk_warning" at ordinal 14 "krnln.fnr" contains export function called "png_convert_from_struct_tm" at ordinal 15 "krnln.fnr" contains export function called "png_convert_from_time_t" at ordinal 16 "krnln.fnr" contains export function called "png_convert_to_rfc1123" at ordinal 17 "krnln.fnr" contains export function called "png_convert_to_rfc1123_buffer" at ordinal 18 "krnln.fnr" contains export function called "png_create_info_struct" at ordinal 19 "krnln.fnr" contains export function called "png_create_read_struct" at ordinal 20 "krnln.fnr" contains export function called "png_create_read_struct_2" at ordinal 21 "krnln.fnr" contains export function called "png_create_write_struct" at ordinal 22 "krnln.fnr" contains export function called "png_create_write_struct_2" at ordinal 23 "krnln.fnr" contains export function called "png_data_freer" at ordinal 24 "krnln.fnr" contains export function called "png_destroy_info_struct" at ordinal 253a:T946,"SOFTWARE\Classes\exefile\DefaultIcon\" in Source: 65109-1848-004010CB "Software\Microsoft\Windows\CurrentVersion\Run\" in Source: 65109-1848-004010CB "Registry\Machine\Software\Classes\WOW6432Node\" in Source: 00000000-00000732.00000000.146875.59010000.00000004.mdmp 00000000-00000732.00000001.148798.59010000.00000004.mdmp 00000000-00000732.00000002.150715.59010000.00000004.mdmp "hine\Software\Classes\WOW6432Node\CLSID\{0000032A-0000-0000P" in Source: 00000000-00000732.00000000.146875.59010000.00000004.mdmp 00000000-00000732.00000001.148798.59010000.00000004.mdmp 00000000-00000732.00000002.150715.59010000.00000004.mdmp "e\Software\C" in Source: 00000000-00000732.00000000.146875.59010000.00000004.mdmp 00000000-00000732.00000001.148798.59010000.00000004.mdmp 00000000-00000732.00000002.150715.59010000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{00020420-0000-0000-C000-000000000046}" in Source: 00000000-00000732.00000000.146875.59010000.00000004.mdmp 00000000-00000732.00000001.148798.59010000.00000004.mdmp 00000000-00000732.00000002.150715.59010000.00000004.mdmp "Path=C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\W\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{0C9281F9-6DA1-4006-872" in Source: 00000000-00002304.00000000.146996.C3D70000.00000004.mdmp 00000000-00002304.00000001.148917.C3D70000.00000004.mdmp 00000000-00002304.00000002.150837.C3D70000.00000004.mdmp "hine\Software\Classes\WOW6432Node\CLSID\{0000032A-0000-0000" in Source: 00000000-00002304.00000000.146996.C3D70000.00000004.mdmp 00000000-00002304.00000001.148917.C3D70000.00000004.mdmp 00000000-00002304.00000002.150837.C3D70000.00000004.mdmp "hine\Software\Classes\WOW6432Node\CLSID\{0" in Source: 00000000-00002304.00000000.146996.C3D70000.00000004.mdmp 00000000-00002304.00000001.148917.C3D70000.00000004.mdmp 00000000-00002304.00000002.150837.C3D70000.00000004.mdmp "SOFTWARE\Classes\exefile\DefaultIcon\" in Source: 00000000-00007100.00000000.146549.00468000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Run\" in Source: 00000000-00007100.00000000.146549.00468000.00000002.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00007100.00000000.146549.030E2000.00000004.mdmp3b:T89b,Process .exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:668:168:WilStaging_02" Process .exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:668:168:WilStaging_02" Process .exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:668:64:WilError_01" Process .exe created mutex with name "\BaseNamedObjects\SyncRootManager" Process .exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:668:64:WilError_01" Process .exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesCacheCounterMutex" Process .exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesLockedCacheCounterMutex" Process .exe created mutex with name "Local\SM0:668:168:WilStaging_02" Process .exe created mutex with name "Local\SM0:668:64:WilError_01" Process .exe created mutex with name "Local\ZonesCacheCounterMutex" Process .exe created mutex with name "SM0:668:168:WilStaging_02" Process .exe created mutex with name "Local\ZonesLockedCacheCounterMutex" Process .exe created mutex with name "SM0:668:64:WilError_01" Process gamesetup.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:7100:168:WilStaging_02" Process gamesetup.exe created mutex with name "Local\SM0:7100:168:WilStaging_02" Process gamesetup.exe created mutex with name "SM0:7100:64:WilError_01" Process gamesetup.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:7100:64:WilError_01" Process rundll32.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:732:304:WilStaging_02" Process rundll32.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:732:304:WilStaging_02" Process rundll32.exe created mutex with name "SM0:732:304:WilStaging_02" Process rundll32.exe created mutex with name "Local\SM0:732:304:WilStaging_02" Process rundll32.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:2304:304:WilStaging_02" Process rundll32.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:2304:304:WilStaging_02" Process rundll32.exe created mutex with name "Local\SM0:2304:304:WilStaging_02" Process rundll32.exe created mutex with name "SM0:2304:304:WilStaging_02"3c:T742,".exe" failed to load missing module "C:\kernel32.dll" - [base:0; Status:c0000135] ".exe" failed to load missing module "%TEMP%\E_N60005\kernel32.dll" - [base:0; Status:c0000135] ".exe" failed to load missing module "C:\ntdll.dll" - [base:0; Status:c0000135] ".exe" failed to load missing module "%TEMP%\E_N60005\ntdll.dll" - [base:0; Status:c0000135] ".exe" failed to load missing module "C:\GdiPlus.dll" - [base:0; Status:c0000135] ".exe" failed to load missing module "%TEMP%\E_N60005\GdiPlus.dll" - [base:0; Status:c0000135] ".exe" failed to load missing module "C:\ole32.dll" - [base:0; Status:c0000135] ".exe" failed to load missing module "%TEMP%\E_N60005\ole32.dll" - [base:0; Status:c0000135] ".exe" failed to load missing module "C:\kernel32" - [base:0; Status:c0000135] ".exe" failed to load missing module "%TEMP%\E_N60005\kernel32" - [base:0; Status:c0000135] ".exe" failed to load missing module "C:\user32" - [base:0; Status:c0000135] ".exe" failed to load missing module "%TEMP%\E_N60005\user32" - [base:0; Status:c0000135] ".exe" failed to load missing module "C:\User32.dll" - [base:0; Status:c0000135] ".exe" failed to load missing module "%TEMP%\E_N60005\User32.dll" - [base:0; Status:c0000135] ".exe" failed to load missing module "C:\user32.dll" - [base:0; Status:c0000135] ".exe" failed to load missing module "%TEMP%\E_N60005\user32.dll" - [base:0; Status:c0000135] ".exe" failed to load missing module "%TEMP%\E_N60005\eAPI.fnr" - [base:0; Status:c0000135] ".exe" failed to load missing module "%TEMP%\E_N60005\EThread.fnr" - [base:0; Status:c0000135] ".exe" failed to load missing module "%TEMP%\E_N60005\shell.fnr" - [base:0; Status:c0000135] ".exe" failed to load missing module "%TEMP%\E_N60005\spec.fnr" - [base:0; Status:c0000135] ".exe" failed to load missing module "krnln.fne" - [base:0; Status:c0000135]3d:Td39,"Registry\Machine\Software\Classes\WOW6432Node\" in Source: 00000000-00000732.00000000.146875.59010000.00000004.mdmp "hine\Software\Classes\WOW6432Node\CLSID\{0000032A-0000-0000P" in Source: 00000000-00000732.00000000.146875.59010000.00000004.mdmp "e\Software\C" in Source: 00000000-00000732.00000000.146875.59010000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{00020420-0000-0000-C000-000000000046}" in Source: 00000000-00000732.00000000.146875.59010000.00000004.mdmp "Registry\Machine\Software\Classes\WOW6432Node\" in Source: 00000000-00000732.00000001.148798.59010000.00000004.mdmp "hine\Software\Classes\WOW6432Node\CLSID\{0000032A-0000-0000P" in Source: 00000000-00000732.00000001.148798.59010000.00000004.mdmp "e\Software\C" in Source: 00000000-00000732.00000001.148798.59010000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{00020420-0000-0000-C000-000000000046}" in Source: 00000000-00000732.00000001.148798.59010000.00000004.mdmp "Registry\Machine\Software\Classes\WOW6432Node\" in Source: 00000000-00000732.00000002.150715.59010000.00000004.mdmp "hine\Software\Classes\WOW6432Node\CLSID\{0000032A-0000-0000P" in Source: 00000000-00000732.00000002.150715.59010000.00000004.mdmp "e\Software\C" in Source: 00000000-00000732.00000002.150715.59010000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{00020420-0000-0000-C000-000000000046}" in Source: 00000000-00000732.00000002.150715.59010000.00000004.mdmp "Path=C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\W\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{0C9281F9-6DA1-4006-872" in Source: 00000000-00002304.00000000.146996.C3D70000.00000004.mdmp "hine\Software\Classes\WOW6432Node\CLSID\{0000032A-0000-0000" in Source: 00000000-00002304.00000000.146996.C3D70000.00000004.mdmp "hine\Software\Classes\WOW6432Node\CLSID\{0" in Source: 00000000-00002304.00000000.146996.C3D70000.00000004.mdmp "Path=C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\W\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{0C9281F9-6DA1-4006-872" in Source: 00000000-00002304.00000001.148917.C3D70000.00000004.mdmp "hine\Software\Classes\WOW6432Node\CLSID\{0000032A-0000-0000" in Source: 00000000-00002304.00000001.148917.C3D70000.00000004.mdmp "hine\Software\Classes\WOW6432Node\CLSID\{0" in Source: 00000000-00002304.00000001.148917.C3D70000.00000004.mdmp "Path=C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\W\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{0C9281F9-6DA1-4006-872" in Source: 00000000-00002304.00000002.150837.C3D70000.00000004.mdmp "hine\Software\Classes\WOW6432Node\CLSID\{0000032A-0000-0000" in Source: 00000000-00002304.00000002.150837.C3D70000.00000004.mdmp "hine\Software\Classes\WOW6432Node\CLSID\{0" in Source: 00000000-00002304.00000002.150837.C3D70000.00000004.mdmp "SOFTWARE\Classes\exefile\DefaultIcon\" in Source: 00000000-00007100.00000000.146549.00468000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Run\" in Source: 00000000-00007100.00000000.146549.00468000.00000002.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00007100.00000000.146549.030E2000.00000004.mdmp3e:T185b,".exe" loaded module "KERNEL32" at base 76ea0000 ".exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 75030000 ".exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 75030000 ".exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 75030000 ".exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 74a40000 ".exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 75030000 ".exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 75030000 ".exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 75030000 ".exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 72d10000 ".exe" loaded module "USER32.DLL" at base 76c20000 ".exe" loaded module "ADVAPI32.DLL" at base 76ba0000 ".exe" loaded module "NTDLL.DLL" at base 77120000 ".exe" loaded module "SHELL32.DLL" at base 754a0000 ".exe" loaded module "SHLWAPI.DLL" at base 742e0000 ".exe" loaded module "KERNEL32.DLL" at base 76ea0000 ".exe" loaded module "USER32" at base 76c20000 ".exe" loaded module "%TEMP%\E_N60005\KRNLN.FNR" at base 10000000 ".exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 735f0000 ".exe" loaded module "GDIPLUS.DLL" at base 73880000 ".exe" loaded module "%WINDIR%\WINSXS\X86_MICROSOFT.WINDOWS.GDIPLUS_6595B64144CCF1DF_1.1.16299.248_NONE_8E66FBC1026DF8AB\GDIPLUS.DLL" at base 73880000 ".exe" loaded module "OLE32.DLL" at base 76da0000 ".exe" loaded module "COMCTL32.DLL" at base 72a20000 ".exe" loaded module "RPCRT4.DLL" at base 753e0000 ".exe" loaded module "WDMAUD.DRV" at base 728c0000 ".exe" loaded module "MMDEVAPI.DLL" at base 72900000 ".exe" loaded module "%TEMP%\E_N60005\EAPI.FNE" at base 6b10000 ".exe" loaded module "%TEMP%\E_N60005\ETHREAD.FNE" at base 6b70000 ".exe" loaded module "%TEMP%\E_N60005\SHELL.FNE" at base 6cd0000 ".exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 73060000 ".exe" loaded module "API-MS-WIN-CORE-PROCESSTHREADS-L1-1-2.DLL" at base 76ea0000 ".exe" loaded module "%WINDIR%\SYSWOW64\\WINDOWS.STATEREPOSITORYPS.DLL" at base 72160000 ".exe" loaded module "%WINDIR%\SYSWOW64\SHELL32.DLL" at base 754a0000 ".exe" loaded module "%WINDIR%\SYSWOW64\URLMON.DLL" at base 73400000 ".exe" loaded module "MSISO.DLL" at base 72100000 ".exe" loaded module "SSPICLI.DLL" at base 73b40000 ".exe" loaded module "API-MS-WIN-CORE-URL-L1-1-0.DLL" at base 75030000 ".exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 73bf0000 ".exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 73a90000 ".exe" loaded module "%TEMP%\E_N60005\IEXT.FNR" at base 87b0000 ".exe" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 76960000 ".exe" loaded module "%TEMP%\E_N60005\SPEC.FNE" at base 8880000 ".exe" loaded module "KRNLN.FNR" at base 10000000 ".exe" loaded module "%WINDIR%\SYSWOW64\WINDOWS.STORAGE.DLL" at base 73bf0000 ".exe" loaded module "CSCAPI.DLL" at base 72eb0000 ".exe" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 76da0000 ".exe" loaded module "EXT-MS-WIN-KERNEL32-ERRORHANDLING-L1-1-0.DLL" at base 76ea0000 "gamesetup.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 75030000 "gamesetup.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 75030000 "gamesetup.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 75030000 "gamesetup.exe" loaded module "KERNEL32" at base 76ea0000 "gamesetup.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 72d10000 "gamesetup.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 735f0000 "gamesetup.exe" loaded module "KERNEL32.DLL" at base 76ea0000 "gamesetup.exe" loaded module "RPCRT4.DLL" at base 753e0000 "gamesetup.exe" loaded module "%WINDIR%\SYSWOW64\ONECOREUAPCOMMONPROXYSTUB.DLL" at base 71e20000 "gamesetup.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 73bf0000 "gamesetup.exe" loaded module "NTDLL.DLL" at base 77120000 "cmd.exe" loaded module "KERNEL32" at base 76ea0000 "cmd.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 75030000 "cmd.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 75030000 "cmd.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 75030000 "cmd.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 74a40000 "cmd.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 75030000 "cmd.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 75030000 "cmd.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 75030000 "cmd.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 72d10000 "cmd.exe" loaded module "KERNEL32.DLL" at base 76ea0000 "cmd.exe" loaded module "NTDLL.DLL" at base 77120000 "rundll32.exe" loaded module "KERNEL32" at base 7ffea5840000 "rundll32.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 7ffea2c70000 "rundll32.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 7ffea2c70000 "rundll32.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 7ffea2c70000 "rundll32.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 27b58f80000 "rundll32.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ffea2c70000 "rundll32.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ffea2c70000 "rundll32.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ffea2c70000 "rundll32.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ffe93590000 "rundll32.exe" loaded module "SHELL32.DLL" at base 7ffea4140000 "rundll32.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7ffea0660000 "rundll32.exe" loaded module "%WINDIR%\SYSTEM32\EXPLORERFRAME.DLL" at base 7ffe8bd50000 "rundll32.exe" loaded module "COMCTL32.DLL" at base 7ffe90b60000 "rundll32.exe" loaded module "RPCRT4.DLL" at base 7ffea3da0000 "rundll32.exe" loaded module "%WINDIR%\SYSTEM32\OLEAUT32.DLL" at base 7ffea3ec0000 "rundll32.exe" loaded module "KERNEL32.DLL" at base 7ffea5840000 "rundll32.exe" loaded module "OLEAUT32" at base 7ffea3ec0000 "rundll32.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 1dec3ea0000 "rundll32.exe" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 7ffea4140000 "rundll32.exe" loaded module "%WINDIR%\SYSTEM32\ONECOREUAPCOMMONPROXYSTUB.DLL" at base 7ffe9cea00003f:Ta33,"???????.exe" was detected as "Themida/Winlicense" and name: "Protector" "???????.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "???????.exe" was detected as "Microsoft Linker" and name: "Linker" "gamesetup.exe" was detected as "Themida/Winlicense" and name: "Protector" "gamesetup.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "gamesetup.exe" was detected as "Microsoft Linker" and name: "Linker" "panda.exe" was detected as "Themida/Winlicense" and name: "Protector" "panda.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "panda.exe" was detected as "Microsoft Linker" and name: "Linker" "krnln.fnr" was detected as "Themida/Winlicense" and name: "Protector" "krnln.fnr" was detected as "Microsoft Visual C/C++" and name: "Compiler" "krnln.fnr" was detected as "Microsoft Linker" and name: "Linker" "iext2.fne" was detected as "Themida/Winlicense" and name: "Protector" "iext2.fne" was detected as "Microsoft Visual C/C++" and name: "Compiler" "iext2.fne" was detected as "Microsoft Linker" and name: "Linker" "eGrid.fne" was detected as "Themida/Winlicense" and name: "Protector" "eGrid.fne" was detected as "Microsoft Visual C/C++" and name: "Compiler" "eGrid.fne" was detected as "Microsoft Linker" and name: "Linker" "eAPI.fne" was detected as "Themida/Winlicense" and name: "Protector" "eAPI.fne" was detected as "Microsoft Visual C/C++" and name: "Compiler" "eAPI.fne" was detected as "Microsoft Linker" and name: "Linker" "iext.fnr" was detected as "Themida/Winlicense" and name: "Protector" "iext.fnr" was detected as "Microsoft Visual C/C++" and name: "Compiler" "iext.fnr" was detected as "Microsoft Linker" and name: "Linker" "mp3.run" was detected as "Themida/Winlicense" and name: "Protector" "mp3.run" was detected as "Microsoft Visual C/C++" and name: "Compiler" "mp3.run" was detected as "Microsoft Linker" and name: "Linker" "spec.fne" was detected as "Themida/Winlicense" and name: "Protector" "spec.fne" was detected as "Microsoft Visual C/C++" and name: "Compiler" "spec.fne" was detected as "Microsoft Linker" and name: "Linker" "EThread.fne" was detected as "Themida/Winlicense" and name: "Protector" "EThread.fne" was detected as "Microsoft Visual C/C++" and name: "Compiler" "EThread.fne" was detected as "Microsoft Linker" and name: "Linker" "shell.fne" was detected as "Themida/Winlicense" and name: "Protector" "shell.fne" was detected as "Microsoft Visual C/C++" and name: "Compiler" "shell.fne" was detected as "Microsoft Linker" and name: "Linker"40:T13a5,".exe" touched "Computer" (Path: "HKCU\WOW6432NODE\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") ".exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\WOW6432NODE\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}") ".exe" touched "Private Profile Object" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{75847177-F077-4171-BD2C-A6BB2164FBD0}\INPROCSERVER32") ".exe" touched "Sync root manager" (Path: "HKCU\WOW6432NODE\CLSID\{F324E4F9-8496-40B2-A1FF-9617C1C9AFFE}\INSTANCE") ".exe" touched "ExecuteAssociation" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{1649D1CF-DEAF-4A68-ABE8-5C9F68572FD1}\INPROCSERVER32") ".exe" touched "Property System Both Class Factory" (Path: "HKCU\WOW6432NODE\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\TREATAS") ".exe" touched "Security Manager" (Path: "HKCU\WOW6432NODE\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\TREATAS") ".exe" touched "ShellItemArray Shell Namespace helper" (Path: "HKCU\WOW6432NODE\CLSID\{CDC82860-468D-4D4E-B7E7-C298FF23AB2C}\TREATAS") ".exe" touched "ShellItem Shell Namespace helper" (Path: "HKCU\WOW6432NODE\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}\TREATAS") ".exe" touched "Shortcut" (Path: "HKCU\WOW6432NODE\CLSID\{00021401-0000-0000-C000-000000000046}\TREATAS") "gamesetup.exe" touched "Network" (Path: "HKCU\WOW6432NODE\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\SHELLFOLDER") "gamesetup.exe" touched "Recycle Bin" (Path: "HKCU\WOW6432NODE\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\SHELLFOLDER") "gamesetup.exe" touched "Control Panel" (Path: "HKCU\WOW6432NODE\CLSID\{26EE0668-A00A-44D7-9371-BEB064C98683}\SHELLFOLDER") "gamesetup.exe" touched "UsersFiles" (Path: "HKCU\WOW6432NODE\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\SHELLFOLDER") "gamesetup.exe" touched "UsersLibraries" (Path: "HKCU\WOW6432NODE\CLSID\{031E4825-7B94-4DC3-B131-E946B44C8DD5}\SHELLFOLDER") "gamesetup.exe" touched "CLSID_SearchFolder" (Path: "HKCU\WOW6432NODE\CLSID\{04731B67-D933-450A-90E6-4ACD2E9408FE}\SHELLFOLDER") "gamesetup.exe" touched "IE History and Feeds Shell Data Source for Windows Search" (Path: "HKCU\WOW6432NODE\CLSID\{11016101-E366-4D22-BC06-4ADA335C892B}\SHELLFOLDER") "gamesetup.exe" touched "Public Folder" (Path: "HKCU\WOW6432NODE\CLSID\{4336A54D-038B-4685-AB02-99BB52D3FB8B}\SHELLFOLDER") "gamesetup.exe" touched "Control Panel command object for Start menu and desktop" (Path: "HKCU\WOW6432NODE\CLSID\{5399E694-6CE5-4D6C-8FCE-1D8870FDCBA0}\SHELLFOLDER") "gamesetup.exe" touched "This Device" (Path: "HKCU\WOW6432NODE\CLSID\{5B934B42-522B-4C34-BBFE-37A3EF7B9C90}\SHELLFOLDER") "gamesetup.exe" touched "CLSID_AppInstanceFolder" (Path: "HKCU\WOW6432NODE\CLSID\{64693913-1C21-4F30-A98F-4E52906D3B56}\SHELLFOLDER") "gamesetup.exe" touched "@%systemroot%\system32\mssvp.dll,-110" (Path: "HKCU\WOW6432NODE\CLSID\{89D83576-6BD1-4C86-9454-BEB04E94C819}\SHELLFOLDER") "gamesetup.exe" touched "CLSID_SearchHome" (Path: "HKCU\WOW6432NODE\CLSID\{9343812E-1C37-4A49-A12E-4B2D810D956B}\SHELLFOLDER") "gamesetup.exe" touched "CLSID_StartMenuLauncherProviderFolder" (Path: "HKCU\WOW6432NODE\CLSID\{98F275B4-4FFF-11E0-89E2-7B86DFD72085}\SHELLFOLDER") "gamesetup.exe" touched "CLSID_StartMenuCommandingProviderFolder" (Path: "HKCU\WOW6432NODE\CLSID\{A00EE528-EBD9-48B8-944A-8942113D46AC}\SHELLFOLDER") "gamesetup.exe" touched "Other Users Folder" (Path: "HKCU\WOW6432NODE\CLSID\{B4FB3F98-C1EA-428D-A78A-D1F5659CBA93}\SHELLFOLDER") "gamesetup.exe" touched "@%systemroot%\system32\mssvp.dll,-112" (Path: "HKCU\WOW6432NODE\CLSID\{BD7A2E7B-21CB-41B2-A086-B309680C6B7E}\SHELLFOLDER") "gamesetup.exe" touched "CLSID_StartMenuProviderFolder" (Path: "HKCU\WOW6432NODE\CLSID\{DAF95313-E44D-46AF-BE1B-CBACEA2C3065}\SHELLFOLDER") "gamesetup.exe" touched "CLSID_StartMenuPathCompleteProviderFolder" (Path: "HKCU\WOW6432NODE\CLSID\{E345F35F-9397-435C-8F95-4E922C26259E}\SHELLFOLDER") "gamesetup.exe" touched "Games Explorer" (Path: "HKCU\WOW6432NODE\CLSID\{ED228FDF-9EA8-4870-83B1-96B02CFE0D52}\SHELLFOLDER") "gamesetup.exe" touched "StreamBackedFolder" (Path: "HKCU\WOW6432NODE\CLSID\{EDC978D6-4D53-4B2F-A265-5805674BE568}\SHELLFOLDER") "gamesetup.exe" touched "Computers and Devices" (Path: "HKCU\WOW6432NODE\CLSID\{F02C1A0D-BE21-4350-88B0-7367FC96EF3C}\SHELLFOLDER") "gamesetup.exe" touched "Removable Drives" (Path: "HKCU\WOW6432NODE\CLSID\{F5FB2C77-0E2F-4A16-A381-3E560C68BC83}\SHELLFOLDER") "rundll32.exe" touched "ShellWindows Class Factory" (Path: "HKCU\CLSID\{D92BD3B9-99A0-4334-A497-11BCB093E9D2}") "rundll32.exe" touched "ShellWindows" (Path: "HKCU\CLSID\{9BA05972-F6A8-11CF-A442-00A0C90A8F39}\TREATAS") "rundll32.exe" touched "PSOAInterface" (Path: "HKCU\CLSID\{00020424-0000-0000-C000-000000000046}\TREATAS") "rundll32.exe" touched "PSDispatch" (Path: "HKCU\CLSID\{00020420-0000-0000-C000-000000000046}\TREATAS") "rundll32.exe" touched "Destkop Undo Manager" (Path: "HKCU\CLSID\{3EEF301F-B596-4C0B-BD92-013BEAFCE793}") "rundll32.exe" touched "PSFactoryBuffer" (Path: "HKCU\CLSID\{B196B286-BAB4-101A-B69C-00AA00341D07}\TREATAS")41:T20be,"???????.exe" file has an entrypoint instructions - "call 0x192b1a8,push ebx,mov ebx, esp,push ebx,mov esi, dword ptr [ebx + 8],mov edi, dword ptr [ebx + 0x10],cld ,mov dl, 0x80,mov al, byte ptr [esi],inc esi,mov byte ptr [edi], al,inc edi,mov ebx, 2,add dl, dl,jne 0x192b07e,mov dl, byte ptr [esi],inc esi,adc dl, dl,jae 0x192b06a,add dl, dl,jne 0x192b089,mov dl, byte ptr [esi],inc esi,adc dl, dl,jae 0x192b0dc,xor eax, eax,add dl, dl,jne 0x192b096,mov dl, byte ptr [esi],inc esi,adc dl, dl,jae 0x192b17d,add dl, dl,jne 0x192b0a5,mov dl, byte ptr [esi],inc esi,adc dl, dl,adc eax, eax,add dl, dl,jne 0x192b0b0,mov dl, byte ptr [esi],inc esi,adc dl, dl,adc eax, eax,add dl, dl,jne 0x192b0bb,mov dl, byte ptr [esi],inc esi,adc dl, dl," "gamesetup.exe" file has an entrypoint instructions - "push ebp,mov ebp, esp,push -1,push 0x46fa50,push 0x44ba74,mov eax, dword ptr fs:[0],push eax,mov dword ptr fs:[0], esp,sub esp, 0x58,push ebx,push esi,push edi,mov dword ptr [ebp - 0x18], esp,call dword ptr [0x468180],xor edx, edx,mov dl, ah,mov dword ptr [0x4a237c], edx,mov ecx, eax,and ecx, 0xff,mov dword ptr [0x4a2378], ecx,shl ecx, 8,add ecx, edx,mov dword ptr [0x4a2374], ecx,shr eax, 0x10,mov dword ptr [0x4a2370], eax,push 1,call 0x44de20,pop ecx,test eax, eax,jne 0x4492f7," "panda.exe" file has an entrypoint instructions - "call 0x42b530,jmp 0x421eb8,int3 ,int3 ,int3 ,push 0x422100,push dword ptr fs:[0],mov eax, dword ptr [esp + 0x10],mov dword ptr [esp + 0x10], ebp,lea ebp, [esp + 0x10],sub esp, eax,push ebx,push esi,push edi,mov eax, dword ptr [0x4470c4],xor dword ptr [ebp - 4], eax,xor eax, ebp,push eax,mov dword ptr [ebp - 0x18], esp,push dword ptr [ebp - 8],mov eax, dword ptr [ebp - 4],mov dword ptr [ebp - 4], 0xfffffffe,mov dword ptr [ebp - 8], eax,lea eax, [ebp - 0x10],mov dword ptr fs:[0], eax,ret ,mov ecx, dword ptr [ebp - 0x10],mov dword ptr fs:[0], ecx,pop ecx,pop edi,pop edi,pop esi,pop ebx,mov esp, ebp,pop ebp," "krnln.fnr" file has an entrypoint instructions - "push ebp,mov ebp, esp,push ebx,mov ebx, dword ptr [ebp + 8],push esi,mov esi, dword ptr [ebp + 0xc],push edi,mov edi, dword ptr [ebp + 0x10],test esi, esi,jne 0x100c3bcc,cmp dword ptr [0x10127e9c], 0,jmp 0x100c3bf2,cmp esi, 1,je 0x100c3bd6,cmp esi, 2,jne 0x100c3bf8,mov eax, dword ptr [0x101285a4],test eax, eax,je 0x100c3be8,push edi,push esi,push ebx,call eax,test eax, eax,je 0x100c3bf4,push edi,push esi,push ebx,call 0x100c3ad7,test eax, eax,jne 0x100c3bf8,xor eax, eax,jmp 0x100c3c46,push edi,push esi,push ebx,call 0x100bedb0,cmp esi, 1,mov dword ptr [ebp + 0xc], eax,jne 0x100c3c14,test eax, eax,jne 0x100c3c43,push edi,push eax,push ebx,call 0x100c3ad7," "iext2.fne" file has an entrypoint instructions - "push ebp,mov ebp, esp,push ebx,mov ebx, dword ptr [ebp + 8],push esi,mov esi, dword ptr [ebp + 0xc],push edi,mov edi, dword ptr [ebp + 0x10],test esi, esi,jne 0x1003133c,cmp dword ptr [0x1007993c], 0,jmp 0x10031362,cmp esi, 1,je 0x10031346,cmp esi, 2,jne 0x10031368,mov eax, dword ptr [0x1007a10c],test eax, eax,je 0x10031358,push edi,push esi,push ebx,call eax,test eax, eax,je 0x10031364,push edi,push esi,push ebx,call 0x10031247,test eax, eax,jne 0x10031368,xor eax, eax,jmp 0x100313b6,push edi,push esi,push ebx,call 0x1002e764,cmp esi, 1,mov dword ptr [ebp + 0xc], eax,jne 0x10031384,test eax, eax,jne 0x100313b3,push edi,push eax,push ebx,call 0x10031247," "eGrid.fne" file has an entrypoint instructions - "push ebp,mov ebp, esp,push ebx,mov ebx, dword ptr [ebp + 8],push esi,mov esi, dword ptr [ebp + 0xc],push edi,mov edi, dword ptr [ebp + 0x10],test esi, esi,jne 0x1002b061,cmp dword ptr [0x10067f90], 0,jmp 0x1002b087,cmp esi, 1,je 0x1002b06b,cmp esi, 2,jne 0x1002b08d,mov eax, dword ptr [0x100696f4],test eax, eax,je 0x1002b07d,push edi,push esi,push ebx,call eax,test eax, eax,je 0x1002b089,push edi,push esi,push ebx,call 0x1002af6c,test eax, eax,jne 0x1002b08d,xor eax, eax,jmp 0x1002b0db,push edi,push esi,push ebx,call 0x10029590,cmp esi, 1,mov dword ptr [ebp + 0xc], eax,jne 0x1002b0a9,test eax, eax,jne 0x1002b0d8,push edi,push eax,push ebx,call 0x1002af6c," "eAPI.fne" file has an entrypoint instructions - "push ebp,mov ebp, esp,push ebx,mov ebx, dword ptr [ebp + 8],push esi,mov esi, dword ptr [ebp + 0xc],push edi,mov edi, dword ptr [ebp + 0x10],test esi, esi,jne 0x1001a852,cmp dword ptr [0x10052130], 0,jmp 0x1001a878,cmp esi, 1,je 0x1001a85c,cmp esi, 2,jne 0x1001a87e,mov eax, dword ptr [0x1005395c],test eax, eax,je 0x1001a86e,push edi,push esi,push ebx,call eax,test eax, eax,je 0x1001a87a,push edi,push esi,push ebx,call 0x1001a75d,test eax, eax,jne 0x1001a87e,xor eax, eax,jmp 0x1001a8cc,push edi,push esi,push ebx,call 0x10017e8a,cmp esi, 1,mov dword ptr [ebp + 0xc], eax,jne 0x1001a89a,test eax, eax,jne 0x1001a8c9,push edi,push eax,push ebx,call 0x1001a75d," "iext.fnr" file has an entrypoint instructions - "push ebp,mov ebp, esp,push ebx,mov ebx, dword ptr [ebp + 8],push esi,mov esi, dword ptr [ebp + 0xc],push edi,mov edi, dword ptr [ebp + 0x10],test esi, esi,jne 0x1000e363,cmp dword ptr [0x10036358], 0,jmp 0x1000e389,cmp esi, 1,je 0x1000e36d,cmp esi, 2,jne 0x1000e38f,mov eax, dword ptr [0x10036a7c],test eax, eax,je 0x1000e37f,push edi,push esi,push ebx,call eax,test eax, eax,je 0x1000e38b,push edi,push esi,push ebx,call 0x1000e26e,test eax, eax,jne 0x1000e38f,xor eax, eax,jmp 0x1000e3dd,push edi,push esi,push ebx,call 0x1000ce20,cmp esi, 1,mov dword ptr [ebp + 0xc], eax,jne 0x1000e3ab,test eax, eax,jne 0x1000e3da,push edi,push eax,push ebx,call 0x1000e26e," "mp3.run" file has an entrypoint instructions - "push ebp,mov ebp, esp,push ebx,mov ebx, dword ptr [ebp + 8],push esi,mov esi, dword ptr [ebp + 0xc],push edi,mov edi, dword ptr [ebp + 0x10],test esi, esi,jne 0x10018992,cmp dword ptr [0x1003abc8], 0,jmp 0x100189b8,cmp esi, 1,je 0x1001899c,cmp esi, 2,jne 0x100189be,mov eax, dword ptr [0x1003fd08],test eax, eax,je 0x100189ae,push edi,push esi,push ebx,call eax,test eax, eax,je 0x100189ba,push edi,push esi,push ebx,call 0x1001889d,test eax, eax,jne 0x100189be,xor eax, eax,jmp 0x10018a0c,push edi,push esi,push ebx,call 0x10013240,cmp esi, 1,mov dword ptr [ebp + 0xc], eax,jne 0x100189da,test eax, eax,jne 0x10018a09,push edi,push eax,push ebx,call 0x1001889d," "spec.fne" file has an entrypoint instructions - "push ebp,mov ebp, esp,push ebx,mov ebx, dword ptr [ebp + 8],push esi,mov esi, dword ptr [ebp + 0xc],push edi,mov edi, dword ptr [ebp + 0x10],test esi, esi,jne 0x10004852,cmp dword ptr [0x10012dec], 0,jmp 0x10004878,cmp esi, 1,je 0x1000485c,cmp esi, 2,jne 0x1000487e,mov eax, dword ptr [0x100144e4],test eax, eax,je 0x1000486e,push edi,push esi,push ebx,call eax,test eax, eax,je 0x1000487a,push edi,push esi,push ebx,call 0x1000475d,test eax, eax,jne 0x1000487e,xor eax, eax,jmp 0x100048cc,push edi,push esi,push ebx,call 0x100079bb,cmp esi, 1,mov dword ptr [ebp + 0xc], eax,jne 0x1000489a,test eax, eax,jne 0x100048c9,push edi,push eax,push ebx,call 0x1000475d," "EThread.fne" file has an entrypoint instructions - "push ebp,mov ebp, esp,push ebx,mov ebx, dword ptr [ebp + 8],push esi,mov esi, dword ptr [ebp + 0xc],push edi,mov edi, dword ptr [ebp + 0x10],test esi, esi,jne 0x1000223a,cmp dword ptr [0x10018a10], 0,jmp 0x10002260,cmp esi, 1,je 0x10002244,cmp esi, 2,jne 0x10002266,mov eax, dword ptr [0x100190fc],test eax, eax,je 0x10002256,push edi,push esi,push ebx,call eax,test eax, eax,je 0x10002262,push edi,push esi,push ebx,call 0x10002145,test eax, eax,jne 0x10002266,xor eax, eax,jmp 0x100022b4,push edi,push esi,push ebx,call 0x10001070,cmp esi, 1,mov dword ptr [ebp + 0xc], eax,jne 0x10002282,test eax, eax,jne 0x100022b1,push edi,push eax,push ebx,call 0x10002145," "shell.fne" file has an entrypoint instructions - "push ebp,mov ebp, esp,push ebx,mov ebx, dword ptr [ebp + 8],push esi,mov esi, dword ptr [ebp + 0xc],push edi,mov edi, dword ptr [ebp + 0x10],test esi, esi,jne 0x10002a67,cmp dword ptr [0x100124e8], 0,jmp 0x10002a8d,cmp esi, 1,je 0x10002a71,cmp esi, 2,jne 0x10002a93,mov eax, dword ptr [0x10012bdc],test eax, eax,je 0x10002a83,push edi,push esi,push ebx,call eax,test eax, eax,je 0x10002a8f,push edi,push esi,push ebx,call 0x10002972,test eax, eax,jne 0x10002a93,xor eax, eax,jmp 0x10002ae1,push edi,push esi,push ebx,call 0x100013c0,cmp esi, 1,mov dword ptr [ebp + 0xc], eax,jne 0x10002aaf,test eax, eax,jne 0x10002ade,push edi,push eax,push ebx,call 0x10002972,"42:T765,Process "taskkill.exe" (UID: 00000000-00002968) was launched with new environment variables: "USERDNSDOMAIN="DESKTOP-FVVF82A", PROCESSOR_ARCHITEW6432="AMD64"" Process "taskkill.exe" (UID: 00000000-00002968) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles, NUMBER_OF_PROCESSORS" Process "taskkill.exe" (UID: 00000000-00006368) was launched with new environment variables: "PROMPT="$P$G"" Process "taskkill.exe" (UID: 00000000-00004636) was launched with missing environment variables: "PROMPT" Process "taskkill.exe" (UID: 00000000-00007492) was launched with new environment variables: "USERDNSDOMAIN="DESKTOP-FVVF82A", PROCESSOR_ARCHITEW6432="AMD64"" Process "taskkill.exe" (UID: 00000000-00007492) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles, NUMBER_OF_PROCESSORS" Process "rundll32.exe" (UID: 00000000-00002304) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles, NUMBER_OF_PROCESSORS" Process "rundll32.exe" (UID: 00000000-00002304) was launched with missing environment variables: "USERDNSDOMAIN, PROCESSOR_ARCHITEW6432" Process "taskkill.exe" (UID: 00000000-00002512) was launched with new environment variables: "USERDNSDOMAIN="DESKTOP-FVVF82A", PROCESSOR_ARCHITEW6432="AMD64"" Process "taskkill.exe" (UID: 00000000-00002512) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles, NUMBER_OF_PROCESSORS" Process "taskkill.exe" (UID: 00000000-00003840) was launched with new environment variables: "USERDNSDOMAIN="DESKTOP-FVVF82A", PROCESSOR_ARCHITEW6432="AMD64"" Process "taskkill.exe" (UID: 00000000-00003840) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles, NUMBER_OF_PROCESSORS"43:T40f,".exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") ".exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") ".exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") ".exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "gamesetup.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "gamesetup.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "gamesetup.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "gamesetup.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "cmd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "cmd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "cmd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "cmd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409")44:T827,Spawned process "taskkill.exe" with commandline "taskkill /im taskmgr.exe /f" (UID: 00000000-00002968) Spawned process "gamesetup.exe" (UID: 00000000-00007100) Spawned process "taskkill.exe" with commandline "taskkill /im taskmgr.exe /f" (UID: 00000000-00005568) Spawned process "cmd.exe" with commandline "%WINDIR%\\system32\\cmd.exe /c C:\\ddel.bat" (UID: 00000000-00004776) Spawned process "taskkill.exe" with commandline "taskkill /im taskmgr.exe /f" (UID: 00000000-00007092) Spawned process "cmd.exe" with commandline "cmd /c taskkill /f /im Aver.exe" (UID: 00000000-00004144) Spawned process "cmd.exe" with commandline "%WINDIR%\\system32\\cmd.exe /c C:\\del.bat" (UID: 00000000-00007712) Spawned process "taskkill.exe" with commandline "taskkill /im taskmgr.exe /f" (UID: 00000000-00001632) Spawned process "taskkill.exe" with commandline "taskkill /im taskmgr.exe /f" (UID: 00000000-00004924) Spawned process "taskkill.exe" with commandline "taskkill /f /im explorer.exe" (UID: 00000000-00006368) Spawned process "taskkill.exe" with commandline "taskkill /f /im Aver.exe" (UID: 00000000-00003300) Spawned process "explorer.exe" (UID: 00000000-00007904) Spawned process "taskkill.exe" with commandline "taskkill /im taskmgr.exe /f" (UID: 00000000-00004636) Spawned process "rundll32.exe" with commandline "shell32.dll,SHCreateLocalServerRunDll {9BA05972-F6A8-11CF-A442-0 ..." (UID: 00000000-00000732) Spawned process "taskkill.exe" with commandline "taskkill /im taskmgr.exe /f" (UID: 00000000-00007492) Spawned process "taskkill.exe" with commandline "taskkill /im taskmgr.exe /f" (UID: 00000000-00001596) Spawned process "rundll32.exe" with commandline "%WINDIR%\\System32\\shell32.dll,SHCreateLocalServerRunDll {3eef3 ..." (UID: 00000000-00002304) Spawned process "taskkill.exe" with commandline "taskkill /im taskmgr.exe /f" (UID: 00000000-00002512) Spawned process "taskkill.exe" with commandline "taskkill /im taskmgr.exe /f" (UID: 00000000-00003840) Spawned process "taskkill.exe" with commandline "taskkill /im taskmgr.exe /f" (UID: 00000000-00006560)45:T827,Spawned process "taskkill.exe" with commandline "taskkill /im taskmgr.exe /f" (UID: 00000000-00002968) Spawned process "gamesetup.exe" (UID: 00000000-00007100) Spawned process "taskkill.exe" with commandline "taskkill /im taskmgr.exe /f" (UID: 00000000-00005568) Spawned process "cmd.exe" with commandline "%WINDIR%\\system32\\cmd.exe /c C:\\ddel.bat" (UID: 00000000-00004776) Spawned process "taskkill.exe" with commandline "taskkill /im taskmgr.exe /f" (UID: 00000000-00007092) Spawned process "cmd.exe" with commandline "cmd /c taskkill /f /im Aver.exe" (UID: 00000000-00004144) Spawned process "cmd.exe" with commandline "%WINDIR%\\system32\\cmd.exe /c C:\\del.bat" (UID: 00000000-00007712) Spawned process "taskkill.exe" with commandline "taskkill /im taskmgr.exe /f" (UID: 00000000-00001632) Spawned process "taskkill.exe" with commandline "taskkill /im taskmgr.exe /f" (UID: 00000000-00004924) Spawned process "taskkill.exe" with commandline "taskkill /f /im explorer.exe" (UID: 00000000-00006368) Spawned process "taskkill.exe" with commandline "taskkill /f /im Aver.exe" (UID: 00000000-00003300) Spawned process "explorer.exe" (UID: 00000000-00007904) Spawned process "taskkill.exe" with commandline "taskkill /im taskmgr.exe /f" (UID: 00000000-00004636) Spawned process "rundll32.exe" with commandline "shell32.dll,SHCreateLocalServerRunDll {9BA05972-F6A8-11CF-A442-0 ..." (UID: 00000000-00000732) Spawned process "taskkill.exe" with commandline "taskkill /im taskmgr.exe /f" (UID: 00000000-00007492) Spawned process "taskkill.exe" with commandline "taskkill /im taskmgr.exe /f" (UID: 00000000-00001596) Spawned process "rundll32.exe" with commandline "%WINDIR%\\System32\\shell32.dll,SHCreateLocalServerRunDll {3eef3 ..." (UID: 00000000-00002304) Spawned process "taskkill.exe" with commandline "taskkill /im taskmgr.exe /f" (UID: 00000000-00002512) Spawned process "taskkill.exe" with commandline "taskkill /im taskmgr.exe /f" (UID: 00000000-00003840) Spawned process "taskkill.exe" with commandline "taskkill /im taskmgr.exe /f" (UID: 00000000-00006560)46:Tdd7,"gamesetup.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 4 sections"- Location: [C:\gamesetup.exe]- [targetUID: 00000000-00007100] "panda.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 4 sections"- Location: [C:\panda.exe]- [targetUID: 00000000-00000668] "D_A_OIa9.lnk" has type "Unknown"- [targetUID: N/A] "ddel.bat" has type "DOS batch file ASCII text with CRLF line terminators"- Location: [C:\ddel.bat]- [targetUID: 00000000-00007100] "del.bat" has type "ASCII text with CRLF line terminators"- Location: [C:\del.bat]- [targetUID: 00000000-00007100] "krnln.fnr" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\E_N60005\krnln.fnr]- [targetUID: 00000000-00000668] "iext2.fne" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\E_N60005\iext2.fne]- [targetUID: 00000000-00000668] "eGrid.fne" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\E_N60005\eGrid.fne]- [targetUID: 00000000-00000668] "eAPI.fne" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\E_N60005\eAPI.fne]- [targetUID: 00000000-00000668] "iext.fnr" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\E_N60005\iext.fnr]- [targetUID: 00000000-00000668] "mp3.run" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 4 sections"- Location: [%TEMP%\E_N60005\mp3.run]- [targetUID: 00000000-00000668] "panda.jpg" has type "JPEG image data JFIF standard 1.02 resolution (DPI) density 72x72 segment length 16 Exif Standard: [TIFF image data big-endian direntries=7 orientation=upper-left xresolution=98 yresolution=106 resolutionunit=2 software=Adobe Photoshop 7.0 datetime=2007:01:26 19:45:26] baseline precision 8 1024x768 components 3"- Location: [%WINDIR%\Temp\panda.jpg]- [targetUID: 00000000-00000668] "spec.fne" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 4 sections"- Location: [%TEMP%\E_N60005\spec.fne]- [targetUID: 00000000-00000668] "EThread.fne" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\E_N60005\EThread.fne]- [targetUID: 00000000-00000668] "shell.fne" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\E_N60005\shell.fne]- [targetUID: 00000000-00000668] "bzdhz.ico" has type "MS Windows icon resource - 12 icons 48x48 2 colors 32x32 2 colors"- Location: [%WINDIR%\SysWOW64\bzdhz.ico]- [targetUID: 00000000-00007100] "panda.ico" has type "MS Windows icon resource - 1 icon 48x48 32 bits/pixel"- Location: [%WINDIR%\Temp\panda.ico]- [targetUID: 00000000-00000668] "D_A_OIa7.lnk" has type "Unknown"- [targetUID: N/A] "D_A_OIa1.lnk" has type "Unknown"- [targetUID: N/A] "D_A_OIa3.lnk" has type "Unknown"- [targetUID: N/A] "D_A_OIa2.lnk" has type "Unknown"- [targetUID: N/A] "D_A_OIa12.lnk" has type "Unknown"- [targetUID: N/A] "D_A_OIa4.lnk" has type "Unknown"- [targetUID: N/A] "D_A_OIa16.lnk" has type "Unknown"- [targetUID: N/A] "D_A_OIa10.lnk" has type "Unknown"- [targetUID: N/A] "D_A_OIa11.lnk" has type "Unknown"- [targetUID: N/A] "D_A_OIa15.lnk" has type "Unknown"- [targetUID: N/A] "D_A_OIa5.lnk" has type "Unknown"- [targetUID: N/A] "D_A_OIa14.lnk" has type "Unknown"- [targetUID: N/A] "D_A_OIa13.lnk" has type "Unknown"- [targetUID: N/A] "D_A_OIa6.lnk" has type "Unknown"- [targetUID: N/A] "D_A_OIa8.lnk" has type "Unknown"- [targetUID: N/A]47:T4eb,".exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME\DYNAMIC DST"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TERMINAL SERVER"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "")48:T7a9,".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "BIAS"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "STANDARDNAME"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "STANDARDBIAS"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "STANDARDSTART"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DAYLIGHTNAME"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DAYLIGHTBIAS"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DAYLIGHTSTART"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "TIMEZONEKEYNAME"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DYNAMICDAYLIGHTTIMEDISABLED"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME\DYNAMIC DST"; Key: "FIRSTENTRY"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME\DYNAMIC DST"; Key: "LASTENTRY"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME\DYNAMIC DST"; Key: "2026"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME\DYNAMIC DST"; Key: "2007"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "ACTIVETIMEBIAS"; Value: "")49:T45f,The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Able to identify virtual environment by using user activity (API string) Matched sigs: Able to identify virtual environment by using API string Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string) Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string) Matched sigs: Queries process mitigation policy via NtQueryInformationProcess Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques Matched sigs: Contains ability to detect virtual environment Matched sigs: Observed a high volume of repeated registry API calls (API Hammering) Matched sigs: Contains ability to detect sandbox (imports API) Matched sigs: Makes a code branch decision directly after an API that is environment aware Matched sigs: Contains ability to delay the execution of current thread Matched sigs: Contains ability to detect virtual environment (API)4a:T4bd,".exe" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL" ".exe" trying to access non-existent file "C:\FLTLIB.DLL" ".exe" trying to access non-existent file "C:\CRYPTSP.DLL" ".exe" trying to access non-existent file "C:\WINMM.DLL" ".exe" trying to access non-existent file "C:\WINMM.dll" ".exe" trying to access non-existent file "C:\OLEPRO32.DLL" ".exe" trying to access non-existent file "C:\WINMMBASE.DLL" ".exe" trying to access non-existent file "C:\WINMMBASE.dll" ".exe" trying to access non-existent file "C:\IPHLPAPI.DLL" ".exe" trying to access non-existent file "C:\BCRYPT.DLL" ".exe" trying to access non-existent file "C:\bcrypt.dll" ".exe" trying to access non-existent file "C:\Windows\SysWOW64\RPCSS.DLL" ".exe" trying to access non-existent file "C:\WINDOWS\system32\rpcss.dll" ".exe" trying to access non-existent file "C:\KERNEL32.DLL" ".exe" trying to access non-existent file "C:\kernel32.dll" ".exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\E_N60005\KERNEL32.DLL" ".exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\E_N60005\kernel32.dll" ".exe" trying to access non-existent file "C:\NTDLL.DLL"4b:T6ca,".exe" trying to access non-existent file "C:\.EXE.LOCAL" ".exe" trying to access non-existent file "C:\.exe.Local\" ".exe" trying to access non-existent file "C:\WINSPOOL.DRV" ".exe" trying to access non-existent file "C:\WDMAUD.DRV" ".exe" trying to access non-existent file "C:\wdmaud.drv" ".exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\E_N60005\EAPI.FNR" ".exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\E_N60005\eAPI.fnr" ".exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\E_N60005\ETHREAD.FNR" ".exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\E_N60005\EThread.fnr" ".exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\E_N60005\SHELL.FNR" ".exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\E_N60005\shell.fnr" ".exe" trying to access non-existent file "C:\gamesetup.exe:ZONE.IDENTIFIER" ".exe" trying to access non-existent file "C:\gamesetup.exe:Zone.Identifier" ".exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\E_N60005\SPEC.FNR" ".exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\E_N60005\spec.fnr" ".exe" trying to access non-existent file "C:\KRNLN.FNE" ".exe" trying to access non-existent file "C:\krnln.fne" ".exe" trying to access non-existent file "C:\Windows\SysWOW64\KRNLN.FNE" ".exe" trying to access non-existent file "C:\WINDOWS\SYSTEM32\krnln.fne" ".exe" trying to access non-existent file "C:\Windows\System\KRNLN.FNE" ".exe" trying to access non-existent file "C:\WINDOWS\system\krnln.fne" ".exe" trying to access non-existent file "C:\Windows\KRNLN.FNE"4c:T599,".exe" writes file "c:\users\%osuser%\appdata\local\temp\e_n60005\krnln.fnr" ".exe" writes file "c:\users\%osuser%\appdata\local\temp\e_n60005\iext.fnr" ".exe" writes file "c:\users\%osuser%\appdata\local\temp\e_n60005\iext2.fne" ".exe" writes file "c:\users\%osuser%\appdata\local\temp\e_n60005\egrid.fne" ".exe" writes file "c:\users\%osuser%\appdata\local\temp\e_n60005\spec.fne" ".exe" writes file "c:\users\%osuser%\appdata\local\temp\e_n60005\ethread.fne" ".exe" writes file "c:\users\%osuser%\appdata\local\temp\e_n60005\shell.fne" ".exe" writes file "c:\users\%osuser%\appdata\local\temp\e_n60005\eapi.fne" ".exe" writes file "c:\users\%osuser%\appdata\local\temp\e_n60005\mp3.run" ".exe" writes file "c:\windows\temp\panda.ico" ".exe" writes file "c:\windows\temp\panda.jpg" ".exe" writes file "c:\panda.exe" ".exe" writes file "c:\gamesetup.exe" ".exe" writes file "\device\namedpipe\srvsvc" ".exe" writes file "c:\ðüã¨éõïã1.lnk" ".exe" writes file "c:\ðüã¨éõïã2.lnk" ".exe" writes file "c:\ðüã¨éõïã3.lnk" ".exe" writes file "c:\ðüã¨éõïã4.lnk" ".exe" writes file "c:\ðüã¨éõïã5.lnk" ".exe" writes file "c:\ðüã¨éõïã6.lnk" ".exe" writes file "c:\ðüã¨éõïã7.lnk" ".exe" writes file "c:\ðüã¨éõïã8.lnk" ".exe" writes file "c:\ðüã¨éõïã9.lnk" ".exe" writes file "c:\ðüã¨éõïã10.lnk" ".exe" writes file "c:\ðüã¨éõïã11.lnk"4d:T748,Heuristic match: "me.pl" Heuristic match: "ih.bd" Heuristic match: "i%.cy" Pattern match: "www.dywt.com.cn/infotreeboxtranslabellistviewtoolbarstatusbar.pavcexception@@iext_idb_stateimagessystreeview32.?avcnotrackobject@@.?av_afx_win_state@@.?avcobject@@.?avccmdtarget@@.?avcwinthread@@.?avcwinapp@@.?av_afx_ctl3d_state@@.?av_afx_ctl3d_thread@@.?a" Pattern match: "ns.adobe.com/xap/1.0/" Pattern match: "www.eyuyan.comservice@dywt.com.cn+86(0411)39895834+86(0411)39895831116001a512548e76954b6e92c21055517615b0this" Pattern match: "www.eyuyan.comservice@dywt.com.cn+86(0411)39895834+86(0411)398958311160015f99c1642a2f4e03850721b4f5d7c3f8this" Pattern match: "www.dywt.com.cn/infoshell_fnexitwindowsshell_fngetspecialfolderpathshell_fnshellexecuteshell_fnshellmovefileshell_fnshellcopyfileshell_fndeleteintorecyclebinshell_fnbrowseforfoldershell_fngetshortcutshell_fncreateshortcutwindowswindowswindowsexitwindowswin" Heuristic match: "zhq445078388.3322.org" Pattern match: "www.dywt.com.cn" Heuristic match: "hq445078388.3322.org" Heuristic match: ":\users\hapubws\appdata\roaming\nvm\zhq445078388.3322.org" Heuristic match: "2.org" Heuristic match: "??\c:\users\hapubws\appdata\local\programs\python\python311\zhq445078388.3322.org" Pattern match: "http://www.w3.org/2001/xmlschema-instance" Heuristic match: ":\%nvm_home%\zhq445078388.3322.org" Heuristic match: ":\%nvm_symlink%\zhq445078388.3322.org" Heuristic match: ":\windows\system\zhq445078388.3322.org" Heuristic match: "??\c:\%nvm_home%\zhq445078388.3322.org" Heuristic match: ":\windows\zhq445078388.3322.org" Heuristic match: "ers\hapubws\appdata\roaming\nvm\zhq445078388.3322.org" Heuristic match: "??\c:\windows\system\zhq445078388.3322.org" Heuristic match: "??\c:\program files\nodejs\zhq445078388.3322.org" Heuristic match: "??\c:\windows\system32\wbem\zhq445078388.3322.org"4e:Tbff,Found reference to API "CreateDCA" (Indicator: "CreateDC"; File: "???????.exe") Found reference to API "CreateCompatibleBitmap" (Indicator: "CreateCompatibleBitmap"; File: "???????.exe") Found reference to API "GetDIBits" (Indicator: "GetDIBits"; File: "???????.exe") Found reference to API "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; File: "???????.exe") Found reference to API "BitBlt" (Indicator: "BitBlt"; File: "???????.exe") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; File: "???????.exe") Found reference to API "GetWindowDC" (Indicator: "GetWindowDC"; File: "???????.exe") Found reference to API "GetDC" (Indicator: "GetDC"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API "BitBlt" (Indicator: "BitBlt"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API "CreateDCA" (Indicator: "CreateDC"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API "CreateCompatibleBitmap" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API "GetDIBits" (Indicator: "GetDIBits"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API "GetWindowDC" (Indicator: "GetWindowDC"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00007100.00000000.146549.030B0000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00007100.00000000.146549.030B0000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00007100.00000000.146549.030B0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00007100.00000000.146549.030B0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00007100.00000000.146549.030B0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00007100.00000000.146549.030B0000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00007100.00000000.146549.030B0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00007100.00000000.146549.030B0000.00000004.mdmp")4f:T57f,Observed import api "GetCommandLineA" which can "retrieve the command-line string for the current process" [Source: gamesetup.exe] Observed import api "GetCommandLineA" which can "retrieve the command-line string for the current process" [Source: panda.exe] Observed import api "GetCommandLineA" which can "retrieve the command-line string for the current process" [Source: krnln.fnr] Observed import api "GetCommandLineA" which can "retrieve the command-line string for the current process" [Source: iext2.fne] Observed import api "GetCommandLineA" which can "retrieve the command-line string for the current process" [Source: eGrid.fne] Observed import api "GetCommandLineA" which can "retrieve the command-line string for the current process" [Source: eAPI.fne] Observed import api "GetCommandLineA" which can "retrieve the command-line string for the current process" [Source: iext.fnr] Observed import api "GetCommandLineA" which can "retrieve the command-line string for the current process" [Source: mp3.run] Observed import api "GetCommandLineA" which can "retrieve the command-line string for the current process" [Source: spec.fne] Observed import api "GetCommandLineA" which can "retrieve the command-line string for the current process" [Source: EThread.fne] Observed import api "GetCommandLineA" which can "retrieve the command-line string for the current process" [Source: shell.fne]50:T8a5,Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "???????.exe") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "???????.exe") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; File: "???????.exe") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "???????.exe") Found reference to API "Process32NextW" (Indicator: "Process32Next"; File: "???????.exe") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; File: "???????.exe") Found reference to API "Process32FirstW" (Indicator: "Process32First"; File: "???????.exe") Found reference to API "Process32First" (Indicator: "Process32First"; File: "???????.exe") Found reference to API "Process32Next" (Indicator: "Process32Next"; File: "???????.exe") Found reference to API "Module32Next" (Indicator: "Module32Next"; File: "???????.exe") Found reference to API "Module32First" (Indicator: "Module32First"; File: "???????.exe") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00002304.00000000.146996.4C448000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00002304.00000000.146996.4C448000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00002304.00000000.146996.4C448000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00002304.00000000.146996.4C448000.00000002.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API "GetEnvironmentStrings" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp")51:T6f0,Found reference to API "GetFileSize" (Indicator: "GetFileSize"; File: "???????.exe") Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; File: "???????.exe") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; File: "???????.exe") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; File: "???????.exe") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfo"; File: "???????.exe") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfoSize"; File: "???????.exe") Found reference to API "GetFileVersionInfoW" (Indicator: "GetFileVersionInfo"; File: "???????.exe") Found reference to API "GetCurrentDirectoryA" (Indicator: "GetCurrentDirectory"; File: "???????.exe") Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; File: "???????.exe") Found reference to API "GetFileVersionInfoA" (Indicator: "GetFileVersionInfo"; File: "???????.exe") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfo"; File: "???????.exe") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfoSize"; File: "???????.exe") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; Source: "00000000-00002304.00000000.146996.4C448000.00000002.mdmp") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "00000000-00002304.00000000.146996.4C448000.00000002.mdmp") Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; Source: "00000000-00007100.00000000.146549.00468000.00000002.mdmp")52:T4bb,Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00000732.00000000.146875.59010000.00000004.mdmp, 00000000-00000732.00000001.148798.59010000.00000004.mdmp, 00000000-00000732.00000002.150715.59010000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\System32\rundll32.exe" (Indicator: "\Device\"; Source: "00000000-00000732.00000000.146875.59010000.00000004.mdmp, 00000000-00000732.00000001.148798.59010000.00000004.mdmp, 00000000-00000732.00000002.150715.59010000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00002304.00000000.146996.C3D70000.00000004.mdmp, 00000000-00002304.00000001.148917.C3D70000.00000004.mdmp, 00000000-00002304.00000002.150837.C3D70000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\System32\rundll32.exe" (Indicator: "\Device\"; Source: "00000000-00002304.00000000.146996.C3D70000.00000004.mdmp, 00000000-00002304.00000001.148917.C3D70000.00000004.mdmp, 00000000-00002304.00000002.150837.C3D70000.00000004.mdmp") Found string "NDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00007100.00000000.146549.030B0000.00000004.mdmp")53:T56a,Found reference to API "InitializeAcl" (Indicator: "InitializeAcl"; File: "???????.exe") Found reference to API "GetSidIdentifierAuthority" (Indicator: "GetSidIdentifierAuthority"; File: "???????.exe") Found reference to API "GetSidSubAuthority" (Indicator: "GetSidSubAuthority"; File: "???????.exe") Found reference to API "FreeSid" (Indicator: "FreeSid"; File: "???????.exe") Found reference to API "InitializeSecurityDescriptor" (Indicator: "InitializeSecurityDescriptor"; File: "???????.exe") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; File: "???????.exe") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; File: "???????.exe") Found reference to API "GetSidSubAuthorityCount" (Indicator: "GetSidSubAuthority"; File: "???????.exe") Found reference to API "GetSidSubAuthorityCount" (Indicator: "GetSidSubAuthorityCount"; File: "???????.exe") Found reference to API "GetLengthSid" (Indicator: "GetLengthSid"; File: "???????.exe") Found reference to API "SetSecurityDescriptorDacl" (Indicator: "SetSecurityDescriptorDacl"; File: "???????.exe") Found reference to API "AddAce" (Indicator: "AddAce"; File: "???????.exe") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "???????.exe") Found reference to API "CopySid" (Indicator: "CopySid"; File: "???????.exe")54:T727,Observed import api "AddAce" which can "add one or more access control entries (ACEs) to a specified access control list (ACL)" [Source: eAPI.fne] Observed import api "AllocateAndInitializeSid" which can "allocate and initialize a security identifier (SID) with up to eight subauthorities" [Source: eAPI.fne] Observed import api "CopySid" which can "copy a security identifier (SID) to a buffer" [Source: eAPI.fne] Observed import api "FreeSid" which can "free a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: eAPI.fne] Observed import api "GetLengthSid" which can "return the length in bytes of a valid security identifier (SID)" [Source: eAPI.fne] Observed import api "GetSidIdentifierAuthority" which can "return a pointer to the SID_IDENTIFIER_AUTHORITY structure in a specified security identifier (SID)" [Source: eAPI.fne] Observed import api "GetSidSubAuthority" which can "return a pointer to a specified subauthority in a security identifier (SID)" [Source: eAPI.fne] Observed import api "GetSidSubAuthorityCount" which can "return a pointer to the member in a security identifier (SID) structure that contains the subauthority count" [Source: eAPI.fne] Observed import api "GetTokenInformation" which can "retrieve a specified type of information about an access token" [Source: eAPI.fne] Observed import api "InitializeAcl" which can "initialize a new ACL structure" [Source: eAPI.fne] Observed import api "InitializeSecurityDescriptor" which can "initialize a new security descriptor" [Source: eAPI.fne] Observed import api "InitializeSid" which can "initialize a security identifier (SID)" [Source: eAPI.fne] Observed import api "SetSecurityDescriptorDacl" which can "set information in a discretionary access control list (DACL)" [Source: eAPI.fne]55:T58c,".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\GAMESETUP.EXE"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSWOW64\TASKKILL.EXE"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LANMANWORKSTATION\PARAMETERS"; Key: "RPCCACHETIMEOUT"; Value: "") "gamesetup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSWOW64\CMD.EXE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CONHOST.EXE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSWOW64\TASKKILL.EXE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSWOW64\EXPLORER.EXE"; Value: "")56:T125d,".exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS"; Value: "0100000000") ".exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "INTRANETNAME"; Value: "0100000000") ".exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "UNCASINTRANET"; Value: "0100000000") ".exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "AUTODETECT"; Value: "0000000000") ".exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\NOTIFICATIONS\DATA"; Key: "418A073AA3BC3475"; Value: "700C000000000000040004000102040000000000630000000D787900010000006B507E000200000087DE83005E000000A19F5E000400010000006C00000056737D00070000006B507E00010000009829B70007000000E6C53100010004000000030000001A9CB2000100050000000100000016F0B20001006500000078030000E6C5310000") ".exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\NOTIFICATIONS\DATA"; Key: "418A073AA3BC1C75"; Value: "E120000000000000040004000100010001010000F1D9A3007800020000000571AE000708B8000C14B5000C3584000D7879000DA18100158AA20015E17A0016277B0016DDA400174B73001B4278001BF60B001C955C001DA16C001E8D52001F4EA8001F5D7A001FF77B00244BAB0024ACC700259960002989DF002A68A9002B2499002C3D810032D1A70036AC52003CB352003E33830041A8760042264A0048C24F0049E57D0049EAB7004AA710004AAA81004EBF72004F85B50053CE8400560A85005A5EB5006041AE00682C900069C3A3006B767D006F0B6D00726E4A007477AD0075A37E0078EF6400799C39007CF788007FD189008106950081515D008227730083F1600084E683008550AE0087DE83008A8093008B5188008C0E7B008E78A20090F7AF00936DAD0093866100959B5100976AB60097748D00978EAB009BE07A009D9D9200A2050600A6D69A00A736A800A7B8AD00A90DAE00B1CE9800B3F1A200B79C1400BB8E8B00BBAE7E00BCFA8D00BD539800BE0CAC00C0CC9900C36D8100C4114C00C8464E00C9389700CA23B700CC495600CDBD8C00CFC29400D0175600D0725B00D08EAB00D19A7B00D1D2A700D3826100D3E88D00DAFF0E00DB6EA100E1C97700E21B5600E42A5E00E7997F00EBBF8400EEE17D00F17D5F00F1D9A300F1FC6000F548B100F7125E00F7D36F00F7ED6A00F8FE8200F9778C005B000600000003CC910007B3AD000858710009EF7D000BFF5C000E4D7E000FBA9E00110FAA001319830013B7B10013E9780016F0B20017349B001786A70019C398001C4452001D97A90022D38900316DBB003256AE0032E9830036A6AC00395EA700427F7A004293800042B3AE0042C46A0042FA5800472471004C41B4004CA770004EA059004F0CAC00508FC4005CE17D00624F980066E7820069D281006B0961006E7B8C007140A300723C120072B29F0073CD610073D3A700757C860076418E0085CAA90091508A0091D3A30093168900938EAB0098B9A40099698A009CE0A8009D9FA0009F60C3009F8F6E00A02AAB00A18EAB00A1D7B300A3F76A00A522A400A58F6000A644A600A9A4C200AA1BAA00B6515D00BA146500BC88B100BC8AA700BD388F00BE558200C176B300C33EA300C456A100C45F7F00CC4BA700D0FE6200D1589600D6B79A00D93DAA00DC38AB00DE3D8300E17E8C00E98AA700EAB94F00EC9FBB00ED0CAD00F4AD7A00FE208B000400400100000571AE006041AE00682C9000F1D9A300010043010000C0EC7C0000") "gamesetup.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\EXEFILE\DEFAULTICON"; Key: "(DEFAULT)"; Value: "%WINDIR%\SysWow64\bzdhz.ico"), "gamesetup.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN"; Key: "GAMESETUP.EXE"; Value: "C:\gamesetup.exe"), "gamesetup.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\HARDWARE PROFILES\0001\.EXE"; Key: "(DEFAULT)"; Value: "jpegfile"), "gamesetup.exe" (Access type: "SETVAL"; Path: "HKCU\.EXE"; Key: "(DEFAULT)"; Value: "jpegfile"), "gamesetup.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\.EXE"; Key: "(DEFAULT)"; Value: "jpegfile"), "gamesetup.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\.LNK"; Key: "(DEFAULT)"; Value: "exefile"), "gamesetup.exe" (Access type: "SETVAL"; Path: "HKCU\.LNK"; Key: "(DEFAULT)"; Value: "exefile"), "gamesetup.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\HARDWARE PROFILES\0001\.LNK"; Key: "(DEFAULT)"; Value: "exefile"), "gamesetup.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\.TXT"; Key: "(DEFAULT)"; Value: "exefile"), "gamesetup.exe" (Access type: "SETVAL"; Path: "HKCU\.TXT"; Key: "(DEFAULT)"; Value: "exefile"), "gamesetup.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\HARDWARE PROFILES\0001\.TXT"; Key: "(DEFAULT)"; Value: "exefile"), "gamesetup.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\HARDWARE PROFILES\0001\.DOC"; Key: "(DEFAULT)"; Value: "exefile"), "gamesetup.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\.DOC"; Key: "(DEFAULT)"; Value: "exefile"), "gamesetup.exe" (Access type: "SETVAL"; Path: "HKCU\.DOC"; Key: "(DEFAULT)"; Value: "exefile")57:T58f,"krnln.fnr" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\E_N60005\krnln.fnr]- [targetUID: 00000000-00000668] "iext2.fne" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\E_N60005\iext2.fne]- [targetUID: 00000000-00000668] "eGrid.fne" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\E_N60005\eGrid.fne]- [targetUID: 00000000-00000668] "eAPI.fne" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\E_N60005\eAPI.fne]- [targetUID: 00000000-00000668] "iext.fnr" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\E_N60005\iext.fnr]- [targetUID: 00000000-00000668] "mp3.run" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 4 sections"- Location: [%TEMP%\E_N60005\mp3.run]- [targetUID: 00000000-00000668] "spec.fne" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 4 sections"- Location: [%TEMP%\E_N60005\spec.fne]- [targetUID: 00000000-00000668] "EThread.fne" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\E_N60005\EThread.fne]- [targetUID: 00000000-00000668] "shell.fne" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\E_N60005\shell.fne]- [targetUID: 00000000-00000668]58:T9a4,Process "%WINDIR%\SysWOW64\taskkill.exe" launched with commandline "taskkill /im taskmgr.exe /f" (UID: 00000000-00002968) Process "%WINDIR%\SysWOW64\taskkill.exe" launched with commandline "taskkill /im taskmgr.exe /f" (UID: 00000000-00005568) Process "%WINDIR%\SysWOW64\cmd.exe" launched with commandline "%WINDIR%\\system32\\cmd.exe /c C:\\ddel.bat" (UID: 00000000-00004776) Process "%WINDIR%\SysWOW64\taskkill.exe" launched with commandline "taskkill /im taskmgr.exe /f" (UID: 00000000-00007092) Process "%WINDIR%\SysWOW64\cmd.exe" launched with commandline "cmd /c taskkill /f /im Aver.exe" (UID: 00000000-00004144) Process "%WINDIR%\SysWOW64\cmd.exe" launched with commandline "%WINDIR%\\system32\\cmd.exe /c C:\\del.bat" (UID: 00000000-00007712) Process "%WINDIR%\SysWOW64\taskkill.exe" launched with commandline "taskkill /im taskmgr.exe /f" (UID: 00000000-00001632) Process "%WINDIR%\SysWOW64\taskkill.exe" launched with commandline "taskkill /im taskmgr.exe /f" (UID: 00000000-00004924) Process "%WINDIR%\SysWOW64\taskkill.exe" launched with commandline "taskkill /f /im explorer.exe" (UID: 00000000-00006368) Process "%WINDIR%\SysWOW64\taskkill.exe" launched with commandline "taskkill /f /im Aver.exe" (UID: 00000000-00003300) Process "%WINDIR%\SysWOW64\explorer.exe" launched with commandline "" (UID: 00000000-00007904) Process "%WINDIR%\SysWOW64\taskkill.exe" launched with commandline "taskkill /im taskmgr.exe /f" (UID: 00000000-00004636) Process "%WINDIR%\System32\rundll32.exe" launched with commandline "shell32.dll,SHCreateLocalServerRunDll {9BA05972-F6A8-11CF-A442-00A0C90A8F39} -Embedding" (UID: 00000000-00000732) Process "%WINDIR%\SysWOW64\taskkill.exe" launched with commandline "taskkill /im taskmgr.exe /f" (UID: 00000000-00007492) Process "%WINDIR%\SysWOW64\taskkill.exe" launched with commandline "taskkill /im taskmgr.exe /f" (UID: 00000000-00001596) Process "%WINDIR%\System32\rundll32.exe" launched with commandline "%WINDIR%\\System32\\shell32.dll,SHCreateLocalServerRunDll {3eef301f-b596-4c0b-bd92-013beafce793} -Embedding" (UID: 00000000-00002304) Process "%WINDIR%\SysWOW64\taskkill.exe" launched with commandline "taskkill /im taskmgr.exe /f" (UID: 00000000-00002512) Process "%WINDIR%\SysWOW64\taskkill.exe" launched with commandline "taskkill /im taskmgr.exe /f" (UID: 00000000-00003840) Process "%WINDIR%\SysWOW64\taskkill.exe" launched with commandline "taskkill /im taskmgr.exe /f" (UID: 00000000-00006560)59:T6bb,"gamesetup.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 4 sections"- Location: [C:\gamesetup.exe]- [targetUID: 00000000-00007100] "panda.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 4 sections"- Location: [C:\panda.exe]- [targetUID: 00000000-00000668] "krnln.fnr" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\E_N60005\krnln.fnr]- [targetUID: 00000000-00000668] "iext2.fne" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\E_N60005\iext2.fne]- [targetUID: 00000000-00000668] "eGrid.fne" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\E_N60005\eGrid.fne]- [targetUID: 00000000-00000668] "eAPI.fne" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\E_N60005\eAPI.fne]- [targetUID: 00000000-00000668] "iext.fnr" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\E_N60005\iext.fnr]- [targetUID: 00000000-00000668] "mp3.run" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 4 sections"- Location: [%TEMP%\E_N60005\mp3.run]- [targetUID: 00000000-00000668] "spec.fne" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 4 sections"- Location: [%TEMP%\E_N60005\spec.fne]- [targetUID: 00000000-00000668] "EThread.fne" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\E_N60005\EThread.fne]- [targetUID: 00000000-00000668] "shell.fne" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\E_N60005\shell.fne]- [targetUID: 00000000-00000668]5a:T1053,".exe" wrote 45056 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\E_N60005\krnln.fnr": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... ".exe" wrote 12288 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\E_N60005\iext.fnr": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... ".exe" wrote 45056 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\E_N60005\iext2.fne": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... ".exe" wrote 20480 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\E_N60005\eGrid.fne": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... ".exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\E_N60005\spec.fne": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... ".exe" wrote 61440 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\E_N60005\EThread.fne": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... ".exe" wrote 61440 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\E_N60005\shell.fne": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... ".exe" wrote 53248 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\E_N60005\eAPI.fne": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... ".exe" wrote 57344 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\E_N60005\mp3.run": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... ".exe" wrote 6064 bytes starting with PE header signature to file "C:\panda.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... ".exe" wrote 16384 bytes starting with PE header signature to file "C:\gamesetup.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000100100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...5b:T62f,GetModuleHandleA RegOpenKeyExA RegCreateKeyExA RegCloseKey RegCreateKeyA GetFileSize FindNextFileA UnhandledExceptionFilter LoadLibraryExA GetModuleFileNameA GetStartupInfoA CreateThread GetVersionExA TerminateProcess CreateProcessA WinExec Sleep FindFirstFileA FindResourceA GetFileAttributesA GetTickCount LockResource WriteFile GetCommandLineA CreateFileA VirtualAlloc GetProcAddress LoadLibraryA ShellExecuteA GetClipboardData GetCursorPos FindWindowExA GetLastActivePopup SetWindowsHookExA recvfrom closesocket accept recv RegEnumKeyExW RegOpenKeyExW RegOpenKeyW RegCreateKeyExW RegDeleteKeyW RegDeleteValueW GetTempPathW LoadLibraryExW DeleteFileW GetCommandLineW CreateDirectoryW LoadLibraryW GetVersionExW FindResourceExW GetModuleHandleExW CreateProcessW GetFileAttributesW GetModuleHandleW CreateFileW Process32NextW CreateToolhelp32Snapshot ExitThread GetStartupInfoW FindFirstFileW Process32FirstW GetModuleFileNameW IsDebuggerPresent FindResourceW ShellExecuteW GetWindowThreadProcessId FindWindowExW FindWindowW WSAStartup RegDeleteValueA RegDeleteKeyA CreateDirectoryA GetDriveTypeA DeviceIoControl GetComputerNameA CopyFileA DeleteFileA GetTempPathA OutputDebugStringA sendto bind connect send listen socket RegOpenKeyA RegEnumKeyA SetSecurityDescriptorDacl GetUserNameA OpenProcessToken Process32First OpenProcess Process32Next GetSystemDirectoryA WNetOpenEnumA FindWindowA InternetCloseHandle InternetGetConnectedState InternetOpenA InternetOpenUrlA EnumPrintersA5c:T495,Process "taskkill.exe" with commandline "taskkill /im taskmgr.exe /f" (UID: 00000000-00004636) Process "rundll32.exe" with commandline "shell32.dll,SHCreateLocalServerRunDll {9BA05972-F6A8-11CF-A442-00A0C90A8F39} -Embedding" (UID: 00000000-00000732) Process "taskkill.exe" with commandline "taskkill /im taskmgr.exe /f" (UID: 00000000-00007492) Process "taskkill.exe" with commandline "taskkill /im taskmgr.exe /f" (UID: 00000000-00001596) Process "rundll32.exe" with commandline "%WINDIR%\\System32\\shell32.dll,SHCreateLocalServerRunDll {3eef301f-b596-4c0b-bd92-013beafce793} -Embedding" (UID: 00000000-00002304) Process "taskkill.exe" with commandline "taskkill /im taskmgr.exe /f" (UID: 00000000-00002512) Process "taskkill.exe" with commandline "taskkill /im taskmgr.exe /f" (UID: 00000000-00003840) Process "taskkill.exe" with commandline "taskkill /im taskmgr.exe /f" (UID: 00000000-00006560) Process "WerFault.exe" with commandline "-pss -s 440 -p 668 -ip 668" (UID: 00000000-00002356) Process "WerFault.exe" with commandline "-u -p 668 -s 1528" (UID: 00000000-00001296) Process "WerFault.exe" with commandline "-u -p 668 -s 1528" (UID: 00000000-00005992)5d:T4de,Process "taskkill.exe" with commandline "taskkill /im taskmgr.exe /f" (UID: 00000000-00002968) Process "taskkill.exe" with commandline "taskkill /im taskmgr.exe /f" (UID: 00000000-00005568) Process "taskkill.exe" with commandline "taskkill /im taskmgr.exe /f" (UID: 00000000-00007092) Process "taskkill.exe" with commandline "taskkill /im taskmgr.exe /f" (UID: 00000000-00001632) Process "taskkill.exe" with commandline "taskkill /im taskmgr.exe /f" (UID: 00000000-00004924) Process "taskkill.exe" with commandline "taskkill /f /im explorer.exe" (UID: 00000000-00006368) Process "taskkill.exe" with commandline "taskkill /f /im Aver.exe" (UID: 00000000-00003300) Process "taskkill.exe" with commandline "taskkill /im taskmgr.exe /f" (UID: 00000000-00004636) Process "taskkill.exe" with commandline "taskkill /im taskmgr.exe /f" (UID: 00000000-00007492) Process "taskkill.exe" with commandline "taskkill /im taskmgr.exe /f" (UID: 00000000-00001596) Process "taskkill.exe" with commandline "taskkill /im taskmgr.exe /f" (UID: 00000000-00002512) Process "taskkill.exe" with commandline "taskkill /im taskmgr.exe /f" (UID: 00000000-00003840) Process "taskkill.exe" with commandline "taskkill /im taskmgr.exe /f" (UID: 00000000-00006560)5e:T559,".exe" wrote 00000004 bytes to a remote process "C:\Windows\SysWOW64\taskkill.exe" (Handle: 896) ".exe" wrote 00000004 bytes to a remote process "C:\gamesetup.exe" (Handle: 1320) ".exe" wrote 00000004 bytes to a remote process "C:\Windows\SysWOW64\taskkill.exe" (Handle: 1088) ".exe" wrote 00000004 bytes to a remote process "C:\Windows\SysWOW64\taskkill.exe" (Handle: 1072) ".exe" wrote 00000004 bytes to a remote process "C:\Windows\SysWOW64\taskkill.exe" (Handle: 1360) ".exe" wrote 00000004 bytes to a remote process "C:\Windows\SysWOW64\taskkill.exe" (Handle: 1364) ".exe" wrote 00000004 bytes to a remote process "C:\Windows\SysWOW64\taskkill.exe" (Handle: 1516) ".exe" wrote 00000004 bytes to a remote process "C:\Windows\SysWOW64\taskkill.exe" (Handle: 1544) ".exe" wrote 00000004 bytes to a remote process "C:\Windows\SysWOW64\taskkill.exe" (Handle: 1540) ".exe" wrote 00000004 bytes to a remote process "C:\Windows\SysWOW64\taskkill.exe" (Handle: 856) ".exe" wrote 00000004 bytes to a remote process "C:\Windows\SysWOW64\taskkill.exe" (Handle: 728) ".exe" wrote 00000004 bytes to a remote process "C:\Windows\SysWOW64\taskkill.exe" (Handle: 1524) "cmd.exe" wrote 00000004 bytes to a remote process "C:\Windows\SysWOW64\taskkill.exe" (Handle: 428) "cmd.exe" wrote 00000004 bytes to a remote process "C:\Windows\SysWOW64\explorer.exe" (Handle: 420)5f:T41e,Process "taskkill.exe" with commandline "taskkill /im taskmgr.exe /f" (UID: 00000000-00002968) Process "taskkill.exe" with commandline "taskkill /im taskmgr.exe /f" (UID: 00000000-00005568) Process "taskkill.exe" with commandline "taskkill /im taskmgr.exe /f" (UID: 00000000-00007092) Process "taskkill.exe" with commandline "taskkill /im taskmgr.exe /f" (UID: 00000000-00001632) Process "taskkill.exe" with commandline "taskkill /im taskmgr.exe /f" (UID: 00000000-00004924) Process "taskkill.exe" with commandline "taskkill /im taskmgr.exe /f" (UID: 00000000-00004636) Process "taskkill.exe" with commandline "taskkill /im taskmgr.exe /f" (UID: 00000000-00007492) Process "taskkill.exe" with commandline "taskkill /im taskmgr.exe /f" (UID: 00000000-00001596) Process "taskkill.exe" with commandline "taskkill /im taskmgr.exe /f" (UID: 00000000-00002512) Process "taskkill.exe" with commandline "taskkill /im taskmgr.exe /f" (UID: 00000000-00003840) Process "taskkill.exe" with commandline "taskkill /im taskmgr.exe /f" (UID: 00000000-00006560)60:T736,Spawned process ".exe" (UID: 00000000-00000668) Spawned process "taskkill.exe" with commandline "taskkill /im taskmgr.exe /f" (UID: 00000000-00002968) Spawned process "gamesetup.exe" (UID: 00000000-00007100) Spawned process "taskkill.exe" with commandline "taskkill /im taskmgr.exe /f" (UID: 00000000-00005568) Spawned process "cmd.exe" with commandline "%WINDIR%\\system32\\cmd.exe /c C:\\ddel.bat" (UID: 00000000-00004776) Spawned process "taskkill.exe" with commandline "taskkill /im taskmgr.exe /f" (UID: 00000000-00007092) Spawned process "cmd.exe" with commandline "cmd /c taskkill /f /im Aver.exe" (UID: 00000000-00004144) Spawned process "cmd.exe" with commandline "%WINDIR%\\system32\\cmd.exe /c C:\\del.bat" (UID: 00000000-00007712) Spawned process "taskkill.exe" with commandline "taskkill /im taskmgr.exe /f" (UID: 00000000-00001632) Spawned process "taskkill.exe" with commandline "taskkill /im taskmgr.exe /f" (UID: 00000000-00004924) Spawned process "taskkill.exe" with commandline "taskkill /f /im explorer.exe" (UID: 00000000-00006368) Spawned process "taskkill.exe" with commandline "taskkill /f /im Aver.exe" (UID: 00000000-00003300) Spawned process "explorer.exe" (UID: 00000000-00007904) Spawned process "taskkill.exe" with commandline "taskkill /im taskmgr.exe /f" (UID: 00000000-00004636) Spawned process "taskkill.exe" with commandline "taskkill /im taskmgr.exe /f" (UID: 00000000-00007492) Spawned process "taskkill.exe" with commandline "taskkill /im taskmgr.exe /f" (UID: 00000000-00001596) Spawned process "taskkill.exe" with commandline "taskkill /im taskmgr.exe /f" (UID: 00000000-00002512) Spawned process "taskkill.exe" with commandline "taskkill /im taskmgr.exe /f" (UID: 00000000-00003840) Spawned process "taskkill.exe" with commandline "taskkill /im taskmgr.exe /f" (UID: 00000000-00006560)61:T8d3,Found string "png_get_compression_buffer_size" (Source: "00000000-00002500.00000000.226954.100E7000.00000002.mdmp, 00000000-00002500.00000001.228876.100E7000.00000002.mdmp") Found string "png_get_compression_type" (Source: "00000000-00002500.00000000.226954.100E7000.00000002.mdmp, 00000000-00002500.00000001.228876.100E7000.00000002.mdmp") Found string "png_set_compression_buffer_size" (Source: "00000000-00002500.00000000.226954.100E7000.00000002.mdmp, 00000000-00002500.00000001.228876.100E7000.00000002.mdmp") Found string "png_set_compression_level" (Source: "00000000-00002500.00000000.226954.100E7000.00000002.mdmp, 00000000-00002500.00000001.228876.100E7000.00000002.mdmp") Found string "png_set_compression_mem_level" (Source: "00000000-00002500.00000000.226954.100E7000.00000002.mdmp, 00000000-00002500.00000001.228876.100E7000.00000002.mdmp") Found string "png_set_compression_method" (Source: "00000000-00002500.00000000.226954.100E7000.00000002.mdmp, 00000000-00002500.00000001.228876.100E7000.00000002.mdmp") Found string "png_set_compression_strategy" (Source: "00000000-00002500.00000000.226954.100E7000.00000002.mdmp, 00000000-00002500.00000001.228876.100E7000.00000002.mdmp") Found string "png_set_compression_window_bits" (Source: "00000000-00002500.00000000.226954.100E7000.00000002.mdmp, 00000000-00002500.00000001.228876.100E7000.00000002.mdmp") Found string "png_set_text_compression_level" (Source: "00000000-00002500.00000000.226954.100E7000.00000002.mdmp, 00000000-00002500.00000001.228876.100E7000.00000002.mdmp") Found string "png_set_text_compression_mem_level" (Source: "00000000-00002500.00000000.226954.100E7000.00000002.mdmp, 00000000-00002500.00000001.228876.100E7000.00000002.mdmp") Found string "png_set_text_compression_method" (Source: "00000000-00002500.00000000.226954.100E7000.00000002.mdmp, 00000000-00002500.00000001.228876.100E7000.00000002.mdmp") Found string "png_set_text_compression_strategy" (Source: "00000000-00002500.00000000.226954.100E7000.00000002.mdmp, 00000000-00002500.00000001.228876.100E7000.00000002.mdmp") Found string "png_set_text_compression_window_bits" (Source: "00000000-00002500.00000000.226954.100E7000.00000002.mdmp, 00000000-00002500.00000001.228876.100E7000.00000002.mdmp")62:T599,Found URL "http://www.w3.org/1999/02/22-rdf-syntax-ns" - Source: "00000000-00002500.00000000.226954.01D30000.00000004.mdmp") Found URL "http://www.w3.org/1999/02/22-rdf-syntax-ns" - Source: "00000000-00002500.00000000.226954.03F90000.00000004.mdmp") Found URL "http://www.w3.org/1999/02/22-rdf-syntax-ns" - Source: "00000000-00002500.00000000.226954.04090000.00000004.mdmp") Found URL "http://www.w3.org/1999/02/22-rdf-syntax-ns" - Source: "00000000-00002500.00000001.228876.01D30000.00000004.mdmp") Found URL "http://www.eyuyan.comservice@dywt.com.cn+86(0411)39895834+86(0411)39895831116001windows" - Source: "00000000-00002500.00000001.228876.01EE8000.00000004.mdmp") Found URL "http://www.w3.org/1999/02/22-rdf-syntax-ns" - Source: "00000000-00002500.00000001.228876.03F90000.00000004.mdmp") Found URL "http://www.w3.org/1999/02/22-rdf-syntax-ns" - Source: "00000000-00002500.00000001.228876.04090000.00000004.mdmp") Found URL "http://www.w3.org/1999/02/22-rdf-syntax-ns" - Source: "00000000-00002500.00000002.230799.01D30000.00000004.mdmp") Found URL "http://www.baidu.comtest\\%snetmessagebuffersendnetapi32.dllindex.datdesktop.ini\*.*s-1-%luset" - Source: "00000000-00002500.00000002.230799.01EF0000.00000004.mdmp") Found URL "http://dywt.com.cnservice@dywt.com.cn+86(0411)88995834+86(0411)88995831116001windows52f260023059454187af826a3c07af2athis" - Source: "00000000-00002500.00000002.230799.03828000.00000004.mdmp")63:T7d0,".exe" called "FindFirstFileW" with parameter %WINDIR%\system32\*.* (UID: 00000000-00002500) ".exe" called "FindFirstFileW" with parameter C:\*.* (UID: 00000000-00002500) ".exe" called "FindNextFileW" with parameter $Recycle.Bin (UID: 00000000-00002500) ".exe" called "FindNextFileW" with parameter .exe (UID: 00000000-00002500) ".exe" called "FindNextFileW" with parameter Documents and Settings (UID: 00000000-00002500) ".exe" called "FindNextFileW" with parameter found.000 (UID: 00000000-00002500) ".exe" called "FindNextFileW" with parameter gamesetup.exe (UID: 00000000-00002500) ".exe" called "FindNextFileW" with parameter MSOCache (UID: 00000000-00002500) ".exe" called "FindNextFileW" with parameter pagefile.sys (UID: 00000000-00002500) ".exe" called "FindNextFileW" with parameter panda.exe (UID: 00000000-00002500) ".exe" called "FindNextFileW" with parameter PerfLogs (UID: 00000000-00002500) ".exe" called "FindNextFileW" with parameter Program Files (UID: 00000000-00002500) ".exe" called "FindNextFileW" with parameter Program Files (x86) (UID: 00000000-00002500) ".exe" called "FindNextFileW" with parameter ProgramData (UID: 00000000-00002500) ".exe" called "FindNextFileW" with parameter Recovery (UID: 00000000-00002500) ".exe" called "FindNextFileW" with parameter System Volume Information (UID: 00000000-00002500) ".exe" called "FindNextFileW" with parameter TorService (UID: 00000000-00002500) ".exe" called "FindNextFileW" with parameter Users (UID: 00000000-00002500) ".exe" called "FindNextFileW" with parameter Windows (UID: 00000000-00002500) ".exe" called "FindNextFileW" with parameter .. (UID: 00000000-00002500) ".exe" called "FindNextFileW" with parameter 0409 (UID: 00000000-00002500) ".exe" called "FindNextFileW" with parameter 12520437.cpx (UID: 00000000-00002500) ".exe" called "FindNextFileW" with parameter 12520850.cpx (UID: 00000000-00002500) ".exe" called "FindNextFileW" with parameter accessibilitycpl.dll (UID: 00000000-00002500)64:T446,"taskkill.exe" called an API "AdjustTokenPrivileges"on file: C:\Windows\Globalization\Sorting\SortDefault.nls" (UID: 00000000-00002924), "taskkill.exe" called an API "AdjustTokenPrivileges"on file: C:\Windows\Globalization\Sorting\SortDefault.nls" (UID: 00000000-00001252) "taskkill.exe" called an API "AdjustTokenPrivileges"on file: C:\Windows\Globalization\Sorting\SortDefault.nls" (UID: 00000000-00001768), "taskkill.exe" called an API "AdjustTokenPrivileges"on file: C:\Windows\Globalization\Sorting\SortDefault.nls" (UID: 00000000-00000972) "taskkill.exe" called an API "AdjustTokenPrivileges"on file: C:\Windows\Globalization\Sorting\SortDefault.nls" (UID: 00000000-00001948), "taskkill.exe" called an API "AdjustTokenPrivileges"on file: C:\Windows\Globalization\Sorting\SortDefault.nls" (UID: 00000000-00003316) "taskkill.exe" called an API "AdjustTokenPrivileges"on file: C:\Windows\Globalization\Sorting\SortDefault.nls" (UID: 00000000-00004244), "taskkill.exe" called an API "AdjustTokenPrivileges"on file: C:\Windows\Globalization\Sorting\SortDefault.nls" (UID: 00000000-00003408)65:T400,AAABAAEAICAQdwAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAHAAAAAAAAAAAAAAAAB4h3eHAAAAAAAAAAAAAAAHd3d3hwAAAAAAAACAAAAHiP//iHAAAAAAAABwAAAHj//////4cAAABwAAd3hweP///////4cAAAcAAHAHB4j///////+IcAAHAABwAAeI////////iHAABwAAcAB3iP///////4h3AAcAAAAAd3d4+IiIiId3dwBwAAAHAHAAAAeP+HAAAAAAAAAACAAAAAAAf/cAAAAAB3AAAAgAAAAAf4dwAAAAAABwAAAAAHgAAH+AAI9wAIcAAAAAAAePgAAAAACIcAj4cAAAAAcHhwAAAAdwMAAAeHBwAAAAeHd3d3h4h4d3d3eHAAAAAHd3d3d4eHeHd3d3dwCAAAB3AAAACAczgAAAAHcA8AAAdwAAADgHc4AAAAB3BwAAAHh4gAA4eIeAAAiHhwAAAAB4iIcAePj/hwB4iIcAAAAAeI////j4/4////iHAAAADwiP///4+P+P///4hwAAAAAHj///iPj/j///+HAAAAAAAI///4j4j3j///gAAAAAB3AI////+I////+AB3AAAAd3AI/////////3AHdwAAB3d3AHj//////4cAd3BwAAAHdwAHeIiP/4cAAHdwAAAAAAcABwAHd4dwAAAAAAAABwAHAHAAB3AAAAAAYABwDAA8ADwAAAA8AAAAPAAAADwAAAA8AAAAPAAAADwAAAA8AAAAPgAAAH4AAAB+AAAAfgAAAH4AAAB8AAAAPAAAADwAAAA8AAAAHAAAABwAAAAcAAAAHAAAABwAAAA4AAAAGAAAABgAAAAYAAAAGAAAABgAAAAYAAAAHAAAADwAAAAw==1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"05cc7a32e5a0023f9e1c790f97b069ccd27ada59ea8b9864f7f9069e3049663c","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790406714535,"unified_at":"2026-09-26T07:11:54.535Z","metadata":{"hashes":{"sha256":"05cc7a32e5a0023f9e1c790f97b069ccd27ada59ea8b9864f7f9069e3049663c","sha1":"8d689f1749d2862df85bef7a70d52482b08d8a49","md5":"7745b093e167b6103c910bcafd0aa27d","sha512":"fe6d83282a0fc3d3f0b3e3f6a1b6b5dc374f66ab386ffbb6e45bdd69d5415502a69717e027ee1b17ae038c84100de159286050281b7dcbe73a3f5f91db82d28c","ssdeep":"393216:LNyhvRvQnbLvlx2K97wsJXrXhrGyR8ovz4v/:ZyVREU4JXtiZqzW/","ssdeep_chunks":["393216:LNyhvRv","393216:NyhvRvQ","393216:yhvRvQn","393216:hvRvQnb","393216:vRvQnbL","393216:RvQnbLv","393216:vQnbLvl","393216:QnbLvlx","393216:nbLvlx2","393216:bLvlx2K","393216:Lvlx2K9","393216:vlx2K97","393216:lx2K97w","393216:x2K97ws","393216:2K97wsJ","393216:K97wsJX","393216:97wsJXr","393216:7wsJXrX","393216:wsJXrXh","393216:sJXrXhr","393216:JXrXhrG","393216:XrXhrGy","393216:rXhrGyR","393216:XhrGyR8","393216:hrGyR8o","393216:rGyR8ov","393216:GyR8ovz","393216:yR8ovz4","393216:R8ovz4v","393216:8ovz4v/","786432:LNyhvRv","786432:NyhvRvQ","786432:yhvRvQn","786432:hvRvQnb","786432:vRvQnbL","786432:RvQnbLv","786432:vQnbLvl","786432:QnbLvlx","786432:nbLvlx2","786432:bLvlx2K","786432:Lvlx2K9","786432:vlx2K97","786432:lx2K97w","786432:x2K97ws","786432:2K97wsJ","786432:K97wsJX","786432:97wsJXr","786432:7wsJXrX","786432:wsJXrXh","786432:sJXrXhr","786432:JXrXhrG","786432:XrXhrGy","786432:rXhrGyR","786432:XhrGyR8","786432:hrGyR8o","786432:rGyR8ov","786432:GyR8ovz","786432:yR8ovz4","786432:R8ovz4v","786432:8ovz4v/","393216:ZyVREU4","393216:yVREU4J","393216:VREU4JX","393216:REU4JXt","393216:EU4JXti","393216:U4JXtiZ","393216:4JXtiZq","393216:JXtiZqz","393216:XtiZqzW","393216:tiZqzW/"],"imphash":"a56f115ee5ef2625bd949acaeec66b76","pehash":"d32f6c8c7124efeb765ba0dfaf4ebb0ae21243fc"},"file_info":{"file_name":"???????.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":12684820,"entropy":8,"compile_timestamp":"1972-12-25T05:33:23","is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1736085690000,"last_seen":1790406369000,"last_multi_scan":1790406369000},"pe_metadata":{"is_dll":false,"is_packed":false,"section_count":6,"import_count":0,"export_count":0,"embedded_file_count":11,"sections":[{"name":" ","virtual_address":"0x1000","virtual_size":17870848,"raw_size":8600064},{"name":" ","virtual_address":"0x110c000","virtual_size":217088,"raw_size":104094},{"name":".imports","virtual_address":"0x1141000","virtual_size":4096,"raw_size":512},{"name":".rsrc","virtual_address":"0x1142000","virtual_size":208384,"raw_size":208384},{"name":".themida","virtual_address":"0x1175000","virtual_size":3891200},{"name":".boot","virtual_address":"0x152b000","virtual_size":2319360,"raw_size":2319195}],"section_names":[" "," ",".imports",".rsrc",".themida",".boot"],"imported_dlls":null,"imported_functions":null}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["sabsik","flystudio","evasive","windows-server-utility"]},"stats":{"av":{"malicious_count":15,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":100},"sandbox_signatures":{"informative_count":248,"suspicious_count":23,"malicious_count":16,"total":287},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win.Evo-gen","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan[Packed]/Win32.Themida","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"malicious","threat_name":"Malware_-10","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/Dropper.Gen","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Zusy.575105","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (D)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Zusy.575105 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win32/Packed.Themida.IIM trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"malicious","threat_name":"Trojan.Heur!.032105A1","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Riskware ( 005ce3731 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"malicious","threat_name":"high_entropy","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/ABTrojan.JEQY-5945","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Genus.XKF","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Dropper.Daws.Win32.38543","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Zusy.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Calls an API typically used to find a resource in a module"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Creates multiple processes"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"suspicious","value":"Contains native function calls"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Able to use GrayString API for text rendering"},{"type":"informative","value":"Contains ability to dynamically load libraries"}],"sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Able to import GetCommandLine API, which retrieves the command line string for the current process"},{"type":"informative","value":"Able to retrieve command line parameters of the running process"},{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"},{"type":"informative","value":"Contains ability to executes commands or batch file"}],"sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Contains ability to create/connect to a named pipe (API string)"},{"type":"informative","value":"Connects to LPC ports"}],"sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Fails to load modules at runtime"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"}],"sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"tactic":"Execution","technique":"Malicious File","attack_id":"T1204.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1204/002","identifiers":[{"type":"malicious","value":"The analysis spawned a process that was identified as malicious"},{"type":"malicious","value":"The analysis extracted a file that was identified as malicious"},{"type":"malicious","value":"Sample was identified as malicious by a trusted antivirus engine"}],"sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"tactic":"Execution","technique":"Command and Scripting Interpreter","attack_id":"T1059","attack_id_wiki":"https://attack.mitre.org/techniques/T1059","identifiers":[{"type":"informative","value":"Executes batch file"}],"sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","identifiers":[{"type":"suspicious","value":"Tries to save executable or command in registry"}],"sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Able to create/load registry keys (API string)"},{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Contains ability to modify registry key/value (API string)"},{"type":"informative","value":"Able to delete registry key/value (API string)"},{"type":"informative","value":"Writes registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"tactic":"Persistence","technique":"Account Manipulation","attack_id":"T1098","attack_id_wiki":"https://attack.mitre.org/techniques/T1098","identifiers":[{"type":"informative","value":"Contains ability to modify the user configuration/privilege (API string)"},{"type":"suspicious","value":"Contains ability to update the user profile"}],"sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to create/control drivers (API string)"},{"type":"informative","value":"Contains ability to access device drivers"}],"sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"tactic":"Persistence","technique":"Socket Filters","attack_id":"T1205.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1205/002","identifiers":[{"type":"informative","value":"Able to monitor socket connection"}],"sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"tactic":"Persistence","technique":"Shortcut Modification","attack_id":"T1547.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/009","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"tactic":"Persistence","technique":"Registry Run Keys / Startup Folder","attack_id":"T1547.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/001","identifiers":[{"type":"informative","value":"Contains reference to Windows Startup folder"},{"type":"suspicious","value":"Modifies auto-execute functionality by setting/creating a value in the registry"}],"sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"},{"type":"informative","value":"Able to modify thread functionality – possible hijack (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"malicious","value":"Creates a process in suspended mode (likely for process injection)"},{"type":"informative","value":"Able to inject code into another process (API string)"},{"type":"malicious","value":"Writes data to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"},{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"},{"type":"informative","value":"Imports system security related APIs"}],"sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to modify access token privileges (API string)"},{"type":"informative","value":"Calls an API typically used to enable or disable privileges in the specified access token"},{"type":"informative","value":"Adjusts debug privileges"}],"sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"},{"type":"informative","value":"Able to identify virtual environment using user register activity"}],"sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"suspicious","value":"Opens file with deletion access rights"},{"type":"informative","value":"Contains ability to delete files"},{"type":"informative","value":"Contains ability to delete files/directories (API string)"},{"type":"informative","value":"Opens file with deletion access rights"},{"type":"informative","value":"Marks file for deletion"}],"sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"PE file contains zero-sized sections"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"suspicious","value":"Timestamp in PE header is very old or in the future"},{"type":"suspicious","value":"Entrypoint in PE header is within an uncommon section"},{"type":"suspicious","value":"CRC value set in PE header does not match actual value"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Loads the Bcrypt module DLL"}],"sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Able to identify virtual/sandbox environment"},{"type":"informative","value":"Able to identify virtual environment by using API string"}],"sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"},{"type":"informative","value":"Contains ability to check debugger is running (API string)"},{"type":"suspicious","value":"Queries kernel debugger information"}],"sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"},{"type":"informative","value":"Contains ability to query local/system time as file time"}],"sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"tactic":"Defense Evasion","technique":"Time Based Checks","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"},{"type":"informative","value":"Contains ability to delay the execution of current thread"}],"sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to show a graphical window (API string)"},{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"tactic":"Defense Evasion","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal","attack_id":"T1070","attack_id_wiki":"https://attack.mitre.org/techniques/T1070","identifiers":[{"type":"informative","value":"Contains ability to empty the recycle bin (API string)"},{"type":"informative","value":"Able to permanently delete files from the Recycle Bin"},{"type":"informative","value":"Imports SHEmptyRecycleBin API"}],"sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"tactic":"Defense Evasion","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Contains reference to method used by Windows shell items (API string)"},{"type":"informative","value":"Spawns Windows crash diagnostic and reporting process"},{"type":"informative","value":"Found virtual disk drive like strings"}],"sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Contains ability to detect sandbox (imports API)"},{"type":"informative","value":"Makes a code branch decision directly after an API that is environment aware"},{"type":"informative","value":"Contains ability to detect virtual environment (API)"},{"type":"informative","value":"Able to identify sandbox environment running process"},{"type":"informative","value":"Able to detect virtual machine (string)"},{"type":"informative","value":"Able to identify virtual/sandbox environment devices"},{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"},{"type":"informative","value":"Observed a high volume of repeated registry API calls (API Hammering)"}],"sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"tactic":"Defense Evasion","technique":"Mutual Exclusion","attack_id":"T1480.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1480/002","identifiers":[{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"tactic":"Defense Evasion","technique":"Match Legitimate Resource Name or Location","attack_id":"T1036.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1036/005","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"tactic":"Defense Evasion","technique":"Rundll32","attack_id":"T1218.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1218/011","identifiers":[{"type":"malicious","value":"Detected Rundll32 process execution"}],"sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"malicious","value":"Uses tskill/taskkill excessively (often used to disable security tools)"},{"type":"informative","value":"Tries to map intranet network resources to internet zone"}],"sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"},{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"}],"sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"tactic":"Defense Evasion","technique":"Masquerade File Type","attack_id":"T1036.008","attack_id_wiki":"https://attack.mitre.org/techniques/T1036/008","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"tactic":"Defense Evasion","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"suspicious","value":"Section contains high entropy"}],"sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"tactic":"Defense Evasion","technique":"Dynamic API Resolution","attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","identifiers":[{"type":"informative","value":"Contains ability to dynamically determine API calls"}],"sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"tactic":"Defense Evasion","technique":"Encrypted/Encoded File","attack_id":"T1027.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/013","identifiers":[{"type":"suspicious","value":"YARA signature match – Anomalous PE file structure"}],"sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"informative","value":"Contains ability to hook/unhook windows functions (API string)"},{"type":"informative","value":"Able to retrieve information about pressed keystrokes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"tactic":"Credential Access","technique":"Input Capture","attack_id":"T1056","attack_id_wiki":"https://attack.mitre.org/techniques/T1056","identifiers":[{"type":"informative","value":"Contains ability to register/read input devices (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"tactic":"Credential Access","technique":"Steal or Forge Kerberos Tickets","attack_id":"T1558","attack_id_wiki":"https://attack.mitre.org/techniques/T1558","identifiers":[{"type":"informative","value":"Able to access credential file using Kerberos"}],"sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"tactic":"Credential Access","technique":"Credential API Hooking","attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","identifiers":[{"type":"malicious","value":"Sets a computer-based training (CBT) hook"},{"type":"informative","value":"Sets a windows hook"}],"sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Able to retrieve logical drive information (API string)"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Able to gather system information (.NET)"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Contains ability to retrieve data about the local computer (API string)"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Contains ability to retrieve the NetBIOS name of the local computer (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Reads system-defined device setup information from registry"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Calls an API typically used to retrieve computer name"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Contains ability to retrieve volume information (API string)"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"malicious","value":"Reads the system/video BIOS version"},{"type":"informative","value":"Able to query volume/memory size (API string)"},{"type":"informative","value":"Contains ability to retrieve the host name of a computer (API string)"},{"type":"informative","value":"Contains ability to query the machine version"},{"type":"informative","value":"Found system command-related strings"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Calls an API typically used to open an existing named mutex object"},{"type":"informative","value":"Contains reference to mutex-related activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Contains ability to enumerate running processes using Tasklist"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Able to enumerate system processes using native API"},{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Process launched with changed environment"},{"type":"malicious","value":"Attempts to stop multiple expected running processes on the machine"},{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Contains ability to retrieve/open a process"},{"type":"informative","value":"Calls an API used to retrieve process information"},{"type":"malicious","value":"Spawns many processes"}],"sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","identifiers":[{"type":"informative","value":"Loads the debugger/analysis tool module"}],"sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Calls an API typically used to enumerate active windows"},{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"},{"type":"informative","value":"Contains ability to find open windows (API string)"},{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"},{"type":"informative","value":"Calls an API typically used to get active windows title"},{"type":"informative","value":"Calls an API typically used to get handle of currently active window"},{"type":"informative","value":"Scanning for window names"}],"sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Able to query registry keys (API string)"},{"type":"informative","value":"Found registry location strings in memory"}],"sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Tries to access LNK files (Windows shortcut)"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Able to rename or move file/directory (API string)"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"suspicious","value":"Reads configuration files (.ini files)"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Contains ability to verify if file exist on disk (API string)"},{"type":"informative","value":"Contains references to file movement (imports API)"},{"type":"informative","value":"Contains ability to enumerate files inside a directory"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Calls an API typically used for searching a directory for files"},{"type":"informative","value":"Able to retrieve the valid logical drives on the computer"},{"type":"informative","value":"Able to determine the valid logical drives on the computer"},{"type":"informative","value":"Contains ability to retrieve path in which Windows is installed (API string)"},{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Contains ability to read files (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Able to retrieve machine time (API string)"},{"type":"informative","value":"Contains ability to retrieve machine timezone (API string)"},{"type":"informative","value":"Contains ability to query the machine timezone"},{"type":"informative","value":"Contains ability to query machine time"}],"sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Able to query system locale information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve local language"}],"sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Able to retrieve system language (API string)"},{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"tactic":"Discovery","technique":"Local Storage Discovery","attack_id":"T1680","attack_id_wiki":"https://attack.mitre.org/techniques/T1680","identifiers":[{"type":"informative","value":"Able to enumerate disk drives (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Able to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Able to query security token membership for user discovery (API string)"},{"type":"informative","value":"Contains ability to retrieve the current user information"},{"type":"informative","value":"Calls an API typically used to retrieve account information for specified SID"}],"sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"tactic":"Discovery","technique":"Network Share Discovery","attack_id":"T1135","attack_id_wiki":"https://attack.mitre.org/techniques/T1135","identifiers":[{"type":"informative","value":"Able to access Windows networking-related API (String)"},{"type":"informative","value":"Contains ability to enumerate system network resources (API string)"},{"type":"informative","value":"Contains ability to provide information and utilities for managing network resources (API string)"},{"type":"informative","value":"Contains ability to query information about shared network resources (API string)"},{"type":"informative","value":"Imports windows networking-related APIs"}],"sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"tactic":"Discovery","technique":"System Network Connections Discovery","attack_id":"T1049","attack_id_wiki":"https://attack.mitre.org/techniques/T1049","identifiers":[{"type":"informative","value":"Contains ability to enumerate network resources (API string)"},{"type":"informative","value":"Contains ability to retrieve internet cache entries (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Contains ability to query network adapter information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"tactic":"Discovery","technique":"Peripheral Device Discovery","attack_id":"T1120","attack_id_wiki":"https://attack.mitre.org/techniques/T1120","identifiers":[{"type":"malicious","value":"Queries firmware table information (may be used to fingerprint/evade)"}],"sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Contains ability to move file or directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Able to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"tactic":"Collection","technique":"Clipboard Data","attack_id":"T1115","attack_id_wiki":"https://attack.mitre.org/techniques/T1115","identifiers":[{"type":"informative","value":"Contains ability to access clipboard data (API string)"},{"type":"informative","value":"Able to capture drag-drop file operations"}],"sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Calls an API typically used to create a directory"},{"type":"informative","value":"Contains ability to create directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"Writes files in a temp directory"},{"type":"suspicious","value":"Contains ability to find and load resources of a specific module"}],"sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Contains ability to communicate with network (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"Contains ability to perform Base64 encoding/decoding"}],"sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"informative","value":"Contains ability to communicate with C2 using Sockets (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"informative","value":"Contains ability to open a port and listen for incoming connection (API string)"},{"type":"suspicious","value":"Contains ability to open a port and listen for incoming connection"}],"sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Contains reference to Windows internet services (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Drops files with image extension"},{"type":"suspicious","value":"Writes a PE file header to disc"},{"type":"suspicious","value":"Drops executable files"},{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Drops executable files inside temp directory"}],"sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"tactic":"Command and Control","technique":"Internal Proxy","attack_id":"T1090.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1090/001","identifiers":[{"type":"suspicious","value":"Modifies proxy settings"}],"sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"tactic":"Command and Control","technique":"Steganography","attack_id":"T1001.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1001/002","identifiers":[{"type":"suspicious","value":"Drops image files with high entropy (likely encrypted/compressed content)"}],"sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Able to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to reboot/shutdown the operating system (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"},{"type":"informative","value":"Calls an API used to open a process handle"},{"type":"malicious","value":"Terminates other processes using tskill/taskkill"},{"type":"malicious","value":"Terminates system processes"}],"sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"tactic":"Reconnaissance","technique":"Credentials","attack_id":"T1589.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1589/001","identifiers":[{"type":"informative","value":"Attempts to steal credentials via Security Account Manager (SAM) modules"}],"sources":[{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"informative","value":"Contains reference to multiple windows system processes"}],"sources":[{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"suspicious","value":"Contains references to WMI/WMIC"}],"sources":[{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"tactic":"Privilege Escalation","technique":"Process Hollowing","attack_id":"T1055.012","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/012","identifiers":[{"type":"informative","value":"Contains ability to unmap view of a section from a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"tactic":"Defense Evasion","technique":"Code Signing Policy Modification","attack_id":"T1553.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/006","sources":[{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"tactic":"Defense Evasion","technique":"Direct Volume Access","attack_id":"T1006","attack_id_wiki":"https://attack.mitre.org/techniques/T1006","identifiers":[{"type":"informative","value":"Attempts to read volume data via DOS device path"}],"sources":[{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"tactic":"Defense Evasion","technique":"Junk Code Insertion","attack_id":"T1027.016","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/016","sources":[{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"tactic":"Discovery","technique":"Domain Groups","attack_id":"T1069.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1069/002","identifiers":[{"type":"informative","value":"References Windows LDAP client module"},{"type":"informative","value":"Loads Windows LDAP client module"}],"sources":[{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"tactic":"Lateral Movement","technique":"Remote Services","attack_id":"T1021","attack_id_wiki":"https://attack.mitre.org/techniques/T1021","identifiers":[{"type":"informative","value":"Calls an API typically used to register an interface (RPC)"}],"sources":[{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"tactic":"Collection","technique":"Archive via Library","attack_id":"T1560.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1560/002","identifiers":[{"type":"informative","value":"Able to compress/decompress content at runtime"}],"sources":[{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"informative","value":"Found E-Mail address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"tactic":"Command and Control","technique":"Mail Protocols","attack_id":"T1071.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/003","identifiers":[{"type":"informative","value":"Found mail related domain names"}],"sources":[{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains reference to crypto DLLs"}],"sources":[{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"???????.exe\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00007100.00000000.146549.00468000.00000002.mdmp\")\n Found reference to API \"VirtualFree\" (Indicator: \"VirtualFree\"; Source: \"00000000-00007100.00000000.146549.00468000.00000002.mdmp\")\n Found reference to API \"VirtualAlloc\" (Indicator: \"VirtualAlloc\"; Source: \"00000000-00007100.00000000.146549.00468000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify thread functionality – possible hijack (API string)","description":"Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; File: \"???????.exe\")\n Found reference to API \"SuspendThread\" (Indicator: \"SuspendThread\"; File: \"???????.exe\")\n Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; Source: \"00000000-00007100.00000000.146549.00468000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.003","relevance":3,"id":"string-309","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to find a resource in a module","description":"$27","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-140","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to load a resource in memory","description":"$28","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"$29","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to impersonate access tokens (API string)","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; File: \"???????.exe\")\n Found reference to API \"NtOpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00002304.00000000.146996.4C448000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-306","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"LoadLibraryExA\" (Indicator: \"LoadLibrary\"; File: \"???????.exe\")\n Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; File: \"???????.exe\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; File: \"???????.exe\")\n Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; File: \"???????.exe\")\n Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; Source: \"00000000-00002304.00000000.146996.4C448000.00000002.mdmp\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00002304.00000000.146996.4C448000.00000002.mdmp\")\n Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00007100.00000000.146549.00468000.00000002.mdmp\")\n Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; Source: \"00000000-00007100.00000000.146549.00468000.00000002.mdmp\")\n Found reference to API \"LoadLibraryExA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00007100.00000000.146549.00468000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify registry key/value (API string)","description":"Found reference to API \"RegSetValueExA\" (Indicator: \"RegSetValue\"; File: \"???????.exe\")\n Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; File: \"???????.exe\")\n Found reference to API \"RegSetKeySecurity\" (Indicator: \"RegSetKeySecurity\"; File: \"???????.exe\")\n Found reference to API \"RegSetValueExA\" (Indicator: \"RegSetValue\"; Source: \"00000000-00007100.00000000.146549.00468000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-304","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to pass information to a window procedure (API string)","description":"Found reference to API \"CallWindowProcA\" (Indicator: \"CallWindowProc\"; File: \"???????.exe\")\n Found reference to API \"CallWindowProcW\" (Indicator: \"CallWindowProc\"; File: \"???????.exe\")\n Found reference to API \"CallWindowProcA\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00007100.00000000.146549.00468000.00000002.mdmp\")\n Found reference to API \"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00007100.00000000.146549.030B0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to perform Base64 encoding/decoding","description":"file/memory contains long string with (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+\"; File: \"panda.exe\")\n file/memory contains long string with (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\"; File: \"panda.exe\")","origin":"File/Memory","mitre_attack_id":"T1132","relevance":1,"id":"string-338","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Loads the debugger/analysis tool module","description":"\"taskkill.exe\" loaded module \"%WINDIR%\\SysWOW64\\dbghelp.dll\" at 72360000\n \"taskkill.exe\" loaded module \"%WINDIR%\\SysWOW64\\dbghelp.dll\" at 722D0000\n \"taskkill.exe\" loaded module \"%WINDIR%\\SysWOW64\\dbghelp.dll\" at 72310000\n \"taskkill.exe\" loaded module \"%WINDIR%\\SysWOW64\\dbghelp.dll\" at 717B0000","origin":"Loaded Module","mitre_attack_id":"T1518.001","relevance":3,"id":"module-16","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"$2a","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"$2b","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Spawns Windows crash diagnostic and reporting process","description":"Process \"WerFault.exe\" [UID: 00000000-00002356]\n Process \"WerFault.exe\" [UID: 00000000-00001296]\n Process \"WerFault.exe\" [UID: 00000000-00005992]","origin":"Monitored Target","mitre_attack_id":"T1564","relevance":1,"id":"target-585","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"???????.exe\")\n Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"???????.exe\")\n Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; File: \"???????.exe\")\n Found reference to API \"OutputDebugStringA\" (Indicator: \"OutputDebugString\"; File: \"???????.exe\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"???????.exe\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"???????.exe\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-148","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Found strings in conjunction with a procedure lookup that resolve to a known API export symbol","description":"Found reference to API InitCommonControlsEx@COMCTL32.DLL at 00000000-00007100-65109-722-0045D5A8\n Found reference to API IsProcessorFeaturePresent@KERNEL32.DLL at 00000000-00007100-65109-3128-0044E059","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-41","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"PE file contains zero-sized sections","description":"Raw size of \".themida\" is zero","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-5","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"Assembly shows XOR instruction xor ecx\n edx in Stream UID: 00000000-00007100-65109-985-00437A80\n Assembly shows XOR instruction xor ecx\n edx in Stream UID: 00000000-00007100-65109-1178-00428BC0\n Assembly shows XOR instruction xor eax\n edx in Stream UID: 00000000-00007100-65109-1178-00428BC0\n Assembly shows XOR instruction xor ecx\n edx in Stream UID: 00000000-00007100-65109-1197-0042CA54\n Assembly shows XOR instruction xor eax\n edx in Stream UID: 00000000-00007100-65109-1197-0042CA54\n Assembly shows XOR instruction xor eax\n edx in Stream UID: 00000000-00007100-65109-1404-0041A7D0\n Assembly shows XOR instruction xor eax\n edx in Stream UID: 00000000-00007100-65109-1562-00419F00\n Assembly shows XOR instruction xor ebx\n ecx in Stream UID: 00000000-00007100-65109-2025-0045C076","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: Contains CRYPTO related strings\n Matched sigs: Drops image files with high entropy (likely encrypted/compressed content)\n Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$2c","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate disk drives (API string)","description":"Found reference to API \"GetLogicalDriveStringsA\" (Indicator: \"GetLogicalDriveStringsA\"; File: \"???????.exe\")\n Found reference to API \"GetDriveTypeA\" (Indicator: \"GetDriveTypeA\"; File: \"???????.exe\")\n Found reference to API \"WNetEnumResourceA\" (Indicator: \"WNetEnumResourceA\"; File: \"???????.exe\")","origin":"File/Memory","mitre_attack_id":"T1680","relevance":5,"id":"string-998","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate system processes using native API","description":"Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00000668-00000C2B-1271845346\")\n Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00002304.00000000.146996.4C448000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-907","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00000668-00000C2B-1271845346\")\n Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00002304.00000000.146996.4C448000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"$2d","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"Environment Awareness","name":"Able to perform scheduled transfer (API string)","description":"Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; File: \"???????.exe\")\n Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; File: \"???????.exe\")\n Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00007100.00000000.146549.00468000.00000002.mdmp\")\n Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00007100.00000000.146549.00468000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; File: \"???????.exe\")\n Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; File: \"???????.exe\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"Found reference to API \"EnumSystemLocalesA\" (Indicator: \"EnumSystemLocales\"; File: \"???????.exe\")\n Found reference to API \"GetLocaleInfoA\" (Indicator: \"GetLocaleInfo\"; File: \"???????.exe\")\n Found reference to API \"GetUserDefaultLCID\" (Indicator: \"GetUserDefaultLCID\"; File: \"???????.exe\")\n Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; File: \"???????.exe\")","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query volume/memory size (API string)","description":"Found reference to API \"GetDiskFreeSpaceA\" (Indicator: \"GetDiskFreeSpace\"; File: \"???????.exe\")\n Found reference to API \"GlobalMemoryStatus\" (Indicator: \"GlobalMemoryStatus\"; File: \"???????.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-193","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"Found system information discovery API: \"GetMonitorInfoA\" in file \"00000000-00007100.00000000.146549.00401000.00000020.mdmp\"\n Found system information discovery API: \"ExpandEnvironmentStringsA\" in file \"???????.exe\"\n Found system information discovery API: \"NtQuerySystemInformation\" in \"00000000-00002304.00000000.146996.4C448000.00000002.mdmp\"\n Found system information discovery API: \"RtlNtStatusToDosError\" in \"00000000-00002304.00000000.146996.4C448000.00000002.mdmp\"\n Found system information discovery API: \"GetMonitorInfoA\" in \"00000000-00007100.00000000.146549.00468000.00000002.mdmp\"\n Found system information discovery API: \"GetEnvironmentStrings\" in \"00000000-00007100.00000000.146549.00468000.00000002.mdmp\"\n Found system information discovery API: \"GetEnvironmentStringsW\" in \"00000000-00007100.00000000.146549.00468000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve machine time (API string)","description":"Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; File: \"???????.exe\")\n Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; File: \"???????.exe\")\n Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00007100.00000000.146549.00468000.00000002.mdmp\")\n Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00007100.00000000.146549.00468000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve system language (API string)","description":"Found reference to API \"GetUserDefaultUILanguage\" (Indicator: \"GetUserDefaultUILanguage\"; File: \"???????.exe\")\n Found reference to API \"GetSystemDefaultLangID\" (Indicator: \"GetSystemDefaultLangID\"; File: \"???????.exe\")\n Found reference to API \"GetKeyboardLayout\" (Indicator: \"GetKeyboardLayout\"; File: \"???????.exe\")","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"$2e","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\".exe\" called \"GetTickCount\" with parameters (UID: 00000000-00000668)","origin":"API Call","mitre_attack_id":"T1497","relevance":3,"id":"api-296","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\".exe\" called \"GetSystemMetrics\" with parameters (UID: 00000000-00000668)\n \".exe\" called \"EnumDisplayMonitors\" with parameters (UID: 00000000-00000668)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\".exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00000668)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API possibly used to retrieve a handle to the foreground window","description":"\".exe\" called \"GetForegroundWindow\" (UID: 00000000-00000668)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-142","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\".exe\" called \"IsWow64Process\" with parameter \"668\" - (UID: 00000000-00000668)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get active windows title","description":"\".exe\" called \"GetWindowTextA\" (UID: 00000000-00000668)\n \".exe\" called \"GetWindowTextW\" with parameter \"c800a100cf00fb00\" - (UID: 00000000-00000668)\n \".exe\" called \"GetWindowTextW\" with parameter \"c800b700b600a800\" - (UID: 00000000-00000668)\n \".exe\" called \"GetWindowTextA\" with parameter \"\"0x0467bfe8\"\" - (UID: 00000000-00000668)\n \".exe\" called \"GetWindowTextA\" with parameter \"cedeb7a8b6a8cebbb3ccd0f2cae4c8ebb5e320476574436869636b656e4665657420d3dab6afccacc1b4bdd3bfe220433a5c57696e646f77735c73797374656d33325c4a695c496b756e2e646c6cc9cf2e\" - (UID: 00000000-00000668)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-151","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get handle of currently active window","description":"\".exe\" called \"GetActiveWindow\" (UID: 00000000-00000668)","origin":"API Call","mitre_attack_id":"T1010","relevance":5,"id":"api-150","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\".exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00000668)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$2f","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"$30","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API used to retrieve process information","description":"Observed import api \"OpenProcessToken\" which can be \"used to retrieve process information\" [Source: eAPI.fne]\n Observed import api \"OpenProcessToken\" which can be \"used to retrieve process information\" [Source: shell.fne]","origin":"Static Parser","mitre_attack_id":"T1057","relevance":5,"id":"static-189","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to detect virtual environment (API)","description":"GetTickCount@KERNEL32.DLL at 00000000-00007100-65109-737-0043A8F0\n GetTickCount@KERNEL32.DLL at 00000000-00007100-65109-1068-00432DE0\n GetTickCount@KERNEL32.DLL at 00000000-00007100-65109-1112-0042D8F0\n GetTickCount@KERNEL32.DLL at 00000000-00007100-65109-1406-0041A750\n GetTickCount@KERNEL32.DLL at 00000000-00007100-65109-3061-0042D560","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497","relevance":3,"id":"stream-87","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to determine if process is running under WOW64 (API string)","description":"Found reference to API \"IsWow64Process2\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00002304.00000000.146996.4C448000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-450","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to enumerate files inside a directory","description":"FindFirstFileA@KERNEL32.DLL at 00000000-00007100-65109-796-0045A222\n FindFirstFileA@KERNEL32.DLL at 00000000-00007100-65109-1487-004192E0\n FindFirstFileA@KERNEL32.DLL at 00000000-00007100-65109-1717-00407FB0\n FindNextFileA@KERNEL32.DLL at 00000000-00007100-65109-2182-0041113D","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1083","relevance":3,"id":"stream-89","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to find open windows (API string)","description":"Found reference to API \"FindWindowExA\" (Indicator: \"FindWindowExA\"; File: \"???????.exe\")\n Found reference to API \"FindWindowExW\" (Indicator: \"FindWindowExW\"; File: \"???????.exe\")\n Found reference to API \"FindWindowW\" (Indicator: \"FindWindowW\"; File: \"???????.exe\")\n Found reference to API \"FindWindowA\" (Indicator: \"FindWindowA\"; File: \"???????.exe\")\n Found reference to API \"FindWindowExA\" (Indicator: \"FindWindowExA\"; Source: \"00000000-00007100.00000000.146549.00468000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-413","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query local/system time as file time","description":"FileTimeToLocalFileTime@KERNEL32.DLL at 00000000-00007100-65109-1984-00458173","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1070.006","relevance":1,"id":"stream-71","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetLocalTime@KERNEL32.DLL at 00000000-00007100-65109-1745-0044B660","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1124","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine timezone","description":"GetTimeZoneInformation@KERNEL32.DLL at 00000000-00007100-65109-1744-0045460C\n GetTimeZoneInformation@KERNEL32.DLL at 00000000-00007100-65109-1745-0044B660","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1124","relevance":1,"id":"stream-48","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"GetVersion@KERNEL32.DLL at 00000000-00007100-65109-76-00463F1D\n GetVersion@KERNEL32.DLL at 00000000-00007100-65109-1871-0044928C\n GetVersionExA@KERNEL32.DLL at 00000000-00007100-65109-1904-0044DCD8\n GetVersion@KERNEL32.DLL at 00000000-00007100-65109-2025-0045C076\n GetVersion@KERNEL32.DLL at 00000000-00007100-65109-2874-00463DDD","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"$31","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"FileTimeToSystemTime\" (Indicator: \"FileTimeToSystemTime\"; File: \"???????.exe\")\n Found reference to API \"FileTimeToLocalFileTime\" (Indicator: \"FileTimeToLocalFileTime\"; File: \"???????.exe\")\n Found reference to API \"GetFileTime\" (Indicator: \"GetFileTime\"; File: \"???????.exe\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; File: \"???????.exe\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00002304.00000000.146996.4C448000.00000002.mdmp\")\n Found reference to API \"FileTimeToSystemTime\" (Indicator: \"FileTimeToSystemTime\"; Source: \"00000000-00007100.00000000.146549.00468000.00000002.mdmp\")\n Found reference to API \"FileTimeToLocalFileTime\" (Indicator: \"FileTimeToLocalFileTime\"; Source: \"00000000-00007100.00000000.146549.00468000.00000002.mdmp\")\n Found reference to API \"GetFileTime\" (Indicator: \"GetFileTime\"; Source: \"00000000-00007100.00000000.146549.00468000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine timezone (API string)","description":"Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; File: \"???????.exe\")\n Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; Source: \"00000000-00007100.00000000.146549.00468000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-248","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"$32","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve path in which Windows is installed (API string)","description":"Found reference to API \"GetWindowsDirectoryA\" (Indicator: \"GetWindowsDirectory\"; File: \"???????.exe\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-312","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"GetVersionExA\" (Indicator: \"GetVersionExA\"; File: \"???????.exe\")\n Found reference to API \"GetVersionExA\" (Indicator: \"GetVersion\"; File: \"???????.exe\")\n Found reference to API \"GetVersionExW\" (Indicator: \"GetVersionExW\"; File: \"???????.exe\")\n Found reference to API \"GetVersionExW\" (Indicator: \"GetVersion\"; File: \"???????.exe\")\n Found reference to API \"GetVersionExA\" (Indicator: \"GetVersionExA\"; Source: \"00000000-00007100.00000000.146549.00468000.00000002.mdmp\")\n Found reference to API \"GetVersionExA\" (Indicator: \"GetVersion\"; Source: \"00000000-00007100.00000000.146549.00468000.00000002.mdmp\")\n Found reference to API \"GetVersion\" (Indicator: \"GetVersion\"; Source: \"00000000-00007100.00000000.146549.00468000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Found reference to API \"GetStartupInfoW\" (Indicator: \"GetStartupInfo\"; File: \"???????.exe\")","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-167","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve volume information (API string)","description":"Found reference to API \"GetVolumeInformationA\" (Indicator: \"GetVolumeInformation\"; File: \"???????.exe\")\n Found reference to API \"GetVolumeInformationA\" (Indicator: \"GetVolumeInformation\"; Source: \"00000000-00007100.00000000.146549.00468000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-162","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve/open a process","description":"GetProcessHeap@KERNEL32.DLL at 00000000-00007100-65109-118-00402420\n GetProcessHeap@KERNEL32.DLL at 00000000-00007100-65109-876-004022F0\n GetProcessHeap@KERNEL32.DLL at 00000000-00007100-65109-877-00402220\n GetProcessHeap@KERNEL32.DLL at 00000000-00007100-65109-1031-00434EC0\n GetProcessHeap@KERNEL32.DLL at 00000000-00007100-65109-1055-004343D0\n GetProcessHeap@KERNEL32.DLL at 00000000-00007100-65109-1060-00434380","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1057","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to verify if file exist on disk (API string)","description":"Found reference to API \"PathFileExistsW\" (Indicator: \"PathFileExist\"; File: \"???????.exe\")\n Found reference to API \"PathFileExistsA\" (Indicator: \"PathFileExist\"; File: \"???????.exe\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-140","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"Environment Awareness","name":"Makes a code branch decision directly after an API that is environment aware","description":"Found API call GetVersion@KERNEL32.DLL directly followed by \"cmp al, 04h\" and \"jnc 00463F49h\" at 00000000-00007100-65109-76-00463F1D\n Found API call GetTimeZoneInformation@KERNEL32.DLL directly followed by \"cmp eax, FFFFFFFFh\" and \"je 0045488Eh\" at 00000000-00007100-65109-1744-0045460C\n Found API call GetSystemTime@KERNEL32.DLL directly followed by \"cmp ax, word ptr [004A2362h]\" and \"jne 0044B6C5h\" at 00000000-00007100-65109-1745-0044B660\n Found API call GetVersion@KERNEL32.DLL directly followed by \"cmp eax, 30h\" and \"ja 0045C510h\" at 00000000-00007100-65109-2025-0045C076\n Found API call GetVersion@KERNEL32.DLL directly followed by \"cmp eax, ebx\" and \"je 00463EA2h\" at 00000000-00007100-65109-2874-00463DDD","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497","relevance":10,"id":"stream-39","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"$33","origin":"API Call","mitre_attack_id":"T1082","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"gamesetup.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"rundll32.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\".exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\GAMESETUP.EXE\")\n \".exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\.EXE\")\n \"gamesetup.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\ZHQ445078388.3322.ORG\")","origin":"Registry Access","mitre_attack_id":"T1518","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"General","name":"Able to create/load registry keys (API string)","description":"Found registry modification API: \"RegCreateKeyExA\" in file \"???????.exe\"\n Found registry modification API: \"RegCreateKeyA\" in file \"???????.exe\"\n Found registry modification API: \"RegCreateKeyExW\" in file \"???????.exe\"\n Found registry modification API: \"RegCreateKeyA\" in \"00000000-00007100.00000000.146549.00468000.00000002.mdmp\"\n Found registry modification API: \"RegCreateKeyExA\" in \"00000000-00007100.00000000.146549.00468000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-307","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"General","name":"Able to rename or move file/directory (API string)","description":"Found string \"MoveFileA\" (Indicator: \"MoveFileA\"; File: \"???????.exe\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-884","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"General","name":"Able to retrieve command line parameters of the running process","description":"file/memory contains long string(File: \"panda.exe\")\n file/memory contains long string(File: \"eGrid.fne\")\n file/memory contains long string(File: \"iext.fnr\")\n file/memory contains long string(File: \"mp3.run\")\n file/memory contains long string(File: \"spec.fne\")\n file/memory contains long string(File: \"EThread.fne\")\n file/memory contains long string(File: \"shell.fne\")\n Found string \"GetCommandLineW\" (Source: \"00000000-00002304.00000000.146996.4C448000.00000002.mdmp\")\n Found string \"GetCommandLineA\" (Source: \"00000000-00007100.00000000.146549.00468000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-930","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"General","name":"Able to retrieve/open a process (API string)","description":"Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; File: \"???????.exe\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00002304.00000000.146996.4C448000.00000002.mdmp\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00007100.00000000.146549.00468000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"General","name":"Able to use GrayString API for text rendering","description":"Found reference to API \"GrayStringA\" (Indicator: \"GrayStringA\"; File: \"???????.exe\")\n Found reference to API \"GrayStringA\" (Indicator: \"GrayStringA\"; Source: \"00000000-00007100.00000000.146549.00468000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-900","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"General","name":"An application crash occurred","description":"Report process \"WerFault.exe\" was created by \"svchost.exe\"\n Report process \"WerFault.exe\" was created by \".exe\"","origin":"Monitored Target","id":"target-2","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"\".exe\" called \"CreateDirectoryA\" with parameter %TEMP%\\E_N60005 (UID: 00000000-00000668)","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"\".exe\" called \"CreateProcessA\" with parameter \"taskkill /im taskmgr.exe /f\" - (UID: 00000000-00000668)\n \".exe\" called \"CreateProcessW\" with parameter \"\"C:\\gamesetup.exe\"\" - (UID: 00000000-00000668)\n \"gamesetup.exe\" called \"CreateProcessA\" with parameter \"C:\\ddel.bat\" - (UID: 00000000-00007100)\n \"gamesetup.exe\" called \"CreateProcessA\" with parameter \"cmd /c taskkill /f /im Aver.exe\" - (UID: 00000000-00007100)\n \"gamesetup.exe\" called \"CreateProcessA\" with parameter \"C:\\del.bat\" - (UID: 00000000-00007100)\n \"cmd.exe\" called \"CreateProcessW\" with parameter \"taskkill /f /im explorer.exe\" - (UID: 00000000-00004776)\n \"cmd.exe\" called \"CreateProcessW\" with parameter \"explorer.exe\" - (UID: 00000000-00004776)\n \"cmd.exe\" called \"CreateProcessW\" with parameter \"taskkill /f /im Aver.exe\" - (UID: 00000000-00004144)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$34","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$35","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"Found reference to API \"CreateProcessA\" (Indicator: \"CreateProcess\"; File: \"???????.exe\")\n Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; File: \"???????.exe\")\n Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; Source: \"00000000-00002304.00000000.146996.4C448000.00000002.mdmp\")\n Found reference to API \"CreateProcessA\" (Indicator: \"CreateProcess\"; Source: \"00000000-00007100.00000000.146549.00468000.00000002.mdmp\")\n Found reference to API \"3219292846,3440,3141,,CreateProcessA,kernel32.dll,\"00:38:06.468\",RX=0,PX=0\" (Indicator: \"CreateProcess\"; Source: \"00000000-00007100.00000000.146549.030E2000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; File: \"???????.exe\")","origin":"File/Memory","mitre_attack_id":"T1074.001","relevance":1,"id":"string-423","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"General","name":"Contains ability to create/control drivers (API string)","description":"Found reference to API \"DeviceIoControl\" (Indicator: \"DeviceIoControl\"; File: \"???????.exe\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-220","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; File: \"???????.exe\")\n Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"00000000-00002304.00000000.146996.4C448000.00000002.mdmp\")\n Found reference to API \"CreateFileA\" (Indicator: \"CreateFile\"; Source: \"00000000-00007100.00000000.146549.00468000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"General","name":"Contains ability to delay the execution of current thread","description":"WaitForSingleObject@KERNEL32.DLL at 00000000-00007100-65109-241-00422010\n WaitForMultipleObjects@KERNEL32.DLL at 00000000-00007100-65109-1054-00434970\n Sleep@KERNEL32.DLL at 00000000-00007100-65109-1068-00432DE0\n Sleep@KERNEL32.DLL at 00000000-00007100-65109-1406-0041A750\n WaitForSingleObject@KERNEL32.DLL at 00000000-00007100-65109-1431-00418C30\n SetTimer at 00000000-00007100-65109-1682-004092D0\n SetTimer at 00000000-00007100-65109-1689-004090E0\n WaitForSingleObject@KERNEL32.DLL at 00000000-00007100-65109-1845-00401A30\n Sleep@KERNEL32.DLL at 00000000-00007100-65109-1973-00457002","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497.003","relevance":3,"id":"stream-103","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; File: \"???????.exe\")\n Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00007100.00000000.146549.00468000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically determine API calls","description":"Found GetProcAddress() and LoadLibraryA() in an import section (Source: gamesetup.exe)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: panda.exe)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: krnln.fnr)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: iext2.fne)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: eGrid.fne)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: eAPI.fne)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: iext.fnr)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: mp3.run)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: spec.fne)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: EThread.fne)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: shell.fne)","origin":"Static Parser","mitre_attack_id":"T1027.007","relevance":1,"id":"static-79","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically load libraries","description":"LoadLibraryA@KERNEL32.DLL at 00000000-00007100-65109-24-00454BE2\n LoadLibraryExA@KERNEL32.DLL at 00000000-00007100-65109-423-00447D40\n LoadLibraryExA@KERNEL32.DLL at 00000000-00007100-65109-434-00447480\n LoadLibraryA@KERNEL32.DLL at 00000000-00007100-65109-722-0045D5A8","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":3,"id":"stream-108","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$36","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Found reference to API \"WinExec\" (Indicator: \"WinExec\"; File: \"???????.exe\")\n Found reference to API \"ShellExecuteA\" (Indicator: \"ShellExecute\"; File: \"???????.exe\")\n Found reference to API \"ShellExecuteW\" (Indicator: \"ShellExecute\"; File: \"???????.exe\")\n Found reference to API \"WinExec\" (Indicator: \"WinExec\"; Source: \"00000000-00007100.00000000.146549.00468000.00000002.mdmp\")\n Found reference to API \"ShellExecuteA\" (Indicator: \"ShellExecute\"; Source: \"00000000-00007100.00000000.146549.00468000.00000002.mdmp\")\n Found reference to API \"yncShellExecuteD\" (Indicator: \"ShellExecute\"; Source: \"00000000-00007100.00000000.146549.030B0000.00000004.mdmp\")\n Found reference to API \"yncShellExecute\" (Indicator: \"ShellExecute\"; Source: \"00000000-00007100.00000000.146549.030B0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-240","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"General","name":"Contains ability to executes commands or batch file","description":"$37","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-174","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"$38","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-550","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"General","name":"Contains ability to move file or directory (API string)","description":"Found reference to API \"MoveFileA\" (Indicator: \"MoveFile\"; File: \"???????.exe\")","origin":"File/Memory","mitre_attack_id":"T1570","relevance":1,"id":"string-322","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"???????.exe\")\n Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00002304.00000000.146996.4C448000.00000002.mdmp\")\n Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00007100.00000000.146549.00468000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; File: \"???????.exe\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"???????.exe\")\n Found reference to API \"SuspendThread\" (Indicator: \"SuspendThread\"; File: \"???????.exe\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00007100.00000000.146549.00468000.00000002.mdmp\")\n Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; Source: \"00000000-00007100.00000000.146549.00468000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"00000000-00002304.00000000.146996.4C448000.00000002.mdmp\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00002304.00000000.146996.4C448000.00000002.mdmp\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00007100.00000000.146549.00468000.00000002.mdmp\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"00000000-00007100.00000000.146549.00468000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; File: \"???????.exe\")\n Found reference to API \"GetWindowThreadProcessId\" (Indicator: \"GetWindowThreadProcessId\"; File: \"???????.exe\")\n Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; Source: \"00000000-00007100.00000000.146549.00468000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-208","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"General","name":"Contains export functions","description":"$39","origin":"Static Parser","relevance":1,"id":"static-78","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"General","name":"Contains reference to method used by Windows shell items (API string)","description":"Found reference to API \"SHFileOperationA\" (Indicator: \"SHFileOperation\"; File: \"???????.exe\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-269","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"General","name":"Contains references to file movement (imports API)","description":"Found MoveFileA in import section (Source: krnln.fnr)","origin":"Static Parser","mitre_attack_id":"T1083","relevance":1,"id":"static-205","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$3a","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"$3b","origin":"Created Mutant","mitre_attack_id":"T1480.002","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"Antivirus vendors marked dropped file \"panda.exe\" as clean (type is \"PE32 executable for MS Windows 4.00 (GUI) Intel i386 4 sections\"), Antivirus vendors marked dropped file \"ddel.bat\" as clean (type is \"DOS batch file ASCII text with CRLF line terminators\"), Antivirus vendors marked dropped file \"iext2.fne\" as clean (type is \"PE32 executable for MS Windows 4.00 (DLL) Intel i386 5 sections\"), Antivirus vendors marked dropped file \"D_A_OIa7.lnk\" as clean (type is \"Unknown\"), Antivirus vendors marked dropped file \"D_A_OIa1.lnk\" as clean (type is \"Unknown\"), Antivirus vendors marked dropped file \"D_A_OIa3.lnk\" as clean (type is \"Unknown\"), Antivirus vendors marked dropped file \"D_A_OIa2.lnk\" as clean (type is \"Unknown\"), Antivirus vendors marked dropped file \"D_A_OIa12.lnk\" as clean (type is \"Unknown\"), Antivirus vendors marked dropped file \"D_A_OIa4.lnk\" as clean (type is \"Unknown\")","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"General","name":"Executes batch file","description":"Process \"cmd.exe\" with commandline \"%WINDIR%\\\\system32\\\\cmd.exe /c C:\\\\ddel.bat\" (UID: 00000000-00004776)\n Process \"cmd.exe\" with commandline \"%WINDIR%\\\\system32\\\\cmd.exe /c C:\\\\del.bat\" (UID: 00000000-00007712)","origin":"Monitored Target","mitre_attack_id":"T1059","relevance":3,"id":"target-220","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"$3c","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"$3d","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$3e","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\".exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 749E0000\n \".exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 72EC0000\n \"taskkill.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 749E0000\n \"taskkill.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 72EC0000\n \"gamesetup.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 749E0000\n \"gamesetup.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 72EC0000\n \"cmd.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 749E0000\n \"explorer.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 749E0000\n \"explorer.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 72EC0000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\".exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 753E0000\n \"taskkill.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 753E0000\n \"gamesetup.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 753E0000\n \"cmd.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 753E0000\n \"explorer.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 753E0000\n \"rundll32.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at A3DA0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"19001a000000000040c7dea2fe7f0000@ntdll.dll\"\n \"220023000000000018c7dea2fe7f0000@ntdll.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"$3f","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$40","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"General","name":"PE file contains Debug data directory","description":"\"panda.exe\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"","origin":"Static Parser","id":"static-146","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"???????.exe\" has an executable section named \"\"\n \"???????.exe\" has an executable section named \".themida\"\n \"???????.exe\" has an executable section named \".boot\"\n \"gamesetup.exe\" has an executable section named \".text\"\n \"panda.exe\" has an executable section named \".text\"\n \"krnln.fnr\" has an executable section named \".text\"\n \"iext2.fne\" has an executable section named \".text\"\n \"eGrid.fne\" has an executable section named \".text\"\n \"eAPI.fne\" has an executable section named \".text\"\n \"iext.fnr\" has an executable section named \".text\"\n \"mp3.run\" has an executable section named \".text\"\n \"spec.fne\" has an executable section named \".text\"\n \"EThread.fne\" has an executable section named \".text\"\n \"shell.fne\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"???????.exe\" has an writable section named \"\"\n \"???????.exe\" has an writable section named \".imports\"\n \"???????.exe\" has an writable section named \".themida\"\n \"gamesetup.exe\" has an writable section named \".data\"\n \"panda.exe\" has an writable section named \".data\"\n \"krnln.fnr\" has an writable section named \".data\"\n \"iext2.fne\" has an writable section named \".data\"\n \"eGrid.fne\" has an writable section named \".data\"\n \"eAPI.fne\" has an writable section named \".data\"\n \"iext.fnr\" has an writable section named \".data\"\n \"mp3.run\" has an writable section named \".data\"\n \"spec.fne\" has an writable section named \".data\"\n \"EThread.fne\" has an writable section named \".data\"\n \"shell.fne\" has an writable section named \".data\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"$41","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"General","name":"PE file has a big raw size section","description":"Raw size of \"\" is \"0x833a00\" greater than 0x100000\n Raw size of \".boot\" is \"0x23635b\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-125","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"General","name":"PE file has a big virtual size section","description":"Virtual size of \"\" is \"0x110b000\" greater than 0x100000\n Virtual size of \".themida\" is \"0x3b6000\" greater than 0x100000\n Virtual size of \".boot\" is \"0x236400\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-124","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"Observed system executable string:\"%WINDIR%\\SysWOW64\\taskkill.exe\" [Source: 00000000-00000668-00000BC0-1277127054]\n Observed system executable string:\"%WINDIR%\\SysWOW64\\cmd.exe\" [Source: 00000000-00007100-00000BC0-1278984189]\n Observed system executable string:\"%WINDIR%\\SysWOW64\\explorer.exe\" [Source: 00000000-00004776-00000BC0-1281941943]\n Observed system executable string:\"%WINDIR%\\system32\\taskkill.exe\" [Source: 00000000-00004776-00000C46-5341720580]\n Observed system executable string:\"%WINDIR%\\system32\\explorer.exe\" [Source: 00000000-00004776-00000C46-6650770234]\n Observed system executable string:\"%WINDIR%\\system32\\cmd.exe /c C:\\ddel.bat\" [Source: cmd.exe]\n Observed system executable string:\"%WINDIR%\\system32\\cmd.exe /c C:\\del.bat\" [Source: cmd.exe]","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"$42","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"$43","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"General","name":"References Windows file paths for DLLs (possible dropped files)","description":"Observed system executable string:\"%WINDIR%\\System32\\shell32.dll,SHCreateLocalServerRunDll {3eef301f-b596-4c0b-bd92-013beafce793} -Embedding\" [Source: rundll32.exe]","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"\"gamesetup.exe\" searching for window \"Microsoft Internet Explorer\"","origin":"API Call","mitre_attack_id":"T1010","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"General","name":"Sets a windows hook","description":"\"gamesetup.exe\" sets a windows hook with filter \"WH_CBT\" for thread ID 3440","origin":"API Call","mitre_attack_id":"T1056.004","relevance":10,"id":"api-71","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"$44","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"$45","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"???????.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"gamesetup.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"panda.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"krnln.fnr\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"iext2.fne\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"eGrid.fne\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"eAPI.fne\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"iext.fnr\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"mp3.run\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"spec.fne\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"EThread.fne\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"shell.fne\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"General","name":"Writes files in a temp directory","description":"\".exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\E_N60005\\krnln.fnr\"\n \".exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\E_N60005\\iext.fnr\"\n \".exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\E_N60005\\iext2.fne\"\n \".exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\E_N60005\\eGrid.fne\"\n \".exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\E_N60005\\spec.fne\"\n \".exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\E_N60005\\EThread.fne\"\n \".exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\E_N60005\\shell.fne\"\n \".exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\E_N60005\\eAPI.fne\"\n \".exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\E_N60005\\mp3.run\"\n \".exe\" writes to a file \"C:\\Windows\\Temp\\panda.ico\"\n \".exe\" writes to a file \"C:\\Windows\\Temp\\panda.jpg\"\n \".exe\" writes to a file \"%WINDIR%\\Temp\\panda.ico\"\n \".exe\" writes to a file \"%WINDIR%\\Temp\\panda.jpg\"","origin":"API Call","mitre_attack_id":"T1005","relevance":1,"id":"api-267","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryExA\" (Indicator: \"LoadLibrary\"; File: \"???????.exe\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; File: \"???????.exe\")\n Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; File: \"???????.exe\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00002304.00000000.146996.4C448000.00000002.mdmp\")\n Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00007100.00000000.146549.00468000.00000002.mdmp\")\n Found reference to API \"LoadLibraryExA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00007100.00000000.146549.00468000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\".exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$46","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$47","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\".exe\" queries basic process information of the \"C:\\.exe\" (UID: 668)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$48","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\".exe\" reads file \"c:\\.exe\"\n \".exe\" reads file \"c:\\windows\\fonts\\staticcache.dat\"\n \"gamesetup.exe\" reads file \"c:\\windows\\fonts\\staticcache.dat\"\n \"cmd.exe\" reads file \"c:\\ddel.bat\"\n \"cmd.exe\" reads file \"c:\\del.bat\"\n \"rundll32.exe\" reads file \"c:\\windows\\system32\\ieframe.dll\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"$49","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"\".exe\" trying to touch file \"C:\\Windows\\System32\\WOW64LOG.DLL\"\n \".exe\" trying to touch file \"C:\\Windows\\SysWOW64\\apphelp.dll\"\n \".exe\" trying to touch file \"C:\\.exe\"\n \".exe\" trying to touch file \"C:\\Windows\\SysWOW64\\ntdll.dll\"\n \".exe\" trying to touch file \"C:\\Windows\\SysWOW64\\kernel32.dll\"\n \".exe\" trying to touch file \"C:\\Windows\\SysWOW64\\KernelBase.dll\"\n \".exe\" trying to touch file \"C:\\Windows\\apppatch\\sysmain.sdb\"\n \".exe\" trying to touch file \"C:\\Windows\\Temp\\VxSSL32.dll\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"\".exe\" touched file \"C:\\Windows\\Temp\\panda.ico\"\n \".exe\" touched file \"C:\\Windows\\Temp\\panda.jpg\"\n \".exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\Caches\"\n \".exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\"\n \"gamesetup.exe\" touched file \"C:\\Windows\\SysWOW64\\bzdhz.ico\"","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access LNK files (Windows shortcut)","description":"\".exe\" trying to access LNK file \"C:\\ÐÜÃ¨ÉÕÏÃ1.LNK\"\n \".exe\" trying to access LNK file \"C:\\ÐÜÃ¨ÉÕÏã1.lnk\"\n \".exe\" trying to access LNK file \"C:\\ÐÜÃ¨ÉÕÏÃ2.LNK\"\n \".exe\" trying to access LNK file \"C:\\ÐÜÃ¨ÉÕÏã2.lnk\"\n \".exe\" trying to access LNK file \"C:\\ÐÜÃ¨ÉÕÏÃ3.LNK\"\n \".exe\" trying to access LNK file \"C:\\ÐÜÃ¨ÉÕÏã3.lnk\"\n \".exe\" trying to access LNK file \"C:\\ÐÜÃ¨ÉÕÏÃ4.LNK\"\n \".exe\" trying to access LNK file \"C:\\ÐÜÃ¨ÉÕÏã4.lnk\"\n \".exe\" trying to access LNK file \"C:\\ÐÜÃ¨ÉÕÏÃ5.LNK\"\n \".exe\" trying to access LNK file \"C:\\ÐÜÃ¨ÉÕÏã5.lnk\"\n \".exe\" trying to access LNK file \"C:\\ÐÜÃ¨ÉÕÏÃ6.LNK\"\n \".exe\" trying to access LNK file \"C:\\ÐÜÃ¨ÉÕÏã6.lnk\"\n \".exe\" trying to access LNK file \"C:\\ÐÜÃ¨ÉÕÏÃ7.LNK\"\n \".exe\" trying to access LNK file \"C:\\ÐÜÃ¨ÉÕÏã7.lnk\"\n \".exe\" trying to access LNK file \"C:\\ÐÜÃ¨ÉÕÏÃ8.LNK\"\n \".exe\" trying to access LNK file \"C:\\ÐÜÃ¨ÉÕÏã8.lnk\"\n \".exe\" trying to access LNK file \"C:\\ÐÜÃ¨ÉÕÏÃ9.LNK\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-203","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$4a","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$4b","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"$4c","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"Network Related","name":"Able to access Windows networking-related API (String)","description":"Found reference to API \"WNetCloseEnum\" (Indicator: \"WNetCloseEnum\"; File: \"???????.exe\")\n Found reference to API \"WNetAddConnection2A\" (Indicator: \"WNetAddConnection\"; File: \"???????.exe\")\n Found reference to API \"WNetOpenEnumA\" (Indicator: \"WNetOpenEnum\"; File: \"???????.exe\")\n Found reference to API \"WNetCancelConnection2A\" (Indicator: \"WNetCancelConnection\"; File: \"???????.exe\")\n Found reference to API \"WNetEnumResourceA\" (Indicator: \"WNetEnumResource\"; File: \"???????.exe\")","origin":"File/Memory","mitre_attack_id":"T1135","relevance":1,"id":"string-923","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"Network Related","name":"Able to monitor socket connection","description":"Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; File: \"???????.exe\")","origin":"File/Memory","mitre_attack_id":"T1205.002","relevance":1,"id":"string-879","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with C2 using Sockets (API string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; File: \"???????.exe\")","origin":"File/Memory","mitre_attack_id":"T1095","relevance":1,"id":"string-228","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; File: \"???????.exe\")\n Found reference to API \"InternetOpenA\" (Indicator: \"InternetOpen\"; File: \"???????.exe\")\n Found reference to API \"InternetOpenUrlA\" (Indicator: \"InternetOpen\"; File: \"???????.exe\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create/connect to a named pipe (API string)","description":"Found reference to API \"CreatePipe\" (Indicator: \"CreatePipe\"; File: \"???????.exe\")\n Found reference to API \"PeekNamedPipe\" (Indicator: \"PeekNamedPipe\"; File: \"???????.exe\")","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-210","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"Network Related","name":"Contains ability to enumerate network resources (API string)","description":"Found reference to API \"WNetCloseEnum\" (Indicator: \"NetCloseEnum\"; File: \"???????.exe\")\n Found reference to API \"WNetAddConnection2A\" (Indicator: \"NetAddConnection\"; File: \"???????.exe\")\n Found reference to API \"WNetEnumResourceA\" (Indicator: \"NetEnumResource\"; File: \"???????.exe\")","origin":"File/Memory","mitre_attack_id":"T1049","relevance":1,"id":"string-257","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"Network Related","name":"Contains ability to open a port and listen for incoming connection (API string)","description":"Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; File: \"???????.exe\")","origin":"File/Memory","mitre_attack_id":"T1571","relevance":1,"id":"string-419","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"Network Related","name":"Contains ability to provide information and utilities for managing network resources (API string)","description":"Found reference to API \"WNetCancelConnection2A\" (Indicator: \"WNetCancelConnection\"; File: \"???????.exe\")","origin":"File/Memory","mitre_attack_id":"T1135","relevance":1,"id":"string-113","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"Network Related","name":"Contains ability to query information about shared network resources (API string)","description":"Found reference to API \"EnumPrintersA\" (Indicator: \"EnumPrinters\"; File: \"???????.exe\")","origin":"File/Memory","mitre_attack_id":"T1135","relevance":3,"id":"string-190","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"Network Related","name":"Contains ability to retrieve internet cache entries (API string)","description":"Found reference to API \"FindNextUrlCacheEntryA\" (Indicator: \"FindNextUrlCacheEntry\"; File: \"???????.exe\")\n Found reference to API \"FindFirstUrlCacheEntryA\" (Indicator: \"FindFirstUrlCacheEntry\"; File: \"???????.exe\")","origin":"File/Memory","mitre_attack_id":"T1049","relevance":1,"id":"string-321","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"Network Related","name":"Contains reference to Windows internet services (API string)","description":"Found reference to API \"InternetOpenA\" (Indicator: \"InternetOpen\"; File: \"???????.exe\")\n Found reference to API \"InternetOpenUrlA\" (Indicator: \"InternetOpen\"; File: \"???????.exe\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-539","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"Found reference to API \"WSACleanup\" (Indicator: \"wsacleanup\"; File: \"???????.exe\")\n Found reference to API \"inet_ntoa\" (Indicator: \"inet_ntoa\"; File: \"???????.exe\")\n Found reference to API \"WSAStartup\" (Indicator: \"wsastartup\"; File: \"???????.exe\")\n Found reference to API \"gethostname\" (Indicator: \"gethostname\"; File: \"???????.exe\")\n Found reference to API \"inet_addr\" (Indicator: \"inet_addr\"; File: \"???????.exe\")\n Found reference to API \"gethostbyname\" (Indicator: \"gethostbyname\"; File: \"???????.exe\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"192.168.0.2\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$4d","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"Network Related","name":"Imports windows networking-related APIs","description":"Observed import api \"WNetAddConnection\" which can \"make a connection to a network resource\" [Source: eAPI.fne]\n Observed import api \"WNetCancelConnection\" which can \"cancel an existing network connection\" [Source: eAPI.fne]\n Observed import api \"WNetCloseEnum\" which can \"end a network resource enumeration\" [Source: eAPI.fne]\n Observed import api \"WNetEnumResource\" which can \"continue an enumeration of network recls.sources\" [Source: eAPI.fne]\n Observed import api \"WNetOpenEnum\" which can \"start an enumeration of network recls.sources or existing connections.\" [Source: eAPI.fne]","origin":"Static Parser","mitre_attack_id":"T1135","relevance":1,"id":"static-86","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"Ransomware/Banking","name":"Contains ability to empty the recycle bin (API string)","description":"Found reference to API \"SHEmptyRecycleBinA\" (Indicator: \"EmptyRecycleBin\"; File: \"???????.exe\")","origin":"File/Memory","mitre_attack_id":"T1070","relevance":1,"id":"string-111","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"Ransomware/Banking","name":"Imports SHEmptyRecycleBin API","description":"Observed import api \"SHEmptyRecycleBin\" which can \"empty the Recycle Bin on the specified drive\" [Source: eAPI.fne]","origin":"Static Parser","mitre_attack_id":"T1070","relevance":1,"id":"static-84","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"Found string \"+ncalrpc:[OLE1D12008CDF85B11D247F2CE3ED66]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00000732.00000000.146875.59010000.00000004.mdmp, 00000000-00000732.00000001.148798.59010000.00000004.mdmp, 00000000-00000732.00000002.150715.59010000.00000004.mdmp\")\n Found string \"+ncalrpc:[OLE141E76C2A9EB3D2906CED7B47CAC]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00000732.00000000.146875.59010000.00000004.mdmp, 00000000-00000732.00000001.148798.59010000.00000004.mdmp, 00000000-00000732.00000002.150715.59010000.00000004.mdmp\")\n Found string \"+ncalrpc:[OLE8414A07A1B2D9FB789D54B181E13]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00002304.00000000.146996.C3D70000.00000004.mdmp, 00000000-00002304.00000001.148917.C3D70000.00000004.mdmp, 00000000-00002304.00000002.150837.C3D70000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access credential file using Kerberos","description":"Found string \"Kerberos\" (Indicator: \"kerberos\"; Source: \"00000000-00007100.00000000.146549.030E2000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1558","relevance":1,"id":"string-868","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture drag-drop file operations","description":"Found string \"GetClipboardData\" (File: \"???????.exe\")\n Found string \"GetClipboardData\" (Source: \"00000000-00007100.00000000.146549.00468000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1115","relevance":1,"id":"string-915","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture screen (API string)","description":"$4e","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to determine the valid logical drives on the computer","description":"Found string \"GetLogicalDriveStringsA\" (Indicator: \"getlogicaldrivestringsa\"; File: \"???????.exe\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-730","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to import GetCommandLine API, which retrieves the command line string for the current process","description":"$4f","origin":"Static Parser","mitre_attack_id":"T1059.003","relevance":1,"id":"static-88","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"Found registry query API: \"RegOpenKeyExA\" in file \"???????.exe\"\n Found registry query API: \"RegQueryValueA\" in file \"???????.exe\"\n Found registry query API: \"RegQueryInfoKeyW\" in file \"???????.exe\"\n Found registry query API: \"RegEnumKeyExW\" in file \"???????.exe\"\n Found registry query API: \"RegOpenKeyExW\" in file \"???????.exe\"\n Found registry query API: \"RegQueryValueExA\" in file \"???????.exe\"\n Found registry query API: \"RegOpenKeyW\" in file \"???????.exe\"\n Found registry query API: \"RegQueryValueExW\" in file \"???????.exe\"\n Found registry query API: \"RegOpenKeyA\" in file \"???????.exe\"\n Found registry query API: \"RegEnumKeyA\" in file \"???????.exe\"\n Found registry query API: \"RegQueryInfoKeyA\" in file \"???????.exe\"\n Found registry query API: \"RegOpenKeyExA\" in \"00000000-00007100.00000000.146549.00468000.00000002.mdmp\"\n Found registry query API: \"RegQueryValueA\" in \"00000000-00007100.00000000.146549.00468000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve information about pressed keystrokes (API string)","description":"Found reference to API \"GetKeyState\" (Indicator: \"GetKeyState\"; File: \"???????.exe\")\n Found reference to API \"VkKeyScanExA\" (Indicator: \"VkKeyScan\"; File: \"???????.exe\")\n Found reference to API \"VkKeyScanExA\" (Indicator: \"VkKeyScanEx\"; File: \"???????.exe\")\n Found reference to API \"GetKeyboardState\" (Indicator: \"GetKeyboardState\"; File: \"???????.exe\")\n Found reference to API \"GetKeyState\" (Indicator: \"GetKeyState\"; Source: \"00000000-00007100.00000000.146549.00468000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-88","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve logical drive information (API string)","description":"Found reference to API \"GetLogicalDriveStringsA\" (Indicator: \"GetLogicalDriveStrings\"; File: \"???????.exe\")\n Found reference to API \"GetDriveTypeA\" (Indicator: \"GetDriveType\"; File: \"???????.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-80","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve the valid logical drives on the computer","description":"Observed import api \"GetLogicalDriveStringsA\" which can be \"used to retrieve a list of available drives (logical drives) in the system\" [Source: krnln.fnr]","origin":"Static Parser","mitre_attack_id":"T1083","relevance":5,"id":"static-192","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve usernames and/or user information (API string)","description":"Found reference to API \"GetTokenInformation\" (Indicator: \"GetTokenInformation\"; File: \"???????.exe\")\n Found reference to API \"GetUserNameA\" (Indicator: \"GetUserName\"; File: \"???????.exe\")\n Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00002304.00000000.146996.4C448000.00000002.mdmp\")\n Found reference to API \"NtQueryInformationToken\" (Indicator: \"NtQueryInformationToken\"; Source: \"00000000-00002304.00000000.146996.4C448000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\".exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"gamesetup.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"cmd.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"rundll32.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve computer name","description":"\".exe\" called \"GetComputerNameW\" (UID: 00000000-00000668)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-141","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"file/memory contains long string with (Indicator: \"aes\"; File: \"eGrid.fne\")\n file/memory contains long string with (Indicator: \"aes\"; File: \"iext.fnr\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to access clipboard data (API string)","description":"Found reference to API \"GetClipboardData\" (Indicator: \"GetClipboardData\"; File: \"???????.exe\")\n Found reference to API \"OpenClipboard\" (Indicator: \"OpenClipboard\"; File: \"???????.exe\")\n Found reference to API \"GetClipboardData\" (Indicator: \"GetClipboardData\"; Source: \"00000000-00007100.00000000.146549.00468000.00000002.mdmp\")\n Found reference to API \"OpenClipboard\" (Indicator: \"OpenClipboard\"; Source: \"00000000-00007100.00000000.146549.00468000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1115","relevance":1,"id":"string-188","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to detect sandbox (imports API)","description":"Found GetCursorPos() in an import section (Source: gamesetup.exe)\n Found GetCursorPos() in an import section (Source: krnln.fnr)\n Found GetCursorPos() in an import section (Source: iext2.fne)\n Found GetCursorPos() in an import section (Source: eGrid.fne)\n Found GetCursorPos() in an import section (Source: eAPI.fne)\n Found GetCursorPos() in an import section (Source: iext.fnr)","origin":"Static Parser","mitre_attack_id":"T1497","relevance":1,"id":"static-132","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"Found reference to API \"FindNextFileA\" (Indicator: \"FindNextFile\"; File: \"???????.exe\")\n Found reference to API \"FindFirstFileA\" (Indicator: \"FindFirstFile\"; File: \"???????.exe\")\n Found reference to API \"FindFirstFileW\" (Indicator: \"FindFirstFile\"; File: \"???????.exe\")\n Found reference to API \"FindFirstFileA\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00007100.00000000.146549.00468000.00000002.mdmp\")\n Found reference to API \"FindNextFileA\" (Indicator: \"FindNextFile\"; Source: \"00000000-00007100.00000000.146549.00468000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$50","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate system network resources (API string)","description":"Found reference to API \"WNetOpenEnumA\" (Indicator: \"WNetOpenEnum\"; File: \"???????.exe\")","origin":"File/Memory","mitre_attack_id":"T1135","relevance":1,"id":"string-313","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to query network adapter information (API string)","description":"Found reference to API \"GetAdaptersInfo\" (Indicator: \"GetAdaptersInfo\"; File: \"???????.exe\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-118","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00002304.00000000.146996.4C448000.00000002.mdmp\")\n Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00007100.00000000.146549.00468000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to register/read input devices (API string)","description":"Found reference to API \"mouse_event\" (Indicator: \"mouse_event\"; File: \"???????.exe\")\n Found reference to API \"keybd_event\" (Indicator: \"keybd_event\"; File: \"???????.exe\")","origin":"File/Memory","mitre_attack_id":"T1056","relevance":1,"id":"string-403","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; File: \"???????.exe\")\n Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; File: \"???????.exe\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; File: \"???????.exe\")\n Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00002304.00000000.146996.4C448000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00002304.00000000.146996.4C448000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00007100.00000000.146549.00468000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00002304.00000000.146996.4C448000.00000002.mdmp\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00007100.00000000.146549.00468000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve data about the local computer (API string)","description":"Found reference to API \"InterlockedExchange\" (Indicator: \"InterlockedExchange\"; File: \"???????.exe\")\n Found reference to API \"InterlockedExchange\" (Indicator: \"InterlockedExchange\"; Source: \"00000000-00007100.00000000.146549.00468000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":3,"id":"string-115","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"$51","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the NetBIOS name of the local computer (API string)","description":"Found reference to API \"GetComputerNameA\" (Indicator: \"GetComputerName\"; File: \"???????.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-122","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; File: \"???????.exe\")\n Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00007100.00000000.146549.00468000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host name of a computer (API string)","description":"Found reference to API \"gethostname\" (Indicator: \"gethostname\"; File: \"???????.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-532","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"Found reference to API \"GetEnvironmentVariableA\" (Indicator: \"GetEnvironmentVariable\"; File: \"???????.exe\")\n Found reference to API \"GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; File: \"???????.exe\")\n Found reference to API \"GetEnvironmentVariableA\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00007100.00000000.146549.00468000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-107","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; Source: \"00000000-00007100.00000000.146549.00468000.00000002.mdmp\")\n Found reference to API \"1275814554,3440,111,,GetSystemMetrics,user32.dll,\"00:38:05.656\",RX=0,PX=0\" (Indicator: \"GetSystemMetrics\"; Source: \"00000000-00007100.00000000.146549.030E2000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-131","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"???????.exe\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00002304.00000000.146996.4C448000.00000002.mdmp\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00007100.00000000.146549.00468000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Reads system-defined device setup information from registry","description":"\".exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0000\"; Key: \"DRIVERDESC\")\n \".exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0002\"; Key: \"PRUNINGMODE\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-106","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"System Destruction","name":"Able to permanently delete files from the Recycle Bin","description":"Found string \"SHEmptyRecycleBinA\" (File: \"???????.exe\")","origin":"File/Memory","mitre_attack_id":"T1070","relevance":1,"id":"string-922","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"System Security","name":"Able to delete registry key/value (API string)","description":"Found registry deletion API: \"RegDeleteKeyW\" in file \"???????.exe\"\n Found registry deletion API: \"RegDeleteValueW\" in file \"???????.exe\"\n Found registry deletion API: \"RegDeleteValueA\" in file \"???????.exe\"\n Found registry deletion API: \"RegDeleteKeyA\" in file \"???????.exe\"\n Found registry deletion API: \"SHDeleteValueA\" in file \"???????.exe\"\n Found registry deletion API: \"SHDeleteKeyA\" in file \"???????.exe\"","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-230","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"System Security","name":"Calls an API used to open a process handle","description":"Observed import api \"OpenProcess\" which can be \"used to open a process handle\" [Source: eAPI.fne]\n Observed import api \"OpenProcess\" which can be \"used to open a process handle\" [Source: shell.fne]","origin":"Static Parser","mitre_attack_id":"T1489","relevance":5,"id":"static-191","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"$52","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files","description":"Observed string: \"del Aver.exe del.batdel %\" (Indicator: \"del \") in Source: del.bat\n Observed string: \"del\" (Indicator: \"del\") in Source: 00000000-00007100.00000000.146549.051D0000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-408","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; File: \"???????.exe\")\n Found reference to API \"RemoveDirectoryA\" (Indicator: \"RemoveDirectory\"; File: \"???????.exe\")\n Found reference to API \"DeleteFileA\" (Indicator: \"DeleteFile\"; File: \"???????.exe\")","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"System Security","name":"Contains ability to hook/unhook windows functions (API string)","description":"Found reference to API \"UnhookWindowsHookEx\" (Indicator: \"UnhookWindowsHook\"; File: \"???????.exe\")\n Found reference to API \"CallNextHookEx\" (Indicator: \"CallNextHook\"; File: \"???????.exe\")\n Found reference to API \"SetWindowsHookExA\" (Indicator: \"SetWindowsHook\"; File: \"???????.exe\")\n Found reference to API \"UnhookWindowsHookEx\" (Indicator: \"UnhookWindowsHook\"; Source: \"00000000-00007100.00000000.146549.00468000.00000002.mdmp\")\n Found reference to API \"CallNextHookEx\" (Indicator: \"CallNextHook\"; Source: \"00000000-00007100.00000000.146549.00468000.00000002.mdmp\")\n Found reference to API \"SetWindowsHookExA\" (Indicator: \"SetWindowsHook\"; Source: \"00000000-00007100.00000000.146549.00468000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-91","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"Found reference to API \"LookupPrivilegeValueA\" (Indicator: \"LookupPrivilegeValue\"; File: \"???????.exe\")\n Found reference to API \"AdjustTokenPrivileges\" (Indicator: \"AdjustTokenPrivileges\"; File: \"???????.exe\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify file attributes (API string)","description":"Found reference to API \"SetFileAttributesA\" (Indicator: \"SetFileAttributes\"; File: \"???????.exe\")","origin":"File/Memory","mitre_attack_id":"T1222","relevance":1,"id":"string-426","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify the user configuration/privilege (API string)","description":"Found reference to API \"SystemParametersInfoA\" (Indicator: \"SystemParametersInfo\"; File: \"???????.exe\")\n Found reference to API \"SystemParametersInfoW\" (Indicator: \"SystemParametersInfo\"; File: \"???????.exe\")\n Found reference to API \"SystemParametersInfoA\" (Indicator: \"SystemParametersInfo\"; Source: \"00000000-00007100.00000000.146549.00468000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1098","relevance":1,"id":"string-132","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"$53","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00002304.00000000.146996.4C448000.00000002.mdmp\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00002304.00000000.146996.4C448000.00000002.mdmp\")\n Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00007100.00000000.146549.00468000.00000002.mdmp\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00007100.00000000.146549.00468000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00007100.00000000.146549.00468000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"System Security","name":"Imports system security related APIs","description":"$54","origin":"Static Parser","mitre_attack_id":"T1134.001","relevance":1,"id":"static-87","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\".exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$55","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"System Security","name":"Writes registry keys","description":"$56","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to reboot/shutdown the operating system (API string)","description":"Found reference to API \"SetSystemPowerState\" (Indicator: \"SetSystemPowerState\"; File: \"???????.exe\")\n Found reference to API \"ExitWindowsEx\" (Indicator: \"ExitWindows\"; File: \"???????.exe\")","origin":"File/Memory","mitre_attack_id":"T1529","relevance":3,"id":"string-189","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"Found reference to API \"OpenMutexW\" (Indicator: \"OpenMutex\"; File: \"???????.exe\")\n Found reference to API \"CreateMutexW\" (Indicator: \"CreateMutex\"; File: \"???????.exe\")\n Found reference to API \"ReleaseMutex\" (Indicator: \"ReleaseMutex\"; File: \"???????.exe\")\n Found reference to API \"CreateMutexA\" (Indicator: \"CreateMutex\"; File: \"???????.exe\")\n Found reference to API \"ReleaseMutex\" (Indicator: \"ReleaseMutex\"; Source: \"00000000-00002304.00000000.146996.4C448000.00000002.mdmp\")\n Found reference to API \"CreateMutexExW\" (Indicator: \"CreateMutex\"; Source: \"00000000-00002304.00000000.146996.4C448000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-354","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops executable files inside temp directory","description":"$57","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-33","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files with image extension","description":"\"panda.jpg\" has type \"JPEG image data JFIF standard 1.02 resolution (DPI) density 72x72 segment length 16 Exif Standard: [TIFF image data big-endian direntries=7 orientation=upper-left xresolution=98 yresolution=106 resolutionunit=2 software=Adobe Photoshop 7.0 datetime=2007:01:26 19:45:26] baseline precision 8 1024x768 components 3\" and extension \"jpg\"","origin":"Binary File","mitre_attack_id":"T1105","id":"binary-56","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"gamesetup.exe\" was detected as \"Microsoft visual C++ 5.0\"\n \"panda.exe\" was detected as \"VC8 -> Microsoft Corporation\"\n \"krnln.fnr\" was detected as \"Armadillo v1.xx - v2.xx\"\n \"iext2.fne\" was detected as \"Armadillo v1.xx - v2.xx\"\n \"eGrid.fne\" was detected as \"Armadillo v1.xx - v2.xx\"\n \"eAPI.fne\" was detected as \"Armadillo v1.xx - v2.xx\"\n \"iext.fnr\" was detected as \"Armadillo v1.xx - v2.xx\"\n \"mp3.run\" was detected as \"Armadillo v1.xx - v2.xx\"\n \"spec.fne\" was detected as \"Armadillo v1.xx - v2.xx\"\n \"EThread.fne\" was detected as \"Armadillo v1.xx - v2.xx\"\n \"shell.fne\" was detected as \"Armadillo v1.xx - v2.xx\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"gamesetup.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"gamesetup.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"Queries kernel debugger information","description":"\".exe\" at 00000000-00000668-00000C15-1277391774","origin":"API Call","mitre_attack_id":"T1622","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"Tries to save executable or command in registry","description":"\"gamesetup.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\"; Key: \"GAMESETUP.EXE\"; Value: \"C:\\gamesetup.exe\")","origin":"Registry Access","mitre_attack_id":"T1547","relevance":7,"id":"registry-113","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"Uses a Windows Living Off The Land Binaries (LOL bins)","description":"$58","origin":"Monitored Target","relevance":3,"id":"target-411","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Section contains high entropy","description":"\"???????.exe\" has section name with entropy \"7.999975631620978\"\n \"???????.exe\" has section name with entropy \"7.94727395137763\"\n \"???????.exe\" has section name .boot with entropy \"7.955834902442826\"","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"suspicious","category":"Cryptographic Related","name":"Drops image files with high entropy (likely encrypted/compressed content)","description":"Dropped file \"%WINDIR%\\Temp\\panda.jpg\" has high entropy 7.42459","origin":"Binary File","mitre_attack_id":"T1001.002","relevance":5,"id":"binary-61","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"15/26 Antivirus vendors marked sample as malicious (57% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"suspicious","category":"General","name":"Contains ability to find and load resources of a specific module","description":"FindResourceA@KERNEL32.DLL at 00000000-00007100-65109-423-00447D40\n FindResourceA@KERNEL32.DLL at 00000000-00007100-65109-642-0045D28B\n FindResourceA@KERNEL32.DLL at 00000000-00007100-65109-930-0045A8AA","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1005","relevance":1,"id":"stream-32","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"suspicious","category":"General","name":"Reads configuration files (.ini files)","description":"\".exe\" reads file \"C:\\Users\\%OSUSER%\\Desktop\\desktop.ini\"\n \".exe\" reads file \"C:\\Users\\%OSUSER%\\Documents\\desktop.ini\"\n \".exe\" reads file \"C:\\Users\\%OSUSER%\\Music\\desktop.ini\"\n \".exe\" reads file \"C:\\Users\\%OSUSER%\\Pictures\\desktop.ini\"\n \".exe\" reads file \"C:\\Users\\%OSUSER%\\Videos\\desktop.ini\"\n \".exe\" reads file \"C:\\Users\\%OSUSER%\\Downloads\\desktop.ini\"\n \".exe\" reads file \"C:\\Users\\%OSUSER%\\OneDrive\\desktop.ini\"","origin":"API Call","mitre_attack_id":"T1083","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"$59","origin":"Binary File","mitre_attack_id":"T1105","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Modifies auto-execute functionality by setting/creating a value in the registry","description":"\"gamesetup.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\"; Key: \"GAMESETUP.EXE\"; Value: \"C:\\gamesetup.exe\")","origin":"Registry Access","mitre_attack_id":"T1547.001","relevance":8,"id":"registry-0","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes a PE file header to disc","description":"$5a","origin":"API Call","mitre_attack_id":"T1105","relevance":10,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"suspicious","category":"Network Related","name":"Contains ability to open a port and listen for incoming connection","description":"ioctlsocket@WS2_32.DLL at 00000000-00007100-65109-1261-00423BA0\n closesocket@WS2_32.DLL at 00000000-00007100-65109-1262-00423840\n ioctlsocket@WS2_32.DLL at 00000000-00007100-65109-1264-00423940\n ioctlsocket@WS2_32.DLL at 00000000-00007100-65109-2328-0042386E","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1571","relevance":5,"id":"stream-85","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match – Anomalous PE file structure","description":"YARA signature for null IAT Directory of PE file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1027.013","relevance":1,"id":"yara-153","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"suspicious","category":"Pattern Matching","name":"Yara Signature Match - Indicators","description":"YARA signature \"INDICATOR_EXE_Packed_Themida\" matched file \"sample.bin\" as \"Detects executables packed with Themida\"","origin":"YARA Signature","relevance":9,"id":"yara-553","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Contains ability to update the user profile","description":"SystemParametersInfoA@USER32.DLL at 00000000-00007100-65109-648-00448F31\n SystemParametersInfoA@USER32.DLL at 00000000-00007100-65109-743-0043A5E0","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1098","relevance":5,"id":"stream-123","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"cmd.exe\" opened \"C:\\ddel.bat\" with delete access\n \"cmd.exe\" opened \"C:\\del.bat\" with delete access","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\".exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\"; Value: \"0100000000\")","origin":"Registry Access","mitre_attack_id":"T1090.001","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"gamesetup.exe\" claimed CRC 12727883 while the actual is CRC 632719\n \"krnln.fnr\" claimed CRC 415288 while the actual is CRC 1350790","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Contains native function calls","description":"NtdllDefWindowProc_A@NTDLL.DLL at 00000000-00007100-65109-1803-0045BA68\n NtdllDefWindowProc_A@NTDLL.DLL at 00000000-00007100-65109-2006-0045B27C","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":5,"id":"stream-22","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Entrypoint in PE header is within an uncommon section","description":"\"???????.exe\" has an entrypoint in section \".boot\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-4","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"$5b","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Timestamp in PE header is very old or in the future","description":"\"???????.exe\" claims program is from Mon Dec 25 05:33:23 1972","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-3","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Attempts to stop multiple expected running processes on the machine","description":"$5c","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-604","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Creates a process in suspended mode (likely for process injection)","description":"\".exe\" called \"CreateProcessW\" with parameter \"\"C:\\gamesetup.exe\"\" - (UID: 00000000-00000668)","origin":"API Call","mitre_attack_id":"T1055","relevance":10,"id":"api-129","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Detected Rundll32 process execution","description":"Process \"rundll32.exe\" with commandline \"shell32.dll,SHCreateLocalServerRunDll {9BA05972-F6A8-11CF-A442-00A0C90A8F39} -Embedding\" (UID: 00000000-00000732)\n Process \"rundll32.exe\" with commandline \"%WINDIR%\\\\System32\\\\shell32.dll,SHCreateLocalServerRunDll {3eef301f-b596-4c0b-bd92-013beafce793} -Embedding\" (UID: 00000000-00002304)","origin":"Monitored Target","mitre_attack_id":"T1218.011","relevance":10,"id":"target-115","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Queries firmware table information (may be used to fingerprint/evade)","description":"\".exe\" at 00000000-00000668-00000C15-1271945972\n \".exe\" at 00000000-00000668-00000C15-1271949800","origin":"API Call","mitre_attack_id":"T1120","relevance":10,"id":"api-65","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Terminates other processes using tskill/taskkill","description":"$5d","origin":"Monitored Target","mitre_attack_id":"T1489","relevance":9,"id":"target-9","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"malicious","category":"Environment Awareness","name":"Reads the system/video BIOS version","description":"\".exe\" (Path: \"HKLM\\HARDWARE\\DESCRIPTION\\SYSTEM\"; Key: \"SYSTEMBIOSVERSION\")\n \".exe\" (Path: \"HKLM\\HARDWARE\\DESCRIPTION\\SYSTEM\"; Key: \"VIDEOBIOSVERSION\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":9,"id":"registry-6","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (D)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"15/26 Antivirus vendors marked sample as malicious (57% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted antivirus engine","description":"Trusted antivirus vendors count marked sample as malicious (count = 2)","origin":"External System","mitre_attack_id":"T1204.002","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"malicious","category":"General","name":"The analysis extracted a file that was identified as malicious","description":"22/26 Antivirus vendors marked dropped file \"gamesetup.exe\" as malicious (classified as \"Trojan.Agent\" with 84% detection rate)","origin":"Binary File","mitre_attack_id":"T1204.002","relevance":10,"id":"binary-11","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"malicious","category":"General","name":"The analysis spawned a process that was identified as malicious","description":"22/26 Antivirus vendors marked spawned process \"gamesetup.exe\" (PID: 7100) as malicious (classified as \"Trojan.Agent\" with 84% detection rate)","origin":"Monitored Target","mitre_attack_id":"T1204.002","relevance":10,"id":"target-58","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"malicious","category":"Installation/Persistence","name":"Sets a computer-based training (CBT) hook","description":"\"gamesetup.exe\" sets a callback procedure (45b4a8) using filter \"WH_CBT\" for process ID: 1bbc","origin":"API Call","mitre_attack_id":"T1056.004","relevance":10,"id":"api-74","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"$5e","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"}]},{"level":"malicious","category":"System Security","name":"Terminates system processes","description":"$5f","origin":"Monitored Target","mitre_attack_id":"T1489","relevance":10,"id":"target-39","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"malicious","category":"System Security","name":"Uses tskill/taskkill excessively (often used to disable security tools)","description":"Process \"taskkill.exe\" spawned very often","origin":"Monitored Target","mitre_attack_id":"T1562.001","relevance":7,"id":"target-64","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns many processes","description":"$60","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to compress/decompress content at runtime","description":"$61","origin":"File/Memory","mitre_attack_id":"T1560.002","relevance":1,"id":"string-935","sources":[{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to unmap view of a section from a process (API string)","description":"Found reference to API \"ZwUnmapViewOfSection\" (Indicator: \"UnmapViewOfSection\"; Source: \"00000000-00002500.00000002.230799.01EF0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.012","relevance":1,"id":"string-90","sources":[{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found virtual disk drive like strings","description":"Found string - \\\\.\\Smartvsd; Source: \"00000000-00002500.00000001.228876.01EE8000.00000004.mdmp\")\n Found string - \\\\.\\PhysicalDrive%d; Source: \"00000000-00002500.00000001.228876.01EE8000.00000004.mdmp\")\n Found string - \\\\.\\Scsi%d:; Source: \"00000000-00002500.00000001.228876.01EE8000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-145","sources":[{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Tries to map intranet network resources to internet zone","description":"\".exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"UNCASINTRANET\"; Value: \"0000000000\")","origin":"Registry Access","mitre_attack_id":"T1562.001","relevance":1,"id":"registry-179","sources":[{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to crypto DLLs","description":"Found string \":\\Windows\\system32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00002500.00000000.226954.01D30000.00000004.mdmp, 00000000-00002500.00000001.228876.01D30000.00000004.mdmp, 00000000-00002500.00000002.230799.01D30000.00000004.mdmp\")\n Found string \":\\Windows\\system32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00002564.00000000.227965.00720000.00000004.mdmp, 00000000-00002564.00000001.228482.00720000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-493","sources":[{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"Environment Awareness","name":"Able to detect virtual machine (string)","description":"Found string \"\\SystemRoot\\system32\\DRIVERS\\vmci.sys\" (Source: \"00000000-00002500.00000000.226954.00280000.00000004.mdmp\")\n Found string \"\\SystemRoot\\system32\\drivers\\vmstorfl.sys\" (Source: \"00000000-00002500.00000000.226954.00280000.00000004.mdmp\")\n Found string \"\\SystemRoot\\system32\\DRIVERS\\vmmouse.sys\" (Source: \"00000000-00002500.00000000.226954.00280000.00000004.mdmp\")\n Found string \"\\SystemRoot\\system32\\DRIVERS\\vm3dmp_loader.sys\" (Source: \"00000000-00002500.00000000.226954.00280000.00000004.mdmp\")\n Found string \"\\SystemRoot\\system32\\DRIVERS\\vm3dmp.sys\" (Source: \"00000000-00002500.00000000.226954.00280000.00000004.mdmp\")\n Found string \"\\SystemRoot\\system32\\DRIVERS\\vmusbmouse.sys\" (Source: \"00000000-00002500.00000000.226954.00280000.00000004.mdmp\")\n Found string \"\\SystemRoot\\system32\\DRIVERS\\vmmemctl.sys\" (Source: \"00000000-00002500.00000000.226954.00280000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497","relevance":1,"id":"string-989","sources":[{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system information (.NET)","description":"Found string \"GetUserNameA\" (Source: \"00000000-00002500.00000001.228876.01EE0000.00000002.mdmp\")\n Found string \"Failed in call to GetOSVersion\" (Source: \"00000000-00002500.00000001.228876.01EE8000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-937","sources":[{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify sandbox environment running process","description":"Found string \"VGAuthService.exe\" (Indicator: \"VGAuthService.exe\"; Source: \"00000000-00002500.00000000.226954.00280000.00000004.mdmp\")\n Found string \"vmtoolsd.exe\" (Indicator: \"vmtoolsd.exe\"; Source: \"00000000-00002500.00000000.226954.00280000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497","relevance":1,"id":"string-666","sources":[{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment using user register activity","description":"Found string \"Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\RecentDocs\" (Indicator: \"software\\microsoft\\windows\\currentversion\\explorer\\recentdocs\"; Source: \"00000000-00002500.00000002.230799.01EF0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-663","sources":[{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual/sandbox environment","description":"Found string \"\\SystemRoot\\system32\\DRIVERS\\vmci.sys\" (Indicator: \"\\vmci\"; Source: \"00000000-00002500.00000000.226954.00280000.00000004.mdmp\")\n Found string \"\\SystemRoot\\system32\\DRIVERS\\vmmouse.sys\" (Indicator: \"vmmouse\"; Source: \"00000000-00002500.00000000.226954.00280000.00000004.mdmp\")\n Found string \"\\SystemRoot\\system32\\DRIVERS\\vmusbmouse.sys\" (Indicator: \"vmusb\"; Source: \"00000000-00002500.00000000.226954.00280000.00000004.mdmp\")\n Found string \"\\SystemRoot\\system32\\DRIVERS\\vmmemctl.sys\" (Indicator: \"vmmemctl\"; Source: \"00000000-00002500.00000000.226954.00280000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-660","sources":[{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual/sandbox environment devices","description":"Found string \"\\SystemRoot\\system32\\DRIVERS\\vmci.sys\" (Indicator: \"\\vmci\"; Source: \"00000000-00002500.00000000.226954.00280000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497","relevance":1,"id":"string-667","sources":[{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to enumerate active windows","description":"\"taskkill.exe\" called \"EnumWindows\" with parameter \"2488212\" - (UID: 00000000-00002924)\n \"taskkill.exe\" called \"EnumWindows\" with parameter \"654668\" - (UID: 00000000-00002924)\n \"taskkill.exe\" called \"EnumWindows\" with parameter \"1570940\" - (UID: 00000000-00001252)\n \"taskkill.exe\" called \"EnumWindows\" with parameter \"1767036\" - (UID: 00000000-00001768)\n \"taskkill.exe\" called \"EnumWindows\" with parameter \"2226300\" - (UID: 00000000-00000972)\n \"taskkill.exe\" called \"EnumWindows\" with parameter \"2293036\" - (UID: 00000000-00001948)\n \"taskkill.exe\" called \"EnumWindows\" with parameter \"1243820\" - (UID: 00000000-00003316)\n \"taskkill.exe\" called \"EnumWindows\" with parameter \"3340780\" - (UID: 00000000-00004244)\n \"taskkill.exe\" called \"EnumWindows\" with parameter \"2225972\" - (UID: 00000000-00003408)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-152","sources":[{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to open an existing named mutex object","description":"\".exe\" called \"OpenMutexW\" with parameter \"Local\\MSCTF.Asm.MutexDefault1\" - (UID: 00000000-00002500)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-144","sources":[{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve account information for specified SID","description":"\"taskkill.exe\" called \"LookupAccountSidW\" with param Name nB49eFI (UID: 00000000-00002924)\n \"taskkill.exe\" called \"LookupAccountSidW\" with param Name nB49eFI (UID: 00000000-00001252)\n \"taskkill.exe\" called \"LookupAccountSidW\" with param Name nB49eFI (UID: 00000000-00001768)\n \"taskkill.exe\" called \"LookupAccountSidW\" with param Name nB49eFI (UID: 00000000-00000972)\n \"taskkill.exe\" called \"LookupAccountSidW\" with param Name nB49eFI (UID: 00000000-00001948)\n \"taskkill.exe\" called \"LookupAccountSidW\" with param Name nB49eFI (UID: 00000000-00003316)\n \"taskkill.exe\" called \"LookupAccountSidW\" with param Name nB49eFI (UID: 00000000-00004244)\n \"taskkill.exe\" called \"LookupAccountSidW\" with param Name nB49eFI (UID: 00000000-00003408)\n \"explorer.exe\" called \"LookupAccountSidW\" with param Name nB49eFI (UID: 00000000-00003700)","origin":"API Call","mitre_attack_id":"T1033","relevance":3,"id":"api-148","sources":[{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\".exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00002500)\n \"gamesetup.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00002564)\n \"cmd.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00004552)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the current user information","description":"Observed string: \"whoami\" (Indicator: \"whoami\") in Source: 00000000-00002500.00000002.230799.01D30000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-432","sources":[{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"General","name":"Contains reference to Windows Startup folder","description":"\":\\Users\\HAPUBWS\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\" (Indicator: \":\\users\\hapubws\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\") in Source: 00000000-00002500.00000002.230799.01D30000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1547.001","relevance":1,"id":"string-265","sources":[{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"General","name":"Creates multiple processes","description":"\"taskkill.exe\" created multiple process","origin":"Monitored Target","mitre_attack_id":"T1106","relevance":1,"id":"target-719","sources":[{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"General","name":"Found E-Mail address in binary/memory","description":"Pattern match: \"service@dywt.com.cn\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"General","name":"Loads Windows LDAP client module","description":"\".exe\" loaded module \"%WINDIR%\\SysWOW64\\Wldap32.dll\" at 76300000","origin":"Loaded Module","mitre_attack_id":"T1069.002","relevance":3,"id":"module-17","sources":[{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"General","name":"References Windows LDAP client module","description":"Found string \"\\Windows\\System32\\Wldap32.dll\" (Source: \"00000000-00002500.00000000.226954.00280000.00000004.mdmp\")\n Found string \":\\Windows\\syswow64\\WLDAP32.dll\" (Source: \"00000000-00002500.00000001.228876.01D30000.00000004.mdmp, 00000000-00002500.00000002.230799.01D30000.00000004.mdmp\")\n Found string \"wldap32.dll\" (Source: \"00000000-00002500.00000002.230799.01D30000.00000004.mdmp, 00000000-00002500.00000002.230799.04090000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1069.002","relevance":1,"id":"string-987","sources":[{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"Installation/Persistence","name":"Connects to LPC ports","description":"\".exe\" connecting to \"\\ThemeApiPort\"\n \"gamesetup.exe\" connecting to \"\\ThemeApiPort\"\n \"explorer.exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","mitre_attack_id":"T1559","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to register an interface (RPC)","description":"\"taskkill.exe\" called \"RpcServerRegisterIf2\" (UID: 00000000-00002924)\n \"taskkill.exe\" called \"RpcServerRegisterIf2\" (UID: 00000000-00001252)\n \"taskkill.exe\" called \"RpcServerRegisterIf2\" (UID: 00000000-00001768)\n \"taskkill.exe\" called \"RpcServerRegisterIf2\" (UID: 00000000-00000972)\n \"taskkill.exe\" called \"RpcServerRegisterIf2\" (UID: 00000000-00001948)\n \"taskkill.exe\" called \"RpcServerRegisterIf2\" (UID: 00000000-00003316)\n \"taskkill.exe\" called \"RpcServerRegisterIf2\" (UID: 00000000-00004244)\n \"taskkill.exe\" called \"RpcServerRegisterIf2\" (UID: 00000000-00003408)\n \"explorer.exe\" called \"RpcServerRegisterIf2\" (UID: 00000000-00003700)","origin":"API Call","mitre_attack_id":"T1021","relevance":3,"id":"api-219","sources":[{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"Network Related","name":"Found mail related domain names","description":"Observed email domain:\"idimap.dll\" [Source: 00000000-00002500.00000001.228876.01D30000.00000004.mdmp\n 00000000-00002500.00000002.230799.01D30000.00000004.mdmp]\n Observed email domain:\"dpmodemx.dll\" [Source: 00000000-00002500.00000002.230799.01D30000.00000004.mdmp]","origin":"File/Memory","mitre_attack_id":"T1071.003","relevance":1,"id":"string-169","sources":[{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$62","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Attempts to read volume data via DOS device path","description":"\".exe\" tries to directly access volume data \"C:\"\n \".exe\" tries to directly access volume data \"Z:\"","origin":"API Call","mitre_attack_id":"T1006","relevance":1,"id":"api-306","sources":[{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Attempts to steal credentials via Security Account Manager (SAM) modules","description":"\"gamesetup.exe\" loaded module \"%WINDIR%\\SysWOW64\\samcli.dll\" at 73990000","origin":"Loaded Module","mitre_attack_id":"T1589.001","relevance":3,"id":"module-19","sources":[{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$63","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\".exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"090000000010000000000100fffffeff0300000008000000d8210000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate running processes using Tasklist","description":"Observed string: \"tasklist.exe\" [Source: 00000000-00002500.00000002.230799.01D30000.00000004.mdmp]","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-517","sources":[{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found system command-related strings","description":"Found string \"whoami\" (Indicator: \"whoami\"; Source: \"00000000-00002500.00000002.230799.01D30000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":7,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"System Destruction","name":"Marks file for deletion","description":"\"cmd.exe\" marked \"C:\\ddel.bat\" for deletion\n \"cmd.exe\" marked \"C:\\del.bat\" for deletion","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"System Security","name":"Adjusts debug privileges","description":"\"taskkill.exe\" adjusted SE_DEBUG_PRIVILEGE on file \"C:\\Windows\\Globalization\\Sorting\\SortDefault.nls\"","origin":"API Call","mitre_attack_id":"T1134","relevance":3,"id":"api-28","sources":[{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"System Security","name":"Calls an API typically used to enable or disable privileges in the specified access token","description":"$64","origin":"API Call","mitre_attack_id":"T1134","relevance":3,"id":"api-111","sources":[{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to multiple windows system processes","description":"Found strings \"smss.exe,wininit.exe,winlogon.exe,services.exe,lsass.exe\" (Source: \"00000000-00002500.00000000.226954.00280000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":3,"id":"string-455","sources":[{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"informative","category":"Unusual Characteristics","name":"Possibly uses a Windows Server utility","description":"\"register-cimprovider.exe\" (Indicator: \"register-cimprovider.exe\")","origin":"File/Memory","relevance":10,"id":"string-65","sources":[{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains references to WMI/WMIC","description":"Found string \"WmiPrvSE.exe\" (Indicator: \"wmiprvse.exe\"; in Source: \"00000000-00002500.00000000.226954.00280000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":3,"id":"string-30","sources":[{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]}],"incidents":[{"name":"Spyware","details_count":4,"details":[{"detail":"Sets a computer-based training (CBT) hook"},{"detail":"Contains ability to open the clipboard"},{"detail":"Contains ability to open the clipboard"},{"detail":"Contains ability to retrieve keyboard strokes"}],"sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"name":"Persistence","details_count":4,"details":[{"detail":"Writes data to a remote process"},{"detail":"Creates new processes"},{"detail":"Modifies auto-execute functionality by setting/creating a value in the registry"},{"detail":"Spawns many processes"}],"sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"name":"Fingerprint","details_count":5,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Queries firmware table information (may be used to fingerprint/evade)"},{"detail":"Queries sensitive IE security settings"},{"detail":"Queries the display settings of system associated file extensions"},{"detail":"Reads the system/video BIOS version"}],"sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"name":"Evasive","details_count":4,"details":[{"detail":"May check for the presence of a forensics/monitoring tool"},{"detail":"Sets the 'ThreadHideFromDebugger' thread data structure"},{"detail":"PE file has a section name known to be used by a packer/protector"},{"detail":"Contains ability to terminate a process"}],"sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]}],"intel_graph":{"map":{"File:05cc7a32e5a0023f9e1c790f97b069ccd27ada59ea8b9864f7f9069e3049663c":{"type":"File","value":"05cc7a32e5a0023f9e1c790f97b069ccd27ada59ea8b9864f7f9069e3049663c","verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Detected suspicious dynamic behaviour","Terminates processes using taskkill.exe"]},"filetype":"PE32 executable (GUI) Intel 80386, for MS Windows, PECompact2 compressed, 6 sections","filetype_short":"PE32","mime_type":"application/x-dosexec"},"File:0a12fcbe6832aad4143dd2ad87a60e9ff4f04fa440831f910557f820ba21fe18":{"type":"File","value":"0a12fcbe6832aad4143dd2ad87a60e9ff4f04fa440831f910557f820ba21fe18"},"File:0c9e6eb8648f4bf5c585d5344035e91c3249bb9686a302503b4681b7ba828dc0":{"type":"File","value":"0c9e6eb8648f4bf5c585d5344035e91c3249bb9686a302503b4681b7ba828dc0"},"File:24cb9ed8557d10a5d957220d754e256cf0614751133df79097d8d719c2f4b690":{"type":"File","value":"24cb9ed8557d10a5d957220d754e256cf0614751133df79097d8d719c2f4b690"},"File:26df17a5650af86da2685ed6c10592fcb200ccb6974f27320ac1a9b407411549":{"type":"File","value":"26df17a5650af86da2685ed6c10592fcb200ccb6974f27320ac1a9b407411549"},"File:2abc6f2830a8dd96845ae79458f9d53791c4c1c87808c6f79ce9e41a03c728c5":{"type":"File","value":"2abc6f2830a8dd96845ae79458f9d53791c4c1c87808c6f79ce9e41a03c728c5"},"File:501f3e1a9afca6a096396a31c1259cfb0720acd29cbaa8d5938791b5eb25d835":{"type":"File","value":"501f3e1a9afca6a096396a31c1259cfb0720acd29cbaa8d5938791b5eb25d835"},"File:53483523c316ad8c022c2b07a5cabfff3339bc5cb5e4ac24c3260eea4f4d9731":{"type":"File","value":"53483523c316ad8c022c2b07a5cabfff3339bc5cb5e4ac24c3260eea4f4d9731"},"File:58e5d6246a0555c2afeeac51ae12ecda459f377e87b92cb4d7a0ddc055abbbca":{"type":"File","value":"58e5d6246a0555c2afeeac51ae12ecda459f377e87b92cb4d7a0ddc055abbbca"},"File:64eef86745d7ae0168fec357099e2e952ce74ee19576d06cc8c8c65f210cc22c":{"type":"File","value":"64eef86745d7ae0168fec357099e2e952ce74ee19576d06cc8c8c65f210cc22c"},"File:8526cf9a3c62261ffbad14bc4a23da5c475d9a5ce0c65074b3aa22551aa2655f":{"type":"File","value":"8526cf9a3c62261ffbad14bc4a23da5c475d9a5ce0c65074b3aa22551aa2655f"},"File:8a18b6ea6d7482139f8c7ea052ab1eb0d9bd939a9b621f1993c585301fed3136":{"type":"File","value":"8a18b6ea6d7482139f8c7ea052ab1eb0d9bd939a9b621f1993c585301fed3136"},"File:8c8254cb49f7287b97c7f952c81edabc9f11f3fa3f02f265e67d5741998cf0bf":{"type":"File","value":"8c8254cb49f7287b97c7f952c81edabc9f11f3fa3f02f265e67d5741998cf0bf"},"File:90284c2ead0598faa715cc90c1f53b83b916099c918ce7f816f0b4550ff55ac6":{"type":"File","value":"90284c2ead0598faa715cc90c1f53b83b916099c918ce7f816f0b4550ff55ac6"},"File:a8b14f31098a191631696db5ddc77e029b48999542e0ec15b63df02220c66d37":{"type":"File","value":"a8b14f31098a191631696db5ddc77e029b48999542e0ec15b63df02220c66d37"},"File:ad5aff9076e482036a1b0260ca52fac54af28591eb96d551d7b6ac13d18a6dcf":{"type":"File","value":"ad5aff9076e482036a1b0260ca52fac54af28591eb96d551d7b6ac13d18a6dcf"},"File:ce5e23d5faeb76de8fbf9c2f5074292627ce6347e46a77bd828097b39fec04de":{"type":"File","value":"ce5e23d5faeb76de8fbf9c2f5074292627ce6347e46a77bd828097b39fec04de"},"File:d1d5f7cdc1ec41bba0ae3391d58409c8d710e5526559168cac5f0fdc510d245b":{"type":"File","value":"d1d5f7cdc1ec41bba0ae3391d58409c8d710e5526559168cac5f0fdc510d245b"},"File:e16c00a72d5d686ca3ccc40ff38bfca59bae1e6d05457c73409f1a0367535f71":{"type":"File","value":"e16c00a72d5d686ca3ccc40ff38bfca59bae1e6d05457c73409f1a0367535f71"}},"chains":[{"id":"1553301654386233657","root":"File:05cc7a32e5a0023f9e1c790f97b069ccd27ada59ea8b9864f7f9069e3049663c","edges":[],"verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Detected suspicious dynamic behaviour","Terminates processes using taskkill.exe"]}},{"id":"sandbox_files","root":"File:05cc7a32e5a0023f9e1c790f97b069ccd27ada59ea8b9864f7f9069e3049663c","edges":[{"edge_kind":"extracted","from_key":"File:05cc7a32e5a0023f9e1c790f97b069ccd27ada59ea8b9864f7f9069e3049663c","to_key":"File:26df17a5650af86da2685ed6c10592fcb200ccb6974f27320ac1a9b407411549"},{"edge_kind":"extracted","from_key":"File:05cc7a32e5a0023f9e1c790f97b069ccd27ada59ea8b9864f7f9069e3049663c","to_key":"File:0a12fcbe6832aad4143dd2ad87a60e9ff4f04fa440831f910557f820ba21fe18"},{"edge_kind":"extracted","from_key":"File:05cc7a32e5a0023f9e1c790f97b069ccd27ada59ea8b9864f7f9069e3049663c","to_key":"File:d1d5f7cdc1ec41bba0ae3391d58409c8d710e5526559168cac5f0fdc510d245b"},{"edge_kind":"extracted","from_key":"File:05cc7a32e5a0023f9e1c790f97b069ccd27ada59ea8b9864f7f9069e3049663c","to_key":"File:a8b14f31098a191631696db5ddc77e029b48999542e0ec15b63df02220c66d37"},{"edge_kind":"extracted","from_key":"File:05cc7a32e5a0023f9e1c790f97b069ccd27ada59ea8b9864f7f9069e3049663c","to_key":"File:8a18b6ea6d7482139f8c7ea052ab1eb0d9bd939a9b621f1993c585301fed3136"},{"edge_kind":"extracted","from_key":"File:05cc7a32e5a0023f9e1c790f97b069ccd27ada59ea8b9864f7f9069e3049663c","to_key":"File:24cb9ed8557d10a5d957220d754e256cf0614751133df79097d8d719c2f4b690"},{"edge_kind":"extracted","from_key":"File:05cc7a32e5a0023f9e1c790f97b069ccd27ada59ea8b9864f7f9069e3049663c","to_key":"File:0c9e6eb8648f4bf5c585d5344035e91c3249bb9686a302503b4681b7ba828dc0"},{"edge_kind":"extracted","from_key":"File:05cc7a32e5a0023f9e1c790f97b069ccd27ada59ea8b9864f7f9069e3049663c","to_key":"File:ad5aff9076e482036a1b0260ca52fac54af28591eb96d551d7b6ac13d18a6dcf"},{"edge_kind":"extracted","from_key":"File:05cc7a32e5a0023f9e1c790f97b069ccd27ada59ea8b9864f7f9069e3049663c","to_key":"File:53483523c316ad8c022c2b07a5cabfff3339bc5cb5e4ac24c3260eea4f4d9731"},{"edge_kind":"extracted","from_key":"File:05cc7a32e5a0023f9e1c790f97b069ccd27ada59ea8b9864f7f9069e3049663c","to_key":"File:8526cf9a3c62261ffbad14bc4a23da5c475d9a5ce0c65074b3aa22551aa2655f"},{"edge_kind":"extracted","from_key":"File:05cc7a32e5a0023f9e1c790f97b069ccd27ada59ea8b9864f7f9069e3049663c","to_key":"File:8c8254cb49f7287b97c7f952c81edabc9f11f3fa3f02f265e67d5741998cf0bf"},{"edge_kind":"extracted","from_key":"File:05cc7a32e5a0023f9e1c790f97b069ccd27ada59ea8b9864f7f9069e3049663c","to_key":"File:90284c2ead0598faa715cc90c1f53b83b916099c918ce7f816f0b4550ff55ac6"},{"edge_kind":"extracted","from_key":"File:05cc7a32e5a0023f9e1c790f97b069ccd27ada59ea8b9864f7f9069e3049663c","to_key":"File:501f3e1a9afca6a096396a31c1259cfb0720acd29cbaa8d5938791b5eb25d835"},{"edge_kind":"extracted","from_key":"File:05cc7a32e5a0023f9e1c790f97b069ccd27ada59ea8b9864f7f9069e3049663c","to_key":"File:e16c00a72d5d686ca3ccc40ff38bfca59bae1e6d05457c73409f1a0367535f71"},{"edge_kind":"extracted","from_key":"File:05cc7a32e5a0023f9e1c790f97b069ccd27ada59ea8b9864f7f9069e3049663c","to_key":"File:2abc6f2830a8dd96845ae79458f9d53791c4c1c87808c6f79ce9e41a03c728c5"},{"edge_kind":"extracted","from_key":"File:05cc7a32e5a0023f9e1c790f97b069ccd27ada59ea8b9864f7f9069e3049663c","to_key":"File:64eef86745d7ae0168fec357099e2e952ce74ee19576d06cc8c8c65f210cc22c"},{"edge_kind":"extracted","from_key":"File:05cc7a32e5a0023f9e1c790f97b069ccd27ada59ea8b9864f7f9069e3049663c","to_key":"File:58e5d6246a0555c2afeeac51ae12ecda459f377e87b92cb4d7a0ddc055abbbca"},{"edge_kind":"extracted","from_key":"File:05cc7a32e5a0023f9e1c790f97b069ccd27ada59ea8b9864f7f9069e3049663c","to_key":"File:ce5e23d5faeb76de8fbf9c2f5074292627ce6347e46a77bd828097b39fec04de"},{"edge_kind":"extracted","from_key":"File:05cc7a32e5a0023f9e1c790f97b069ccd27ada59ea8b9864f7f9069e3049663c","to_key":"File:ce5e23d5faeb76de8fbf9c2f5074292627ce6347e46a77bd828097b39fec04de"},{"edge_kind":"extracted","from_key":"File:05cc7a32e5a0023f9e1c790f97b069ccd27ada59ea8b9864f7f9069e3049663c","to_key":"File:ce5e23d5faeb76de8fbf9c2f5074292627ce6347e46a77bd828097b39fec04de"},{"edge_kind":"extracted","from_key":"File:05cc7a32e5a0023f9e1c790f97b069ccd27ada59ea8b9864f7f9069e3049663c","to_key":"File:ce5e23d5faeb76de8fbf9c2f5074292627ce6347e46a77bd828097b39fec04de"},{"edge_kind":"extracted","from_key":"File:05cc7a32e5a0023f9e1c790f97b069ccd27ada59ea8b9864f7f9069e3049663c","to_key":"File:ce5e23d5faeb76de8fbf9c2f5074292627ce6347e46a77bd828097b39fec04de"},{"edge_kind":"extracted","from_key":"File:05cc7a32e5a0023f9e1c790f97b069ccd27ada59ea8b9864f7f9069e3049663c","to_key":"File:ce5e23d5faeb76de8fbf9c2f5074292627ce6347e46a77bd828097b39fec04de"},{"edge_kind":"extracted","from_key":"File:05cc7a32e5a0023f9e1c790f97b069ccd27ada59ea8b9864f7f9069e3049663c","to_key":"File:ce5e23d5faeb76de8fbf9c2f5074292627ce6347e46a77bd828097b39fec04de"},{"edge_kind":"extracted","from_key":"File:05cc7a32e5a0023f9e1c790f97b069ccd27ada59ea8b9864f7f9069e3049663c","to_key":"File:ce5e23d5faeb76de8fbf9c2f5074292627ce6347e46a77bd828097b39fec04de"},{"edge_kind":"extracted","from_key":"File:05cc7a32e5a0023f9e1c790f97b069ccd27ada59ea8b9864f7f9069e3049663c","to_key":"File:ce5e23d5faeb76de8fbf9c2f5074292627ce6347e46a77bd828097b39fec04de"},{"edge_kind":"extracted","from_key":"File:05cc7a32e5a0023f9e1c790f97b069ccd27ada59ea8b9864f7f9069e3049663c","to_key":"File:ce5e23d5faeb76de8fbf9c2f5074292627ce6347e46a77bd828097b39fec04de"},{"edge_kind":"extracted","from_key":"File:05cc7a32e5a0023f9e1c790f97b069ccd27ada59ea8b9864f7f9069e3049663c","to_key":"File:ce5e23d5faeb76de8fbf9c2f5074292627ce6347e46a77bd828097b39fec04de"},{"edge_kind":"extracted","from_key":"File:05cc7a32e5a0023f9e1c790f97b069ccd27ada59ea8b9864f7f9069e3049663c","to_key":"File:ce5e23d5faeb76de8fbf9c2f5074292627ce6347e46a77bd828097b39fec04de"},{"edge_kind":"extracted","from_key":"File:05cc7a32e5a0023f9e1c790f97b069ccd27ada59ea8b9864f7f9069e3049663c","to_key":"File:ce5e23d5faeb76de8fbf9c2f5074292627ce6347e46a77bd828097b39fec04de"},{"edge_kind":"extracted","from_key":"File:05cc7a32e5a0023f9e1c790f97b069ccd27ada59ea8b9864f7f9069e3049663c","to_key":"File:ce5e23d5faeb76de8fbf9c2f5074292627ce6347e46a77bd828097b39fec04de"},{"edge_kind":"extracted","from_key":"File:05cc7a32e5a0023f9e1c790f97b069ccd27ada59ea8b9864f7f9069e3049663c","to_key":"File:ce5e23d5faeb76de8fbf9c2f5074292627ce6347e46a77bd828097b39fec04de"},{"edge_kind":"extracted","from_key":"File:05cc7a32e5a0023f9e1c790f97b069ccd27ada59ea8b9864f7f9069e3049663c","to_key":"File:ce5e23d5faeb76de8fbf9c2f5074292627ce6347e46a77bd828097b39fec04de"},{"edge_kind":"extracted","from_key":"File:05cc7a32e5a0023f9e1c790f97b069ccd27ada59ea8b9864f7f9069e3049663c","to_key":"File:ce5e23d5faeb76de8fbf9c2f5074292627ce6347e46a77bd828097b39fec04de"},{"edge_kind":"extracted","from_key":"File:05cc7a32e5a0023f9e1c790f97b069ccd27ada59ea8b9864f7f9069e3049663c","to_key":"File:ce5e23d5faeb76de8fbf9c2f5074292627ce6347e46a77bd828097b39fec04de"},{"edge_kind":"extracted","from_key":"File:05cc7a32e5a0023f9e1c790f97b069ccd27ada59ea8b9864f7f9069e3049663c","to_key":"File:ce5e23d5faeb76de8fbf9c2f5074292627ce6347e46a77bd828097b39fec04de"},{"edge_kind":"extracted","from_key":"File:05cc7a32e5a0023f9e1c790f97b069ccd27ada59ea8b9864f7f9069e3049663c","to_key":"File:ce5e23d5faeb76de8fbf9c2f5074292627ce6347e46a77bd828097b39fec04de"},{"edge_kind":"extracted","from_key":"File:05cc7a32e5a0023f9e1c790f97b069ccd27ada59ea8b9864f7f9069e3049663c","to_key":"File:ce5e23d5faeb76de8fbf9c2f5074292627ce6347e46a77bd828097b39fec04de"},{"edge_kind":"extracted","from_key":"File:05cc7a32e5a0023f9e1c790f97b069ccd27ada59ea8b9864f7f9069e3049663c","to_key":"File:ce5e23d5faeb76de8fbf9c2f5074292627ce6347e46a77bd828097b39fec04de"},{"edge_kind":"extracted","from_key":"File:05cc7a32e5a0023f9e1c790f97b069ccd27ada59ea8b9864f7f9069e3049663c","to_key":"File:ce5e23d5faeb76de8fbf9c2f5074292627ce6347e46a77bd828097b39fec04de"},{"edge_kind":"extracted","from_key":"File:05cc7a32e5a0023f9e1c790f97b069ccd27ada59ea8b9864f7f9069e3049663c","to_key":"File:ce5e23d5faeb76de8fbf9c2f5074292627ce6347e46a77bd828097b39fec04de"},{"edge_kind":"extracted","from_key":"File:05cc7a32e5a0023f9e1c790f97b069ccd27ada59ea8b9864f7f9069e3049663c","to_key":"File:ce5e23d5faeb76de8fbf9c2f5074292627ce6347e46a77bd828097b39fec04de"},{"edge_kind":"extracted","from_key":"File:05cc7a32e5a0023f9e1c790f97b069ccd27ada59ea8b9864f7f9069e3049663c","to_key":"File:ce5e23d5faeb76de8fbf9c2f5074292627ce6347e46a77bd828097b39fec04de"},{"edge_kind":"extracted","from_key":"File:05cc7a32e5a0023f9e1c790f97b069ccd27ada59ea8b9864f7f9069e3049663c","to_key":"File:ce5e23d5faeb76de8fbf9c2f5074292627ce6347e46a77bd828097b39fec04de"},{"edge_kind":"extracted","from_key":"File:05cc7a32e5a0023f9e1c790f97b069ccd27ada59ea8b9864f7f9069e3049663c","to_key":"File:ce5e23d5faeb76de8fbf9c2f5074292627ce6347e46a77bd828097b39fec04de"},{"edge_kind":"extracted","from_key":"File:05cc7a32e5a0023f9e1c790f97b069ccd27ada59ea8b9864f7f9069e3049663c","to_key":"File:ce5e23d5faeb76de8fbf9c2f5074292627ce6347e46a77bd828097b39fec04de"},{"edge_kind":"extracted","from_key":"File:05cc7a32e5a0023f9e1c790f97b069ccd27ada59ea8b9864f7f9069e3049663c","to_key":"File:ce5e23d5faeb76de8fbf9c2f5074292627ce6347e46a77bd828097b39fec04de"},{"edge_kind":"extracted","from_key":"File:05cc7a32e5a0023f9e1c790f97b069ccd27ada59ea8b9864f7f9069e3049663c","to_key":"File:ce5e23d5faeb76de8fbf9c2f5074292627ce6347e46a77bd828097b39fec04de"},{"edge_kind":"extracted","from_key":"File:05cc7a32e5a0023f9e1c790f97b069ccd27ada59ea8b9864f7f9069e3049663c","to_key":"File:ce5e23d5faeb76de8fbf9c2f5074292627ce6347e46a77bd828097b39fec04de"},{"edge_kind":"extracted","from_key":"File:05cc7a32e5a0023f9e1c790f97b069ccd27ada59ea8b9864f7f9069e3049663c","to_key":"File:ce5e23d5faeb76de8fbf9c2f5074292627ce6347e46a77bd828097b39fec04de"},{"edge_kind":"extracted","from_key":"File:05cc7a32e5a0023f9e1c790f97b069ccd27ada59ea8b9864f7f9069e3049663c","to_key":"File:ce5e23d5faeb76de8fbf9c2f5074292627ce6347e46a77bd828097b39fec04de"},{"edge_kind":"extracted","from_key":"File:05cc7a32e5a0023f9e1c790f97b069ccd27ada59ea8b9864f7f9069e3049663c","to_key":"File:ce5e23d5faeb76de8fbf9c2f5074292627ce6347e46a77bd828097b39fec04de"},{"edge_kind":"extracted","from_key":"File:05cc7a32e5a0023f9e1c790f97b069ccd27ada59ea8b9864f7f9069e3049663c","to_key":"File:ce5e23d5faeb76de8fbf9c2f5074292627ce6347e46a77bd828097b39fec04de"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}}]}},"activity":{"stats":{"process_count":63,"spawned_processes_count":63,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":25,"imported_dlls_count":154,"dropped_files_count":0,"extracted_files_count":53,"files_written_count":53,"files_deleted_count":0,"registry_keys_created_count":17,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":17,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["sabsik","flystudio","evasive","windows-server-utility"],"sample_flags":["Multi-Process","Extracted Files","Sample Crashed"],"sandbox_reports":[{"id":"6ab76ee0ce1c80d039085de2","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Dropper.Daws","submit_name":"???????.exe","analysis_start_time":"2026-09-26T07:06:10+00:00","indicators_count":{"informative":239,"suspicious":67,"malicious":13},"tags":["Multi-Process","Extracted Files"],"is_in_unified_schema":true},{"id":"6a1828d2ccfe3493bd0df6cc","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Dropper.Daws","submit_name":"???????.exe","analysis_start_time":"2026-05-28T11:36:53+00:00","indicators_count":{"informative":212,"suspicious":63,"malicious":17},"tags":["Multi-Process","Extracted Files","Sample Crashed"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}],"processes":[{"pid":2500,"ppid":0,"name":".exe","command_line":"","sha256":"05cc7a32e5a0023f9e1c790f97b069ccd27ada59ea8b9864f7f9069e3049663c","normalized_path":"C:\\.exe","uid":"00000000-00002500","icon":"$65"},{"pid":2924,"ppid":2500,"name":"taskkill.exe","command_line":"taskkill /im taskmgr.exe /f","sha256":"cb1822a981e9821d571af16b7e37beba5feb8e3dedcdd0461119af9aac0358b3","normalized_path":"%WINDIR%\\SysWOW64\\taskkill.exe","parent_uid":"00000000-00002500","uid":"00000000-00002924"},{"pid":2564,"ppid":2500,"name":"gamesetup.exe","command_line":"","sha256":"26df17a5650af86da2685ed6c10592fcb200ccb6974f27320ac1a9b407411549","normalized_path":"C:\\gamesetup.exe","parent_uid":"00000000-00002500","uid":"00000000-00002564"},{"pid":4880,"ppid":2564,"name":"cmd.exe","command_line":"%WINDIR%\\system32\\cmd.exe /c C:\\ddel.bat","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00000000-00002564","uid":"00000000-00004880"},{"pid":4244,"ppid":4880,"name":"taskkill.exe","command_line":"taskkill /f /im explorer.exe","sha256":"cb1822a981e9821d571af16b7e37beba5feb8e3dedcdd0461119af9aac0358b3","normalized_path":"%WINDIR%\\SysWOW64\\taskkill.exe","parent_uid":"00000000-00004880","uid":"00000000-00004244"},{"pid":3700,"ppid":4880,"name":"explorer.exe","command_line":"","sha256":"11d69fb388ff59e5ba6ca217ca04ecde6a38fa8fb306aa5f1b72e22bb7c3a25a","normalized_path":"%WINDIR%\\SysWOW64\\explorer.exe","parent_uid":"00000000-00004880","uid":"00000000-00003700"},{"pid":4552,"ppid":2564,"name":"cmd.exe","command_line":"cmd /c taskkill /f /im Aver.exe","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00000000-00002564","uid":"00000000-00004552"},{"pid":3408,"ppid":4552,"name":"taskkill.exe","command_line":"taskkill /f /im Aver.exe","sha256":"cb1822a981e9821d571af16b7e37beba5feb8e3dedcdd0461119af9aac0358b3","normalized_path":"%WINDIR%\\SysWOW64\\taskkill.exe","parent_uid":"00000000-00004552","uid":"00000000-00003408"},{"pid":2492,"ppid":2564,"name":"cmd.exe","command_line":"%WINDIR%\\system32\\cmd.exe /c C:\\del.bat","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00000000-00002564","uid":"00000000-00002492"},{"pid":1252,"ppid":2500,"name":"taskkill.exe","command_line":"taskkill /im taskmgr.exe /f","sha256":"cb1822a981e9821d571af16b7e37beba5feb8e3dedcdd0461119af9aac0358b3","normalized_path":"%WINDIR%\\SysWOW64\\taskkill.exe","parent_uid":"00000000-00002500","uid":"00000000-00001252"},{"pid":1768,"ppid":2500,"name":"taskkill.exe","command_line":"taskkill /im taskmgr.exe /f","sha256":"cb1822a981e9821d571af16b7e37beba5feb8e3dedcdd0461119af9aac0358b3","normalized_path":"%WINDIR%\\SysWOW64\\taskkill.exe","parent_uid":"00000000-00002500","uid":"00000000-00001768"},{"pid":972,"ppid":2500,"name":"taskkill.exe","command_line":"taskkill /im taskmgr.exe /f","sha256":"cb1822a981e9821d571af16b7e37beba5feb8e3dedcdd0461119af9aac0358b3","normalized_path":"%WINDIR%\\SysWOW64\\taskkill.exe","parent_uid":"00000000-00002500","uid":"00000000-00000972"},{"pid":1948,"ppid":2500,"name":"taskkill.exe","command_line":"taskkill /im taskmgr.exe /f","sha256":"cb1822a981e9821d571af16b7e37beba5feb8e3dedcdd0461119af9aac0358b3","normalized_path":"%WINDIR%\\SysWOW64\\taskkill.exe","parent_uid":"00000000-00002500","uid":"00000000-00001948"},{"pid":3316,"ppid":2500,"name":"taskkill.exe","command_line":"taskkill /im taskmgr.exe /f","sha256":"cb1822a981e9821d571af16b7e37beba5feb8e3dedcdd0461119af9aac0358b3","normalized_path":"%WINDIR%\\SysWOW64\\taskkill.exe","parent_uid":"00000000-00002500","uid":"00000000-00003316"},{"pid":4944,"ppid":2500,"name":"taskkill.exe","command_line":"taskkill /im taskmgr.exe /f","sha256":"cb1822a981e9821d571af16b7e37beba5feb8e3dedcdd0461119af9aac0358b3","normalized_path":"%WINDIR%\\SysWOW64\\taskkill.exe","parent_uid":"00000000-00002500","uid":"00000000-00004944"},{"pid":4176,"ppid":2500,"name":"taskkill.exe","command_line":"taskkill /im taskmgr.exe /f","sha256":"cb1822a981e9821d571af16b7e37beba5feb8e3dedcdd0461119af9aac0358b3","normalized_path":"%WINDIR%\\SysWOW64\\taskkill.exe","parent_uid":"00000000-00002500","uid":"00000000-00004176"},{"pid":1876,"ppid":2500,"name":"taskkill.exe","command_line":"taskkill /im taskmgr.exe /f","sha256":"cb1822a981e9821d571af16b7e37beba5feb8e3dedcdd0461119af9aac0358b3","normalized_path":"%WINDIR%\\SysWOW64\\taskkill.exe","parent_uid":"00000000-00002500","uid":"00000000-00001876"},{"pid":4196,"ppid":2500,"name":"taskkill.exe","command_line":"taskkill /im taskmgr.exe /f","sha256":"cb1822a981e9821d571af16b7e37beba5feb8e3dedcdd0461119af9aac0358b3","normalized_path":"%WINDIR%\\SysWOW64\\taskkill.exe","parent_uid":"00000000-00002500","uid":"00000000-00004196"},{"pid":2512,"ppid":2500,"name":"taskkill.exe","command_line":"taskkill /im taskmgr.exe /f","sha256":"cb1822a981e9821d571af16b7e37beba5feb8e3dedcdd0461119af9aac0358b3","normalized_path":"%WINDIR%\\SysWOW64\\taskkill.exe","parent_uid":"00000000-00002500","uid":"00000000-00002512"},{"pid":4008,"ppid":2500,"name":"taskkill.exe","command_line":"taskkill /im taskmgr.exe /f","sha256":"cb1822a981e9821d571af16b7e37beba5feb8e3dedcdd0461119af9aac0358b3","normalized_path":"%WINDIR%\\SysWOW64\\taskkill.exe","parent_uid":"00000000-00002500","uid":"00000000-00004008"},{"pid":4564,"ppid":2500,"name":"taskkill.exe","command_line":"taskkill /im taskmgr.exe /f","sha256":"cb1822a981e9821d571af16b7e37beba5feb8e3dedcdd0461119af9aac0358b3","normalized_path":"%WINDIR%\\SysWOW64\\taskkill.exe","parent_uid":"00000000-00002500","uid":"00000000-00004564"},{"pid":4144,"ppid":2500,"name":"taskkill.exe","command_line":"taskkill /im taskmgr.exe /f","sha256":"cb1822a981e9821d571af16b7e37beba5feb8e3dedcdd0461119af9aac0358b3","normalized_path":"%WINDIR%\\SysWOW64\\taskkill.exe","parent_uid":"00000000-00002500","uid":"00000000-00004144"},{"pid":564,"ppid":2500,"name":"taskkill.exe","command_line":"taskkill /im taskmgr.exe /f","sha256":"cb1822a981e9821d571af16b7e37beba5feb8e3dedcdd0461119af9aac0358b3","normalized_path":"%WINDIR%\\SysWOW64\\taskkill.exe","parent_uid":"00000000-00002500","uid":"00000000-00000564"},{"pid":4408,"ppid":2500,"name":"taskkill.exe","command_line":"taskkill /im taskmgr.exe /f","sha256":"cb1822a981e9821d571af16b7e37beba5feb8e3dedcdd0461119af9aac0358b3","normalized_path":"%WINDIR%\\SysWOW64\\taskkill.exe","parent_uid":"00000000-00002500","uid":"00000000-00004408"},{"pid":1080,"ppid":2500,"name":"taskkill.exe","command_line":"taskkill /im taskmgr.exe /f","sha256":"cb1822a981e9821d571af16b7e37beba5feb8e3dedcdd0461119af9aac0358b3","normalized_path":"%WINDIR%\\SysWOW64\\taskkill.exe","parent_uid":"00000000-00002500","uid":"00000000-00001080"},{"pid":2572,"ppid":2500,"name":"taskkill.exe","command_line":"taskkill /im taskmgr.exe /f","sha256":"cb1822a981e9821d571af16b7e37beba5feb8e3dedcdd0461119af9aac0358b3","normalized_path":"%WINDIR%\\SysWOW64\\taskkill.exe","parent_uid":"00000000-00002500","uid":"00000000-00002572"},{"pid":4684,"ppid":2500,"name":"taskkill.exe","command_line":"taskkill /im taskmgr.exe /f","sha256":"cb1822a981e9821d571af16b7e37beba5feb8e3dedcdd0461119af9aac0358b3","normalized_path":"%WINDIR%\\SysWOW64\\taskkill.exe","parent_uid":"00000000-00002500","uid":"00000000-00004684"},{"pid":5016,"ppid":2500,"name":"taskkill.exe","command_line":"taskkill /im taskmgr.exe /f","sha256":"cb1822a981e9821d571af16b7e37beba5feb8e3dedcdd0461119af9aac0358b3","normalized_path":"%WINDIR%\\SysWOW64\\taskkill.exe","parent_uid":"00000000-00002500","uid":"00000000-00005016"},{"pid":3684,"ppid":2500,"name":"taskkill.exe","command_line":"taskkill /im taskmgr.exe /f","sha256":"cb1822a981e9821d571af16b7e37beba5feb8e3dedcdd0461119af9aac0358b3","normalized_path":"%WINDIR%\\SysWOW64\\taskkill.exe","parent_uid":"00000000-00002500","uid":"00000000-00003684"},{"pid":4000,"ppid":2500,"name":"taskkill.exe","command_line":"taskkill /im taskmgr.exe /f","sha256":"cb1822a981e9821d571af16b7e37beba5feb8e3dedcdd0461119af9aac0358b3","normalized_path":"%WINDIR%\\SysWOW64\\taskkill.exe","parent_uid":"00000000-00002500","uid":"00000000-00004000"},{"pid":2552,"ppid":2500,"name":"taskkill.exe","command_line":"taskkill /im taskmgr.exe /f","sha256":"cb1822a981e9821d571af16b7e37beba5feb8e3dedcdd0461119af9aac0358b3","normalized_path":"%WINDIR%\\SysWOW64\\taskkill.exe","parent_uid":"00000000-00002500","uid":"00000000-00002552"},{"pid":4160,"ppid":2500,"name":"taskkill.exe","command_line":"taskkill /im taskmgr.exe /f","sha256":"cb1822a981e9821d571af16b7e37beba5feb8e3dedcdd0461119af9aac0358b3","normalized_path":"%WINDIR%\\SysWOW64\\taskkill.exe","parent_uid":"00000000-00002500","uid":"00000000-00004160"},{"pid":4412,"ppid":2500,"name":"taskkill.exe","command_line":"taskkill /im taskmgr.exe /f","sha256":"cb1822a981e9821d571af16b7e37beba5feb8e3dedcdd0461119af9aac0358b3","normalized_path":"%WINDIR%\\SysWOW64\\taskkill.exe","parent_uid":"00000000-00002500","uid":"00000000-00004412"},{"pid":3888,"ppid":2500,"name":"taskkill.exe","command_line":"taskkill /im taskmgr.exe /f","sha256":"cb1822a981e9821d571af16b7e37beba5feb8e3dedcdd0461119af9aac0358b3","normalized_path":"%WINDIR%\\SysWOW64\\taskkill.exe","parent_uid":"00000000-00002500","uid":"00000000-00003888"},{"pid":3740,"ppid":2500,"name":"taskkill.exe","command_line":"taskkill /im taskmgr.exe /f","sha256":"cb1822a981e9821d571af16b7e37beba5feb8e3dedcdd0461119af9aac0358b3","normalized_path":"%WINDIR%\\SysWOW64\\taskkill.exe","parent_uid":"00000000-00002500","uid":"00000000-00003740"},{"pid":3188,"ppid":2500,"name":"taskkill.exe","command_line":"taskkill /im taskmgr.exe /f","sha256":"cb1822a981e9821d571af16b7e37beba5feb8e3dedcdd0461119af9aac0358b3","normalized_path":"%WINDIR%\\SysWOW64\\taskkill.exe","parent_uid":"00000000-00002500","uid":"00000000-00003188"},{"pid":3964,"ppid":2500,"name":"taskkill.exe","command_line":"taskkill /im taskmgr.exe /f","sha256":"cb1822a981e9821d571af16b7e37beba5feb8e3dedcdd0461119af9aac0358b3","normalized_path":"%WINDIR%\\SysWOW64\\taskkill.exe","parent_uid":"00000000-00002500","uid":"00000000-00003964"},{"pid":3636,"ppid":2500,"name":"taskkill.exe","command_line":"taskkill /im taskmgr.exe /f","sha256":"cb1822a981e9821d571af16b7e37beba5feb8e3dedcdd0461119af9aac0358b3","normalized_path":"%WINDIR%\\SysWOW64\\taskkill.exe","parent_uid":"00000000-00002500","uid":"00000000-00003636"},{"pid":4628,"ppid":2500,"name":"taskkill.exe","command_line":"taskkill /im taskmgr.exe /f","sha256":"cb1822a981e9821d571af16b7e37beba5feb8e3dedcdd0461119af9aac0358b3","normalized_path":"%WINDIR%\\SysWOW64\\taskkill.exe","parent_uid":"00000000-00002500","uid":"00000000-00004628"},{"pid":860,"ppid":2500,"name":"taskkill.exe","command_line":"taskkill /im taskmgr.exe /f","sha256":"cb1822a981e9821d571af16b7e37beba5feb8e3dedcdd0461119af9aac0358b3","normalized_path":"%WINDIR%\\SysWOW64\\taskkill.exe","parent_uid":"00000000-00002500","uid":"00000000-00000860"},{"pid":1084,"ppid":2500,"name":"taskkill.exe","command_line":"taskkill /im taskmgr.exe /f","sha256":"cb1822a981e9821d571af16b7e37beba5feb8e3dedcdd0461119af9aac0358b3","normalized_path":"%WINDIR%\\SysWOW64\\taskkill.exe","parent_uid":"00000000-00002500","uid":"00000000-00001084"},{"pid":2340,"ppid":2500,"name":"taskkill.exe","command_line":"taskkill /im taskmgr.exe /f","sha256":"cb1822a981e9821d571af16b7e37beba5feb8e3dedcdd0461119af9aac0358b3","normalized_path":"%WINDIR%\\SysWOW64\\taskkill.exe","parent_uid":"00000000-00002500","uid":"00000000-00002340"},{"pid":4652,"ppid":2500,"name":"taskkill.exe","command_line":"taskkill /im taskmgr.exe /f","sha256":"cb1822a981e9821d571af16b7e37beba5feb8e3dedcdd0461119af9aac0358b3","normalized_path":"%WINDIR%\\SysWOW64\\taskkill.exe","parent_uid":"00000000-00002500","uid":"00000000-00004652"},{"pid":3312,"ppid":2500,"name":"taskkill.exe","command_line":"taskkill /im taskmgr.exe /f","sha256":"cb1822a981e9821d571af16b7e37beba5feb8e3dedcdd0461119af9aac0358b3","normalized_path":"%WINDIR%\\SysWOW64\\taskkill.exe","parent_uid":"00000000-00002500","uid":"00000000-00003312"},{"pid":2180,"ppid":2500,"name":"taskkill.exe","command_line":"taskkill /im taskmgr.exe /f","sha256":"cb1822a981e9821d571af16b7e37beba5feb8e3dedcdd0461119af9aac0358b3","normalized_path":"%WINDIR%\\SysWOW64\\taskkill.exe","parent_uid":"00000000-00002500","uid":"00000000-00002180"},{"pid":4464,"ppid":2500,"name":"taskkill.exe","command_line":"taskkill /im taskmgr.exe /f","sha256":"cb1822a981e9821d571af16b7e37beba5feb8e3dedcdd0461119af9aac0358b3","normalized_path":"%WINDIR%\\SysWOW64\\taskkill.exe","parent_uid":"00000000-00002500","uid":"00000000-00004464"},{"pid":4540,"ppid":2500,"name":"taskkill.exe","command_line":"taskkill /im taskmgr.exe /f","sha256":"cb1822a981e9821d571af16b7e37beba5feb8e3dedcdd0461119af9aac0358b3","normalized_path":"%WINDIR%\\SysWOW64\\taskkill.exe","parent_uid":"00000000-00002500","uid":"00000000-00004540"},{"pid":4856,"ppid":2500,"name":"taskkill.exe","command_line":"taskkill /im taskmgr.exe /f","sha256":"cb1822a981e9821d571af16b7e37beba5feb8e3dedcdd0461119af9aac0358b3","normalized_path":"%WINDIR%\\SysWOW64\\taskkill.exe","parent_uid":"00000000-00002500","uid":"00000000-00004856"},{"pid":1380,"ppid":2500,"name":"taskkill.exe","command_line":"taskkill /im taskmgr.exe /f","sha256":"cb1822a981e9821d571af16b7e37beba5feb8e3dedcdd0461119af9aac0358b3","normalized_path":"%WINDIR%\\SysWOW64\\taskkill.exe","parent_uid":"00000000-00002500","uid":"00000000-00001380"},{"pid":904,"ppid":2500,"name":"taskkill.exe","command_line":"taskkill /im taskmgr.exe /f","sha256":"cb1822a981e9821d571af16b7e37beba5feb8e3dedcdd0461119af9aac0358b3","normalized_path":"%WINDIR%\\SysWOW64\\taskkill.exe","parent_uid":"00000000-00002500","uid":"00000000-00000904"},{"pid":4660,"ppid":2500,"name":"taskkill.exe","command_line":"taskkill /im taskmgr.exe /f","sha256":"cb1822a981e9821d571af16b7e37beba5feb8e3dedcdd0461119af9aac0358b3","normalized_path":"%WINDIR%\\SysWOW64\\taskkill.exe","parent_uid":"00000000-00002500","uid":"00000000-00004660"},{"pid":2408,"ppid":2500,"name":"taskkill.exe","command_line":"taskkill /im taskmgr.exe /f","sha256":"cb1822a981e9821d571af16b7e37beba5feb8e3dedcdd0461119af9aac0358b3","normalized_path":"%WINDIR%\\SysWOW64\\taskkill.exe","parent_uid":"00000000-00002500","uid":"00000000-00002408"},{"pid":1608,"ppid":2500,"name":"taskkill.exe","command_line":"taskkill /im taskmgr.exe /f","sha256":"cb1822a981e9821d571af16b7e37beba5feb8e3dedcdd0461119af9aac0358b3","normalized_path":"%WINDIR%\\SysWOW64\\taskkill.exe","parent_uid":"00000000-00002500","uid":"00000000-00001608"},{"pid":3252,"ppid":2500,"name":"taskkill.exe","command_line":"taskkill /im taskmgr.exe /f","sha256":"cb1822a981e9821d571af16b7e37beba5feb8e3dedcdd0461119af9aac0358b3","normalized_path":"%WINDIR%\\SysWOW64\\taskkill.exe","parent_uid":"00000000-00002500","uid":"00000000-00003252"},{"pid":4820,"ppid":2500,"name":"taskkill.exe","command_line":"taskkill /im taskmgr.exe /f","sha256":"cb1822a981e9821d571af16b7e37beba5feb8e3dedcdd0461119af9aac0358b3","normalized_path":"%WINDIR%\\SysWOW64\\taskkill.exe","parent_uid":"00000000-00002500","uid":"00000000-00004820"},{"pid":804,"ppid":2500,"name":"taskkill.exe","command_line":"taskkill /im taskmgr.exe /f","sha256":"cb1822a981e9821d571af16b7e37beba5feb8e3dedcdd0461119af9aac0358b3","normalized_path":"%WINDIR%\\SysWOW64\\taskkill.exe","parent_uid":"00000000-00002500","uid":"00000000-00000804"},{"pid":4456,"ppid":2500,"name":"taskkill.exe","command_line":"taskkill /im taskmgr.exe /f","sha256":"cb1822a981e9821d571af16b7e37beba5feb8e3dedcdd0461119af9aac0358b3","normalized_path":"%WINDIR%\\SysWOW64\\taskkill.exe","parent_uid":"00000000-00002500","uid":"00000000-00004456"},{"pid":1604,"ppid":2500,"name":"taskkill.exe","command_line":"taskkill /im taskmgr.exe /f","sha256":"cb1822a981e9821d571af16b7e37beba5feb8e3dedcdd0461119af9aac0358b3","normalized_path":"%WINDIR%\\SysWOW64\\taskkill.exe","parent_uid":"00000000-00002500","uid":"00000000-00001604"},{"pid":3508,"ppid":2500,"name":"taskkill.exe","command_line":"taskkill /im taskmgr.exe /f","sha256":"cb1822a981e9821d571af16b7e37beba5feb8e3dedcdd0461119af9aac0358b3","normalized_path":"%WINDIR%\\SysWOW64\\taskkill.exe","parent_uid":"00000000-00002500","uid":"00000000-00003508"},{"pid":3648,"ppid":2500,"name":"taskkill.exe","command_line":"taskkill /im taskmgr.exe /f","sha256":"cb1822a981e9821d571af16b7e37beba5feb8e3dedcdd0461119af9aac0358b3","normalized_path":"%WINDIR%\\SysWOW64\\taskkill.exe","parent_uid":"00000000-00002500","uid":"00000000-00003648"},{"pid":2452,"ppid":2500,"name":"taskkill.exe","command_line":"taskkill /im taskmgr.exe /f","sha256":"cb1822a981e9821d571af16b7e37beba5feb8e3dedcdd0461119af9aac0358b3","normalized_path":"%WINDIR%\\SysWOW64\\taskkill.exe","parent_uid":"00000000-00002500","uid":"00000000-00002452"},{"pid":4556,"ppid":2500,"name":"taskkill.exe","command_line":"taskkill /im taskmgr.exe /f","sha256":"cb1822a981e9821d571af16b7e37beba5feb8e3dedcdd0461119af9aac0358b3","normalized_path":"%WINDIR%\\SysWOW64\\taskkill.exe","parent_uid":"00000000-00002500","uid":"00000000-00004556"},{"pid":2440,"ppid":2500,"name":"taskkill.exe","command_line":"taskkill /im taskmgr.exe /f","sha256":"cb1822a981e9821d571af16b7e37beba5feb8e3dedcdd0461119af9aac0358b3","normalized_path":"%WINDIR%\\SysWOW64\\taskkill.exe","parent_uid":"00000000-00002500","uid":"00000000-00002440"}],"all_imported_dlls":["SHCore.dll","winmmbase.dll","msctf.dll","ksuser.dll","edputil.dll","iertutil.dll","userenv.dll","ELSCore.dll","gdi32.dll","powrprof.dll","winmm.dll","WinTypes.dll","Windows.Storage.Search.dll","wow64.dll","sspicli.dll","fltLib.dll","cfgmgr32.dll","MMDevAPI.dll","aepic.dll","wtsapi32.dll","BCP47Langs.dll","propsys.dll","mpr.dll","twinapi.dll","actxprxy.dll","gdi32full.dll","oleaut32.dll","cryptsp.dll","profapi.dll","olepro32.dll","ntshrui.dll","wbemprox.dll","combase.dll","rpcrt4.dll","msvcrt.dll","SettingSyncCore.dll","msvcr90.dll","StructuredQuery.dll","MSWB7.dll","ole32.dll","shlwapi.dll","shell32.dll","wbemsvc.dll","rsaenh.dll","kernel.appcore.dll","dwmapi.dll","cldapi.dll","framedynos.dll","sxs.dll","wow64win.dll","wow64cpu.dll","VxSSL32.dll","bcrypt.dll","devobj.dll","wininet.dll","msIso.dll","wbemcomn.dll","ntdll.dll","user32.dll","comctl32.dll","imagehlp.dll","fastprox.dll","cmdext.dll","rmclient.dll","GROOVEEX.DLL","ws2_32.dll","msvcp_win.dll","windows.storage.dll","IPHLPAPI.DLL","urlmon.dll","Windows.StateRepositoryPS.dll","cscapi.dll","OneCoreUAPCommonProxyStub.dll","kernel32.dll","KernelBase.dll","apphelp.dll","uxtheme.dll","linkinfo.dll","CoreUIComponents.dll","twinapi.appcore.dll","sppc.dll","srvcli.dll","CoreMessaging.dll","netutils.dll","slc.dll","VxSSL64.dll","imm32.dll","sechost.dll","win32u.dll","advapi32.dll","GdiPlus.dll","avrt.dll","version.dll","ntmarta.dll","clbcatq.dll","TextInputFramework.dll","dbghelp.dll","winsta.dll","msvcp90.dll","ATL90.dll","AppResolver.dll","ExplorerFrame.dll","cryptbase.dll","bcryptprimitives.dll","ucrtbase.dll","comdlg32.dll","ntdsapi.dll","api-ms-win-crt-runtime-l1-1-0.dll","api-ms-win-core-file-l1-2-0.dll","api-ms-win-crt-convert-l1-1-0.dll","samcli.dll","api-ms-win-crt-locale-l1-1-0.dll","api-ms-win-downlevel-shell32-l1-1-0.dll","winnsi.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","wbemcomn2.dll","ieframe.dll","api-ms-win-core-timezone-l1-1-0.dll","api-ms-win-core-processthreads-l1-1-1.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll","api-ms-win-downlevel-ole32-l1-1-0.dll","secur32.dll","normaliz.dll","Wldap32.dll","AcGenral.dll","api-ms-win-crt-time-l1-1-0.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","msvcp140.dll","duser.dll","api-ms-win-crt-string-l1-1-0.dll","msacm32.dll","sfc.dll","dui70.dll","api-ms-win-core-localization-l1-2-0.dll","api-ms-win-core-synch-l1-2-0.dll","vcruntime140.dll","api-ms-win-crt-filesystem-l1-1-0.dll","RpcRtRemote.dll","api-ms-win-core-file-l2-1-0.dll","api-ms-win-crt-stdio-l1-1-0.dll","api-ms-win-crt-math-l1-1-0.dll","api-ms-win-crt-utility-l1-1-0.dll","wkscli.dll","nsi.dll","api-ms-win-downlevel-user32-l1-1-0.dll","sfc_os.dll","api-ms-win-crt-heap-l1-1-0.dll","winbrand.dll","lpk.dll","usp10.dll","netapi32.dll","api-ms-win-crt-environment-l1-1-0.dll","api-ms-win-downlevel-version-l1-1-0.dll","setupapi.dll"]},"file_activity":{"dropped_files":[],"extracted_files":[{"name":"gamesetup.exe","sha256":"26df17a5650af86da2685ed6c10592fcb200ccb6974f27320ac1a9b407411549","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"name":"eGrid.fne","sha256":"0a12fcbe6832aad4143dd2ad87a60e9ff4f04fa440831f910557f820ba21fe18","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"name":"krnln.fnr","sha256":"d1d5f7cdc1ec41bba0ae3391d58409c8d710e5526559168cac5f0fdc510d245b","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"name":"iext2.fne","sha256":"a8b14f31098a191631696db5ddc77e029b48999542e0ec15b63df02220c66d37","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"name":"panda.exe","sha256":"8a18b6ea6d7482139f8c7ea052ab1eb0d9bd939a9b621f1993c585301fed3136","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"name":"bzdhz.ico","sha256":"24cb9ed8557d10a5d957220d754e256cf0614751133df79097d8d719c2f4b690","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"name":"spec.fne","sha256":"0c9e6eb8648f4bf5c585d5344035e91c3249bb9686a302503b4681b7ba828dc0","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"name":"del.bat","sha256":"ad5aff9076e482036a1b0260ca52fac54af28591eb96d551d7b6ac13d18a6dcf","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"name":"eAPI.fne","sha256":"53483523c316ad8c022c2b07a5cabfff3339bc5cb5e4ac24c3260eea4f4d9731","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"name":"panda.ico","sha256":"8526cf9a3c62261ffbad14bc4a23da5c475d9a5ce0c65074b3aa22551aa2655f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"name":"iext.fnr","sha256":"8c8254cb49f7287b97c7f952c81edabc9f11f3fa3f02f265e67d5741998cf0bf","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"name":"shell.fne","sha256":"90284c2ead0598faa715cc90c1f53b83b916099c918ce7f816f0b4550ff55ac6","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"name":"panda.jpg","sha256":"501f3e1a9afca6a096396a31c1259cfb0720acd29cbaa8d5938791b5eb25d835","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"name":"ddel.bat","sha256":"e16c00a72d5d686ca3ccc40ff38bfca59bae1e6d05457c73409f1a0367535f71","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"name":"D_A_OIa8.lnk","sha256":"2abc6f2830a8dd96845ae79458f9d53791c4c1c87808c6f79ce9e41a03c728c5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"name":"EThread.fne","sha256":"64eef86745d7ae0168fec357099e2e952ce74ee19576d06cc8c8c65f210cc22c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"name":"mp3.run","sha256":"58e5d6246a0555c2afeeac51ae12ecda459f377e87b92cb4d7a0ddc055abbbca","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"name":"D_A_OIa22.lnk","sha256":"ce5e23d5faeb76de8fbf9c2f5074292627ce6347e46a77bd828097b39fec04de","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"name":"D_A_OIa37.lnk","sha256":"ce5e23d5faeb76de8fbf9c2f5074292627ce6347e46a77bd828097b39fec04de","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"name":"D_A_OIa9.lnk","sha256":"ce5e23d5faeb76de8fbf9c2f5074292627ce6347e46a77bd828097b39fec04de","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"name":"D_A_OIa33.lnk","sha256":"ce5e23d5faeb76de8fbf9c2f5074292627ce6347e46a77bd828097b39fec04de","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"name":"D_A_OIa18.lnk","sha256":"ce5e23d5faeb76de8fbf9c2f5074292627ce6347e46a77bd828097b39fec04de","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"name":"D_A_OIa26.lnk","sha256":"ce5e23d5faeb76de8fbf9c2f5074292627ce6347e46a77bd828097b39fec04de","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"name":"D_A_OIa23.lnk","sha256":"ce5e23d5faeb76de8fbf9c2f5074292627ce6347e46a77bd828097b39fec04de","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"name":"D_A_OIa7.lnk","sha256":"ce5e23d5faeb76de8fbf9c2f5074292627ce6347e46a77bd828097b39fec04de","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"name":"D_A_OIa3.lnk","sha256":"ce5e23d5faeb76de8fbf9c2f5074292627ce6347e46a77bd828097b39fec04de","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"name":"D_A_OIa38.lnk","sha256":"ce5e23d5faeb76de8fbf9c2f5074292627ce6347e46a77bd828097b39fec04de","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"name":"D_A_OIa2.lnk","sha256":"ce5e23d5faeb76de8fbf9c2f5074292627ce6347e46a77bd828097b39fec04de","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"name":"D_A_OIa12.lnk","sha256":"ce5e23d5faeb76de8fbf9c2f5074292627ce6347e46a77bd828097b39fec04de","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"name":"D_A_OIa24.lnk","sha256":"ce5e23d5faeb76de8fbf9c2f5074292627ce6347e46a77bd828097b39fec04de","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"name":"D_A_OIa4.lnk","sha256":"ce5e23d5faeb76de8fbf9c2f5074292627ce6347e46a77bd828097b39fec04de","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"name":"D_A_OIa17.lnk","sha256":"ce5e23d5faeb76de8fbf9c2f5074292627ce6347e46a77bd828097b39fec04de","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"name":"D_A_OIa16.lnk","sha256":"ce5e23d5faeb76de8fbf9c2f5074292627ce6347e46a77bd828097b39fec04de","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"name":"D_A_OIa10.lnk","sha256":"ce5e23d5faeb76de8fbf9c2f5074292627ce6347e46a77bd828097b39fec04de","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"name":"D_A_OIa30.lnk","sha256":"ce5e23d5faeb76de8fbf9c2f5074292627ce6347e46a77bd828097b39fec04de","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"name":"D_A_OIa11.lnk","sha256":"ce5e23d5faeb76de8fbf9c2f5074292627ce6347e46a77bd828097b39fec04de","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"name":"D_A_OIa27.lnk","sha256":"ce5e23d5faeb76de8fbf9c2f5074292627ce6347e46a77bd828097b39fec04de","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"name":"D_A_OIa29.lnk","sha256":"ce5e23d5faeb76de8fbf9c2f5074292627ce6347e46a77bd828097b39fec04de","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"name":"D_A_OIa36.lnk","sha256":"ce5e23d5faeb76de8fbf9c2f5074292627ce6347e46a77bd828097b39fec04de","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"name":"D_A_OIa28.lnk","sha256":"ce5e23d5faeb76de8fbf9c2f5074292627ce6347e46a77bd828097b39fec04de","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"name":"D_A_OIa35.lnk","sha256":"ce5e23d5faeb76de8fbf9c2f5074292627ce6347e46a77bd828097b39fec04de","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"name":"D_A_OIa15.lnk","sha256":"ce5e23d5faeb76de8fbf9c2f5074292627ce6347e46a77bd828097b39fec04de","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"name":"D_A_OIa31.lnk","sha256":"ce5e23d5faeb76de8fbf9c2f5074292627ce6347e46a77bd828097b39fec04de","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"name":"D_A_OIa5.lnk","sha256":"ce5e23d5faeb76de8fbf9c2f5074292627ce6347e46a77bd828097b39fec04de","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"name":"D_A_OIa14.lnk","sha256":"ce5e23d5faeb76de8fbf9c2f5074292627ce6347e46a77bd828097b39fec04de","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"name":"D_A_OIa21.lnk","sha256":"ce5e23d5faeb76de8fbf9c2f5074292627ce6347e46a77bd828097b39fec04de","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"name":"D_A_OIa19.lnk","sha256":"ce5e23d5faeb76de8fbf9c2f5074292627ce6347e46a77bd828097b39fec04de","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"name":"D_A_OIa13.lnk","sha256":"ce5e23d5faeb76de8fbf9c2f5074292627ce6347e46a77bd828097b39fec04de","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"name":"D_A_OIa34.lnk","sha256":"ce5e23d5faeb76de8fbf9c2f5074292627ce6347e46a77bd828097b39fec04de","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"name":"D_A_OIa6.lnk","sha256":"ce5e23d5faeb76de8fbf9c2f5074292627ce6347e46a77bd828097b39fec04de","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"name":"D_A_OIa20.lnk","sha256":"ce5e23d5faeb76de8fbf9c2f5074292627ce6347e46a77bd828097b39fec04de","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"name":"D_A_OIa25.lnk","sha256":"ce5e23d5faeb76de8fbf9c2f5074292627ce6347e46a77bd828097b39fec04de","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"name":"D_A_OIa32.lnk","sha256":"ce5e23d5faeb76de8fbf9c2f5074292627ce6347e46a77bd828097b39fec04de","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]}],"files_written":[{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"}]},{"path":"%TEMP%\\E_N60005\\krnln.fnr","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"path":"%TEMP%\\E_N60005\\iext.fnr","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"path":"%TEMP%\\E_N60005\\iext2.fne","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"path":"%TEMP%\\E_N60005\\eGrid.fne","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"path":"%TEMP%\\E_N60005\\spec.fne","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"path":"%TEMP%\\E_N60005\\EThread.fne","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"path":"%TEMP%\\E_N60005\\shell.fne","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"path":"%TEMP%\\E_N60005\\eAPI.fne","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"path":"%TEMP%\\E_N60005\\mp3.run","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"path":"%WINDIR%\\Temp\\panda.ico","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"path":"%WINDIR%\\Temp\\panda.jpg","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"path":"C:\\panda.exe","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"path":"C:\\gamesetup.exe","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"path":"PIPE\\srvsvc","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"}]},{"path":"C:\\ÐÜÃ¨ÉÕÏã1.lnk","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"}]},{"path":"C:\\ÐÜÃ¨ÉÕÏã2.lnk","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"path":"C:\\ÐÜÃ¨ÉÕÏã3.lnk","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"path":"C:\\ÐÜÃ¨ÉÕÏã4.lnk","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"path":"C:\\ÐÜÃ¨ÉÕÏã5.lnk","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"path":"C:\\ÐÜÃ¨ÉÕÏã6.lnk","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"path":"C:\\ÐÜÃ¨ÉÕÏã7.lnk","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"path":"C:\\ÐÜÃ¨ÉÕÏã8.lnk","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"path":"C:\\ÐÜÃ¨ÉÕÏã9.lnk","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"path":"C:\\ÐÜÃ¨ÉÕÏã10.lnk","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"path":"C:\\ÐÜÃ¨ÉÕÏã11.lnk","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"path":"C:\\ÐÜÃ¨ÉÕÏã12.lnk","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"path":"C:\\ÐÜÃ¨ÉÕÏã13.lnk","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"path":"C:\\ÐÜÃ¨ÉÕÏã14.lnk","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"path":"C:\\ÐÜÃ¨ÉÕÏã15.lnk","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"path":"C:\\ÐÜÃ¨ÉÕÏã16.lnk","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"path":"%WINDIR%\\SysWOW64\\bzdhz.ico","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"path":"C:\\del.bat","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"path":"C:\\ddel.bat","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"path":"C:\\ÐÜÃ¨ÉÕÏã17.lnk","sources":[{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"path":"C:\\ÐÜÃ¨ÉÕÏã18.lnk","sources":[{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"path":"C:\\ÐÜÃ¨ÉÕÏã19.lnk","sources":[{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"path":"C:\\ÐÜÃ¨ÉÕÏã20.lnk","sources":[{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"path":"C:\\ÐÜÃ¨ÉÕÏã21.lnk","sources":[{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"path":"C:\\ÐÜÃ¨ÉÕÏã22.lnk","sources":[{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"path":"C:\\ÐÜÃ¨ÉÕÏã23.lnk","sources":[{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"path":"C:\\ÐÜÃ¨ÉÕÏã24.lnk","sources":[{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"path":"C:\\ÐÜÃ¨ÉÕÏã25.lnk","sources":[{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"path":"C:\\ÐÜÃ¨ÉÕÏã26.lnk","sources":[{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"path":"C:\\ÐÜÃ¨ÉÕÏã27.lnk","sources":[{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"path":"C:\\ÐÜÃ¨ÉÕÏã28.lnk","sources":[{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"path":"C:\\ÐÜÃ¨ÉÕÏã29.lnk","sources":[{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"path":"C:\\ÐÜÃ¨ÉÕÏã30.lnk","sources":[{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"path":"C:\\ÐÜÃ¨ÉÕÏã31.lnk","sources":[{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"path":"C:\\ÐÜÃ¨ÉÕÏã32.lnk","sources":[{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"path":"C:\\ÐÜÃ¨ÉÕÏã33.lnk","sources":[{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"path":"C:\\ÐÜÃ¨ÉÕÏã34.lnk","sources":[{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\HARDWARE PROFILES\\0001\\.EXE\\","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"}]},{"key":"\\REGISTRY\\USER\\.EXE\\","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"}]},{"key":"HKLMHKLM\\.EXE\\","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"}]},{"key":"HKCUHKCU\\.EXE\\","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"}]},{"key":"HKLMHKLM\\.LNK\\","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"}]},{"key":"HKCUHKCU\\.LNK\\","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"}]},{"key":"\\REGISTRY\\USER\\.LNK\\","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\HARDWARE PROFILES\\0001\\.LNK\\","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"}]},{"key":"HKLMHKLM\\.TXT\\","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"}]},{"key":"\\REGISTRY\\USER\\.TXT\\","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"}]},{"key":"HKCUHKCU\\.TXT\\","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\HARDWARE PROFILES\\0001\\.TXT\\","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\HARDWARE PROFILES\\0001\\.DOC\\","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"}]},{"key":"HKCUHKCU\\.DOC\\","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"}]},{"key":"\\REGISTRY\\USER\\.DOC\\","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"}]},{"key":"HKLMHKLM\\.DOC\\","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:668:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:668:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:668:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"}]},{"name":"\\BaseNamedObjects\\SyncRootManager","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:668:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"},{"report_type":"sandbox","report_id":"6ab76ee0ce1c80d039085de2"}]},{"name":"Local\\SM0:668:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"}]},{"name":"Local\\SM0:668:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"}]},{"name":"SM0:668:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"}]},{"name":"SM0:668:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7100:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"}]},{"name":"Local\\SM0:7100:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"}]},{"name":"SM0:7100:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7100:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:732:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:732:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"}]},{"name":"SM0:732:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"}]},{"name":"Local\\SM0:732:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:2304:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2304:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"}]},{"name":"Local\\SM0:2304:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"}]},{"name":"SM0:2304:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a1828d2ccfe3493bd0df6cc"}]}]}},"report_ids":{"sandbox_job_ids":["6ab76ee0ce1c80d039085de2","6a1828d2ccfe3493bd0df6cc"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Zusy.Generic Sample 05cc7a32e5a0… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 05cc7a32e5a0…. Malware family: Zusy.Generic. Threat score 100/100. 15/27 AV engines flagged this file. 16 malicious and 23 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/05cc7a32e5a0023f9e1c790f97b069ccd27ada59ea8b9864f7f9069e3049663c"}],["$","meta","4",{"property":"og:title","content":"Malicious Zusy.Generic Sample 05cc7a32e5a0… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 05cc7a32e5a0…. Malware family: Zusy.Generic. Threat score 100/100. 15/27 AV engines flagged this file. 16 malicious and 23 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/05cc7a32e5a0023f9e1c790f97b069ccd27ada59ea8b9864f7f9069e3049663c"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Zusy.Generic Sample 05cc7a32e5a0… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 05cc7a32e5a0…. Malware family: Zusy.Generic. Threat score 100/100. 15/27 AV engines flagged this file. 16 malicious and 23 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L66","11",{}]]