21:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/4109t72175nm8.js","/_next/static/chunks/04k_7k5p4krw4.js","/_next/static/chunks/30r--1re9i9ly.js"],"SampleDetailWrapper"] 52:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js"],"IconMark"] 20:T40d,{"@context":"https://schema.org","@type":"TechArticle","headline":"Clean Sample 06cdf814387f… — Score 0/100 — Hybrid Analysis","description":"Clean verdict for sample 06cdf814387f…. Threat score 0/100. 0/25 AV engines flagged this file. 11 malicious and 26 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/06cdf814387f627a4bd05a0c68211f715bfa952423e8e8a462e1f47c11a4d20e","keywords":["Clean","malware analysis","sandbox report","threat intelligence","06cdf814387f627a4bd05a0c68211f715bfa952423e8e8a462e1f47c11a4d20e"],"about":{"@type":"SoftwareApplication","name":"emule.exe","applicationCategory":["peexe","executable"],"identifier":"06cdf814387f627a4bd05a0c68211f715bfa952423e8e8a462e1f47c11a4d20e","additionalType":"Clean sample"},"threatScore":0,"antivirusDetections":{"malicious":0,"total":25},"behavioralIndicators":{"malicious":11,"suspicious":26},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}22:T4a4,"\Sessions\1\BaseNamedObjects\EMULE-{4EADC6FC-516F-4b7c-9066-97D893649570}:4662" "EMULE-{4EADC6FC-516F-4b7c-9066-97D893649570}:4662" "\Sessions\1\BaseNamedObjects\Local\!BrowserEmulation!SharedMemory!Mutex" "\Sessions\1\BaseNamedObjects\Local\VERMGMTBlockListFileMutex" "\Sessions\1\BaseNamedObjects\Local\URLBLOCK_FILEMAPSWITCH_MUTEX_2248" "\Sessions\1\BaseNamedObjects\Local\URLBLOCK_HASHFILESWITCH_MUTEX" "\Sessions\1\BaseNamedObjects\Local\URLBLOCK_DOWNLOAD_MUTEX" "\Sessions\1\BaseNamedObjects\Local\ZonesCacheCounterMutex" "\Sessions\1\BaseNamedObjects\Local\ZonesLockedCacheCounterMutex" "\Sessions\1\BaseNamedObjects\IsoScope_8c8_IE_EarlyTabStart_0xae8_Mutex" "\Sessions\1\BaseNamedObjects\IsoScope_8c8_ConnHashTable<2248>_HashTable_Mutex" "\Sessions\1\BaseNamedObjects\{5312EE61-79E3-4A24-BFE1-132B85B23C3A}" "\Sessions\1\BaseNamedObjects\IsoScope_8c8_IESQMMUTEX_0_303" "\Sessions\1\BaseNamedObjects\IsoScope_8c8_IESQMMUTEX_0_331" "\Sessions\1\BaseNamedObjects\{66D0969A-1E86-44CF-B4EC-3806DDDA3B5D}" "{5312EE61-79E3-4A24-BFE1-132B85B23C3A}" "IsoScope_8c8_IESQMMUTEX_0_519" "IsoScope_8c8_ConnHashTable<2248>_HashTable_Mutex" "Local\ZonesLockedCacheCounterMutex"23:T1e81,"GET /connectiontest.php?tcpport=55479&udpport=8987&lang=1033 HTTP/1.1 Accept: text/html, application/xhtml+xml, */* Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: porttest.emule-project.net DNT: 1 Connection: Keep-Alive" "GET /home/perl/general.cgi?rm=porttest&tcpport=55479&udpport=8987&lang=1033&l=1 HTTP/1.1 Accept: text/html, application/xhtml+xml, */* Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate DNT: 1 Connection: Keep-Alive Host: www.emule-project.net" "GET /home/emule.css HTTP/1.1 Accept: text/css, */* Referer: http://www.emule-project.net/home/perl/general.cgi?rm=porttest&tcpport=55479&udpport=8987&lang=1033&l=1 Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: www.emule-project.net DNT: 1 Connection: Keep-Alive" "GET /home/img/top_bg.gif HTTP/1.1 Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5 Referer: http://www.emule-project.net/home/perl/general.cgi?rm=porttest&tcpport=55479&udpport=8987&lang=1033&l=1 Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: www.emule-project.net DNT: 1 Connection: Keep-Alive" "GET /home/img/logo_top.jpg HTTP/1.1 Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5 Referer: http://www.emule-project.net/home/perl/general.cgi?rm=porttest&tcpport=55479&udpport=8987&lang=1033&l=1 Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: www.emule-project.net DNT: 1 Connection: Keep-Alive" "GET /home/img/logo.jpg HTTP/1.1 Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5 Referer: http://www.emule-project.net/home/perl/general.cgi?rm=porttest&tcpport=55479&udpport=8987&lang=1033&l=1 Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: www.emule-project.net DNT: 1 Connection: Keep-Alive" "GET /images/de.jpg HTTP/1.1 Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5 Referer: http://www.emule-project.net/home/perl/general.cgi?rm=porttest&tcpport=55479&udpport=8987&lang=1033&l=1 Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: www.emule-project.net DNT: 1 Connection: Keep-Alive" "GET /images/uk.jpg HTTP/1.1 Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5 Referer: http://www.emule-project.net/home/perl/general.cgi?rm=porttest&tcpport=55479&udpport=8987&lang=1033&l=1 Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: www.emule-project.net DNT: 1 Connection: Keep-Alive" "GET /pagead/show_ads.js HTTP/1.1 Accept: application/javascript, */*;q=0.8 Referer: http://www.emule-project.net/home/perl/general.cgi?rm=porttest&tcpport=55479&udpport=8987&lang=1033&l=1 Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: pagead2.googlesyndication.com DNT: 1 Connection: Keep-Alive" "GET /images/fr.gif HTTP/1.1 Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5 Referer: http://www.emule-project.net/home/perl/general.cgi?rm=porttest&tcpport=55479&udpport=8987&lang=1033&l=1 Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: www.emule-project.net DNT: 1 Connection: Keep-Alive" "GET /images/he.jpg HTTP/1.1 Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5 Referer: http://www.emule-project.net/home/perl/general.cgi?rm=porttest&tcpport=55479&udpport=8987&lang=1033&l=1 Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: www.emule-project.net DNT: 1 Connection: Keep-Alive" "GET /images/cht.gif HTTP/1.1 Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5 Referer: http://www.emule-project.net/home/perl/general.cgi?rm=porttest&tcpport=55479&udpport=8987&lang=1033&l=1 Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: www.emule-project.net DNT: 1 Connection: Keep-Alive" "GET /images/es.gif HTTP/1.1 Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5 Referer: http://www.emule-project.net/home/perl/general.cgi?rm=porttest&tcpport=55479&udpport=8987&lang=1033&l=1 Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: www.emule-project.net DNT: 1 Connection: Keep-Alive" "GET /images/itaflag.jpg HTTP/1.1 Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5 Referer: http://www.emule-project.net/home/perl/general.cgi?rm=porttest&tcpport=55479&udpport=8987&lang=1033&l=1 Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: www.emule-project.net DNT: 1 Connection: Keep-Alive" "GET /images/pl.gif HTTP/1.1 Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5 Referer: http://www.emule-project.net/home/perl/general.cgi?rm=porttest&tcpport=55479&udpport=8987&lang=1033&l=1 Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: www.emule-project.net DNT: 1 Connection: Keep-Alive" "GET /home/img/mid_bg.gif HTTP/1.1 Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5 Referer: http://www.emule-project.net/home/perl/general.cgi?rm=porttest&tcpport=55479&udpport=8987&lang=1033&l=1 Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: www.emule-project.net DNT: 1 Connection: Keep-Alive" "GET /images/lt.gif HTTP/1.1 Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5 Referer: http://www.emule-project.net/home/perl/general.cgi?rm=porttest&tcpport=55479&udpport=8987&lang=1033&l=1 Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: www.emule-project.net DNT: 1 Connection: Keep-Alive" "GET /pagead/js/r20190128/r20180604/show_ads_impl.js HTTP/1.1 Accept: application/javascript, */*;q=0.8 Referer: http://www.emule-project.net/home/perl/general.cgi?rm=porttest&tcpport=55479&udpport=8987&lang=1033&l=1 Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: pagead2.googlesyndication.com DNT: 1 Connection: Keep-Alive" "GET /sflogo.php?group_id=53489&type=12 HTTP/1.1 Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5 Referer: http://www.emule-project.net/home/perl/general.cgi?rm=porttest&tcpport=55479&udpport=8987&lang=1033&l=1 Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: sflogo.sourceforge.net DNT: 1 Connection: Keep-Alive" "GET /images/ee.gif HTTP/1.1 Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5 Referer: http://www.emule-project.net/home/perl/general.cgi?rm=porttest&tcpport=55479&udpport=8987&lang=1033&l=1 Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: www.emule-project.net DNT: 1 Connection: Keep-Alive"24:T81f,"emule.exe" touched "Network" (Path: "HKCU\WOW6432NODE\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\SHELLFOLDER") "emule.exe" touched "Property System Both Class Factory" (Path: "HKCU\WOW6432NODE\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}") "emule.exe" touched "Application Registration" (Path: "HKCU\WOW6432NODE\CLSID\{591209C7-767B-42B2-9FBA-44EE4615F2C7}\TREATAS") "emule.exe" touched "Shell Drag and Drop helper" (Path: "HKCU\WOW6432NODE\CLSID\{4657278A-411B-11D2-839A-00C04FD918D0}\TREATAS") "emule.exe" touched "Enhanced Storage Icon Overlay Handler Class" (Path: "HKCU\WOW6432NODE\CLSID\{D9144DCD-E998-4ECA-AB6A-DCD83CCBA16D}\INPROCSERVER32") "emule.exe" touched "Groove Explorer Icon Overlay 1 (GFS Unread Stub)" (Path: "HKCU\WOW6432NODE\CLSID\{99FD978C-D287-4F50-827F-B2C658EDA8E7}\INPROCSERVER32") "emule.exe" touched "Groove Explorer Icon Overlay 2 (GFS Stub)" (Path: "HKCU\WOW6432NODE\CLSID\{AB5C5600-7E6E-4B06-9197-9ECEF74D31CC}\INPROCSERVER32") "emule.exe" touched "Groove Explorer Icon Overlay 2.5 (GFS Unread Folder)" (Path: "HKCU\WOW6432NODE\CLSID\{920E6DB1-9907-4370-B3A0-BAFC03D81399}\INPROCSERVER32") "emule.exe" touched "Groove Explorer Icon Overlay 3 (GFS Folder)" (Path: "HKCU\WOW6432NODE\CLSID\{16F3DD56-1AF5-4347-846D-7C10C4192619}\INPROCSERVER32") "emule.exe" touched "Groove Explorer Icon Overlay 4 (GFS Unread Mark)" (Path: "HKCU\WOW6432NODE\CLSID\{2916C86E-86A6-43FE-8112-43ABE6BF8DCC}\INPROCSERVER32") "emule.exe" touched "Microsoft AutoComplete" (Path: "HKCU\WOW6432NODE\CLSID\{00BB2763-6A77-11D0-A535-00C04FD7D062}\TREATAS") "emule.exe" touched "Microsoft TipAutoCompleteClient Control" (Path: "HKCU\WOW6432NODE\CLSID\{807C1E6C-1D00-453F-B920-B61BB7CDD997}\TREATAS") "emule.exe" touched "Computer" (Path: "HKCU\WOW6432NODE\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "emule.exe" touched "Task Bar Communication" (Path: "HKCU\WOW6432NODE\CLSID\{56FDF344-FD6D-11D0-958A-006097C9A090}\TREATAS") "emule.exe" touched "UPnPDeviceFinder Class" (Path: "HKCU\WOW6432NODE\CLSID\{E2085F28-FEB7-404A-B8E7-E659BDEAAA02}\TREATAS")25:T51f,"urlblockindex_1_.bin" has type "data" "pl_1_.gif" has type "GIF image data version 89a 23 x 15" "known.met" has type "data" "6BADA8974A10C4BD62CC921D13E43B18_BEB37ABADF39714871232B4792417E04" has type "data" "~DF4196E44446430BCF.TMP" has type "data" "result_err_1_.gif" has type "GIF image data version 89a 32 x 32" "shareddir.dat" has type "Little-endian UTF-16 Unicode text with no line terminators" "favicon_1_.ico" has type "PNG image data 16 x 16 4-bit colormap non-interlaced" "www.emule-project_1_.xml" has type "ASCII text with no line terminators" "se_1_.gif" has type "GIF image data version 89a 23 x 15" "fpt_1_.gif" has type "GIF image data version 89a 21 x 14" "~DF25452A5E49C9EBEE.TMP" has type "data" "cryptkey.dat" has type "ASCII text" "ca-pub-9652609043628988_1_.js" has type "ASCII text" "01B16CDBADE7DB774141D7E30D50EC69" has type "data" "RecoveryStore._8B54D661-2538-11E9-A156-0A0027C19E6D_.dat" has type "Composite Document File V2 Document Cannot read section info" "ee_1_.gif" has type "GIF image data version 89a 18 x 12" "_8B54D663-2538-11E9-A156-0A0027C19E6D_.dat" has type "Composite Document File V2 Document Cannot read section info" "connecting_1_.gif" has type "GIF image data version 89a 34 x 34" "mid_bg_1_.gif" has type "GIF image data version 89a 10 x 62"26:Te89,Pattern match: "http://www.microsoft.com/downloads/details.aspx?FamilyId=73BA7BD7-ED06-4F0D-80A4-2A7EEAEE17E2" Pattern match: "http://%s/.ed2khash=%s" Heuristic match: "vcdns2.emule-project.org" Pattern match: "http://mediainfo.sourceforge.net" Pattern match: "http://schemas.xmlsoap.org/soap/envelope/" Pattern match: "http://schemas.microsoft.com/intellisense/ie5/" Pattern match: "http://www.emule-project.net" Pattern match: "www.|.de" Pattern match: "http://onlinehelp.emule-project.net/help.php?language=%u&topic=%u" Pattern match: "http://www.microsoft.com/downloads/details.aspx?FamilyID=cb2cf3a2-8025-4e8f-8511-9b476a8d35d2" Pattern match: "http://www.rarlab.com" Pattern match: "http://porttest.emule-project.net/connectiontest.php?tcpport=%i&udpport=%i&lang=%i" Heuristic match: "%u.%u.%u.%u.IN-ADDR.ARPA" Pattern match: "http://sourceforge.net/projects/emule/" Pattern match: "http://www.emuleproject.net" Pattern match: "http://emule.sf.net" Pattern match: "http://www%i.emule-project.com" Pattern match: "http://www%i.emule-project.org" Pattern match: "http://www%i.emule-project.net" Pattern match: "http://www.emule-project.com" Pattern match: "http://www.emule-project.org" Pattern match: "http://emule-project.net" Pattern match: "http://vcheck%i.emule-project.com" Pattern match: "http://vcheck%i.emule-project.org" Pattern match: "http://vcheck.emule-project.net" Pattern match: "www.|.com|.de|.org|.net|shared|powered|sponsored|sharelive|filedonkey|" Pattern match: "http://|https://|ftp://|www.|ftp" Heuristic match: "ircchat.emule-project.net" Pattern match: "http://miniupnp.free.fr/" Pattern match: "http://kademlia.scs.cs.nyu.edu" Pattern match: "http://langmirror%i.emule-project.org/lang/%i%i%i%i/" Pattern match: "http://mobil.emule-project.net" Pattern match: "http://www.filedonkey.com/search.html" Pattern match: "http://sourceforge.net/projects/mediainfo/" Heuristic match: "porttest.emule-project.net" Pattern match: "www.emule-project.net" Pattern match: "http://www.emule-project.net/home/perl/general.cgi?rm=porttest&tcpport=55479&udpport=8987&lang=1033&l=1" Heuristic match: "pagead2.googlesyndication.com" Heuristic match: "sflogo.sourceforge.net" Heuristic match: "DefaultIRCServerNew=ircchat.emule-project.net" Pattern match: "http://porttest.emule-project.net/connectiontest.php?tcpport=55479&udpport=8987&lang=1033" Heuristic match: "et |.com |.org |.to |.tk |.cc |.fr |ftp:|ed2k:|https:|ftp.|.info|.biz|.uk|.eu|.es|.tv|.cn|.tw|.ws|.nu|.jp" Pattern match: "onlinehelp.emule-project.net/help.php?language=%u&topic=%u" Pattern match: "emule-project.net/connectiontest.php?tcpport=%i&udpport=%i&lang=%i" Heuristic match: ".%u.%u.%u.IN-ADDR.ARPA" Pattern match: "http://%s:%u/.p2pinfo" Heuristic match: "leproject.net" Heuristic match: ".sf.net" Heuristic match: "/www%i.emule-project.com" Heuristic match: "ject.org" Heuristic match: "/www%i.emule-project.net" Heuristic match: "ct.com" Pattern match: "www.emule-project.org" Heuristic match: "ule-project.net" Pattern match: "i.emule-project.org/lang/%i%i%i%i/" Heuristic match: ".emule-project.net" Pattern match: "www.filedonkey.com/search.html" Pattern match: "http://forum.emule-project.net" Heuristic match: "w.emule-project.net" Pattern match: "www.emule-project.net/emule.ico" Pattern match: "pagead2.googlesyndication.com/pagead/show_ads.js" Pattern match: "http://contentdb.emule-project.net" Pattern match: "http://sourceforge.net/projects/emule" Pattern match: "http://porttest.emule-project.net:81/ct_frame.php?lang=1033&tcpport=55479&udpport=8987" Pattern match: "http://porttest.emule-project.net:81/ct_noframe.php?lang=1033&tcpport=55479&udpport=8987"27:T91e,"emule.exe" wrote bytes "b4360200" to virtual address "0x75284D68" (part of module "SSPICLI.DLL") "emule.exe" wrote bytes "68130000" to virtual address "0x75621680" (part of module "WS2_32.DLL") "emule.exe" wrote bytes "711164017a3b6301ab8b02007f950200fc8c0200729602006cc805001ecd60017d266001" to virtual address "0x764007E4" (part of module "USER32.DLL") "emule.exe" wrote bytes "c0df9e771cf99d77ccf89d770d649f7700000000c0119a7600000000fc3e9a7600000000e0139a76000000009457fd7625e09e77c6e09e7700000000bc6afc7600000000cf319a76000000009319fd76000000002c329a7600000000" to virtual address "0x76861000" (part of module "NSI.DLL") "emule.exe" wrote bytes "d83a2875" to virtual address "0x752901E0" (part of module "SSPICLI.DLL") "emule.exe" wrote bytes "b4362875" to virtual address "0x75290200" (part of module "SSPICLI.DLL") "emule.exe" wrote bytes "b83012b573ffe0" to virtual address "0x75621368" (part of module "WS2_32.DLL") "emule.exe" wrote bytes "b4360200" to virtual address "0x75284EA4" (part of module "SSPICLI.DLL") "emule.exe" wrote bytes "7d07a27781eda077ae869f77c6e09e77effda1772d16a0776014a277478d9f77a8e29e7760899f7700000000ad3762758b2d6275b641627500000000" to virtual address "0x734C1000" (part of module "GROOVEEX.DLL") "emule.exe" wrote bytes "b4362875" to virtual address "0x752901E4" (part of module "SSPICLI.DLL") "emule.exe" wrote bytes "0674eca6" to virtual address "0x72DFB9F0" (part of module "GROOVEEX.DLL") "emule.exe" wrote bytes "b84013b573ffe0" to virtual address "0x75283AD8" (part of module "SSPICLI.DLL") "emule.exe" wrote bytes "d83a0200" to virtual address "0x75284E38" (part of module "SSPICLI.DLL") "emule.exe" wrote bytes "d83a0200" to virtual address "0x75284D78" (part of module "SSPICLI.DLL") "emule.exe" wrote bytes "d83a2875" to virtual address "0x75290258" (part of module "SSPICLI.DLL") "emule.exe" wrote bytes "b4362875" to virtual address "0x75290278" (part of module "SSPICLI.DLL") "emule.exe" wrote bytes "14cdb274c601050000000000000000000000" to virtual address "0x004AFF78" "emule.exe" wrote bytes "6012b573" to virtual address "0x7757E324" (part of module "WININET.DLL") "emule.exe" wrote bytes "b4362875" to virtual address "0x7529025C" (part of module "SSPICLI.DLL") "emule.exe" wrote bytes "d83a2875" to virtual address "0x752901FC" (part of module "SSPICLI.DLL")28:T22a1,Found malicious artifacts related to "152.199.19.161": ... URL: http://152.199.19.161:49201/ (AV positives: 1/69 scanned on 01/30/2019 07:05:03) URL: http://152.199.19.161/ (AV positives: 1/69 scanned on 01/28/2019 14:57:35) URL: https://152.199.19.161/ (AV positives: 1/66 scanned on 01/18/2019 20:37:48) File SHA256: 2fab102252440446356d62075e55f8db23b9feda60b5902546fa9f36ed3bea08 (AV positives: 47/71 scanned on 01/31/2019 07:16:45) File SHA256: 1386a9c85deae8ba97e1a9aaa479d95f8402344bf422d7bb92bcf15326deea19 (AV positives: 47/71 scanned on 01/31/2019 07:16:42) File SHA256: d58b8903a77f5845dcf72444dfbaa47ca9cd19bac95bc364802c24de7c41ac09 (AV positives: 47/71 scanned on 01/31/2019 07:15:18) File SHA256: 1346d5d36adaf3be0399ff7b5d9c7a92fc01ca1ef486e90e5eabd63fd1e1d3d7 (AV positives: 47/71 scanned on 01/31/2019 07:13:35) File SHA256: be5412acd270f956445ff0bbb8fa5118114b7dd13b182defb31abde9f1ee1be8 (AV positives: 47/71 scanned on 01/31/2019 07:12:04) File SHA256: 9d85a4320ead72ec486c92c03b37f7d4d7b2480c9c3da2ca529ef9e09cf2c93f (Date: 01/30/2019 17:44:02) File SHA256: 1c3cc06f600fd53933f0be95077ff97a08adc60eae82735f7f88f2617c127951 (Date: 01/30/2019 17:41:45) File SHA256: 38d7c7fddc147c8420fd7f90492e8291a390d82a2b3a9a873bd8ad9f26be333b (Date: 01/30/2019 17:38:57) File SHA256: 28c045fba238849674b41c46d6d000a5d4483c1669bc7caae109f1723fe546d3 (Date: 01/30/2019 17:26:57) File SHA256: a7d6507bb9a6a15d0ed5c168b5f2104980ab14b550b804a45ecfc972dced81f4 (Date: 01/30/2019 17:25:30) Found malicious artifacts related to "216.58.198.194": ... File SHA256: 122f580411e63cdb488864dc525978652fe624ba5f522dae370d9ea5ccc31b16 (AV positives: 58/71 scanned on 01/31/2019 03:22:42) File SHA256: 0c28581a0350a00367307ff9561dd56a1b9837792fc97f4896a5e1b8ab6edb84 (AV positives: 60/71 scanned on 01/30/2019 20:24:35) File SHA256: b51afb6b2d5f4fd1a470f8949bf6962e2cc138f2b84365676c19689470df7d18 (AV positives: 60/70 scanned on 01/30/2019 20:23:39) File SHA256: e5a36317da65a41c719d81139efd702e5991be882d76655284cf8d8d74a57f68 (AV positives: 55/70 scanned on 01/30/2019 14:36:11) File SHA256: bca677dc79daae791570979aee57cf6cfcf8c265988e7baf6f34f07c0d706259 (AV positives: 59/69 scanned on 01/30/2019 14:04:11) File SHA256: 1d56104d351398e1080e6cd3b0834a4afb7a05a977402d3fcd5e42b0e3ab99f6 (Date: 05/04/2018 02:44:38) File SHA256: 7223f2dbc1222ec78a26e60e5875ff42a4c125abdd97169162f05a9938b83b75 (Date: 03/05/2018 12:51:10) File SHA256: ca7e5e87efa83da5130afb0f6fea66bb7b7a0451a6eb887ae892d8945b82da59 (Date: 03/05/2018 09:32:36) File SHA256: 81985d845671203b5a778a403a37b16c086bd84fff04a06eb32f4b8c835ef982 (Date: 01/09/2018 10:50:47) File SHA256: 4378533e026efb797b1601a1c817082c5146752ebb9a91fc46fe78c39e50cfd6 (Date: 01/09/2018 06:44:18) Found malicious artifacts related to "216.105.38.13": ... URL: http://sourceforge.net/projects/orwelldevcpp/files/Setup%20Releases/Dev-Cpp%205.11%20TDM-GCC%204.9.2%20Setup.exe/download (AV positives: 1/70 scanned on 01/28/2019 01:11:52) URL: http://downloads.sourceforge.net/project/filezilla/FileZilla%20Server/0.9.44/FileZilla_Server-0_9_44.exe?r=&ts=1397038664&use_mirror=iweb&secret=fdcca4c49ed101c2ad098582d4152bd5b8f475cb3a04bc04d3a708ff03be9cf6 (AV positives: 1/66 scanned on 01/23/2019 06:27:51) URL: https://downloads.sourceforge.net/project/sih/sih.3.6.0.0.exe?r=https%3A%2F%2Fappnee.com%2Fsilent-install-helper%2F&ts=1548223555&use_mirror=excellmedia (AV positives: 1/66 scanned on 01/23/2019 06:06:30) URL: https://downloads.sourceforge.net/project/loic/loic/loic-1.0.8/LOIC-1.0.8-binary.zip?r=https://sourceforge.net/projects/loic/&ts=1542262717&use_mirror=nchc (AV positives: 1/66 scanned on 01/15/2019 02:09:39) URL: https://downloads.sourceforge.net/project/highorbitioncannon/Hoic.rar?r=https://sourceforge.net/projects/highorbitioncannon/&ts=1541476693&use_mirror=netix (AV positives: 1/66 scanned on 01/13/2019 12:14:23) File SHA256: b080c795976b2b9ecd24ae8c312a71d73dad9c11ad0def7c426ce1bce362efc8 (AV positives: 1/59 scanned on 01/31/2019 06:39:40) File SHA256: 5454f16e5f397b617bb96f1682cd63b8278e8c09a992d67114137ed659327658 (AV positives: 1/69 scanned on 01/31/2019 07:17:55) File SHA256: b6d6e0d1dce867836a684a0af278e46ed4a50be49a784ab7bfcb3ed59841c9d0 (AV positives: 35/55 scanned on 01/28/2019 13:46:24) File SHA256: 61feff516a8e36daa5ee5704c7e8ab2ad9adcd4390b3cfe84088e26b9f743a09 (AV positives: 2/70 scanned on 01/28/2019 07:30:56) File SHA256: 3bd7f0d9de4ad88f06b2f684a141c1ac2453d339d2dc49cc584da28a67ec5317 (AV positives: 2/57 scanned on 01/28/2019 05:13:14) File SHA256: 28ba964041d934745ecbbdc6440cd3b248ae70a5f61575bea425271414b31bff (Date: 01/27/2019 08:41:09) File SHA256: c866f47f362ee88c5e72aa20f9f8d3d9ffb8a5fcba69125fce19575fd4481b4a (Date: 01/27/2019 08:24:44) File SHA256: 9ec502506bf666dcca46ba2a40d09ae766e6c0ffe27fa0005424d69d443d9c97 (Date: 01/27/2019 07:39:52) File SHA256: ea4287b295a6ae53199bd316c759fd2e7cd1fc4f03f0bacd7c58fee6fd3c641d (Date: 01/22/2019 01:13:01) File SHA256: a61796abbcc3ec0f476277410d3215b3ceb97dd708bf06e1bffd93d94f2de785 (Date: 01/20/2019 19:08:39) Found malicious artifacts related to "216.58.213.130": ... File SHA256: 33a226d851aef649a40aa0888b2201f3de9f483e40683fb23dae6c3f5c912523 (AV positives: 57/71 scanned on 01/30/2019 14:39:57) File SHA256: 119bbb6074b356b1ecb1465478824abd09d1701012015babf0c5bc1f86510d43 (AV positives: 56/71 scanned on 01/30/2019 14:24:11) File SHA256: c920fb38a6b40dc33b92570e1d4e6cd6747223e31d934b718ff53659d1f70170 (AV positives: 59/71 scanned on 01/29/2019 21:27:25) File SHA256: e22f0274d6b4790b065c4db46b93c33f937fd8265639c1d30a1d3be60d19406c (AV positives: 55/70 scanned on 01/29/2019 14:50:36) File SHA256: 6125a2d162be9b30d710f0effe50d61436b7a30487fade282278f70d61b8f9f1 (AV positives: 1/70 scanned on 01/29/2019 08:54:17) File SHA256: 7c208e7307a574d7ae3dd09fda7738f43c60dc9025371a207a0efe8fe71bf240 (Date: 05/26/2018 03:14:51) File SHA256: 6646491d9d2c0552cda707bd00e864af26ad543eaff8bdb7135783083a82b3d0 (Date: 03/03/2018 23:08:02) File SHA256: 098c27166981526d5b38defc3f2d1989cf95436c8c6b2124bdaf81064c0f0965 (Date: 03/03/2018 22:24:34) File SHA256: f31e44b3409d426a1f8d1dae059e50df7fb0da464d291a85149dc951304d8439 (Date: 12/23/2017 09:34:02) File SHA256: 5c54704d7ed59c0bed413fe7f25bb4f1b1c51c3e4dd473ea4a35f1d7a87cc9af (Date: 12/22/2017 20:22:04) Found malicious artifacts related to "216.58.198.195": ... File SHA256: 5cb11d1617eb4ddef6b9c2883d4c424ab56c1b1c69f839e94eeb58e34beef7bc (AV positives: 54/71 scanned on 01/30/2019 22:52:50) File SHA256: 8ceb42019bf498da27f257a252f7f998a7ac562e077f31cc5932216c31403b4e (AV positives: 56/71 scanned on 01/30/2019 10:57:25) File SHA256: 1918abba423720704ae8ed212cf0463f16833b3d7072f68702be3322b8aabb47 (AV positives: 55/69 scanned on 01/30/2019 04:55:17) File SHA256: f64d1ec00b802d5036642c35846a00e1217219f7d145c981e5af42db45117db0 (AV positives: 48/71 scanned on 01/29/2019 22:23:51) File SHA256: 454da4a3f606122b6a7351e37977389bf164476438250753411e82d972671221 (AV positives: 54/71 scanned on 01/29/2019 21:46:40) File SHA256: b62c0fea4cbe3ab4fa18957ace18b93ef64a0856215a20749021a869c5eeb6ee (Date: 01/02/2019 01:04:30) File SHA256: 832037409a947ad4258f23892cba8c51e4acfbb43b8392ce101ab2196167db25 (Date: 01/01/2019 15:46:08) File SHA256: 935f7717f9cbe885a14a18c649b6946a04d70f7ccdabb7edc0a5400e98fe28c4 (Date: 01/01/2019 13:09:19) File SHA256: 84b5faf937068ce48141e3bdace4285a3bca0a35a77665704d4b6ee64db68aea (Date: 01/01/2019 08:24:51) File SHA256: 363d5eb54b1a84b1852a244c3e0671de91925b392e7f8866fbcbbd11e61214b6 (Date: 01/01/2019 07:02:37) Found malicious artifacts related to "172.217.22.131": ... File SHA256: 5cb11d1617eb4ddef6b9c2883d4c424ab56c1b1c69f839e94eeb58e34beef7bc (AV positives: 54/71 scanned on 01/30/2019 22:52:50) File SHA256: 8f2f69348f49adf18b226169e4ef8dc0665a7ccd54b10a89b2dd514686257c02 (AV positives: 54/71 scanned on 01/29/2019 21:46:39) File SHA256: 341fcfd9070df89371695b445f48c777f8eed4bfac006fd1be6991c4599a66e1 (AV positives: 48/71 scanned on 01/29/2019 22:44:00) File SHA256: 806858f5e494362d100c67eb9652911130e81a7a5624bc384657cf9e9744150b (AV positives: 59/71 scanned on 01/28/2019 21:40:10) File SHA256: 0682e20b98cd407682f9ece986efaf9b7894cb1028ee53ca6c4fc225968a4b37 (AV positives: 59/71 scanned on 01/27/2019 22:29:19) File SHA256: 7d5824c3063c38fa9f78f886c1991a3aed15c9f5348ba0c2e23421e92eab9ee1 (Date: 01/22/2019 23:04:47) File SHA256: 968748305bff444397a703815994feb9f93a992acaf779adf3c5b75c3c6af3b9 (Date: 01/22/2019 21:50:56) File SHA256: ff116ba9e8393fe0d1225e85a7354fc2aeaa5ac3edb20a6c784917d334f31d30 (Date: 01/05/2019 04:06:16) File SHA256: 8252bdb5f7f7de6fb18e3f5b6ee971e422eee9b423a98b19832f280fbad4afa8 (Date: 01/03/2019 03:27:23) File SHA256: 41e1def3e7efeca7e4898613c555f752cd7d8c166c02d779152034eae3338baa (Date: 01/01/2019 23:39:08)29:T22a1,Found malicious artifacts related to "152.199.19.161": ... URL: http://152.199.19.161:49201/ (AV positives: 1/69 scanned on 01/30/2019 07:05:03) URL: http://152.199.19.161/ (AV positives: 1/69 scanned on 01/28/2019 14:57:35) URL: https://152.199.19.161/ (AV positives: 1/66 scanned on 01/18/2019 20:37:48) File SHA256: 2fab102252440446356d62075e55f8db23b9feda60b5902546fa9f36ed3bea08 (AV positives: 47/71 scanned on 01/31/2019 07:16:45) File SHA256: 1386a9c85deae8ba97e1a9aaa479d95f8402344bf422d7bb92bcf15326deea19 (AV positives: 47/71 scanned on 01/31/2019 07:16:42) File SHA256: d58b8903a77f5845dcf72444dfbaa47ca9cd19bac95bc364802c24de7c41ac09 (AV positives: 47/71 scanned on 01/31/2019 07:15:18) File SHA256: 1346d5d36adaf3be0399ff7b5d9c7a92fc01ca1ef486e90e5eabd63fd1e1d3d7 (AV positives: 47/71 scanned on 01/31/2019 07:13:35) File SHA256: be5412acd270f956445ff0bbb8fa5118114b7dd13b182defb31abde9f1ee1be8 (AV positives: 47/71 scanned on 01/31/2019 07:12:04) File SHA256: 9d85a4320ead72ec486c92c03b37f7d4d7b2480c9c3da2ca529ef9e09cf2c93f (Date: 01/30/2019 17:44:02) File SHA256: 1c3cc06f600fd53933f0be95077ff97a08adc60eae82735f7f88f2617c127951 (Date: 01/30/2019 17:41:45) File SHA256: 38d7c7fddc147c8420fd7f90492e8291a390d82a2b3a9a873bd8ad9f26be333b (Date: 01/30/2019 17:38:57) File SHA256: 28c045fba238849674b41c46d6d000a5d4483c1669bc7caae109f1723fe546d3 (Date: 01/30/2019 17:26:57) File SHA256: a7d6507bb9a6a15d0ed5c168b5f2104980ab14b550b804a45ecfc972dced81f4 (Date: 01/30/2019 17:25:30) Found malicious artifacts related to "216.58.198.194": ... File SHA256: 122f580411e63cdb488864dc525978652fe624ba5f522dae370d9ea5ccc31b16 (AV positives: 58/71 scanned on 01/31/2019 03:22:42) File SHA256: 0c28581a0350a00367307ff9561dd56a1b9837792fc97f4896a5e1b8ab6edb84 (AV positives: 60/71 scanned on 01/30/2019 20:24:35) File SHA256: b51afb6b2d5f4fd1a470f8949bf6962e2cc138f2b84365676c19689470df7d18 (AV positives: 60/70 scanned on 01/30/2019 20:23:39) File SHA256: e5a36317da65a41c719d81139efd702e5991be882d76655284cf8d8d74a57f68 (AV positives: 55/70 scanned on 01/30/2019 14:36:11) File SHA256: bca677dc79daae791570979aee57cf6cfcf8c265988e7baf6f34f07c0d706259 (AV positives: 59/69 scanned on 01/30/2019 14:04:11) File SHA256: 1d56104d351398e1080e6cd3b0834a4afb7a05a977402d3fcd5e42b0e3ab99f6 (Date: 05/04/2018 02:44:38) File SHA256: 7223f2dbc1222ec78a26e60e5875ff42a4c125abdd97169162f05a9938b83b75 (Date: 03/05/2018 12:51:10) File SHA256: ca7e5e87efa83da5130afb0f6fea66bb7b7a0451a6eb887ae892d8945b82da59 (Date: 03/05/2018 09:32:36) File SHA256: 81985d845671203b5a778a403a37b16c086bd84fff04a06eb32f4b8c835ef982 (Date: 01/09/2018 10:50:47) File SHA256: 4378533e026efb797b1601a1c817082c5146752ebb9a91fc46fe78c39e50cfd6 (Date: 01/09/2018 06:44:18) Found malicious artifacts related to "216.105.38.13": ... URL: http://sourceforge.net/projects/orwelldevcpp/files/Setup%20Releases/Dev-Cpp%205.11%20TDM-GCC%204.9.2%20Setup.exe/download (AV positives: 1/70 scanned on 01/28/2019 01:11:52) URL: http://downloads.sourceforge.net/project/filezilla/FileZilla%20Server/0.9.44/FileZilla_Server-0_9_44.exe?r=&ts=1397038664&use_mirror=iweb&secret=fdcca4c49ed101c2ad098582d4152bd5b8f475cb3a04bc04d3a708ff03be9cf6 (AV positives: 1/66 scanned on 01/23/2019 06:27:51) URL: https://downloads.sourceforge.net/project/sih/sih.3.6.0.0.exe?r=https%3A%2F%2Fappnee.com%2Fsilent-install-helper%2F&ts=1548223555&use_mirror=excellmedia (AV positives: 1/66 scanned on 01/23/2019 06:06:30) URL: https://downloads.sourceforge.net/project/loic/loic/loic-1.0.8/LOIC-1.0.8-binary.zip?r=https://sourceforge.net/projects/loic/&ts=1542262717&use_mirror=nchc (AV positives: 1/66 scanned on 01/15/2019 02:09:39) URL: https://downloads.sourceforge.net/project/highorbitioncannon/Hoic.rar?r=https://sourceforge.net/projects/highorbitioncannon/&ts=1541476693&use_mirror=netix (AV positives: 1/66 scanned on 01/13/2019 12:14:23) File SHA256: b080c795976b2b9ecd24ae8c312a71d73dad9c11ad0def7c426ce1bce362efc8 (AV positives: 1/59 scanned on 01/31/2019 06:39:40) File SHA256: 5454f16e5f397b617bb96f1682cd63b8278e8c09a992d67114137ed659327658 (AV positives: 1/69 scanned on 01/31/2019 07:17:55) File SHA256: b6d6e0d1dce867836a684a0af278e46ed4a50be49a784ab7bfcb3ed59841c9d0 (AV positives: 35/55 scanned on 01/28/2019 13:46:24) File SHA256: 61feff516a8e36daa5ee5704c7e8ab2ad9adcd4390b3cfe84088e26b9f743a09 (AV positives: 2/70 scanned on 01/28/2019 07:30:56) File SHA256: 3bd7f0d9de4ad88f06b2f684a141c1ac2453d339d2dc49cc584da28a67ec5317 (AV positives: 2/57 scanned on 01/28/2019 05:13:14) File SHA256: 28ba964041d934745ecbbdc6440cd3b248ae70a5f61575bea425271414b31bff (Date: 01/27/2019 08:41:09) File SHA256: c866f47f362ee88c5e72aa20f9f8d3d9ffb8a5fcba69125fce19575fd4481b4a (Date: 01/27/2019 08:24:44) File SHA256: 9ec502506bf666dcca46ba2a40d09ae766e6c0ffe27fa0005424d69d443d9c97 (Date: 01/27/2019 07:39:52) File SHA256: ea4287b295a6ae53199bd316c759fd2e7cd1fc4f03f0bacd7c58fee6fd3c641d (Date: 01/22/2019 01:13:01) File SHA256: a61796abbcc3ec0f476277410d3215b3ceb97dd708bf06e1bffd93d94f2de785 (Date: 01/20/2019 19:08:39) Found malicious artifacts related to "216.58.213.130": ... File SHA256: 33a226d851aef649a40aa0888b2201f3de9f483e40683fb23dae6c3f5c912523 (AV positives: 57/71 scanned on 01/30/2019 14:39:57) File SHA256: 119bbb6074b356b1ecb1465478824abd09d1701012015babf0c5bc1f86510d43 (AV positives: 56/71 scanned on 01/30/2019 14:24:11) File SHA256: c920fb38a6b40dc33b92570e1d4e6cd6747223e31d934b718ff53659d1f70170 (AV positives: 59/71 scanned on 01/29/2019 21:27:25) File SHA256: e22f0274d6b4790b065c4db46b93c33f937fd8265639c1d30a1d3be60d19406c (AV positives: 55/70 scanned on 01/29/2019 14:50:36) File SHA256: 6125a2d162be9b30d710f0effe50d61436b7a30487fade282278f70d61b8f9f1 (AV positives: 1/70 scanned on 01/29/2019 08:54:17) File SHA256: 7c208e7307a574d7ae3dd09fda7738f43c60dc9025371a207a0efe8fe71bf240 (Date: 05/26/2018 03:14:51) File SHA256: 6646491d9d2c0552cda707bd00e864af26ad543eaff8bdb7135783083a82b3d0 (Date: 03/03/2018 23:08:02) File SHA256: 098c27166981526d5b38defc3f2d1989cf95436c8c6b2124bdaf81064c0f0965 (Date: 03/03/2018 22:24:34) File SHA256: f31e44b3409d426a1f8d1dae059e50df7fb0da464d291a85149dc951304d8439 (Date: 12/23/2017 09:34:02) File SHA256: 5c54704d7ed59c0bed413fe7f25bb4f1b1c51c3e4dd473ea4a35f1d7a87cc9af (Date: 12/22/2017 20:22:04) Found malicious artifacts related to "216.58.198.195": ... File SHA256: 5cb11d1617eb4ddef6b9c2883d4c424ab56c1b1c69f839e94eeb58e34beef7bc (AV positives: 54/71 scanned on 01/30/2019 22:52:50) File SHA256: 8ceb42019bf498da27f257a252f7f998a7ac562e077f31cc5932216c31403b4e (AV positives: 56/71 scanned on 01/30/2019 10:57:25) File SHA256: 1918abba423720704ae8ed212cf0463f16833b3d7072f68702be3322b8aabb47 (AV positives: 55/69 scanned on 01/30/2019 04:55:17) File SHA256: f64d1ec00b802d5036642c35846a00e1217219f7d145c981e5af42db45117db0 (AV positives: 48/71 scanned on 01/29/2019 22:23:51) File SHA256: 454da4a3f606122b6a7351e37977389bf164476438250753411e82d972671221 (AV positives: 54/71 scanned on 01/29/2019 21:46:40) File SHA256: b62c0fea4cbe3ab4fa18957ace18b93ef64a0856215a20749021a869c5eeb6ee (Date: 01/02/2019 01:04:30) File SHA256: 832037409a947ad4258f23892cba8c51e4acfbb43b8392ce101ab2196167db25 (Date: 01/01/2019 15:46:08) File SHA256: 935f7717f9cbe885a14a18c649b6946a04d70f7ccdabb7edc0a5400e98fe28c4 (Date: 01/01/2019 13:09:19) File SHA256: 84b5faf937068ce48141e3bdace4285a3bca0a35a77665704d4b6ee64db68aea (Date: 01/01/2019 08:24:51) File SHA256: 363d5eb54b1a84b1852a244c3e0671de91925b392e7f8866fbcbbd11e61214b6 (Date: 01/01/2019 07:02:37) Found malicious artifacts related to "172.217.22.131": ... File SHA256: 5cb11d1617eb4ddef6b9c2883d4c424ab56c1b1c69f839e94eeb58e34beef7bc (AV positives: 54/71 scanned on 01/30/2019 22:52:50) File SHA256: 8f2f69348f49adf18b226169e4ef8dc0665a7ccd54b10a89b2dd514686257c02 (AV positives: 54/71 scanned on 01/29/2019 21:46:39) File SHA256: 341fcfd9070df89371695b445f48c777f8eed4bfac006fd1be6991c4599a66e1 (AV positives: 48/71 scanned on 01/29/2019 22:44:00) File SHA256: 806858f5e494362d100c67eb9652911130e81a7a5624bc384657cf9e9744150b (AV positives: 59/71 scanned on 01/28/2019 21:40:10) File SHA256: 0682e20b98cd407682f9ece986efaf9b7894cb1028ee53ca6c4fc225968a4b37 (AV positives: 59/71 scanned on 01/27/2019 22:29:19) File SHA256: 7d5824c3063c38fa9f78f886c1991a3aed15c9f5348ba0c2e23421e92eab9ee1 (Date: 01/22/2019 23:04:47) File SHA256: 968748305bff444397a703815994feb9f93a992acaf779adf3c5b75c3c6af3b9 (Date: 01/22/2019 21:50:56) File SHA256: ff116ba9e8393fe0d1225e85a7354fc2aeaa5ac3edb20a6c784917d334f31d30 (Date: 01/05/2019 04:06:16) File SHA256: 8252bdb5f7f7de6fb18e3f5b6ee971e422eee9b423a98b19832f280fbad4afa8 (Date: 01/03/2019 03:27:23) File SHA256: 41e1def3e7efeca7e4898613c555f752cd7d8c166c02d779152034eae3338baa (Date: 01/01/2019 23:39:08)2a:T4e4,"emule.exe" called "FindResourceW" with parameter "1362" - (UID: 00000000-00002716) "emule.exe" called "FindResourceW" with parameter "28" - (UID: 00000000-00002716) "emule.exe" called "FindResourceW" with parameter "24" - (UID: 00000000-00002716) "emule.exe" called "FindResourceW" with parameter "45" - (UID: 00000000-00002716) "emule.exe" called "FindResourceW" with parameter "23" - (UID: 00000000-00002716) "emule.exe" called "FindResourceW" with parameter "94" - (UID: 00000000-00002716) "emule.exe" called "FindResourceW" with parameter "21" - (UID: 00000000-00002716) "emule.exe" called "FindResourceW" with parameter "102" - (UID: 00000000-00002716) "emule.exe" called "FindResourceW" with parameter "2300" - (UID: 00000000-00002716) "emule.exe" called "FindResourceW" with parameter "3574020" - (UID: 00000000-00002716) "emule.exe" called "FindResourceW" with parameter "7" - (UID: 00000000-00002716) "emule.exe" called "FindResourceW" with parameter "49" - (UID: 00000000-00002716) "emule.exe" called "FindResourceW" with parameter "14" - (UID: 00000000-00002716) "emule.exe" called "FindResourceW" with parameter "74" - (UID: 00000000-00002716) "emule.exe" called "FindResourceW" with parameter "27" - (UID: 00000000-00002716)2b:T6f3,"emule.exe" called "LoadResource with parameter {'hModule': '65536', 'hResInfo': '6349920'}" (UID: 00000000-00002716) "emule.exe" called "LoadResource with parameter {'hModule': '65536', 'hResInfo': '6363056'}" (UID: 00000000-00002716) "emule.exe" called "LoadResource with parameter {'hModule': '65536', 'hResInfo': '6362992'}" (UID: 00000000-00002716) "emule.exe" called "LoadResource with parameter {'hModule': '65536', 'hResInfo': '6363328'}" (UID: 00000000-00002716) "emule.exe" called "LoadResource with parameter {'hModule': '65536', 'hResInfo': '6362976'}" (UID: 00000000-00002716) "emule.exe" called "LoadResource with parameter {'hModule': '65536', 'hResInfo': '6364112'}" (UID: 00000000-00002716) "emule.exe" called "LoadResource with parameter {'hModule': '65536', 'hResInfo': '6362944'}" (UID: 00000000-00002716) "emule.exe" called "LoadResource with parameter {'hModule': '65536', 'hResInfo': '6361728'}" (UID: 00000000-00002716) "emule.exe" called "LoadResource with parameter {'hModule': '65536', 'hResInfo': '6362208'}" (UID: 00000000-00002716) "emule.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '6349904'}" (UID: 00000000-00002716) "emule.exe" called "LoadResource with parameter {'hModule': '65536', 'hResInfo': '6362720'}" (UID: 00000000-00002716) "emule.exe" called "LoadResource with parameter {'hModule': '65536', 'hResInfo': '6363392'}" (UID: 00000000-00002716) "emule.exe" called "LoadResource with parameter {'hModule': '65536', 'hResInfo': '6362832'}" (UID: 00000000-00002716) "emule.exe" called "LoadResource with parameter {'hModule': '65536', 'hResInfo': '6363792'}" (UID: 00000000-00002716) "emule.exe" called "LoadResource with parameter {'hModule': '65536', 'hResInfo': '6363040'}" (UID: 00000000-00002716)2c:T43e,Found reference to API "Pinger: LoadLibrary() failed: Unable to locate ICMP.DLL!" (Indicator: "LoadLibrary"; File: "emule.exe") Found reference to API "Pinger: LoadLibrary() failed: Unable to locate ICMP.DLL!" (Indicator: "LoadLibrary"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp, 00000000-00002716.00000001.68293.72677000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp, 00000000-00002716.00000001.68293.72677000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00002716.00000001.68293.72677000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00002716.00000001.68293.72677000.00000002.mdmp")2d:T4f5,Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; File: "emule.exe") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; File: "emule.exe") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/`" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/`" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp")2e:T102d,Assembly shows XOR instruction xor eax esp in Stream UID: 15639-19150-0053AD40 Assembly shows XOR instruction xor ecx esp in Stream UID: 15639-19150-0053AD40 Assembly shows XOR instruction xor eax ebp in Stream UID: 15639-22555-005501A0 Assembly shows XOR instruction xor edx eax in Stream UID: 15639-22555-005501A0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 15639-22555-005501A0 Assembly shows XOR instruction xor eax ebp in Stream UID: 15639-23656-0046F200 Assembly shows XOR instruction xor ecx ebp in Stream UID: 15639-23656-0046F200 Assembly shows XOR instruction xor eax esp in Stream UID: 15639-22912-00633C00 Assembly shows XOR instruction xor ecx esp in Stream UID: 15639-22912-00633C00 Assembly shows XOR instruction xor eax ebp in Stream UID: 15639-19239-006CFD02 Assembly shows XOR instruction xor ecx ebp in Stream UID: 15639-19239-006CFD02 Assembly shows XOR instruction xor eax ebp in Stream UID: 15639-18020-006ACF13 Assembly shows XOR instruction xor ecx ebp in Stream UID: 15639-18020-006ACF13 Assembly shows XOR instruction xor eax ebp in Stream UID: 15639-18389-006BDFA1 Assembly shows XOR instruction xor ecx ebp in Stream UID: 15639-18389-006BDFA1 Assembly shows XOR instruction xor eax esp in Stream UID: 15639-23555-00476EC0 Assembly shows XOR instruction xor ecx esp in Stream UID: 15639-23555-00476EC0 Assembly shows XOR instruction xor eax esp in Stream UID: 15639-24002-0046FF20 Assembly shows XOR instruction xor ecx esp in Stream UID: 15639-24002-0046FF20 Assembly shows XOR instruction xor ecx esp in Stream UID: 15639-22695-0063E72D Assembly shows XOR instruction xor eax ebp in Stream UID: 15639-18386-006C4226 Assembly shows XOR instruction xor ecx ebp in Stream UID: 15639-18386-006C4226 Assembly shows XOR instruction xor eax ebp in Stream UID: 15639-19123-006C82BD Assembly shows XOR instruction xor ecx ebp in Stream UID: 15639-19123-006C82BD Assembly shows XOR instruction xor eax esp in Stream UID: 15639-19336-00475FA0 Assembly shows XOR instruction xor ecx esp in Stream UID: 15639-19336-00475FA0 Assembly shows XOR instruction xor eax ebp in Stream UID: 15639-24077-0061EDF0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 15639-24077-0061EDF0 Assembly shows XOR instruction xor eax ebp in Stream UID: 15639-22668-006D77FB Assembly shows XOR instruction xor ecx ebp in Stream UID: 15639-22668-006D77FB Assembly shows XOR instruction xor ecx ebp in Stream UID: 15639-22876-006349F2 Assembly shows XOR instruction xor eax ebp in Stream UID: 15639-19063-006BFFE9 Assembly shows XOR instruction xor ecx ebp in Stream UID: 15639-19063-006BFFE9 Assembly shows XOR instruction xor eax ebp in Stream UID: 15639-19310-006E9652 Assembly shows XOR instruction xor ecx ebp in Stream UID: 15639-19310-006E9652 Assembly shows XOR instruction xor eax edx in Stream UID: 15639-23860-004B6750 Assembly shows XOR instruction xor ecx edx in Stream UID: 15639-23860-004B6750 Assembly shows XOR instruction xor edx ecx in Stream UID: 15639-23860-004B6750 Assembly shows XOR instruction xor eax dword ptr [ecx] in Stream UID: 15639-23860-004B6750 Assembly shows XOR instruction xor eax esp in Stream UID: 15639-22549-005511C0 Assembly shows XOR instruction xor ecx esp in Stream UID: 15639-22549-005511C0 Assembly shows XOR instruction xor eax esp in Stream UID: 15639-23044-00470250 Assembly shows XOR instruction xor ecx esp in Stream UID: 15639-23044-00470250 Assembly shows XOR instruction xor eax esp in Stream UID: 15639-22837-00635F90 Assembly shows XOR instruction xor ecx esp in Stream UID: 15639-22837-00635F90 Assembly shows XOR instruction xor eax esp in Stream UID: 15639-23953-0040E830 Assembly shows XOR instruction xor ecx esp in Stream UID: 15639-23953-0040E830 Assembly shows XOR instruction xor eax esp in Stream UID: 15639-23707-0062B910 Assembly shows XOR instruction xor ecx esp in Stream UID: 15639-23707-0062B910 Assembly shows XOR instruction xor eax esp in Stream UID: 15639-23572-004E1800 Assembly shows XOR instruction xor ecx esp in Stream UID: 15639-23572-004E18002f:T5c8,Found string "received signature for client without public key" (Indicator: "public key"; File: "emule.exe") Found string "Failed to use new received public key" (Indicator: "public key"; File: "emule.exe") Found string "Collection %s: Public key verified" (Indicator: "public key"; File: "emule.exe") Found string "Collection %s: Verifying of public key failed!" (Indicator: "public key"; File: "emule.exe") Found string "InvertibleRSAFunction: computational error during private key operation" (Indicator: "private key"; File: "emule.exe") Found string "received signature for client without public key" (Indicator: "public key"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found string "Failed to use new received public key" (Indicator: "public key"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found string "Collection %s: Public key verified" (Indicator: "public key"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found string "Collection %s: Verifying of public key failed!" (Indicator: "public key"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found string "InvertibleRSAFunction: computational error during private key operation" (Indicator: "private key"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found string ": message too long for this public key" (Indicator: "public key"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp")30:T1b8e,Contains base64 string in header "1033" in header "GET /connectiontest.php?tcpport=46500&udpport=62123&lang=1033 HTTP/1.1Host: porttest.emule-project.netConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.56Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9" Contains base64 string in header "porttest" in header "GET /connectiontest.php?tcpport=46500&udpport=62123&lang=1033 HTTP/1.1Host: porttest.emule-project.netConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.56Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9" Contains base64 string in header "keep" in header "GET /connectiontest.php?tcpport=46500&udpport=62123&lang=1033 HTTP/1.1Host: porttest.emule-project.netConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.56Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9" Contains base64 string in header "aliveUpgrade" in header "GET /connectiontest.php?tcpport=46500&udpport=62123&lang=1033 HTTP/1.1Host: porttest.emule-project.netConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.56Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9" Contains base64 string in header "Insecure" in header "GET /connectiontest.php?tcpport=46500&udpport=62123&lang=1033 HTTP/1.1Host: porttest.emule-project.netConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.56Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9" Contains base64 string in header "Requests" in header "GET /connectiontest.php?tcpport=46500&udpport=62123&lang=1033 HTTP/1.1Host: porttest.emule-project.netConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.56Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9" Contains base64 string in header "like" in header "GET /connectiontest.php?tcpport=46500&udpport=62123&lang=1033 HTTP/1.1Host: porttest.emule-project.netConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.56Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9" Contains base64 string in header "1418" in header "GET /connectiontest.php?tcpport=46500&udpport=62123&lang=1033 HTTP/1.1Host: porttest.emule-project.netConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.56Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9" Contains base64 string in header "56Accept" in header "GET /connectiontest.php?tcpport=46500&udpport=62123&lang=1033 HTTP/1.1Host: porttest.emule-project.netConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.56Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9" Contains base64 string in header "exchange" in header "GET /connectiontest.php?tcpport=46500&udpport=62123&lang=1033 HTTP/1.1Host: porttest.emule-project.netConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.56Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9" Contains base64 string in header "Encoding" in header "GET /connectiontest.php?tcpport=46500&udpport=62123&lang=1033 HTTP/1.1Host: porttest.emule-project.netConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.56Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9" Contains base64 string in header "gzip" in header "GET /connectiontest.php?tcpport=46500&udpport=62123&lang=1033 HTTP/1.1Host: porttest.emule-project.netConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.56Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9" Contains base64 string in header "Language" in header "GET /connectiontest.php?tcpport=46500&udpport=62123&lang=1033 HTTP/1.1Host: porttest.emule-project.netConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.56Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9"31:T493,"emule.exe" called "GetWindowTextW" (UID: 00000000-00002716) "emule.exe" called "GetWindowTextW" with parameter "Add Server" - (UID: 00000000-00002716) "emule.exe" called "GetWindowTextW" with parameter "Update server.met from URL" - (UID: 00000000-00002716) "emule.exe" called "GetWindowTextW" with parameter "My Info" - (UID: 00000000-00002716) "emule.exe" called "GetWindowTextW" with parameter "Search Parameters" - (UID: 00000000-00002716) "emule.exe" called "GetWindowTextW" with parameter "Info" - (UID: 00000000-00002716) "emule.exe" called "GetWindowTextW" with parameter "Download Commands" - (UID: 00000000-00002716) "emule.exe" called "GetWindowTextW" with parameter "Bootstrap" - (UID: 00000000-00002716) "emule.exe" called "GetWindowTextW" with parameter "Welcome to eMule" - (UID: 00000000-00002716) "emule.exe" called "GetWindowTextW" with parameter "This wizard will guide you through the first steps in configuring eMule." - (UID: 00000000-00002716) "emule.exe" called "GetWindowTextW" with parameter "To continue, click Next." - (UID: 00000000-00002716) "emule.exe" called "GetWindowTextW" with parameter "< &Back" - (UID: 00000000-00002716)32:Tebc,"emule.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002716) "emule.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002716) "emule.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000a900000029000000000000000000000090de0f01506a35775208f977feffffff40de0f01b71632777400000080000000d4026b052cde0f017400000000006b0500000000800000000000000000000000100000000300000000006b0574000000000000000000000064de0f01ee13327700000000ee1332770000000000000000740000007614c82600000000a0de0f0117a92b0000006b05000000001ca92b0074000000489c3c05000000000000000078de0f0100000000e0de0f0150b92b00f0da3900ffffffff1ca92b0039a92b007400000064a92b007400000000000000f7ea2d007400000050a74474489c3c05d8c41d0074000000a41e2e00 (UID: 00000000-00002716) "emule.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000002000000009f030000cf000000f83f6b051f0300001f0300009f0300001f0300000000000020000000e8de0f01506a35775208f977feffffff98de0f01b716327744010000500100003c036b0584de0f014401000000006b05d4de0f015001000000000000000000002a0000000300000000006b05440100000000000007000000bcde0f01ee13327700000000ee13327700000000000000004401000001000000909f3c05f8de0f0117a92b0000006b05000000001ca92b0044010000d0df0f010000000000000000d0de0f010400000038df0f0150b92b00f0da3900ffffffff1ca92b0039a92b004401000064a92b004401000000000000f7ea2d00 (UID: 00000000-00002716) "emule.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000390300000000be52dda350db0f01000000001cdf0f01f0fbf3744ea22ed6feffffff92cbf174d7451c74ffffffff0000000000000000409abb7340493f03000000000000000034de0f0140de0f018019ba7340493f030100000040de0f01a6b6bb7328b3be73709dbb7358463f03fc003577fcdebb7388030000a0e1bb73c07e3c03000000000000000058463f0390e3bb7339dfbb732562bb7398293f01c07e3c0340000a0020391b738cde0f019ae4bb73730300000300000070da3b0390e3bb7300000000887e3c031f000000c0de0f015c5add745803000040000a007303000003000000b8de0f0100000000815add7448ec3903988f3b0300000000 (UID: 00000000-00002716) "emule.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002716)33:T45d,"emule.exe" called "GetVersionExA" with parameter 940000000600000002000000f0230000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000074952b00 (UID: 00000000-00002716) "emule.exe" called "GetVersionExA" with parameter 940000000600000002000000f0230000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002716) "emule.exe" called "GetVersionExA" with parameter 940000000600000002000000f02300000200000000000000a80b1e0300000000a8d30f01591632770100000008000000010000000000390300000000100000000000000000000000020000000200000000003903010000000800000000000000c8d30f01ee13327701000000ee1332770800000000000000080000000100000000d60f01ad9c8772000039030800000001000000 (UID: 00000000-00002716)34:T4f9,GetTickCount@KERNEL32.dll at 15639-23994-004827B0 GetTickCount@KERNEL32.dll at 15639-23887-0042A5F0 GetTickCount@KERNEL32.dll at 15639-22956-004D9310 GetTickCount@KERNEL32.dll at 15639-23417-00423B50 GetTickCount@KERNEL32.dll at 15639-23970-004892D0 GetTickCount@KERNEL32.dll at 15639-23934-00422E90 GetTickCount@KERNEL32.dll at 15639-23938-00422200 GetTickCount@KERNEL32.dll at 15639-23984-00481280 GetTickCount@KERNEL32.dll at 15639-23436-004F3020 GetTickCount@KERNEL32.dll at 15639-23888-0042A650 GetTickCount@KERNEL32.dll at 15639-23420-004F4090 GetTickCount@KERNEL32.dll at 15639-22733-004702F0 GetTickCount@KERNEL32.dll at 15639-24006-00429E50 GetTickCount@KERNEL32.dll at 15639-23980-004822A0 GetTickCount@KERNEL32.dll at 15639-23908-0042B990 GetTickCount@KERNEL32.dll at 15639-23967-00433B60 GetTickCount@KERNEL32.dll at 15639-23884-0042CF60 GetTickCount@KERNEL32.dll at 15639-23160-00426530 GetTickCount@KERNEL32.dll at 15639-24069-004D9B90 GetTickCount@KERNEL32.dll at 15639-24004-0048C810 GetTickCount@KERNEL32.dll at 15639-23917-0042A8C0 GetTickCount@KERNEL32.dll at 15639-23937-00423470 GetTickCount@KERNEL32.dll at 15639-23893-0042BEC0 GetTickCount@KERNEL32.dll at 15639-23889-0042AE90 GetTickCount@KERNEL32.dll at 15639-23936-0042254035:T53b,Found reference to API "GetUserObjectInformationA" (Indicator: "GetUserObjectInformation"; File: "emule.exe") Found reference to API "GetMonitorInfoW" (Indicator: "GetMonitorInfo"; File: "emule.exe") Found reference to API "GetMonitorInfoA" (Indicator: "GetMonitorInfo"; File: "emule.exe") Found reference to API "ExpandEnvironmentStringsW" (Indicator: "ExpandEnvironmentStrings"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API "GetMonitorInfoA" (Indicator: "GetMonitorInfo"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API "GetMonitorInfoW" (Indicator: "GetMonitorInfo"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API "GetUserObjectInformationA" (Indicator: "GetUserObjectInformation"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API "GetSystemInfo" (Indicator: "GetSystemInfo"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API "GetUserObjectInformationW" (Indicator: "GetUserObjectInformation"; Source: "00000000-00002716.00000001.68293.72677000.00000002.mdmp") Found reference to API "RtlNtStatusToDosErrorNoTeb" (Indicator: "RtlNtStatusToDosError"; Source: "00000000-00002716.00000002.70213.72611000.00000020.mdmp")36:T4e0,Found reference to API "GetActiveWindow" (Indicator: "GetActiveWindow"; File: "emule.exe") Found reference to API "FindWindowW" (Indicator: "FindWindow"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API "FindWindowExW" (Indicator: "FindWindow"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API "GetWindowTextW" (Indicator: "GetWindowText"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API "GetActiveWindow" (Indicator: "GetActiveWindow"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API "GetWindowTextLengthW" (Indicator: "GetWindowText"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API "EnumWindows" (Indicator: "EnumWindows"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API "GetWindowTextA" (Indicator: "GetWindowText"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API "GetForegroundWindow" (Indicator: "GetForegroundWindow"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp, 00000000-00002716.00000001.68293.72677000.00000002.mdmp")37:Ta10,"emule.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002716) "emule.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002716) "emule.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002716) "emule.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002716) "emule.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00002716) "emule.exe" called "LoadLibrary" with a parameter gdiplus.dll (UID: 00000000-00002716) "emule.exe" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00002716) "emule.exe" called "LoadLibrary" with a parameter UxTheme.dll (UID: 00000000-00002716) "emule.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00002716) "emule.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00002716) "emule.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00002716) "emule.exe" called "LoadLibrary" with a parameter C:\emuleENU.dll (UID: 00000000-00002716) "emule.exe" called "LoadLibrary" with a parameter C:\emuleLOC.dll (UID: 00000000-00002716) "emule.exe" called "LoadLibrary" with a parameter RICHED20.DLL (UID: 00000000-00002716) "emule.exe" called "LoadLibrary" with a parameter iphlpapi.dll (UID: 00000000-00002716) "emule.exe" called "LoadLibrary" with a parameter dwmapi.dll (UID: 00000000-00002716) "emule.exe" called "LoadLibrary" with a parameter msimg32.dll (UID: 00000000-00002716) "emule.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00002716) "emule.exe" called "LoadLibrary" with a parameter MSIMG32.DLL (UID: 00000000-00002716) "emule.exe" called "LoadLibrary" with a parameter ICMP.DLL (UID: 00000000-00002716) "emule.exe" called "LoadLibrary" with a parameter COMCTL32.DLL (UID: 00000000-00002716) "emule.exe" called "LoadLibrary" with a parameter PROPSYS.dll (UID: 00000000-00002716) "emule.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-ole32-l1-1-0.dll (UID: 00000000-00002716) "emule.exe" called "LoadLibrary" with a parameter Secur32.dll (UID: 00000000-00002716) "emule.exe" called "LoadLibrary" with a parameter MLANG.dll (UID: 00000000-00002716) "emule.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-shlwapi-l2-1-0.dll (UID: 00000000-00002716) "emule.exe" called "LoadLibrary" with a parameter WININET.dll (UID: 00000000-00002716) "emule.exe" called "LoadLibrary" with a parameter Advapi32.dll (UID: 00000000-00002716)38:T2842,"emule.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00002716) "emule.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00002716) "emule.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00002716) "emule.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00002716) "emule.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00002716) "emule.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00002716) "emule.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00002716) "emule.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00002716) "emule.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00002716) "emule.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00002716) "emule.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00002716) "emule.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00002716) "emule.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00002716) "emule.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00002716) "emule.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00002716) "emule.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00002716) "emule.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00002716) "emule.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00002716) "emule.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00002716) "emule.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00002716) "emule.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00002716) "emule.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00002716) "emule.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00002716) "emule.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00002716) "emule.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00002716) "emule.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00002716) "emule.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00002716) "emule.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00002716) "emule.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00002716) "emule.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00002716) "emule.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00002716) "emule.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00002716) "emule.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00002716) "emule.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00002716) "emule.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00002716) "emule.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00002716) "emule.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00002716) "emule.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00002716) "emule.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00002716) "emule.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00002716) "emule.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00002716) "emule.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00002716) "emule.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00002716) "emule.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00002716) "emule.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00002716) "emule.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionAndSpinCount (UID: 00000000-00002716) "emule.exe" called "GetProcAddress" with a parameter IsProcessorFeaturePresent (UID: 00000000-00002716) "emule.exe" called "GetProcAddress" with a parameter GetProcessDEPPolicy (UID: 00000000-00002716) "emule.exe" called "GetProcAddress" with a parameter SetProcessDEPPolicy (UID: 00000000-00002716) "emule.exe" called "GetProcAddress" with a parameter HeapSetInformation (UID: 00000000-00002716) "emule.exe" called "GetProcAddress" with a parameter GdiplusStartup (UID: 00000000-00002716) "emule.exe" called "GetProcAddress" with a parameter NotifyWinEvent (UID: 00000000-00002716) "emule.exe" called "GetProcAddress" with a parameter SHGetKnownFolderPath (UID: 00000000-00002716) "emule.exe" called "GetProcAddress" with a parameter DllGetVersion (UID: 00000000-00002716) "emule.exe" called "GetProcAddress" with a parameter GetUserDefaultUILanguage (UID: 00000000-00002716) "emule.exe" called "GetProcAddress" with a parameter GetSystemDefaultUILanguage (UID: 00000000-00002716) "emule.exe" called "GetProcAddress" with a parameter GetTcpTable (UID: 00000000-00002716) "emule.exe" called "GetProcAddress" with a parameter GetUdpTable (UID: 00000000-00002716) "emule.exe" called "GetProcAddress" with a parameter DwmIsCompositionEnabled (UID: 00000000-00002716) "emule.exe" called "GetProcAddress" with a parameter IsThemeActive (UID: 00000000-00002716) "emule.exe" called "GetProcAddress" with a parameter IsAppThemed (UID: 00000000-00002716) "emule.exe" called "GetProcAddress" with a parameter GetCurrentThemeName (UID: 00000000-00002716) "emule.exe" called "GetProcAddress" with a parameter GradientFill (UID: 00000000-00002716) "emule.exe" called "GetProcAddress" with a parameter AlphaBlend (UID: 00000000-00002716) "emule.exe" called "GetProcAddress" with a parameter IcmpCreateFile (UID: 00000000-00002716) "emule.exe" called "GetProcAddress" with a parameter IcmpCloseHandle (UID: 00000000-00002716) "emule.exe" called "GetProcAddress" with a parameter IcmpSendEcho (UID: 00000000-00002716) "emule.exe" called "GetProcAddress" with a parameter InitCommonControlsEx (UID: 00000000-00002716) "emule.exe" called "GetProcAddress" with a parameter ChangeWindowMessageFilter (UID: 00000000-00002716) "emule.exe" called "GetProcAddress" with a parameter OpenThemeData (UID: 00000000-00002716) "emule.exe" called "GetProcAddress" with a parameter DrawThemeBackground (UID: 00000000-00002716) "emule.exe" called "GetProcAddress" with a parameter CloseThemeData (UID: 00000000-00002716) "emule.exe" called "GetProcAddress" with a parameter DrawThemeText (UID: 00000000-00002716) "emule.exe" called "GetProcAddress" with a parameter SetMenuInfo (UID: 00000000-00002716) "emule.exe" called "GetProcAddress" with a parameter GetMenuInfo (UID: 00000000-00002716) "emule.exe" called "GetProcAddress" with a parameter GetDiskFreeSpaceExW (UID: 00000000-00002716) "emule.exe" called "GetProcAddress" with a parameter GetSystemMetrics (UID: 00000000-00002716) "emule.exe" called "GetProcAddress" with a parameter MonitorFromWindow (UID: 00000000-00002716) "emule.exe" called "GetProcAddress" with a parameter MonitorFromRect (UID: 00000000-00002716) "emule.exe" called "GetProcAddress" with a parameter MonitorFromPoint (UID: 00000000-00002716) "emule.exe" called "GetProcAddress" with a parameter EnumDisplayMonitors (UID: 00000000-00002716) "emule.exe" called "GetProcAddress" with a parameter EnumDisplayDevicesW (UID: 00000000-00002716) "emule.exe" called "GetProcAddress" with a parameter GetMonitorInfoW (UID: 00000000-00002716) "emule.exe" called "GetProcAddress" with a parameter IsThemeBackgroundPartiallyTransparent (UID: 00000000-00002716) "emule.exe" called "GetProcAddress" with a parameter DrawThemeParentBackground (UID: 00000000-00002716) "emule.exe" called "GetProcAddress" with a parameter PSCreateMemoryPropertyStore (UID: 00000000-00002716) "emule.exe" called "GetProcAddress" with a parameter PSCreateAdapterFromPropertyStore (UID: 00000000-00002716) "emule.exe" called "GetProcAddress" with a parameter PropVariantToBSTR (UID: 00000000-00002716) "emule.exe" called "GetProcAddress" with a parameter PropVariantClear (UID: 00000000-00002716) "emule.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00002716) "emule.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00002716) "emule.exe" called "GetProcAddress" with a parameter CoGetMalloc (UID: 00000000-00002716) "emule.exe" called "GetProcAddress" with a parameter GetUserNameExW (UID: 00000000-00002716) "emule.exe" called "GetProcAddress" with a parameter SHStrDupW (UID: 00000000-00002716) "emule.exe" called "GetProcAddress" with a parameter GetUrlCacheEntryBinaryBlob (UID: 00000000-00002716) "emule.exe" called "GetProcAddress" with a parameter IUnknown_Set (UID: 00000000-00002716) "emule.exe" called "GetProcAddress" with a parameter OpenSCManagerW (UID: 00000000-00002716) "emule.exe" called "GetProcAddress" with a parameter OpenServiceW (UID: 00000000-00002716) "emule.exe" called "GetProcAddress" with a parameter QueryServiceStatusEx (UID: 00000000-00002716) "emule.exe" called "GetProcAddress" with a parameter CloseServiceHandle (UID: 00000000-00002716) "emule.exe" called "GetProcAddress" with a parameter StartServiceW (UID: 00000000-00002716) "emule.exe" called "GetProcAddress" with a parameter ControlService (UID: 00000000-00002716) "emule.exe" called "GetProcAddress" with a parameter GetBestInterface (UID: 00000000-00002716) "emule.exe" called "GetProcAddress" with a parameter GetIpAddrTable (UID: 00000000-00002716) "emule.exe" called "GetProcAddress" with a parameter GetIfEntry (UID: 00000000-00002716)39:T132d8,Found reference to API (Indicator: "GetCompressedFileSizeW"; File: "emule.exe") Found reference to API (Indicator: "FlsAlloc"; File: "emule.exe") Found reference to API (Indicator: "FlsGetValue"; File: "emule.exe") Found reference to API (Indicator: "FlsSetValue"; File: "emule.exe") Found reference to API (Indicator: "FlsFree"; File: "emule.exe") Found reference to API (Indicator: "GetDiskFreeSpaceExA"; File: "emule.exe") Found reference to API (Indicator: "GetDiskFreeSpaceExW"; File: "emule.exe") Found reference to API (Indicator: "CryptAcquireContext"; File: "emule.exe") Found reference to API (Indicator: "MessageBoxA"; File: "emule.exe") Found reference to API (Indicator: "GetActiveWindow"; File: "emule.exe") Found reference to API (Indicator: "GetLastActivePopup"; File: "emule.exe") Found reference to API (Indicator: "GetUserObjectInformationA"; File: "emule.exe") Found reference to API (Indicator: "GetProcessWindowStation"; File: "emule.exe") Found reference to API (Indicator: "GetProcessDEPPolicy"; File: "emule.exe") Found reference to API (Indicator: "SetProcessDEPPolicy"; File: "emule.exe") Found reference to API (Indicator: "GetUserDefaultUILanguage"; File: "emule.exe") Found reference to API (Indicator: "getsockname"; File: "emule.exe") Found reference to API (Indicator: "SetMenuInfo"; File: "emule.exe") Found reference to API (Indicator: "GetMenuInfo"; File: "emule.exe") Found reference to API (Indicator: "PrivateExtractIconsW"; File: "emule.exe") Found reference to API (Indicator: "GetSystemMetrics"; File: "emule.exe") Found reference to API (Indicator: "SHGetKnownFolderPath"; File: "emule.exe") Found reference to API (Indicator: "CryptGenRandom"; File: "emule.exe") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; File: "emule.exe") Found reference to API (Indicator: "SHGetFolderPathW"; File: "emule.exe") Found reference to API (Indicator: "SHGetFolderPathA"; File: "emule.exe") Found reference to API (Indicator: "HeapSetInformation"; File: "emule.exe") Found reference to API (Indicator: "SetProcessDEPPolicy"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "GetProcessDEPPolicy"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "HeapSetInformation"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "SetThreadExecutionState"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "PrivateExtractIconsW"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "GetCompressedFileSizeW"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "GetDiskFreeSpaceExW"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "GetDiskFreeSpaceExA"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "SHGetFolderPathA"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "SHGetFolderPathW"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "IcmpSendEcho"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "GetTcpTable"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "GetUdpTable"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "SHGetKnownFolderPath"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "CreateProcessAsUserW"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "CreateRestrictedToken"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "GetTokenInformation"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "OpenProcessToken"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "GetLengthSid"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "EqualSid"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "AddAce"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "GetAce"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "InitializeAcl"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "GetAclInformation"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "LookupAccountNameW"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "AddAccessAllowedAceEx"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "SetNamedSecurityInfoW"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "GetNamedSecurityInfoW"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "CreateProcessWithLogonW"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "GetIfEntry"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "GetIpAddrTable"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "GetBestInterface"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "ControlService"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "StartServiceW"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "CloseServiceHandle"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "QueryServiceStatusEx"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "OpenServiceW"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "OpenSCManagerW"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "AnimateWindow"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "GetMenuInfo"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "SetMenuInfo"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "FindResourceW"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp, 00000000-00002716.00000001.68293.72677000.00000002.mdmp") Found reference to API (Indicator: "ShellExecuteExW"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "DefWindowProcW"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp, 00000000-00002716.00000001.68293.72677000.00000002.mdmp") Found reference to API (Indicator: "CreateWindowExW"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp, 00000000-00002716.00000001.68293.72677000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp, 00000000-00002716.00000001.68293.72677000.00000002.mdmp") Found reference to API (Indicator: "CopyFileW"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "EnableWindow"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "CreateFontIndirectW"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "GetObjectW"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "LoadIconW"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExW"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp, 00000000-00002716.00000001.68293.72677000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExW"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp, 00000000-00002716.00000001.68293.72677000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp, 00000000-00002716.00000001.68293.72677000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryW"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp, 00000000-00002716.00000001.68293.72677000.00000002.mdmp") Found reference to API (Indicator: "SHGetFileInfoW"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "ExpandEnvironmentStringsW"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "GetPrivateProfileStringW"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "GetClipboardData"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "CreateMutexW"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "ShellExecuteW"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExW"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp, 00000000-00002716.00000001.68293.72677000.00000002.mdmp") Found reference to API (Indicator: "LoadImageW"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "lstrlenW"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "FindResourceExW"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp, 00000000-00002716.00000001.68293.72677000.00000002.mdmp") Found reference to API (Indicator: "VerQueryValueW"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp, 00000000-00002716.00000001.68293.72677000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoW"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeW"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "GetLocaleInfoW"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "WritePrivateProfileStringW"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentDirectoryW"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp, 00000000-00002716.00000001.68293.72677000.00000002.mdmp") Found reference to API (Indicator: "MessageBoxW"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "SHFileOperationW"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "DeleteFileW"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "SHGetPathFromIDListW"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "SHBrowseForFolderW"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileW"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "CompareStringW"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp, 00000000-00002716.00000001.68293.72677000.00000002.mdmp") Found reference to API (Indicator: "lstrcpynW"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "RegDeleteKeyW"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp, 00000000-00002716.00000002.70213.72611000.00000020.mdmp") Found reference to API (Indicator: "RegDeleteValueW"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp, 00000000-00002716.00000001.68293.72677000.00000002.mdmp") Found reference to API (Indicator: "RegCreateKeyExW"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp, 00000000-00002716.00000001.68293.72677000.00000002.mdmp") Found reference to API (Indicator: "RegSetValueExW"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp, 00000000-00002716.00000001.68293.72677000.00000002.mdmp") Found reference to API (Indicator: "RegEnumKeyExW"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp, 00000000-00002716.00000001.68293.72677000.00000002.mdmp") Found reference to API (Indicator: "GetDiskFreeSpaceW"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "OutputDebugStringW"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp, 00000000-00002716.00000001.68293.72677000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp, 00000000-00002716.00000001.68293.72677000.00000002.mdmp") Found reference to API (Indicator: "GetNumberFormatW"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "CreateDirectoryW"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "GetVolumeInformationW"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "MoveFileW"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesW"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "RemoveDirectoryW"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "GetDriveTypeW"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "AppendMenuW"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "UnregisterClassW"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp, 00000000-00002716.00000001.68293.72677000.00000002.mdmp") Found reference to API (Indicator: "CreateEventW"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp, 00000000-00002716.00000001.68293.72677000.00000002.mdmp") Found reference to API (Indicator: "CryptAcquireContextW"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "DispatchMessageW"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp, 00000000-00002716.00000001.68293.72677000.00000002.mdmp") Found reference to API (Indicator: "PeekMessageW"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "GetComputerNameW"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "LoadMenuW"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "LoadCursorW"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp, 00000000-00002716.00000001.68293.72677000.00000002.mdmp") Found reference to API (Indicator: "SystemParametersInfoW"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp, 00000000-00002716.00000001.68293.72677000.00000002.mdmp") Found reference to API (Indicator: "GetLogicalDriveStringsW"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "InsertMenuW"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "ModifyMenuW"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "IsTextUnicode"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "GetWindowsDirectoryW"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "SetCurrentDirectoryW"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "TranslateAcceleratorW"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "LoadAcceleratorsW"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "FindNextFileW"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "SetMenuItemInfoW"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "GetDateFormatW"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "GetTimeFormatW"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "GetWindowTextW"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "SetWindowTextW"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "LoadStringW"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "InsertMenuItemW"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "Shell_NotifyIconW"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp, 00000000-00002716.00000001.68293.72677000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExA"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExA"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "GetCPInfo"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "IsValidCodePage"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "lstrcatW"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "lstrcpyW"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "CryptAcquireContext"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "CryptGenRandom"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "getsockname"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "GetSystemMetrics"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp, 00000000-00002716.00000001.68293.72677000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDefaultUILanguage"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "GetUserDefaultUILanguage"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "FlsFree"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "FlsSetValue"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "FlsGetValue"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "FlsAlloc"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp, 00000000-00002716.00000001.68293.72677000.00000002.mdmp") Found reference to API (Indicator: "GetProcessWindowStation"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "GetUserObjectInformationA"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "GetLastActivePopup"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "GetActiveWindow"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "MessageBoxA"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "GetMenuStringW"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "GetStringTypeExW"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "lstrcmpiW"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp, 00000000-00002716.00000001.68293.72677000.00000002.mdmp") Found reference to API (Indicator: "CharUpperW"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "GetFullPathNameW"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "GetShortPathNameW"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "wsprintfW"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "CreateSemaphoreW"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "SetFileAttributesW"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "lstrcmpW"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp, 00000000-00002716.00000001.68293.72677000.00000002.mdmp") Found reference to API (Indicator: "RegisterClassW"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp, 00000000-00002716.00000001.68293.72677000.00000002.mdmp") Found reference to API (Indicator: "GetWindowTextLengthW"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "GlobalFindAtomW"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "GlobalAddAtomW"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "RegEnumKeyW"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "GetPrivateProfileIntW"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "GetKeyNameTextW"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "GetSaveFileNameW"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "GetOpenFileNameW"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "GetMenuItemInfoW"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "GetProfileIntW"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "CopyAcceleratorTableW"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "GlobalGetAtomNameW"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "RegCreateKeyW"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "ExtractIconW"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "CharNextW"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp, 00000000-00002716.00000001.68293.72677000.00000002.mdmp") Found reference to API (Indicator: "GetTempFileNameW"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "FreeEnvironmentStringsW"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "GetEnvironmentStringsW"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "LCMapStringW"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "GetStringTypeW"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "SizeofResource"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp, 00000000-00002716.00000001.68293.72677000.00000002.mdmp") Found reference to API (Indicator: "LockResource"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp, 00000000-00002716.00000001.68293.72677000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp, 00000000-00002716.00000001.68293.72677000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp, 00000000-00002716.00000001.68293.72677000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp, 00000000-00002716.00000001.68293.72677000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSection"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp, 00000000-00002716.00000001.68293.72677000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp, 00000000-00002716.00000001.68293.72677000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp, 00000000-00002716.00000001.68293.72677000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp, 00000000-00002716.00000001.68293.72677000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp, 00000000-00002716.00000001.68293.72677000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp, 00000000-00002716.00000001.68293.72677000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp, 00000000-00002716.00000001.68293.72677000.00000002.mdmp") Found reference to API (Indicator: "GetFileSize"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp, 00000000-00002716.00000001.68293.72677000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp, 00000000-00002716.00000001.68293.72677000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp, 00000000-00002716.00000001.68293.72677000.00000002.mdmp") Found reference to API (Indicator: "GlobalUnlock"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp, 00000000-00002716.00000001.68293.72677000.00000002.mdmp") Found reference to API (Indicator: "GlobalLock"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp, 00000000-00002716.00000001.68293.72677000.00000002.mdmp") Found reference to API (Indicator: "SetConsoleCtrlHandler"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "GlobalFree"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp, 00000000-00002716.00000001.68293.72677000.00000002.mdmp") Found reference to API (Indicator: "GlobalAlloc"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp, 00000000-00002716.00000001.68293.72677000.00000002.mdmp") Found reference to API (Indicator: "SetThreadLocale"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "GetThreadLocale"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "GetPrivateProfileStringA"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "WritePrivateProfileStringA"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "ResumeThread"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp, 00000000-00002716.00000001.68293.72677000.00000002.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp, 00000000-00002716.00000001.68293.72677000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp, 00000000-00002716.00000001.68293.72677000.00000002.mdmp") Found reference to API (Indicator: "InterlockedIncrement"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointer"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "GetFileInformationByHandle"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "InterlockedDecrement"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "InterlockedExchange"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "GetACP"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "GetLocaleInfoA"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "GetTimeZoneInformation"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "MulDiv"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp, 00000000-00002716.00000001.68293.72677000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp, 00000000-00002716.00000001.68293.72677000.00000002.mdmp") Found reference to API (Indicator: "Beep"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "DeviceIoControl"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "TerminateThread"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "IsBadReadPtr"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "lstrlenA"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp, 00000000-00002716.00000001.68293.72677000.00000002.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp, 00000000-00002716.00000001.68293.72677000.00000002.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp, 00000000-00002716.00000001.68293.72677000.00000002.mdmp") Found reference to API (Indicator: "GetOverlappedResult"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "GetLocalTime"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp, 00000000-00002716.00000001.68293.72677000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "ResetEvent"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp, 00000000-00002716.00000001.68293.72677000.00000002.mdmp") Found reference to API (Indicator: "WaitForMultipleObjects"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "FreeResource"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "SetThreadPriority"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "LocalUnlock"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "LocalLock"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "LocalAlloc"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "CompareStringA"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleA"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameA"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp, 00000000-00002716.00000001.68293.72677000.00000002.mdmp") Found reference to API (Indicator: "GetWindowsDirectoryA"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDirectoryA"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "LookupPrivilegeValueW"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "CryptReleaseContext"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "DestroyWindow"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp, 00000000-00002716.00000001.68293.72677000.00000002.mdmp") Found reference to API (Indicator: "DestroyIcon"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "CloseClipboard"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "OpenClipboard"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "EnumWindows"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "SetClipboardData"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "EmptyClipboard"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "CallNextHookEx"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp, 00000000-00002716.00000001.68293.72677000.00000002.mdmp") Found reference to API (Indicator: "UnhookWindowsHookEx"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp, 00000000-00002716.00000001.68293.72677000.00000002.mdmp") Found reference to API (Indicator: "IsRectEmpty"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp, 00000000-00002716.00000001.68293.72677000.00000002.mdmp") Found reference to API (Indicator: "KillTimer"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp, 00000000-00002716.00000001.68293.72677000.00000002.mdmp") Found reference to API (Indicator: "ExitWindowsEx"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "SetTimer"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp, 00000000-00002716.00000001.68293.72677000.00000002.mdmp") Found reference to API (Indicator: "GetWindowRect"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp, 00000000-00002716.00000001.68293.72677000.00000002.mdmp") Found reference to API (Indicator: "ClientToScreen"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "ReleaseDC"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp, 00000000-00002716.00000001.68293.72677000.00000002.mdmp") Found reference to API (Indicator: "GetDC"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp, 00000000-00002716.00000001.68293.72677000.00000002.mdmp") Found reference to API (Indicator: "GetIconInfo"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "GetClassNameA"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "FillRect"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "GetSysColor"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "GetDesktopWindow"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp, 00000000-00002716.00000001.68293.72677000.00000002.mdmp") Found reference to API (Indicator: "SetForegroundWindow"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "wsprintfA"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "IsWindow"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp, 00000000-00002716.00000001.68293.72677000.00000002.mdmp") Found reference to API (Indicator: "IsWindowVisible"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp, 00000000-00002716.00000001.68293.72677000.00000002.mdmp") Found reference to API (Indicator: "TranslateMessage"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp, 00000000-00002716.00000001.68293.72677000.00000002.mdmp") Found reference to API (Indicator: "FrameRect"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "UpdateWindow"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "InvalidateRect"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "CreatePopupMenu"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "CreateIconIndirect"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "CopyRect"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "InflateRect"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp, 00000000-00002716.00000001.68293.72677000.00000002.mdmp") Found reference to API (Indicator: "OffsetRect"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp, 00000000-00002716.00000001.68293.72677000.00000002.mdmp") Found reference to API (Indicator: "DrawFocusRect"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "GetClientRect"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "GetParent"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp, 00000000-00002716.00000001.68293.72677000.00000002.mdmp") Found reference to API (Indicator: "WindowFromPoint"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "DestroyMenu"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "DestroyCursor"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "SetCursor"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "GetSubMenu"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "SetWindowPos"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "MapWindowPoints"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp, 00000000-00002716.00000001.68293.72677000.00000002.mdmp") Found reference to API (Indicator: "ScreenToClient"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp, 00000000-00002716.00000001.68293.72677000.00000002.mdmp") Found reference to API (Indicator: "RedrawWindow"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "GetCursorPos"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "GetAsyncKeyState"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "PtInRect"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp, 00000000-00002716.00000001.68293.72677000.00000002.mdmp") Found reference to API (Indicator: "DrawEdge"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "DrawFrameControl"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "SetRect"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "GetCapture"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "SetCapture"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "ReleaseCapture"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "GetWindow"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp, 00000000-00002716.00000001.68293.72677000.00000002.mdmp") Found reference to API (Indicator: "GetFocus"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp, 00000000-00002716.00000001.68293.72677000.00000002.mdmp") Found reference to API (Indicator: "GetWindowDC"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "GetKeyState"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "GetSysColorBrush"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "IntersectRect"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp, 00000000-00002716.00000001.68293.72677000.00000002.mdmp") Found reference to API (Indicator: "DrawIcon"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "CreateMenu"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "CheckMenuItem"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "EnableMenuItem"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "GetMenuItemCount"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "RemoveMenu"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "GetSystemMenu"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "IsIconic"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp, 00000000-00002716.00000001.68293.72677000.00000002.mdmp") Found reference to API (Indicator: "BringWindowToTop"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "SetActiveWindow"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "MessageBeep"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "EqualRect"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp, 00000000-00002716.00000001.68293.72677000.00000002.mdmp") Found reference to API (Indicator: "SetMenuDefaultItem"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "CopyImage"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "DrawIconEx"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "ShowScrollBar"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "CopyIcon"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "AdjustWindowRectEx"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "CheckMenuRadioItem"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "SetWindowTextA"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "GetWindowTextA"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "ShowCursor"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "SetWindowRgn"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "ShowWindow"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "BeginPaint"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "MoveWindow"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "SetFocus"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "PostQuitMessage"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "WaitMessage"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "IsChild"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp, 00000000-00002716.00000001.68293.72677000.00000002.mdmp") Found reference to API (Indicator: "DeleteObject"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "GetDeviceCaps"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp, 00000000-00002716.00000002.70213.72611000.00000020.mdmp") Found reference to API (Indicator: "DPtoLP"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "GetStockObject"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp, 00000000-00002716.00000002.70213.72611000.00000020.mdmp") Found reference to API (Indicator: "DeleteDC"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "BitBlt"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "SelectObject"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "CreateCompatibleDC"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "GetTextColor"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "CreateSolidBrush"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "GetBkColor"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "GetMapMode"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "SHGetMalloc"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "CertGetCertificateContextProperty"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "CertGetNameStringW"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "CertNameToStrW"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "CertFindCertificateInStore"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "CertCloseStore"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "CertFreeCertificateContext"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "CryptEncryptMessage"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "CertOpenSystemStoreW"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "PathFileExistsW"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "PathMatchSpecW"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "PathRenameExtensionW"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "PathRemoveFileSpecW"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "PathIsRelativeW"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "PathRemoveExtensionW"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "PathFindExtensionW"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "PathFindFileNameW"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "PathRemoveBackslashW"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "PathAddBackslashW"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "PathCanonicalizeW"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "PathStripPathW"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "PathCombineW"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "CoUninitialize"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp, 00000000-00002716.00000002.70213.72611000.00000020.mdmp") Found reference to API (Indicator: "CoInitializeSecurity"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "CoInitialize"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp, 00000000-00002716.00000002.70213.72611000.00000020.mdmp") Found reference to API (Indicator: "CoTaskMemFree"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp, 00000000-00002716.00000002.70213.72611000.00000020.mdmp") Found reference to API (Indicator: "CoTaskMemAlloc"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp, 00000000-00002716.00000002.70213.72611000.00000020.mdmp") Found reference to API (Indicator: "CreateStreamOnHGlobal"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp, 00000000-00002716.00000002.70213.72611000.00000020.mdmp") Found reference to API (Indicator: "CLSIDFromString"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "OleUninitialize"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "OleInitialize"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "CoGetClassObject"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "InternetCrackUrlW"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "HttpQueryInfoW"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "InternetCanonicalizeUrlW"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "InternetReadFile"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "InternetCloseHandle"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "InternetErrorDlg"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "HttpSendRequestW"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "HttpAddRequestHeadersW"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "HttpOpenRequestW"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "InternetConnectW"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "InternetOpenW"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "InternetQueryOptionW"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "InternetQueryDataAvailable"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "InternetGetLastResponseInfoW"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "InternetSetFilePointer"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "InternetWriteFile"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "InternetOpenUrlW"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "SetEndOfFile"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "CreateFileA"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "GlobalSize"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "lstrcmpA"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "SuspendThread"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "FlushFileBuffers"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "LockFile"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "UnlockFile"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "DuplicateHandle"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "ReleaseMutex"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp, 00000000-00002716.00000001.68293.72677000.00000002.mdmp") Found reference to API (Indicator: "FileTimeToSystemTime"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "FileTimeToLocalFileTime"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "GetFileTime"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExA"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "GlobalDeleteAtom"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "EnumResourceLanguagesW"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "GetVersion"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "ConvertDefaultLocale"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "lstrcmpiA"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThread"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "GlobalReAlloc"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "GlobalHandle"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "TlsGetValue"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp, 00000000-00002716.00000001.68293.72677000.00000002.mdmp") Found reference to API (Indicator: "TlsAlloc"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp, 00000000-00002716.00000001.68293.72677000.00000002.mdmp") Found reference to API (Indicator: "TlsSetValue"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp, 00000000-00002716.00000001.68293.72677000.00000002.mdmp") Found reference to API (Indicator: "LocalReAlloc"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "TlsFree"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp, 00000000-00002716.00000001.68293.72677000.00000002.mdmp") Found reference to API (Indicator: "VirtualProtect"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "SetErrorMode"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "GlobalFlags"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "RtlUnwind"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "HeapReAlloc"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp, 00000000-00002716.00000001.68293.72677000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp, 00000000-00002716.00000001.68293.72677000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp, 00000000-00002716.00000001.68293.72677000.00000002.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "PeekNamedPipe"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "GetTimeFormatA"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "GetDateFormatA"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "VirtualAlloc"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp, 00000000-00002716.00000001.68293.72677000.00000002.mdmp") Found reference to API (Indicator: "GetSystemInfo"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "VirtualQuery"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "ExitThread"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "SetStdHandle"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "HeapSize"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp, 00000000-00002716.00000001.68293.72677000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp, 00000000-00002716.00000001.68293.72677000.00000002.mdmp") Found reference to API (Indicator: "FreeEnvironmentStringsA"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "GetEnvironmentStrings"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "GetCommandLineA"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "GetCommandLineW"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "SetHandleCount"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoA"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "HeapDestroy"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp, 00000000-00002716.00000001.68293.72677000.00000002.mdmp") Found reference to API (Indicator: "HeapCreate"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "VirtualFree"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp, 00000000-00002716.00000001.68293.72677000.00000002.mdmp") Found reference to API (Indicator: "LCMapStringA"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "IsBadWritePtr"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "GetOEMCP"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "GetStringTypeA"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentDirectoryA"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "GetUserDefaultLCID"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "EnumSystemLocalesA"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "IsValidLocale"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "IsBadCodePtr"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "GetDriveTypeA"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "SetEnvironmentVariableA"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "CryptAcquireContextA"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "GetMenu"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "GetScrollInfo"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "IsZoomed"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "GetMenuItemID"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "GetMenuState"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "GetMenuCheckMarkDimensions"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "SetMenuItemBitmaps"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "GetWindowPlacement"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "SystemParametersInfoA"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "SetWindowPlacement"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "SetScrollInfo"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "GetScrollPos"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "SetScrollPos"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "GetScrollRange"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "SetScrollRange"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "TrackPopupMenu"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "ScrollWindow"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "GetMessageTime"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp, 00000000-00002716.00000001.68293.72677000.00000002.mdmp") Found reference to API (Indicator: "GetTopWindow"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "GetForegroundWindow"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp, 00000000-00002716.00000001.68293.72677000.00000002.mdmp") Found reference to API (Indicator: "IsWindowEnabled"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "ShowOwnedPopups"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "MapDialogRect"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "SetMenu"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "SetParent"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "DeleteMenu"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "GetDCEx"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "GetDIBits"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "SetStretchBltMode"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "SetMapMode"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "CreatePatternBrush"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00002716.00000001.68293.72677000.00000002.mdmp") Found reference to API (Indicator: "EventRegister"; Source: "00000000-00002716.00000001.68293.72677000.00000002.mdmp") Found reference to API (Indicator: "EventUnregister"; Source: "00000000-00002716.00000001.68293.72677000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00002716.00000001.68293.72677000.00000002.mdmp") Found reference to API (Indicator: "DebugBreak"; Source: "00000000-00002716.00000001.68293.72677000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00002716.00000001.68293.72677000.00000002.mdmp") Found reference to API (Indicator: "AcquireSRWLockExclusive"; Source: "00000000-00002716.00000001.68293.72677000.00000002.mdmp") Found reference to API (Indicator: "ReleaseSRWLockExclusive"; Source: "00000000-00002716.00000001.68293.72677000.00000002.mdmp") Found reference to API (Indicator: "AcquireSRWLockShared"; Source: "00000000-00002716.00000001.68293.72677000.00000002.mdmp") Found reference to API (Indicator: "ReleaseSRWLockShared"; Source: "00000000-00002716.00000001.68293.72677000.00000002.mdmp") Found reference to API (Indicator: "ReleaseSemaphore"; Source: "00000000-00002716.00000001.68293.72677000.00000002.mdmp") Found reference to API (Indicator: "CloseThreadpoolTimer"; Source: "00000000-00002716.00000001.68293.72677000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00002716.00000001.68293.72677000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionEx"; Source: "00000000-00002716.00000001.68293.72677000.00000002.mdmp") Found reference to API (Indicator: "OpenSemaphoreW"; Source: "00000000-00002716.00000001.68293.72677000.00000002.mdmp") Found reference to API (Indicator: "SetThreadpoolTimer"; Source: "00000000-00002716.00000001.68293.72677000.00000002.mdmp") Found reference to API (Indicator: "CreateThreadpoolTimer"; Source: "00000000-00002716.00000001.68293.72677000.00000002.mdmp") Found reference to API (Indicator: "OpenMutexW"; Source: "00000000-00002716.00000001.68293.72677000.00000002.mdmp") Found reference to API (Indicator: "RegQueryInfoKeyW"; Source: "00000000-00002716.00000001.68293.72677000.00000002.mdmp") Found reference to API (Indicator: "CompareStringOrdinal"; Source: "00000000-00002716.00000001.68293.72677000.00000002.mdmp") Found reference to API (Indicator: "InitOnceBeginInitialize"; Source: "00000000-00002716.00000001.68293.72677000.00000002.mdmp") Found reference to API (Indicator: "InitOnceComplete"; Source: "00000000-00002716.00000001.68293.72677000.00000002.mdmp") Found reference to API (Indicator: "CreateMutexExW"; Source: "00000000-00002716.00000001.68293.72677000.00000002.mdmp") Found reference to API (Indicator: "CreateSemaphoreExW"; Source: "00000000-00002716.00000001.68293.72677000.00000002.mdmp") Found reference to API (Indicator: "WaitForThreadpoolTimerCallbacks"; Source: "00000000-00002716.00000001.68293.72677000.00000002.mdmp") Found reference to API (Indicator: "ProcessIdToSessionId"; Source: "00000000-00002716.00000001.68293.72677000.00000002.mdmp") Found reference to API (Indicator: "MapViewOfFile"; Source: "00000000-00002716.00000001.68293.72677000.00000002.mdmp") Found reference to API (Indicator: "OpenFileMappingW"; Source: "00000000-00002716.00000001.68293.72677000.00000002.mdmp") Found reference to API (Indicator: "UnmapViewOfFile"; Source: "00000000-00002716.00000001.68293.72677000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeExW"; Source: "00000000-00002716.00000001.68293.72677000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoExW"; Source: "00000000-00002716.00000001.68293.72677000.00000002.mdmp") Found reference to API (Indicator: "TryEnterCriticalSection"; Source: "00000000-00002716.00000001.68293.72677000.00000002.mdmp") Found reference to API (Indicator: "RegGetValueW"; Source: "00000000-00002716.00000001.68293.72677000.00000002.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00002716.00000001.68293.72677000.00000002.mdmp") Found reference to API (Indicator: "OutputDebugStringA"; Source: "00000000-00002716.00000001.68293.72677000.00000002.mdmp") Found reference to API (Indicator: "GetWindowThreadProcessId"; Source: "00000000-00002716.00000001.68293.72677000.00000002.mdmp") Found reference to API (Indicator: "GetKeyboardLayout"; Source: "00000000-00002716.00000001.68293.72677000.00000002.mdmp") Found reference to API (Indicator: "GetThreadDesktop"; Source: "00000000-00002716.00000001.68293.72677000.00000002.mdmp") Found reference to API (Indicator: "GetUserObjectInformationW"; Source: "00000000-00002716.00000001.68293.72677000.00000002.mdmp") Found reference to API (Indicator: "SetWinEventHook"; Source: "00000000-00002716.00000001.68293.72677000.00000002.mdmp") Found reference to API (Indicator: "UnregisterClassA"; Source: "00000000-00002716.00000001.68293.72677000.00000002.mdmp") Found reference to API (Indicator: "SendInput"; Source: "00000000-00002716.00000001.68293.72677000.00000002.mdmp") Found reference to API (Indicator: "RtlDllShutdownInProgress"; Source: "00000000-00002716.00000001.68293.72677000.00000002.mdmp, 00000000-00002716.00000002.70213.72611000.00000020.mdmp") Found reference to API (Indicator: "GetTickCount64"; Source: "00000000-00002716.00000001.68293.72677000.00000002.mdmp") Found reference to API (Indicator: "OpenEventW"; Source: "00000000-00002716.00000001.68293.72677000.00000002.mdmp") Found reference to API (Indicator: "QueryFullProcessImageNameW"; Source: "00000000-00002716.00000001.68293.72677000.00000002.mdmp") Found reference to API (Indicator: "EventWrite"; Source: "00000000-00002716.00000001.68293.72677000.00000002.mdmp") Found reference to API (Indicator: "NdrOleFree"; Source: "00000000-00002716.00000001.68293.72677000.00000002.mdmp") Found reference to API (Indicator: "NdrOleAllocate"; Source: "00000000-00002716.00000001.68293.72677000.00000002.mdmp") Found reference to API (Indicator: "NdrStubCall2"; Source: "00000000-00002716.00000001.68293.72677000.00000002.mdmp") Found reference to API (Indicator: "DelayLoadFailureHook"; Source: "00000000-00002716.00000001.68293.72677000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExA"; Source: "00000000-00002716.00000001.68293.72677000.00000002.mdmp") Found reference to API (Indicator: "EncodePointer"; Source: "00000000-00002716.00000001.68293.72677000.00000002.mdmp") Found reference to API (Indicator: "DecodePointer"; Source: "00000000-00002716.00000001.68293.72677000.00000002.mdmp") Found reference to API (Indicator: "FlushInstructionCache"; Source: "00000000-00002716.00000001.68293.72677000.00000002.mdmp") Found reference to API (Indicator: "InterlockedPushEntrySList"; Source: "00000000-00002716.00000001.68293.72677000.00000002.mdmp") Found reference to API (Indicator: "InterlockedPopEntrySList"; Source: "00000000-00002716.00000001.68293.72677000.00000002.mdmp") Found reference to API (Indicator: "CreateTimerQueueTimer"; Source: "00000000-00002716.00000001.68293.72677000.00000002.mdmp") Found reference to API (Indicator: "DeleteTimerQueueTimer"; Source: "00000000-00002716.00000001.68293.72677000.00000002.mdmp") Found reference to API (Indicator: "SetSystemFileCacheSize"; Source: "00000000-00002716.00000002.70213.72611000.00000020.mdmp") Found reference to API (Indicator: "InitializeConditionVariable"; Source: "00000000-00002716.00000002.70213.72611000.00000020.mdmp") Found reference to API (Indicator: "SleepConditionVariableCS"; Source: "00000000-00002716.00000002.70213.72611000.00000020.mdmp") Found reference to API (Indicator: "WakeAllConditionVariable"; Source: "00000000-00002716.00000002.70213.72611000.00000020.mdmp") Found reference to API (Indicator: "RtlNtStatusToDosErrorNoTeb"; Source: "00000000-00002716.00000002.70213.72611000.00000020.mdmp") Found reference to API (Indicator: "RegDeleteKeyExW"; Source: "00000000-00002716.00000002.70213.72611000.00000020.mdmp") Found reference to API (Indicator: "CoTaskMemRealloc"; Source: "00000000-00002716.00000002.70213.72611000.00000020.mdmp") Found reference to API (Indicator: "StringFromCLSID"; Source: "00000000-00002716.00000002.70213.72611000.00000020.mdmp") Found reference to API (Indicator: "StringFromGUID2"; Source: "00000000-00002716.00000002.70213.72611000.00000020.mdmp") Found reference to API (Indicator: "CoInitializeEx"; Source: "00000000-00002716.00000002.70213.72611000.00000020.mdmp")3a:T9fa,Found reference to API "FindResourceW" (Indicator: "FindResource"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API "FindResourceExW" (Indicator: "FindResource"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp, 00000000-00002716.00000001.68293.72677000.00000002.mdmp") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp, 00000000-00002716.00000001.68293.72677000.00000002.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp, 00000000-00002716.00000001.68293.72677000.00000002.mdmp") Found reference to API "FreeResource" (Indicator: "FreeResource"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API "142307339435,7568,3134,,FindResourceW,kernel32.dll,"00:18:11.562",RX=0,PX=0" (Indicator: "FindResource"; Source: "00000000-00002716.00000002.70213.03390000.00000004.mdmp") Found reference to API "155438116217,7568,3135,,LoadResource,kernel32.dll,"00:18:17.031",RX=0,PX=0" (Indicator: "LoadResource"; Source: "00000000-00002716.00000002.70213.03390000.00000004.mdmp") Found reference to API "155436960365,7568,3134,,FindResourceW,kernel32.dll,"00:18:17.031",RX=0,PX=0" (Indicator: "FindResource"; Source: "00000000-00002716.00000002.70213.03390000.00000004.mdmp") Found reference to API "155443479738,7568,3135,,LoadResource,kernel32.dll,"00:18:17.046",RX=0,PX=0" (Indicator: "LoadResource"; Source: "00000000-00002716.00000002.70213.03390000.00000004.mdmp") Found reference to API "155443312094,7568,3134,,FindResourceW,kernel32.dll,"00:18:17.046",RX=0,PX=0" (Indicator: "FindResource"; Source: "00000000-00002716.00000002.70213.03390000.00000004.mdmp") Found reference to API "142311949973,7568,3135,,LoadResource,kernel32.dll,"00:18:11.562",RX=0,PX=0" (Indicator: "LoadResource"; Source: "00000000-00002716.00000002.70213.03390000.00000004.mdmp") Found reference to API "142311428300,7568,3134,,FindResourceW,kernel32.dll,"00:18:11.562",RX=0,PX=0" (Indicator: "FindResource"; Source: "00000000-00002716.00000002.70213.03390000.00000004.mdmp") Found reference to API "143949074975,7568,3134,,FindResourceW,kernel32.dll,"00:18:12.250",RX=0,PX=0" (Indicator: "FindResource"; Source: "00000000-00002716.00000002.70213.03390000.00000004.mdmp")3b:T1a79,"System\CurrentControlSet\Services\VxD\MSTCP" in Source: emule.exe "Software\Classes\ed2k\DefaultIcon" in Source: emule.exe "Software\Classes\ed2k\shell\open\command" in Source: emule.exe "SYSTEM\CurrentControlSet\Control\TimeZoneInformation" in Source: emule.exe "Software\Microsoft\Windows\CurrentVersion\Run" in Source: emule.exe "Software\Classes\.emulecollection" in Source: emule.exe "Software\Classes\eMule\shell\open" in Source: emule.exe "Software\Classes\eMule" in Source: emule.exe "Software\Classes\eMule\DefaultIcon" in Source: emule.exe "Software\Classes\eMule\shell\open\command" in Source: emule.exe "ISoftware\Classes\ed2k\shell\open" in Source: emule.exe "Software\Classes\ed2k" in Source: emule.exe "Software\eMule" in Source: emule.exe "Software\MediaInfo" in Source: emule.exe "Software\Microsoft\Windows\CurrentVersion\Policies\Comdlg32" in Source: emule.exe "Software\Microsoft\Windows\CurrentVersion\Policies\Network" in Source: emule.exe "Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" in Source: emule.exe "nSoftware\" in Source: emule.exe "System\CurrentControlSet\Services\VxD\MSTCP" in Source: 00000000-00002716.00000000.66373.0032E000.00000002.mdmp "Software\Classes\ed2k\DefaultIcon" in Source: 00000000-00002716.00000000.66373.0032E000.00000002.mdmp "Software\Classes\ed2k\shell\open\command" in Source: 00000000-00002716.00000000.66373.0032E000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\TimeZoneInformation" in Source: 00000000-00002716.00000000.66373.0032E000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00002716.00000000.66373.0032E000.00000002.mdmp "Software\Classes\.emulecollection" in Source: 00000000-00002716.00000000.66373.0032E000.00000002.mdmp "Software\Classes\eMule\shell\open" in Source: 00000000-00002716.00000000.66373.0032E000.00000002.mdmp "Software\Classes\eMule" in Source: 00000000-00002716.00000000.66373.0032E000.00000002.mdmp "Software\Classes\eMule\DefaultIcon" in Source: 00000000-00002716.00000000.66373.0032E000.00000002.mdmp "Software\Classes\eMule\shell\open\command" in Source: 00000000-00002716.00000000.66373.0032E000.00000002.mdmp "Software\Classes\ed2k\shell\open" in Source: 00000000-00002716.00000000.66373.0032E000.00000002.mdmp "Software\Classes\ed2k" in Source: 00000000-00002716.00000000.66373.0032E000.00000002.mdmp "Software\eMule" in Source: 00000000-00002716.00000000.66373.0032E000.00000002.mdmp "Software\MediaInfo" in Source: 00000000-00002716.00000000.66373.0032E000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies\Comdlg32" in Source: 00000000-00002716.00000000.66373.0032E000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies\Network" in Source: 00000000-00002716.00000000.66373.0032E000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" in Source: 00000000-00002716.00000000.66373.0032E000.00000002.mdmp "Software\" in Source: 00000000-00002716.00000000.66373.0032E000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion" in Source: 00000000-00002716.00000000.66373.0032E000.00000002.mdmp "Software\Wow6432`" in Source: 00000000-00002716.00000000.66373.03390000.00000004.mdmp 00000000-00002716.00000001.68293.03390000.00000004.mdmp 00000000-00002716.00000002.70213.03390000.00000004.mdmp "Software\Wow6432" in Source: 00000000-00002716.00000000.66373.03390000.00000004.mdmp 00000000-00002716.00000001.68293.03390000.00000004.mdmp 00000000-00002716.00000002.70213.03390000.00000004.mdmp "sSoftware\Wow6432" in Source: 00000000-00002716.00000000.66373.03390000.00000004.mdmp 00000000-00002716.00000001.68293.03390000.00000004.mdmp 00000000-00002716.00000002.70213.03390000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00002716.00000001.68293.03390000.00000004.mdmp "oftware\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\PackageRepository\Extensions" in Source: 00000000-00002716.00000002.70213.03390000.00000004.mdmp "Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.ZuneMusic_10.18112.10711.0_x64__8wekyb3d8bbwe\Microsoft.ZuneMusic\Capabilities" in Source: 00000000-00002716.00000002.70213.03390000.00000004.mdmp "Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.MicrosoftEdge_41.16299.248.0_neutral__8wekyb3d8bbwe\MicrosoftEdge\Capabilities" in Source: 00000000-00002716.00000002.70213.03390000.00000004.mdmp "oftware\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.GetHelp_10.1706.13371.0_x64__8wekyb3d8bbwe\App\Capabilities" in Source: 00000000-00002716.00000002.70213.03390000.00000004.mdmp "oftware\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.BingWeather_4.28.3242.0_x64__8wekyb3d8bbwe\App\Capabilities" in Source: 00000000-00002716.00000002.70213.03390000.00000004.mdmp "Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Getstarted_6.15.12641.0_x64__8wekyb3d8bbwe\App\Capabilities" in Source: 00000000-00002716.00000002.70213.07E40000.00000004.mdmp "Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.BingWeather_4.28.3242.0_x64__8wekyb3d8bbwe\App\Capabilities" in Source: 00000000-00002716.00000002.70213.07E40000.00000004.mdmp "oftware\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.WindowsStore_11810.1001.12.0_x64__8wekyb3d8bbwe\App\Capabilities" in Source: 00000000-00002716.00000002.70213.07E40000.00000004.mdmp "\REGISTRY\MACHINE\Software\Microsoft\WindowsRuntime" in Source: 00000000-00002716.00000002.70213.07E40000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00002716.00000002.70213.07E40000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00002716.00000002.70213.07E40000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\CaretTracking" in Source: 00000000-00002716.00000002.70213.72611000.00000020.mdmp "Software\Microsoft\Input" in Source: 00000000-00002716.00000002.70213.72611000.00000020.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\OOBE" in Source: 00000000-00002716.00000002.70213.72611000.00000020.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\CFL\ExperienceManagerData" in Source: 00000000-00002716.00000002.70213.72611000.00000020.mdmp3c:T1037,"emule.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 74e30000 "emule.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 74e30000 "emule.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 74e30000 "emule.exe" loaded module "KERNEL32" at base 741b0000 "emule.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 72940000 "emule.exe" loaded module "USER32.DLL" at base 74430000 "emule.exe" loaded module "GDIPLUS.DLL" at base 734f0000 "emule.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 72890000 "emule.exe" loaded module "KERNEL32.DLL" at base 741b0000 "emule.exe" loaded module "WS2_32.DLL" at base 74dc0000 "emule.exe" loaded module "UXTHEME.DLL" at base 73c40000 "emule.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73c40000 "emule.exe" loaded module "ADVAPI32.DLL" at base 755f0000 "emule.exe" loaded module "SHELL32.DLL" at base 75ac0000 "emule.exe" loaded module "COMCTL32.DLL" at base 73950000 "emule.exe" loaded module "C:\EMULEENU.DLL" at base 0 "emule.exe" loaded module "C:\EMULELOC.DLL" at base 0 "emule.exe" loaded module "RICHED20.DLL" at base 72810000 "emule.exe" loaded module "IPHLPAPI.DLL" at base 73660000 "emule.exe" loaded module "DWMAPI.DLL" at base 72900000 "emule.exe" loaded module "MSIMG32.DLL" at base 727a0000 "emule.exe" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 75ac0000 "emule.exe" loaded module "GDI32.DLL" at base 75010000 "emule.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 73ba0000 "emule.exe" loaded module "ICMP.DLL" at base 5c90000 "emule.exe" loaded module "%WINDIR%\SYSTEM32\NAPINSP.DLL" at base 72780000 "emule.exe" loaded module "RPCRT4.DLL" at base 754f0000 "emule.exe" loaded module "%WINDIR%\SYSTEM32\PNRPNSP.DLL" at base 72760000 "emule.exe" loaded module "%WINDIR%\SYSTEM32\NLAAPI.DLL" at base 72740000 "emule.exe" loaded module "%WINDIR%\SYSTEM32\WINRNR.DLL" at base 72720000 "emule.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 726d0000 "emule.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 726c0000 "emule.exe" loaded module "%WINDIR%\SYSTEM32\ASYCFILT.DLL" at base 726a0000 "emule.exe" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 77140000 "emule.exe" loaded module "COMCTL32" at base 73950000 "emule.exe" loaded module "%PROGRAMFILES%\(X86)\COMMON FILES\MICROSOFT SHARED\INK\TIPTSF.DLL" at base 72610000 "emule.exe" loaded module "%WINDIR%\SYSTEM32\DATAEXCHANGE.DLL" at base 725c0000 "emule.exe" loaded module "%WINDIR%\SYSWOW64\THUMBCACHE.DLL" at base 72030000 "emule.exe" loaded module "%WINDIR%\SYSTEM32\EXPLORERFRAME.DLL" at base 713d0000 "emule.exe" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 75050000 "emule.exe" loaded module "OLEAUT32.DLL" at base 745b0000 "emule.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-WINDOW-EXT-L1-1-0.DLL" at base 74430000 "emule.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-INTEGRATION-L1-1-0.DLL" at base 74430000 "emule.exe" loaded module "API-MS-WIN-CORE-COM-L1-1-0.DLL" at base 75740000 "emule.exe" loaded module "%WINDIR%\SYSWOW64\ONECOREUAPCOMMONPROXYSTUB.DLL" at base 710f0000 "emule.exe" loaded module "%WINDIR%\SYSWOW64\WINDOWS.SHELL.SERVICEHOSTBUILDER.DLL" at base 71d50000 "emule.exe" loaded module "%WINDIR%\SYSWOW64\IEFRAME.DLL" at base 70580000 "emule.exe" loaded module "PROPSYS.DLL" at base 730f0000 "emule.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 730f0000 "emule.exe" loaded module "API-MS-WIN-DOWNLEVEL-OLE32-L1-1-0.DLL" at base 75740000 "emule.exe" loaded module "SECUR32.DLL" at base 71b10000 "emule.exe" loaded module "SSPICLI.DLL" at base 73d00000 "emule.exe" loaded module "MLANG.DLL" at base 71ad0000 "emule.exe" loaded module "API-MS-WIN-DOWNLEVEL-SHLWAPI-L2-1-0.DLL" at base 770b0000 "emule.exe" loaded module "WININET.DLL" at base 72d20000 "emule.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.UI.APPDEFAULTS.DLL" at base 0 "emule.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 74660000 "emule.exe" loaded module "NTDLL.DLL" at base 772e0000 "emule.exe" loaded module "%WINDIR%\SYSTEM32\UPNP.DLL" at base 71a700003d:T9db,"emule.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: ""; Value: "") "emule.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS NT\DNSCLIENT"; Key: ""; Value: "") "emule.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNS"; Key: ""; Value: "") "emule.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\SETUP"; Key: ""; Value: "") "emule.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{3480A401-BDE9-4407-BC02-798A866AC051}"; Key: ""; Value: "") "emule.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{3480A401-BDE9-4407-BC02-798A866AC051}"; Key: ""; Value: "") "emule.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{3480A401-BDE9-4407-BC02-798A866AC051}"; Key: ""; Value: "") "emule.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{3480A401-BDE9-4407-BC02-798A866AC051}"; Key: ""; Value: "") "emule.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{3480A401-BDE9-4407-BC02-798A866AC051}\TREATAS"; Key: ""; Value: "") "emule.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{3480A401-BDE9-4407-BC02-798A866AC051}\TREATAS"; Key: ""; Value: "") "emule.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{3480A401-BDE9-4407-BC02-798A866AC051}\INPROCHANDLER32"; Key: ""; Value: "") "emule.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{3480A401-BDE9-4407-BC02-798A866AC051}\INPROCHANDLER32"; Key: ""; Value: "") "emule.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{3480A401-BDE9-4407-BC02-798A866AC051}\INPROCHANDLER"; Key: ""; Value: "") "emule.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{3480A401-BDE9-4407-BC02-798A866AC051}\INPROCHANDLER"; Key: ""; Value: "") "emule.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{0000032A-0000-0000-C000-000000000046}"; Key: ""; Value: "") "emule.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{0000032A-0000-0000-C000-000000000046}"; Key: ""; Value: "") "emule.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{0000032A-0000-0000-C000-000000000046}"; Key: ""; Value: "") "emule.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0000032A-0000-0000-C000-000000000046}"; Key: ""; Value: "") "emule.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\PACKAGEDCOM\TREATASCLASSINDEX"; Key: ""; Value: "") "emule.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\PACKAGEDCOM\CLASSINDEX\{0000032A-0000-0000-C000-000000000046}"; Key: ""; Value: "")3e:Tdf1,"emule.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "QUERYADAPTERNAME"; Value: "") "emule.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "DISABLEADAPTERDOMAINNAME"; Value: "") "emule.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "USEDOMAINNAMEDEVOLUTION"; Value: "") "emule.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "USEDOMAINNAMEDEVOLUTION"; Value: "") "emule.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "DOMAINNAMEDEVOLUTIONLEVEL"; Value: "") "emule.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "PRIORITIZERECORDDATA"; Value: "") "emule.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "PRIORITIZERECORDDATA"; Value: "") "emule.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "ALLOWUNQUALIFIEDQUERY"; Value: "") "emule.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "ALLOWUNQUALIFIEDQUERY"; Value: "") "emule.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "APPENDTOMULTILABELNAME"; Value: "") "emule.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "SCREENBADTLDS"; Value: "") "emule.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "SCREENUNREACHABLESERVERS"; Value: "") "emule.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "SCREENDEFAULTSERVERS"; Value: "") "emule.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "DYNAMICSERVERQUERYORDER"; Value: "") "emule.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "FILTERCLUSTERIP"; Value: "") "emule.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "WAITFORNAMEERRORONALL"; Value: "") "emule.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "USEEDNS"; Value: "") "emule.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "DNSSECURENAMEQUERYFALLBACK"; Value: "") "emule.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "ENABLEDAFORALLNETWORKS"; Value: "") "emule.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "DIRECTACCESSQUERYORDER"; Value: "") "emule.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "QUERYIPMATCHING"; Value: "") "emule.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "USEHOSTSFILE"; Value: "") "emule.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "ADDRCONFIGCONTROL"; Value: "") "emule.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "DISABLESMARTNAMERESOLUTION"; Value: "") "emule.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "PREFERLOCALOVERLOWERBINDINGDNS"; Value: "")3f:T504,"emule.exe" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL" "emule.exe" trying to access non-existent file "C:\WINMM.DLL" "emule.exe" trying to access non-existent file "C:\URLMON.DLL" "emule.exe" trying to access non-existent file "C:\WININET.DLL" "emule.exe" trying to access non-existent file "C:\IERTUTIL.DLL" "emule.exe" trying to access non-existent file "C:\WINMMBASE.DLL" "emule.exe" trying to access non-existent file "C:\IPHLPAPI.DLL" "emule.exe" trying to access non-existent file "C:\BCRYPT.DLL" "emule.exe" trying to access non-existent file "C:\FLTLIB.DLL" "emule.exe" trying to access non-existent file "C:\CRYPTSP.DLL" "emule.exe" trying to access non-existent file "C:\CRYPTSP.dll" "emule.exe" trying to access non-existent file "C:\UXTHEME.DLL" "emule.exe" trying to access non-existent file "C:\UxTheme.dll" "emule.exe" trying to access non-existent file "C:\Windows\SysWOW64\RPCSS.DLL" "emule.exe" trying to access non-existent file "C:\WINDOWS\system32\rpcss.dll" "emule.exe" trying to access non-existent file "C:\EMULEENU.DLL" "emule.exe" trying to access non-existent file "C:\emuleENU.dll" "emule.exe" trying to access non-existent file "C:\EMULELOC.DLL" "emule.exe" trying to access non-existent file "C:\emuleLOC.dll"40:T479,"emule.exe" trying to access non-existent file "C:\EMULE.EXE.LOCAL" "emule.exe" trying to access non-existent file "C:\WINSPOOL.DRV" "emule.exe" trying to access non-existent file "C:\emule.exe.Local\" "emule.exe" trying to access non-existent file "C:\CONFIG" "emule.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\eMule\config\PREFERENCES.INI" "emule.exe" trying to access non-existent file "C:\Users\%OSUSER%\Downloads\eMule\DOWNLOADS.TXT" "emule.exe" trying to access non-existent file "C:\Users\%OSUSER%\Downloads\eMule\downloads.txt" "emule.exe" trying to access non-existent file "C:\Users\%OSUSER%\Downloads\eMule\DOWNLOADS.BAK" "emule.exe" trying to access non-existent file "C:\Users\%OSUSER%\Downloads\eMule\downloads.bak" "emule.exe" trying to access non-existent file "C:\DOWNLOADS.TXT" "emule.exe" trying to access non-existent file "C:\downloads.txt" "emule.exe" trying to access non-existent file "C:\DOWNLOADS.BAK" "emule.exe" trying to access non-existent file "C:\downloads.bak" "emule.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\eMule\config\PREFERENCES.DAT"41:T5f64,Found URL "http://onlinehelp.emule-project.net/help.php?language=%u&topic=%ums" - Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found URL "http://www.microsoft.com/downloads/details.aspx?familyid=cb2cf3a2-8025-4e8f-8511-9b476a8d35d2checkcomctl32emule" - Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found URL "http://www.rarlab.com" - Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found URL "http://porttest.emule-project.net/connectiontest.php?tcpport=%i&udpport=%i&lang=%i%s" - Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found URL "http://%s:%u/.p2pinfoailed" - Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found URL "http://www.emule-project.nethttp://sourceforge.net/projects/emule/http://www.emuleproject.nethttp://emule.sf.nethttp://www%i.emule-project.comhttp://www%i.emule-project.orghttp://www%i.emule-project.nethttp://www.emule-project.comhttp://www.emule-project.orghttp://emule-project.nethttp://vcheck%i.emule-project.comhttp://vcheck%i.emule-project.orghttp://vcheck.emule-project.net%u.part.met.backup%c%u.part.met.bak%c%u.part.met%c%u.part%clastworkingimplementationcloseupnponexitskipwanpppsetupskipwanipsetupenableupnpupnppcportfoundlastsearchpeercachemobilemulewebtimeoutminsallowadminhilevelfuncuselowrightsuserpagerefreshtimeusegzipenabledwebuseupnppasswordlowpasswordwebserverhascustomtaskiconcolorstatcolor%i0x%06xstatsexpandedtreeitemsstatsconnectionsgraphratiostatisticsproxytypeproxyportproxyuserproxypasswordproxynameproxyenableproxyproxyenablepasswordproxyenablesearchresultspamfilterkadudpkeycryptlayersupportedcryptlayerrequiredcryptlayerrequestedshowdownloadtoolbarwinatranstoolbarnotifiermailrecipientnotifiermailservernotifiermailsendernotifiersendmailrememberdownloadedfilesremembercancelledfileswinxpsp2orhigherdebugloglevelopenportsonstartuprunasunprivilegeduserwebmirroralertlevelhighrestimera4afsavecpuussnumberofpingsussgoingdowndividerussgoingupdividerusspingtolerancemillisecondsusspingtoleranceussusemillisecondpingtoleranceussenabledlogtextfonthypertextfontskinprofiledirskinprofiletoolbariconsizetoolbarlabelstoolbarbitmapfoldertoolbarbitmaptoolbarsettingautoarchivepreviewstartremovefilestobinshowdwlpercentageadvancedspamfiltersecureidentfilterlevelversionchecklastautomaticautoshowlookupsshowsharedfilesdetailsallocatefullfileusesimpletimeremainingcomputationtransflstremainorderautoclearcompletednetworked2knetworkkademliauseautocompletionshowextcontrolsautofilenamecleanupshowinfooncattabsmessageusecaptchasmessagesfromfriendsonlyenableschedulersavedebugtodisksavelogtodiskusecreditsystemdisablequeuelistdisableknownclientlistfilterserversbyipuapprefdapprefcommitfilesqueuesizequeuesizepreffilebuffersizefilebuffersizeprefstartnextfilevideopreviewbackuppedshowoverheadfullchunktransfersmanualhighpriopreviewpriologuldleventsloga4aflogfilesavinglogfilteredipslogsecureidentlogratingdescreceivedlogbannedclientsdebugsourceexchangeverbosesmartidcheckmessageenablesmileysircenablesmileysirchelpchannelircignoreemulesendlinkmsgsircallowemuleaddfriendircignoreemuleaddfriendmsgsircignorequitmessagesircignorepartmessagesircignorejoinmessagesircignoremiscmessagesircsoundeventsircacceptlinkfriendsircacceptlinkirclistonconnectircuseperformircperformstringircusefilterircfilteruserircfilternameircaddtimestampircnickdefaultircservernewextractmetadatafilenamecleanupswebtemplatefiledatetimeformat4logdatetimeformatcommentfiltermessagefiltervideoplayerargsvideoplayertxteditornotifiersoundpathnotifierusesoundnotifierpopnewversionnotifierpopeverychatmessagenotifyonimportanterrornotifyonlognotifyonchatnotifyonnewdownloadnotifyondownloadnotifierconfigurationminimule3ddepthaddnewfilespausedautotakeed2klinksautoconnectstaticonlyshowwin7taskbargoodiescheckfileopenyourhostnameresolvesharedshelllinkssparsepartfilesminfreediskspacecheckdiskspacesearchmethodwatchclipboard4ed2kfilelinksindicateratingsshowratesontitlesafeserverconnectlastlogpaneidlastmainwnddlgidstartupminimizedonlinesignatureautoconnectfilterbadipsconfirmexittransferdoubleclickbringtofrontsplashscreenaddserversfromclientaddserversfromserverstoresearchespreventstandbymintotraymintotray_aeroupdatenotifytestclientserverlistscoresystemreconnectcheck4newversiondelaymaxconnectionsperfivesecondsstatsaverageminutesvariousstatisticsmaxvaluetransferwnd2transferwnd1splitterbarpositionsharedsplitterbarpositionircsplitterbarpositionfriendsplitterbarpositionstat_hrsplitterbarpositionstat_hlsplitterbarpositionstatsplitterbarpositionserversplitterbarpositionserverkeepalivetimeoutdeadserverretryuploadcapacitynewdownloadcapacitystatsfillgraphsstatsintervalstatgraphsintervaltooltipdelayseesharelanguagemaxsourcesperfileserverudpportudpportconditionaltcpacceptmaxhalfconnectionsmaxdownloadmaxuploadminuploadtempdirstempdirincomingdirnickappversionlistcontrolsetupskinswebserver\lang\logs\incomingtempunable" - Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found URL "http://miniupnp.free.fr/using" - Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found URL "http://kademlia.scs.cs.nyu.edu01:06:copyright" - Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found URL "ftp://https://failed" - Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found URL "http://langmirror%i.emule-project.org/lang/%i%i%i%i/" - Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found URL "http://mobil.emule-project.netlink:" - Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found URL "http://www.filedonkey.com/search.html?@filehash@rating@comment@codec@bitrate@length@title@album@artist@complete@sources@lastseencomplete@format@type@sizehi@size@name*unkop*%s=" - Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found URL "http://wininet.dlllistboxeditscrollbartooltips_class32sysipaddress32comboboxex32rebarwindow32dragscrollintervaldragscrolldelaywindowsdragscrollinsetes://%s/%sres://%s/%dsysdatetimepick32mswheel_rollmsgbar" - Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found URL "http://www.microsoft.com/downloads/details.aspx?familyid=73ba7bd7-ed06-4f0d-80a4-2a7eeaee17e2" - Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found URL "http://www.emule-project.net/home/perl/general.cgi?rm=download" - Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found URL "http://www.microsoft.com/downloads/" - Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found URL "http://%s/.ed2khash=%s" - Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found URL "http://mediainfo.sourceforge.netmediainfo_info_versioncgdithreadchtricheditctrlchttpdownloaddlghttpdownloadchypertextctrlciconstaticinputboxcipfilterdlgckademliawndsetlayeredwindowattributesclistviewsearchdlgclistviewwalkerpropertysheetclistviewpropertysheetcmetadatadlg" - Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found URL "http://schemas.xmlsoap.org/soap/envelope/" - Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found URL "http://schemas.xmlsoap.org/soap/encoding/" - Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found URL "http://www.virtualbox.orgoracle" - Source: "00000000-00002716.00000000.66373.03390000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=215117microsoft" - Source: "00000000-00002716.00000000.66373.03390000.00000004.mdmp") Found URL "http://support.microsoft.com/kb/4023057c:\windows\softwaredistribution\download\eb561161694e9fba93423cc2a2678b78\img\update" - Source: "00000000-00002716.00000000.66373.03390000.00000004.mdmp") Found URL "http://www.cacetech.comwinpcap" - Source: "00000000-00002716.00000000.66373.03390000.00000004.mdmp") Found URL "http://www.autoitscript.com/autoit3autoit" - Source: "00000000-00002716.00000000.66373.03390000.00000004.mdmp") Found URL "https://www.wireshark.orgc:\program" - Source: "00000000-00002716.00000000.66373.03390000.00000004.mdmp") Found URL "https://ask.wireshark.org/wireshark" - Source: "00000000-00002716.00000000.66373.03390000.00000004.mdmp") Found URL "http://www.adobe.com/support/main.htmlc:\windows\installer\" - Source: "00000000-00002716.00000000.66373.03390000.00000004.mdmp") Found URL "http://support.microsoft.com/kb/4023057c:\windows\softwaredistribution\download\1eb060e9b9d3cbeb39c83f2a9722294e\img\update" - Source: "00000000-00002716.00000000.66373.03390000.00000004.mdmp") Found URL "http://java.com/helpc:\users\hapubws\appdata\locallow\oracle\java\jre1.8.0_161\http://java.comjava" - Source: "00000000-00002716.00000000.66373.03390000.00000004.mdmp") Found URL "https://support.mozilla.orgmozilla" - Source: "00000000-00002716.00000000.66373.03390000.00000004.mdmp") Found URL "https://npcap.com/" - Source: "00000000-00002716.00000000.66373.03390000.00000004.mdmp") Found URL "https://npcap.com/oracle" - Source: "00000000-00002716.00000001.68293.03390000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=215117microsoft" - Source: "00000000-00002716.00000001.68293.03390000.00000004.mdmp") Found URL "http://support.microsoft.com/kb/4023057c:\windows\softwaredistribution\download\eb561161694e9fba93423cc2a2678b78\img\update" - Source: "00000000-00002716.00000001.68293.03390000.00000004.mdmp") Found URL "http://www.cacetech.comwinpcap" - Source: "00000000-00002716.00000001.68293.03390000.00000004.mdmp") Found URL "http://www.autoitscript.com/autoit3autoit" - Source: "00000000-00002716.00000001.68293.03390000.00000004.mdmp") Found URL "https://www.wireshark.orgc:\program" - Source: "00000000-00002716.00000001.68293.03390000.00000004.mdmp") Found URL "https://ask.wireshark.org/wireshark" - Source: "00000000-00002716.00000001.68293.03390000.00000004.mdmp") Found URL "http://www.adobe.com/support/main.htmlc:\windows\installer\" - Source: "00000000-00002716.00000001.68293.03390000.00000004.mdmp") Found URL "http://support.microsoft.com/kb/4023057c:\windows\softwaredistribution\download\1eb060e9b9d3cbeb39c83f2a9722294e\img\update" - Source: "00000000-00002716.00000001.68293.03390000.00000004.mdmp") Found URL "http://java.com/helpc:\users\hapubws\appdata\locallow\oracle\java\jre1.8.0_161\http://java.comjava" - Source: "00000000-00002716.00000001.68293.03390000.00000004.mdmp") Found URL "https://support.mozilla.orgmozilla" - Source: "00000000-00002716.00000001.68293.03390000.00000004.mdmp") Found URL "https://npcap.com/" - Source: "00000000-00002716.00000001.68293.03390000.00000004.mdmp") Found URL "https://npcap.com/" - Source: "00000000-00002716.00000001.68293.053C0000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=105926" - Source: "00000000-00002716.00000001.68293.053C0000.00000004.mdmp") Found URL "http://emule-project.netc:\users\hapubws\downloads\emule\incominghttp://emule-project.netircchat.emule-project.netc:\users\hapubws\downloads\emule\tempnotepad.exec:\users\hapubws\appdata\local\emule\config\notifier.inic:\emule.tmplfastest" - Source: "00000000-00002716.00000001.68293.056B0000.00000004.mdmp") Found URL "http://emule-project.net?download" - Source: "00000000-00002716.00000002.70213.00605000.00000002.mdmp") Found URL "http://sourceforge.net/projects/mediainfo/" - Source: "00000000-00002716.00000002.70213.00605000.00000002.mdmp") Found URL "http://forum.emule-project.net).pdo" - Source: "00000000-00002716.00000002.70213.00605000.00000002.mdmp") Found URL "http://www.emule-project.netfiledescriptionemulefileversion0.50.0" - Source: "00000000-00002716.00000002.70213.00605000.00000002.mdmp") Found URL "http://www.virtualbox.orgoracle" - Source: "00000000-00002716.00000002.70213.03390000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=215117microsoft" - Source: "00000000-00002716.00000002.70213.03390000.00000004.mdmp") Found URL "http://support.microsoft.com/kb/4023057c:\windows\softwaredistribution\download\eb561161694e9fba93423cc2a2678b78\img\update" - Source: "00000000-00002716.00000002.70213.03390000.00000004.mdmp") Found URL "http://www.cacetech.comwinpcap" - Source: "00000000-00002716.00000002.70213.03390000.00000004.mdmp") Found URL "http://www.autoitscript.com/autoit3autoit" - Source: "00000000-00002716.00000002.70213.03390000.00000004.mdmp") Found URL "https://www.wireshark.orgc:\program" - Source: "00000000-00002716.00000002.70213.03390000.00000004.mdmp") Found URL "https://ask.wireshark.org/wireshark" - Source: "00000000-00002716.00000002.70213.03390000.00000004.mdmp") Found URL "http://www.adobe.com/support/main.htmlc:\windows\installer\" - Source: "00000000-00002716.00000002.70213.03390000.00000004.mdmp") Found URL "http://support.microsoft.com/kb/4023057c:\windows\softwaredistribution\download\1eb060e9b9d3cbeb39c83f2a9722294e\img\update" - Source: "00000000-00002716.00000002.70213.03390000.00000004.mdmp") Found URL "http://java.com/helpc:\users\hapubws\appdata\locallow\oracle\java\jre1.8.0_161\http://java.comjava" - Source: "00000000-00002716.00000002.70213.03390000.00000004.mdmp") Found URL "https://support.mozilla.orgmozilla" - Source: "00000000-00002716.00000002.70213.03390000.00000004.mdmp") Found URL "https://npcap.com/" - Source: "00000000-00002716.00000002.70213.03390000.00000004.mdmp") Found URL "https://npcap.com/" - Source: "00000000-00002716.00000002.70213.053C0000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=105926" - Source: "00000000-00002716.00000002.70213.053C0000.00000004.mdmp") Found URL "http://emule-project.netc:\users\hapubws\downloads\emule\incominghttp://emule-project.netircchat.emule-project.netc:\users\hapubws\downloads\emule\tempnotepad.exec:\users\hapubws\appdata\local\emule\config\notifier.inic:\emule.tmplfastest" - Source: "00000000-00002716.00000002.70213.056B0000.00000004.mdmp") Found URL "http://porttest.emule-project.net/connectiontest.php?tcpport=46500&udpport=62123&lang=1033omstoresholnternet" - Source: "00000000-00002716.00000002.70213.07E40000.00000004.mdmp") Found URL "http://porttest.emule-project.net/connectiontest.php?tcpport=46500&udpport=62123&lang=1033rpc" - Source: "00000000-00002716.00000002.70213.07E40000.00000004.mdmp") Found URL "http://porttest.emule-project.net/connectiontest.php?tcpport=46500&udpport=62123&lang=1033http://porttest.emule-project.net/connectiontest.php?tcpport=46500&udpport=62123&lang=1033rpc" - Source: "00000000-00002716.00000002.70213.07E40000.00000004.mdmp") Found URL "http://porttest.emule-project.net/connectiontest.php?tcpport=46500&udpport=62123&lang=1033ir=c:\windowsllusersprofile=c:\programdataappdata=c:\users\hapubws\appdata\roamingcommonprogramfiles=c:\program" - Source: "00000000-00002716.00000002.70213.07E40000.00000004.mdmp") Found URL "http://pst.emule-project.net/connectiontest.php?tcpport=46500&udpport=62123&lang=10:\users\defappdata\local\microsoft\windows\inetcache:\users\hapubws\appdata\local\microsoft\windows\ine:\users\hapappdata\local\microsoft\windows\historyf78b5632b1a4-e38a-400a-928a-d4cd63230295" - Source: "00000000-00002716.00000002.70213.07E40000.00000004.mdmp")42:T89d,Found string "GET %s HTTP/1.1Host: %s:%dConnection: CloseUser-Agent: Windows/Win32, UPnP/1.0, MiniUPnPc/1.4" (Indicator: "HTTP/1.1"; File: "emule.exe") Found string "POST %s HTTP/1.1Host: %s%sUser-Agent: Windows/Win32, UPnP/1.0, MiniUPnPc/1.4Content-Length: %dContent-Type: text/xmlSOAPAction: "%s"Connection: CloseCache-Control: no-cachePragma: no-cache" (Indicator: "HTTP/1.1"; File: "emule.exe") Found string "M-SEARCH * HTTP/1.1HOST: 239.255.255.250:1900ST: %sMAN: "ssdp:discover"MX: %u" (Indicator: "HTTP/1.1"; File: "emule.exe") Found string "CONNECT %s:%u HTTP/1.1" (Indicator: "HTTP/1.1"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found string "CONNECT %s:%u HTTP/1.0" (Indicator: "HTTP/1.0"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found string "HTTP/1.1 200 OK" (Indicator: "HTTP/1.1"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found string "HTTP/1.0 %u" (Indicator: "HTTP/1.0"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found string "GET http://%s/.ed2khash=%s HTTP/1.0" (Indicator: "HTTP/1.0"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found string "HTTP/1.0 206" (Indicator: "HTTP/1.0"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found string "GET %s HTTP/1.0" (Indicator: "HTTP/1.0"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found string "HTTP/1.1 404 File not found" (Indicator: "HTTP/1.1"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found string "HTTP/1.1 403 Forbidden" (Indicator: "HTTP/1.1"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found string "HTTP/1.1 500 Internal Server Error" (Indicator: "HTTP/1.1"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found string "M-SEARCH * HTTP/1.1" (Indicator: "HTTP/1.1"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found string "GET %s HTTP/1.1" (Indicator: "HTTP/1.1"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found string "POST %s HTTP/1.1" (Indicator: "HTTP/1.1"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp")43:T41d9,GET /edgeoffer/experiments?appId=edge-extensions&country=US HTTP/1.1Host: api.edgeoffer.microsoft.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.56 Accept-Encoding: gzip deflate br Accept-Language: en-US en;q=0.9 GET /home/perl/general.cgi?rm=porttest&tcpport=46500&udpport=62123&lang=1033&l=1 HTTP/1.1Host: www.emule-project.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.56 Accept: text/html application/xhtml+xml application/xml;q=0.9 image/webp image/apng */*;q=0.8 application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Microsoft Edge";v="107" "Chromium";v="107" "Not=A?Brand";v="24" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip deflate br Accept-Language: en-US en;q=0.9 GET /home/fontawesome/js/all.js HTTP/1.1Host: www.emule-project.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="107" "Chromium";v="107" "Not=A?Brand";v="24" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.56 sec-ch-ua-platform: "Windows" Accept: */* Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.emule-project.com/home/perl/general.cgi?rm=porttest&tcpport=46500&udpport=62123&lang=1033&l=1 Accept-Encoding: gzip deflate br Accept-Language: en-US en;q=0.9 GET /home/emule.css HTTP/1.1Host: www.emule-project.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="107" "Chromium";v="107" "Not=A?Brand";v="24" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.56 sec-ch-ua-platform: "Windows" Accept: text/css */*;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.emule-project.com/home/perl/general.cgi?rm=porttest&tcpport=46500&udpport=62123&lang=1033&l=1 Accept-Encoding: gzip deflate br Accept-Language: en-US en;q=0.9 GET /home/img/logo_top.jpg HTTP/1.1Host: www.emule-project.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="107" "Chromium";v="107" "Not=A?Brand";v="24" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.56 sec-ch-ua-platform: "Windows" Accept: image/webp image/apng image/svg+xml image/* */*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.emule-project.com/home/perl/general.cgi?rm=porttest&tcpport=46500&udpport=62123&lang=1033&l=1 Accept-Encoding: gzip deflate br Accept-Language: en-US en;q=0.9 GET /home/img/top_bg.gif HTTP/1.1Host: www.emule-project.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="107" "Chromium";v="107" "Not=A?Brand";v="24" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.56 sec-ch-ua-platform: "Windows" Accept: image/webp image/apng image/svg+xml image/* */*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.emule-project.com/home/perl/general.cgi?rm=porttest&tcpport=46500&udpport=62123&lang=1033&l=1 Accept-Encoding: gzip deflate br Accept-Language: en-US en;q=0.9 GET /home/img/mid_bg.gif HTTP/1.1Host: www.emule-project.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="107" "Chromium";v="107" "Not=A?Brand";v="24" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.56 sec-ch-ua-platform: "Windows" Accept: image/webp image/apng image/svg+xml image/* */*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.emule-project.com/home/perl/general.cgi?rm=porttest&tcpport=46500&udpport=62123&lang=1033&l=1 Accept-Encoding: gzip deflate br Accept-Language: en-US en;q=0.9 GET /images/cht.gif HTTP/1.1Host: www.emule-project.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="107" "Chromium";v="107" "Not=A?Brand";v="24" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.56 sec-ch-ua-platform: "Windows" Accept: image/webp image/apng image/svg+xml image/* */*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.emule-project.com/home/perl/general.cgi?rm=porttest&tcpport=46500&udpport=62123&lang=1033&l=1 Accept-Encoding: gzip deflate br Accept-Language: en-US en;q=0.9 GET /home/img/url.gif HTTP/1.1Host: www.emule-project.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="107" "Chromium";v="107" "Not=A?Brand";v="24" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.56 sec-ch-ua-platform: "Windows" Accept: image/webp image/apng image/svg+xml image/* */*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.emule-project.com/home/perl/general.cgi?rm=porttest&tcpport=46500&udpport=62123&lang=1033&l=1 Accept-Encoding: gzip deflate br Accept-Language: en-US en;q=0.9 GET /home/img/bar_bg.gif HTTP/1.1Host: www.emule-project.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="107" "Chromium";v="107" "Not=A?Brand";v="24" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.56 sec-ch-ua-platform: "Windows" Accept: image/webp image/apng image/svg+xml image/* */*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.emule-project.com/home/perl/general.cgi?rm=porttest&tcpport=46500&udpport=62123&lang=1033&l=1 Accept-Encoding: gzip deflate br Accept-Language: en-US en;q=0.9 GET /images/itaflag.jpg HTTP/1.1Host: www.emule-project.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="107" "Chromium";v="107" "Not=A?Brand";v="24" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.56 sec-ch-ua-platform: "Windows" Accept: image/webp image/apng image/svg+xml image/* */*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.emule-project.com/home/perl/general.cgi?rm=porttest&tcpport=46500&udpport=62123&lang=1033&l=1 Accept-Encoding: gzip deflate br Accept-Language: en-US en;q=0.9 GET /images/br.gif HTTP/1.1Host: www.emule-project.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="107" "Chromium";v="107" "Not=A?Brand";v="24" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.56 sec-ch-ua-platform: "Windows" Accept: image/webp image/apng image/svg+xml image/* */*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.emule-project.com/home/perl/general.cgi?rm=porttest&tcpport=46500&udpport=62123&lang=1033&l=1 Accept-Encoding: gzip deflate br Accept-Language: en-US en;q=0.9 GET /images/fca.gif HTTP/1.1Host: www.emule-project.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="107" "Chromium";v="107" "Not=A?Brand";v="24" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.56 sec-ch-ua-platform: "Windows" Accept: image/webp image/apng image/svg+xml image/* */*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.emule-project.com/home/perl/general.cgi?rm=porttest&tcpport=46500&udpport=62123&lang=1033&l=1 Accept-Encoding: gzip deflate br Accept-Language: en-US en;q=0.9 GET /ct_frame.php?lang=1033&tcpport=46500&udpport=62123 HTTP/1.1Host: porttest.emule-project.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="107" "Chromium";v="107" "Not=A?Brand";v="24" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.56 Accept: text/html application/xhtml+xml application/xml;q=0.9 image/webp image/apng */*;q=0.8 application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://www.emule-project.com/ Accept-Encoding: gzip deflate br Accept-Language: en-US en;q=0.9 GET /images/fcz.gif HTTP/1.1Host: www.emule-project.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="107" "Chromium";v="107" "Not=A?Brand";v="24" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.56 sec-ch-ua-platform: "Windows" Accept: image/webp image/apng image/svg+xml image/* */*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.emule-project.com/home/perl/general.cgi?rm=porttest&tcpport=46500&udpport=62123&lang=1033&l=1 Accept-Encoding: gzip deflate br Accept-Language: en-US en;q=0.9 GET /images/es.gif HTTP/1.1Host: www.emule-project.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="107" "Chromium";v="107" "Not=A?Brand";v="24" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.56 sec-ch-ua-platform: "Windows" Accept: image/webp image/apng image/svg+xml image/* */*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.emule-project.com/home/perl/general.cgi?rm=porttest&tcpport=46500&udpport=62123&lang=1033&l=1 Accept-Encoding: gzip deflate br Accept-Language: en-US en;q=0.9 GET /images/se.gif HTTP/1.1Host: www.emule-project.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="107" "Chromium";v="107" "Not=A?Brand";v="24" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.56 sec-ch-ua-platform: "Windows" Accept: image/webp image/apng image/svg+xml image/* */*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.emule-project.com/home/perl/general.cgi?rm=porttest&tcpport=46500&udpport=62123&lang=1033&l=1 Accept-Encoding: gzip deflate br Accept-Language: en-US en;q=0.9 GET /images/fgr.gif HTTP/1.1Host: www.emule-project.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="107" "Chromium";v="107" "Not=A?Brand";v="24" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.56 sec-ch-ua-platform: "Windows" Accept: image/webp image/apng image/svg+xml image/* */*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.emule-project.com/home/perl/general.cgi?rm=porttest&tcpport=46500&udpport=62123&lang=1033&l=1 Accept-Encoding: gzip deflate br Accept-Language: en-US en;q=0.9 GET /images/fpt.gif HTTP/1.1Host: www.emule-project.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="107" "Chromium";v="107" "Not=A?Brand";v="24" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.56 sec-ch-ua-platform: "Windows" Accept: image/webp image/apng image/svg+xml image/* */*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.emule-project.com/home/perl/general.cgi?rm=porttest&tcpport=46500&udpport=62123&lang=1033&l=1 Accept-Encoding: gzip deflate br Accept-Language: en-US en;q=0.9 GET /images/chs.gif HTTP/1.1Host: www.emule-project.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="107" "Chromium";v="107" "Not=A?Brand";v="24" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.56 sec-ch-ua-platform: "Windows" Accept: image/webp image/apng image/svg+xml image/* */*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.emule-project.com/home/perl/general.cgi?rm=porttest&tcpport=46500&udpport=62123&lang=1033&l=1 Accept-Encoding: gzip deflate br Accept-Language: en-US en;q=0.9 GET /images/fcs.gif HTTP/1.1Host: www.emule-project.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="107" "Chromium";v="107" "Not=A?Brand";v="24" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.56 sec-ch-ua-platform: "Windows" Accept: image/webp image/apng image/svg+xml image/* */*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.emule-project.com/home/perl/general.cgi?rm=porttest&tcpport=46500&udpport=62123&lang=1033&l=1 Accept-Encoding: gzip deflate br Accept-Language: en-US en;q=0.9 GET /images/ffi.gif HTTP/1.1Host: www.emule-project.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="107" "Chromium";v="107" "Not=A?Brand";v="24" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.56 sec-ch-ua-platform: "Windows" Accept: image/webp image/apng image/svg+xml image/* */*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.emule-project.com/home/perl/general.cgi?rm=porttest&tcpport=46500&udpport=62123&lang=1033&l=1 Accept-Encoding: gzip deflate br Accept-Language: en-US en;q=0.9 GET /images/dk.gif HTTP/1.1Host: www.emule-project.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="107" "Chromium";v="107" "Not=A?Brand";v="24" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.56 sec-ch-ua-platform: "Windows" Accept: image/webp image/apng image/svg+xml image/* */*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.emule-project.com/home/perl/general.cgi?rm=porttest&tcpport=46500&udpport=62123&lang=1033&l=1 Accept-Encoding: gzip deflate br Accept-Language: en-US en;q=0.9 GET /images/lt.gif HTTP/1.1Host: www.emule-project.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="107" "Chromium";v="107" "Not=A?Brand";v="24" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.56 sec-ch-ua-platform: "Windows" Accept: image/webp image/apng image/svg+xml image/* */*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.emule-project.com/home/perl/general.cgi?rm=porttest&tcpport=46500&udpport=62123&lang=1033&l=1 Accept-Encoding: gzip deflate br Accept-Language: en-US en;q=0.9 GET /images/ee.gif HTTP/1.1Host: www.emule-project.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="107" "Chromium";v="107" "Not=A?Brand";v="24" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.56 sec-ch-ua-platform: "Windows" Accept: image/webp image/apng image/svg+xml image/* */*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.emule-project.com/home/perl/general.cgi?rm=porttest&tcpport=46500&udpport=62123&lang=1033&l=1 Accept-Encoding: gzip deflate br Accept-Language: en-US en;q=0.9 44:T7d5,Found HTTPS GET request to https://api.edgeoffer.microsoft.com/edgeoffer/experiments?appId=edge-extensions&country=US Found HTTPS GET request to https://www.emule-project.com/home/perl/general.cgi?rm=porttest&tcpport=46500&udpport=62123&lang=1033&l=1 Found HTTPS GET request to https://www.emule-project.com/home/fontawesome/js/all.js Found HTTPS GET request to https://www.emule-project.com/home/emule.css Found HTTPS GET request to https://www.emule-project.com/home/img/logo_top.jpg Found HTTPS GET request to https://www.emule-project.com/home/img/top_bg.gif Found HTTPS GET request to https://www.emule-project.com/home/img/mid_bg.gif Found HTTPS GET request to https://www.emule-project.com/images/cht.gif Found HTTPS GET request to https://www.emule-project.com/home/img/url.gif Found HTTPS GET request to https://www.emule-project.com/home/img/bar_bg.gif Found HTTPS GET request to https://www.emule-project.com/images/itaflag.jpg Found HTTPS GET request to https://www.emule-project.com/images/br.gif Found HTTPS GET request to https://www.emule-project.com/images/fca.gif Found HTTPS GET request to https://porttest.emule-project.net/ct_frame.php?lang=1033&tcpport=46500&udpport=62123 Found HTTPS GET request to https://www.emule-project.com/images/fcz.gif Found HTTPS GET request to https://www.emule-project.com/images/es.gif Found HTTPS GET request to https://www.emule-project.com/images/se.gif Found HTTPS GET request to https://www.emule-project.com/images/fgr.gif Found HTTPS GET request to https://www.emule-project.com/images/fpt.gif Found HTTPS GET request to https://www.emule-project.com/images/chs.gif Found HTTPS GET request to https://www.emule-project.com/images/fcs.gif Found HTTPS GET request to https://www.emule-project.com/images/ffi.gif Found HTTPS GET request to https://www.emule-project.com/images/dk.gif Found HTTPS GET request to https://www.emule-project.com/images/lt.gif Found HTTPS GET request to https://www.emule-project.com/images/ee.gif45:T69d,"emule.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "16845007" "cx": "1" "cy": "1"} "emule.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "16844568" "cx": "350" "cy": "300"} "emule.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "16844202" "cx": "300" "cy": "118"} "emule.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "16844202" "cx": "79" "cy": "16"} "emule.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "16844202" "cx": "163" "cy": "16"} "emule.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "16844202" "cx": "62" "cy": "16"} "emule.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "16844202" "cx": "81" "cy": "16"} "emule.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "889260181" "cx": "163" "cy": "16"} "emule.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "33621802" "cx": "62" "cy": "16"} "emule.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "16844202" "cx": "45" "cy": "16"} "emule.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "33621802" "cx": "45" "cy": "16"} "emule.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "16845007" "cx": "424" "cy": "148"} "emule.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "33621802" "cx": "424" "cy": "148"} "emule.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "16845007" "cx": "522" "cy": "148"} "emule.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "16844568" "cx": "522" "cy": "148"} "emule.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "33621802" "cx": "522" "cy": "149"}46:T50a,"emule.exe" called "FindFirstFileW" with parameter C:\config\preferences.ini (UID: 00000000-00002716) "emule.exe" called "FindFirstFileW" with parameter %LOCALAPPDATA%\eMule\config\preferences.ini (UID: 00000000-00002716) "emule.exe" called "FindFirstFileW" with parameter %ALLUSERSPROFILE%\eMule\config\preferences.ini (UID: 00000000-00002716) "emule.exe" called "FindFirstFileW" with parameter C:\eMule*.log (UID: 00000000-00002716) "emule.exe" called "FindFirstFileW" with parameter %LOCALAPPDATA%\eMule\config\eMule.tmpl (UID: 00000000-00002716) "emule.exe" called "FindFirstFileW" with parameter C:\lang\*.dll (UID: 00000000-00002716) "emule.exe" called "FindFirstFileW" with parameter %USERPROFILE%\Downloads\eMule\Incoming\* (UID: 00000000-00002716) "emule.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00002716) "emule.exe" called "FindNextFileW" with parameter . (UID: 00000000-00002716) "emule.exe" called "FindFirstFileW" with parameter %LOCALAPPDATA%\eMule\config\Notifier.ini (UID: 00000000-00002716) "emule.exe" called "FindFirstFileW" with parameter %USERPROFILE%\Downloads\eMule\Temp\*.part.met (UID: 00000000-00002716) "emule.exe" called "FindFirstFileW" with parameter %USERPROFILE%\Downloads\eMule\Temp\*.part.met.backup (UID: 00000000-00002716)47:Tfcf,Found reference to API "CreateDCW" (Indicator: "CreateDC"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API "?GetDIBits failed" (Indicator: "GetDIBits"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API "GetDC" (Indicator: "GetDC"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp, 00000000-00002716.00000001.68293.72677000.00000002.mdmp") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp, 00000000-00002716.00000001.68293.72677000.00000002.mdmp") Found reference to API "GetWindowDC" (Indicator: "GetWindowDC"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API "BitBlt" (Indicator: "BitBlt"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API "CreateCompatibleBitmap" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API "GetDCEx" (Indicator: "GetDC"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API "GetDIBits" (Indicator: "GetDIBits"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00002716.00000000.66373.03390000.00000004.mdmp, 00000000-00002716.00000001.68293.03390000.00000004.mdmp, 00000000-00002716.00000002.70213.03390000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00002716.00000000.66373.03390000.00000004.mdmp, 00000000-00002716.00000001.68293.03390000.00000004.mdmp, 00000000-00002716.00000002.70213.03390000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00002716.00000000.66373.03390000.00000004.mdmp, 00000000-00002716.00000001.68293.03390000.00000004.mdmp, 00000000-00002716.00000002.70213.03390000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00002716.00000000.66373.03390000.00000004.mdmp, 00000000-00002716.00000001.68293.03390000.00000004.mdmp, 00000000-00002716.00000002.70213.03390000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00002716.00000000.66373.03390000.00000004.mdmp, 00000000-00002716.00000001.68293.03390000.00000004.mdmp, 00000000-00002716.00000002.70213.03390000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00002716.00000000.66373.03390000.00000004.mdmp, 00000000-00002716.00000001.68293.03390000.00000004.mdmp, 00000000-00002716.00000002.70213.03390000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00002716.00000000.66373.03390000.00000004.mdmp, 00000000-00002716.00000001.68293.03390000.00000004.mdmp, 00000000-00002716.00000002.70213.03390000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00002716.00000000.66373.03390000.00000004.mdmp, 00000000-00002716.00000001.68293.03390000.00000004.mdmp, 00000000-00002716.00000002.70213.03390000.00000004.mdmp") Found reference to API "11388435670,7568,3155,,CreateCompatibleBitmap,Gdi32.dll,"00:17:17.000",RX=0,PX=0" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00002716.00000000.66373.03390000.00000004.mdmp") Found reference to API "GetDCOrgEx" (Indicator: "GetDC"; Source: "00000000-00002716.00000002.70213.72611000.00000020.mdmp")48:T4a5,Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp, 00000000-00002716.00000001.68293.72677000.00000002.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp, 00000000-00002716.00000001.68293.72677000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp, 00000000-00002716.00000001.68293.72677000.00000002.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API "GetEnvironmentStrings" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00002716.00000001.68293.72677000.00000002.mdmp")49:T5ef,Found reference to API "RegOpenKeyExW" (Indicator: "RegOpenKey"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp, 00000000-00002716.00000001.68293.72677000.00000002.mdmp") Found reference to API "RegQueryValueExW" (Indicator: "RegQueryValue"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp, 00000000-00002716.00000001.68293.72677000.00000002.mdmp") Found reference to API "RegEnumKeyExW" (Indicator: "RegEnumKey"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp, 00000000-00002716.00000001.68293.72677000.00000002.mdmp") Found reference to API "RegQueryValueExA" (Indicator: "RegQueryValue"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API "RegOpenKeyExA" (Indicator: "RegOpenKey"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API "RegOpenKeyW" (Indicator: "RegOpenKey"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API "RegEnumKeyW" (Indicator: "RegEnumKey"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API "RegQueryValueW" (Indicator: "RegQueryValue"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API "RegQueryInfoKeyW" (Indicator: "RegQueryInfoKey"; Source: "00000000-00002716.00000001.68293.72677000.00000002.mdmp") Found reference to API "RegGetValueW" (Indicator: "RegGetValue"; Source: "00000000-00002716.00000001.68293.72677000.00000002.mdmp")4a:T81e,Found reference to API "GetFileVersionInfoW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API "GetTempFileNameW" (Indicator: "GetTempFileName"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API "GetFileInformationByHandle" (Indicator: "GetFileInformationByHandle"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API "PathFindFileNameW" (Indicator: "PathFindFileName"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API "GetCurrentDirectoryA" (Indicator: "GetCurrentDirectory"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeExW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00002716.00000001.68293.72677000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeExW" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00002716.00000001.68293.72677000.00000002.mdmp") Found reference to API "GetFileVersionInfoExW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00002716.00000001.68293.72677000.00000002.mdmp")4b:T1107,Found reference to API "MapVirtualKeyW" (Indicator: "MapVirtualKey"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp, 00000000-00002716.00000001.68293.72677000.00000002.mdmp") Found reference to API "GetKeyNameTextW" (Indicator: "GetKeyNameText"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API "GetAsyncKeyState" (Indicator: "GetAsyncKeyState"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API "GetKeyState" (Indicator: "GetKeyState"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API "81618581336,7568,104,,GetKeyState,user32.dll,"00:17:46.265",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00002716.00000001.68293.03390000.00000004.mdmp") Found reference to API "79879788892,7568,104,,GetKeyState,user32.dll,"00:17:45.546",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00002716.00000001.68293.03390000.00000004.mdmp") Found reference to API "79855363117,7568,104,,GetKeyState,user32.dll,"00:17:45.531",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00002716.00000001.68293.03390000.00000004.mdmp") Found reference to API "79879623887,7568,104,,GetKeyState,user32.dll,"00:17:45.546",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00002716.00000001.68293.03390000.00000004.mdmp") Found reference to API "79879872212,7568,104,,GetKeyState,user32.dll,"00:17:45.546",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00002716.00000001.68293.03390000.00000004.mdmp") Found reference to API "73318368981,7568,104,,GetKeyState,user32.dll,"00:17:42.812",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00002716.00000001.68293.03390000.00000004.mdmp") Found reference to API "79906264806,7568,104,,GetKeyState,user32.dll,"00:17:45.546",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00002716.00000001.68293.03390000.00000004.mdmp") Found reference to API "79879535239,7568,104,,GetKeyState,user32.dll,"00:17:45.546",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00002716.00000001.68293.03390000.00000004.mdmp") Found reference to API "79855447388,7568,104,,GetKeyState,user32.dll,"00:17:45.531",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00002716.00000001.68293.03390000.00000004.mdmp") Found reference to API "81584848127,7568,104,,GetKeyState,user32.dll,"00:17:46.250",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00002716.00000001.68293.03390000.00000004.mdmp") Found reference to API "81618493705,7568,104,,GetKeyState,user32.dll,"00:17:46.265",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00002716.00000001.68293.03390000.00000004.mdmp") Found reference to API "81585191952,7568,104,,GetKeyState,user32.dll,"00:17:46.250",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00002716.00000001.68293.03390000.00000004.mdmp") Found reference to API "79879223861,7568,104,,GetKeyState,user32.dll,"00:17:45.546",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00002716.00000001.68293.03390000.00000004.mdmp") Found reference to API "81618348016,7568,104,,GetKeyState,user32.dll,"00:17:46.265",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00002716.00000001.68293.03390000.00000004.mdmp") Found reference to API "MapVirtualKeyExW" (Indicator: "MapVirtualKey"; Source: "00000000-00002716.00000001.68293.72677000.00000002.mdmp") Found reference to API "131644665303,7568,104,,GetKeyState,user32.dll,"00:18:07.125",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00002716.00000002.70213.03390000.00000004.mdmp") Found reference to API "131104368879,7568,104,,GetKeyState,user32.dll,"00:18:06.890",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00002716.00000002.70213.03390000.00000004.mdmp") Found reference to API "131644578884,7568,104,,GetKeyState,user32.dll,"00:18:07.125",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00002716.00000002.70213.03390000.00000004.mdmp") Found reference to API "131782327536,7568,104,,GetKeyState,user32.dll,"00:18:07.171",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00002716.00000002.70213.03390000.00000004.mdmp") Found reference to API "131696722788,7568,104,,GetKeyState,user32.dll,"00:18:07.140",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00002716.00000002.70213.03390000.00000004.mdmp")4c:T6f2,Found reference to API "Run as unpriveleged user: Error: LookupAccountName()2 failed" (Indicator: "LookupAccountName"; File: "emule.exe") Found reference to API "Run as unpriveleged user: Error: LookupAccountName() failed," (Indicator: "LookupAccountName"; File: "emule.exe") Found reference to API "GetUserObjectInformationA" (Indicator: "GetUserObjectInformation"; File: "emule.exe") Found reference to API "GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; File: "emule.exe") Found reference to API "Run as unpriveleged user: Error: LookupAccountName()2 failed" (Indicator: "LookupAccountName"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API "Run as unpriveleged user: Error: LookupAccountName() failed," (Indicator: "LookupAccountName"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API "LookupAccountNameW" (Indicator: "LookupAccountName"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API "GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API "GetUserObjectInformationA" (Indicator: "GetUserObjectInformation"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API "GetUserObjectInformationW" (Indicator: "GetUserObjectInformation"; Source: "00000000-00002716.00000001.68293.72677000.00000002.mdmp")4d:Tdc2,Found reference to API "Run as unpriveleged user: Error: AddAce()2 failed," (Indicator: "AddAce"; File: "emule.exe") Found reference to API "Run as unpriveleged user: Error: GetAce()2 failed," (Indicator: "GetAce"; File: "emule.exe") Found reference to API "Run as unpriveleged user: Error: AddAccessAllowedAceEx() failed," (Indicator: "AddAccessAllowedAce"; File: "emule.exe") Found reference to API "Run as unpriveleged user: Error: AddAccessAllowedAceEx() failed," (Indicator: "AddAccessAllowedAceEx"; File: "emule.exe") Found reference to API "Run as unpriveleged user: Error: AddAce()1 failed," (Indicator: "AddAce"; File: "emule.exe") Found reference to API "Run as unpriveleged user: Error: GetAce() failed," (Indicator: "GetAce"; File: "emule.exe") Found reference to API "Run as unpriveleged user: Error: GetAclInformation() failed" (Indicator: "GetAclInformation"; File: "emule.exe") Found reference to API "Run as unpriveleged user: Error: AddAce()2 failed," (Indicator: "AddAce"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API "Run as unpriveleged user: Error: GetAce()2 failed," (Indicator: "GetAce"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API "Run as unpriveleged user: Error: AddAccessAllowedAceEx() failed," (Indicator: "AddAccessAllowedAce"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API "Run as unpriveleged user: Error: AddAccessAllowedAceEx() failed," (Indicator: "AddAccessAllowedAceEx"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API "Run as unpriveleged user: Error: AddAce()1 failed," (Indicator: "AddAce"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API "Run as unpriveleged user: Error: GetAce() failed," (Indicator: "GetAce"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API "Run as unpriveleged user: Error: GetAclInformation() failed" (Indicator: "GetAclInformation"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API "CreateRestrictedToken" (Indicator: "CreateRestrictedToken"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API "GetLengthSid" (Indicator: "GetLengthSid"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API "EqualSid" (Indicator: "EqualSid"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API "AddAce" (Indicator: "AddAce"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API "GetAce" (Indicator: "GetAce"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API "InitializeAcl" (Indicator: "InitializeAcl"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API "GetAclInformation" (Indicator: "GetAclInformation"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API "AddAccessAllowedAceEx" (Indicator: "AddAccessAllowedAce"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found reference to API "AddAccessAllowedAceEx" (Indicator: "AddAccessAllowedAceEx"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp")4e:Tdf1,"emule.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "QUERYADAPTERNAME"; Value: "") "emule.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "DISABLEADAPTERDOMAINNAME"; Value: "") "emule.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "USEDOMAINNAMEDEVOLUTION"; Value: "") "emule.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "USEDOMAINNAMEDEVOLUTION"; Value: "") "emule.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "DOMAINNAMEDEVOLUTIONLEVEL"; Value: "") "emule.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "PRIORITIZERECORDDATA"; Value: "") "emule.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "PRIORITIZERECORDDATA"; Value: "") "emule.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "ALLOWUNQUALIFIEDQUERY"; Value: "") "emule.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "ALLOWUNQUALIFIEDQUERY"; Value: "") "emule.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "APPENDTOMULTILABELNAME"; Value: "") "emule.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "SCREENBADTLDS"; Value: "") "emule.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "SCREENUNREACHABLESERVERS"; Value: "") "emule.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "SCREENDEFAULTSERVERS"; Value: "") "emule.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "DYNAMICSERVERQUERYORDER"; Value: "") "emule.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "FILTERCLUSTERIP"; Value: "") "emule.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "WAITFORNAMEERRORONALL"; Value: "") "emule.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "USEEDNS"; Value: "") "emule.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "DNSSECURENAMEQUERYFALLBACK"; Value: "") "emule.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "ENABLEDAFORALLNETWORKS"; Value: "") "emule.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "DIRECTACCESSQUERYORDER"; Value: "") "emule.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "QUERYIPMATCHING"; Value: "") "emule.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "USEHOSTSFILE"; Value: "") "emule.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "ADDRCONFIGCONTROL"; Value: "") "emule.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "DISABLESMARTNAMERESOLUTION"; Value: "") "emule.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "PREFERLOCALOVERLOWERBINDINGDNS"; Value: "")4f:T494,file/memory contains long string with (Indicator: "dbghelp.dll"; File: "emule.exe") Found string "DBGHELP.DLL" (Indicator: "dbghelp.dll"; File: "emule.exe") Found string "DBGHELP.DLL found is too old. Please upgrade to version 5.1 (or later) of DBGHELP.DLL." (Indicator: "dbghelp.dll"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found string "You can get the required DBGHELP.DLL by downloading the "User Mode Process Dumper" from "Microsoft Download Center"." (Indicator: "dbghelp.dll"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found string "Extract the "User Mode Process Dumper" and locate the "x86" folder. Copy the DBGHELP.DLL from the "x86" folder into your eMule installation folder and/or into your Windows system/system32 folder." (Indicator: "dbghelp.dll"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found string "DBGHELP.DLL not found. Please install a DBGHELP.DLL." (Indicator: "dbghelp.dll"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found string "DBGHELP.DLL" (Indicator: "dbghelp.dll"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp")50:Tdc3,Found string "Proxy hostname not resolved" (Indicator: "hostname"; File: "emule.exe") Found string "UploadSpeedSense: Lowest ping: %i ms. (Filtered lower values. Lowest ping is never allowed to go under %i ms)" (Indicator: "ping"; File: "emule.exe") Found string "UploadSpeedSense: Could perform no ping at all at TTL %i. Giving up." (Indicator: "ping"; File: "emule.exe") Found string "UploadSpeedSense: Unknown pinging error! (TTL: %i IP: %s status: %i). Reason follows. Changing ping method to see if it helps." (Indicator: "ping"; File: "emule.exe") Found string "UploadSpeedSense: Unknown ping status! (TTL: %i IP: %s status: %i). Reason follows. Changing ping method to see if it helps." (Indicator: "ping"; File: "emule.exe") Found string "UploadSpeedSense: Failure #%i to ping host! (TTL: %i IP: %s error: %i). Sleeping 1 sec before retry. Error info follows." (Indicator: "ping"; File: "emule.exe") Found string "UploadSpeedSense: Could perform no ping at all at TTL %i. Trying next ttl." (Indicator: "ping"; File: "emule.exe") Found string "PING %s" (Indicator: "ping"; File: "emule.exe") Found string "PING :" (Indicator: "ping"; File: "emule.exe") Found string "Proxy hostname not resolved" (Indicator: "hostname"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found string "ploadSpeedSense: Lowest ping: %i ms. (Filtered lower values. Lowest ping is never allowed to go under %i ms)" (Indicator: "ping"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found string "UploadSpeedSense: Could perform no ping at all at TTL %i. Giving up." (Indicator: "ping"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found string "UploadSpeedSense: Unknown pinging error! (TTL: %i IP: %s status: %i). Reason follows. Changing ping method to see if it helps." (Indicator: "ping"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found string "UploadSpeedSense: Unknown ping status! (TTL: %i IP: %s status: %i). Reason follows. Changing ping method to see if it helps." (Indicator: "ping"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found string "UploadSpeedSense: Failure #%i to ping host! (TTL: %i IP: %s error: %i). Sleeping 1 sec before retry. Error info follows." (Indicator: "ping"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found string "UploadSpeedSense: Could perform no ping at all at TTL %i. Trying next ttl." (Indicator: "ping"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found string "PING %s" (Indicator: "ping"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found string "PING" (Indicator: "ping"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found string "PING :" (Indicator: "ping"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found string "ping" (Indicator: "ping"; Source: "00000000-00002716.00000000.66373.0032E000.00000002.mdmp") Found string "Use hostname (from peferences) instead of IP when creating a source link" (Indicator: "hostname"; Source: "00000000-00002716.00000002.70213.00605000.00000002.mdmp") Found string "Ping" (Indicator: "ping"; Source: "00000000-00002716.00000002.70213.00605000.00000002.mdmp") Found string "Ping tolerance (ms)" (Indicator: "ping"; Source: "00000000-00002716.00000002.70213.00605000.00000002.mdmp") Found string "Method for ping tolerance" (Indicator: "ping"; Source: "00000000-00002716.00000002.70213.00605000.00000002.mdmp")51:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AETMzd3czMxAAAAAAAAAAABETMzMzMzEQAAB3d3dwAAABEzMzEREREQA3d3d3B3AAERMxERMzMzMzd3h4eIiIAAERETMzMzMzM3eIh4iIiHARERMzMzMzMzN3iIh4iIiAAREzMzN3MzMzN4iIj///gBERMzd3dzMzMzd4iP///4ABEzN3iHczMzM3eIj///+AERM3eIh3MzMzN3iIj//4gAETN4iIdzMzMzN4iIiP+IABEzeIiHMzMzM3d3dzj4hwARM3d3czM3dzM3h3eP+IAAARM3d3M3j3AzN4j//4hwABETNzMzf/8wBzOIiIiHAAABEzMzM4//cAczN3d3AAAAERMzMzOP/4MDMzEQAAAAAAERMzMxeP//gzEQAAAAAAARETMzMxGPiDMREAAAAAABEREzMzcxERMREQAAAAAAAAERMzMzMzMxEQAAAAAAAAARExMzMzMREAAAAAAAAAAAARMxN3MzMRERAAAAAAAAAAATMxN3dzMzEREAAAAAAAAAEzMxOIh3czMxEQAAAAAAABMzMxeIiHdzMzERAAAAAAATMzMRN4iHdzMzMRAAAAAAETMzERE3eIiDMzMxAAAAAAE3MTEBETN3MzMzMxAAAAABE4ExEBEREzMzMzMxAAAAABExMRAAARERERERERAAAAABEREQAAAAAAAAAAAAAAAeAPAAGAA4AAAAEAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAAgAAAAIAAAACAAAAAwAAAAIAAAAHAAAADgAAAD8AAA/+AAAP/AAAH/8AAH/+AAP//wAAf/+AAB//gAAH/4AAAf+AAAD/gAAAf8BAAD/AIAAf4DwAD/A///w==18:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$20"}}],["$","$L21",null,{"initialData":{"schema_version":"1.0.15","sha256":"06cdf814387f627a4bd05a0c68211f715bfa952423e8e8a462e1f47c11a4d20e","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"clean","threat_score":0,"unified_at_epoch_ms":1790307522743,"unified_at":"2026-09-25T03:38:42.743Z","metadata":{"hashes":{"sha256":"06cdf814387f627a4bd05a0c68211f715bfa952423e8e8a462e1f47c11a4d20e","sha1":"8e0ea03e4c38199e10a2bc12db8b2df70484111d","md5":"f3f709c2d49dd6636f4ede5c2cae5448","sha512":"7a0df912b5ddc149d770260a2e1a3f55e58ac2e9ef02883e8baa08e79261075b82955bc8e57641bb2c16983abcada2581850fafc11b92a133605127bda80513e","ssdeep":"49152:/BGoXbyOj8LePLHcPPLRCAnyOTxP9DzE4GEATLHYiipKXePi9Wxmw7b4ZC1VTWS3:rEWLHcPFCv745ATLHY1kO6g0w7b0XiG","ssdeep_chunks":["49152:/BGoXby","49152:BGoXbyO","49152:GoXbyOj","49152:oXbyOj8","49152:XbyOj8L","49152:byOj8Le","49152:yOj8LeP","49152:Oj8LePL","49152:j8LePLH","49152:8LePLHc","49152:LePLHcP","49152:ePLHcPP","49152:PLHcPPL","49152:LHcPPLR","49152:HcPPLRC","49152:cPPLRCA","49152:PPLRCAn","49152:PLRCAny","49152:LRCAnyO","49152:RCAnyOT","49152:CAnyOTx","49152:AnyOTxP","49152:nyOTxP9","49152:yOTxP9D","49152:OTxP9Dz","49152:TxP9DzE","49152:xP9DzE4","49152:P9DzE4G","49152:9DzE4GE","49152:DzE4GEA","49152:zE4GEAT","49152:E4GEATL","49152:4GEATLH","49152:GEATLHY","49152:EATLHYi","49152:ATLHYii","49152:TLHYiip","49152:LHYiipK","49152:HYiipKX","49152:YiipKXe","49152:iipKXeP","49152:ipKXePi","49152:pKXePi9","49152:KXePi9W","49152:XePi9Wx","49152:ePi9Wxm","49152:Pi9Wxmw","49152:i9Wxmw7","49152:9Wxmw7b","49152:Wxmw7b4","49152:xmw7b4Z","49152:mw7b4ZC","49152:w7b4ZC1","49152:7b4ZC1V","49152:b4ZC1VT","49152:4ZC1VTW","49152:ZC1VTWS","49152:C1VTWS3","98304:/BGoXby","98304:BGoXbyO","98304:GoXbyOj","98304:oXbyOj8","98304:XbyOj8L","98304:byOj8Le","98304:yOj8LeP","98304:Oj8LePL","98304:j8LePLH","98304:8LePLHc","98304:LePLHcP","98304:ePLHcPP","98304:PLHcPPL","98304:LHcPPLR","98304:HcPPLRC","98304:cPPLRCA","98304:PPLRCAn","98304:PLRCAny","98304:LRCAnyO","98304:RCAnyOT","98304:CAnyOTx","98304:AnyOTxP","98304:nyOTxP9","98304:yOTxP9D","98304:OTxP9Dz","98304:TxP9DzE","98304:xP9DzE4","98304:P9DzE4G","98304:9DzE4GE","98304:DzE4GEA","98304:zE4GEAT","98304:E4GEATL","98304:4GEATLH","98304:GEATLHY","98304:EATLHYi","98304:ATLHYii","98304:TLHYiip","98304:LHYiipK","98304:HYiipKX","98304:YiipKXe","98304:iipKXeP","98304:ipKXePi","98304:pKXePi9","98304:KXePi9W","98304:XePi9Wx","98304:ePi9Wxm","98304:Pi9Wxmw","98304:i9Wxmw7","98304:9Wxmw7b","98304:Wxmw7b4","98304:xmw7b4Z","98304:mw7b4ZC","98304:w7b4ZC1","98304:7b4ZC1V","98304:b4ZC1VT","98304:4ZC1VTW","98304:ZC1VTWS","98304:C1VTWS3","49152:rEWLHcP","49152:EWLHcPF","49152:WLHcPFC","49152:LHcPFCv","49152:HcPFCv7","49152:cPFCv74","49152:PFCv745","49152:FCv745A","49152:Cv745AT","49152:v745ATL","49152:745ATLH","49152:45ATLHY","49152:5ATLHY1","49152:ATLHY1k","49152:TLHY1kO","49152:LHY1kO6","49152:HY1kO6g","49152:Y1kO6g0","49152:1kO6g0w","49152:kO6g0w7","49152:O6g0w7b","49152:6g0w7b0","49152:g0w7b0X","49152:0w7b0Xi","49152:w7b0XiG"],"imphash":"e398bcd85a5a4d5fa02e3bb6b12c9d85"},"file_info":{"file_name":"emule.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":5758976,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1507113795000,"last_seen":1708924662000,"last_multi_scan":1708924662000}},"detections":{"summary":{"verdict":"clean","score":0,"tags":["alma","almanahe","dropper","expiro","floxif","locker","ransomware","trojan","windows-server-utility"]},"stats":{"av":{"malicious_count":0,"suspicious_count":0,"total_engines":25},"attributions":{"malware_families_count":0,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":86},"sandbox_signatures":{"informative_count":210,"suspicious_count":26,"malicious_count":11,"total":247},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"undetected","status":"whitelisted","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cylance":{"name":"Cylance","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{},"mitre_attacks":[{"tactic":"Execution","technique":"Service Execution","attack_id":"T1035","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1035","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"tactic":"Persistence","technique":"Hooking","attack_id":"T1179","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1179","identifiers":[{"type":"suspicious","value":"Installs hooks/patches the running process"},{"type":"informative","value":"Loads rich edit control libraries"}],"sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"tactic":"Persistence","technique":"Kernel Modules and Extensions","attack_id":"T1215","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1215","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"tactic":"Persistence","technique":"Registry Run Keys / Start Folder","attack_id":"T1060","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1060","identifiers":[{"type":"suspicious","value":"Modifies auto-execute functionality by setting/creating a value in the registry"}],"sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1055","identifiers":[{"type":"malicious","value":"Writes data to a remote process"},{"type":"malicious","value":"Creates a process in suspended mode (likely for process injection)"},{"type":"informative","value":"Contains ability to inject code into another process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"},{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1112","identifiers":[{"type":"informative","value":"Contains ability to create/load registry keys (API string)"},{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Contains ability to modify registry key/value (API string)"},{"type":"informative","value":"Contains ability to delete registry key/value (API string)"},{"type":"informative","value":"Creates or modifies windows services"}],"sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"},{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1124","identifiers":[{"type":"informative","value":"Contains ability to query the machine timezone"},{"type":"informative","value":"Contains ability to query machine time"},{"type":"informative","value":"Contains ability to retrieve machine time (API string)"},{"type":"informative","value":"Contains ability to retrieve machine timezone (API string)"}],"sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"},{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1010","identifiers":[{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"},{"type":"informative","value":"Scanning for window names"},{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"},{"type":"informative","value":"Contains ability to find open windows (API string)"},{"type":"informative","value":"Calls an API typically used to get handle of currently active window"},{"type":"informative","value":"Calls an API typically used to get active windows title"}],"sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"},{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1012","identifiers":[{"type":"suspicious","value":"Reads the cryptographic machine GUID"},{"type":"suspicious","value":"Reads the active computer name"},{"type":"suspicious","value":"Reads information about supported languages"},{"type":"informative","value":"Reads the registry for installed applications"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Contains ability to query registry keys (API string)"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Opens registry keys"}],"sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"},{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"tactic":"Lateral Movement","technique":"Remote Desktop Protocol","attack_id":"T1076","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1076","identifiers":[{"type":"suspicious","value":"Reads terminal service related keys (often RDP related)"}],"sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1114","identifiers":[{"type":"informative","value":"Found mail information locations related strings"}],"sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"},{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"tactic":"Command and Control","technique":"Custom Command and Control Protocol","attack_id":"T1094","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1094","identifiers":[{"type":"suspicious","value":"Contains indicators of bot communication commands"}],"sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"tactic":"Exfiltration","technique":"Data Compressed","attack_id":"T1002","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"malicious","value":"Calls an API typically used to execute an application"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Imports GetCommandLine API"},{"type":"informative","value":"Contains ability to dynamically load libraries"},{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"},{"type":"informative","value":"Calls an API typically used to find a resource in a module"}],"sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"tactic":"Execution","technique":"JavaScript","attack_id":"T1059.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/007","identifiers":[{"type":"informative","value":"References JavaScript(s)"}],"sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"informative","value":"Contains ability to open a service (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Contains ability to create/connect to a named pipe (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Loads rich edit control libraries"},{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"}],"sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to start a service (API string)"},{"type":"informative","value":"Contains ability to create/control drivers (API string)"},{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Creates or modifies windows services"},{"type":"informative","value":"Contains the ability to modify system service (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"tactic":"Persistence","technique":"Account Manipulation","attack_id":"T1098","attack_id_wiki":"https://attack.mitre.org/techniques/T1098","identifiers":[{"type":"suspicious","value":"Contains ability to update the user profile"},{"type":"informative","value":"Contains ability to modify the user configuration/privilege (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"tactic":"Persistence","technique":"DLL Side-Loading","attack_id":"T1574.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/002","identifiers":[{"type":"informative","value":"Fails to load modules at runtime"}],"sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"tactic":"Persistence","technique":"Registry Run Keys / Startup Folder","attack_id":"T1547.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/001","identifiers":[{"type":"suspicious","value":"Modifies auto-execute functionality by setting/creating a value in the registry"}],"sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"tactic":"Persistence","technique":"Kernel Modules and Extensions","attack_id":"T1547.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/006","identifiers":[{"type":"malicious","value":"Contains ability to start/interact with device drivers"}],"sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"},{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"tactic":"Privilege Escalation","technique":"Create Process with Token","attack_id":"T1134.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/002","identifiers":[{"type":"informative","value":"Contains ability to create process with token (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to modify access token privileges (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"informative","value":"Contains ability to perform AES/RC4 encryption (API string)"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Contains ability to encrypt/encode message (API string)"},{"type":"informative","value":"Found XOR operators (encryption/decryption)"}],"sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"tactic":"Defense Evasion","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"},{"type":"informative","value":"Contains ability to delay the execution of current thread"}],"sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"},{"type":"informative","value":"Contains ability to query local/system time as file time"}],"sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to show a graphical window (API string)"},{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"tactic":"Defense Evasion","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Contains reference to method used by Windows shell items (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Contains ability to delete files/directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Renames files"},{"type":"informative","value":"Drops files inside appdata directory"}],"sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal","attack_id":"T1070","attack_id_wiki":"https://attack.mitre.org/techniques/T1070","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Contains ability to detect virtual environment (API)"},{"type":"informative","value":"Makes a code branch decision directly after an API that is environment aware"},{"type":"malicious","value":"The input sample contains a known anti-VM trick"},{"type":"informative","value":"Contains ability to detect sandbox (imports API)"}],"sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"}],"sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"suspicious","value":"Contains ability to retrieve keyboard strokes"},{"type":"informative","value":"Contains ability to hook/unhook windows functions (API string)"},{"type":"informative","value":"Contains ability to retrieve information about pressed keystrokes (API string)"},{"type":"suspicious","value":"Calls an API typically used for keylogging"}],"sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"tactic":"Credential Access","technique":"Credential API Hooking","attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","identifiers":[{"type":"malicious","value":"Sets a computer-based training (CBT) hook"},{"type":"informative","value":"Sets a windows hook"}],"sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains ability to retrieve environment variable settings"},{"type":"informative","value":"Contains ability to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains ability to retrieve volume information (API string)"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Contains ability to query the machine version"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Contains ability to find logical drives of the machine (API string)"},{"type":"informative","value":"Contains ability to retrieve the NetBIOS name of the local computer (API string)"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Contains ability to query volume/memory size (API string)"},{"type":"informative","value":"Contains ability to retrieve data about the local computer (API string)"},{"type":"informative","value":"Contains ability to determine disk drive type (API string)"},{"type":"informative","value":"Contains ability to retrieve information about operating system (API string)"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Reads information about supported languages"},{"type":"suspicious","value":"Found system commands related strings"}],"sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"tactic":"Discovery","technique":"Remote System Discovery","attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Contains ability to retrieve the current user information"},{"type":"informative","value":"Contains ability to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve user name"}],"sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","identifiers":[{"type":"suspicious","value":"Possibly checks for known debuggers/analysis tools"}],"sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"tactic":"Discovery","technique":"Account Discovery","attack_id":"T1087","attack_id_wiki":"https://attack.mitre.org/techniques/T1087","identifiers":[{"type":"informative","value":"Contains ability to retrieve SID for the specified name (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Calls an API's typically used for searching a directory for a files"},{"type":"informative","value":"Touches files"},{"type":"suspicious","value":"Reads configuration files (.ini files)"},{"type":"informative","value":"Contains ability to retrieve path in which Windows is installed (API string)"},{"type":"informative","value":"Contains ability to verify if file exist on disk (API string)"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Contains ability to verify if file exist on disk"},{"type":"informative","value":"Contains ability to enumerates all mounted drives"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Contains ability to query system locale (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve local language"},{"type":"informative","value":"Contains ability to query the system locale"}],"sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Contains ability to retrieve system language (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve default language settings"},{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Contains ability to retrieve the local name for a socket (API string)"},{"type":"informative","value":"Contains ability to retrieve internet settings (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Contains ability to retrieve/open a process (API string)"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Spawns new processes that are not known child processes"}],"sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"tactic":"Discovery","technique":"System Network Connections Discovery","attack_id":"T1049","attack_id_wiki":"https://attack.mitre.org/techniques/T1049","identifiers":[{"type":"informative","value":"Contains ability to retrieve IPv4 TCP connection table (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"},{"type":"informative","value":"Contains the ability to enumerate service (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Contains ability to move file or directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"},{"type":"informative","value":"Writes log files"},{"type":"informative","value":"Calls an API typically used to create a directory"}],"sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Calls an API possibly used to take screenshots"},{"type":"informative","value":"Contains ability to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"tactic":"Collection","technique":"Clipboard Data","attack_id":"T1115","attack_id_wiki":"https://attack.mitre.org/techniques/T1115","identifiers":[{"type":"suspicious","value":"Contains ability to open the clipboard"},{"type":"informative","value":"Contains ability to access clipboard data (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Contains SQL queries"}],"sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"suspicious","value":"Contains ability to find and load resources of a specific module"},{"type":"informative","value":"Queries list of installed browsers"}],"sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"tactic":"Collection","technique":"Automated Collection","attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","identifiers":[{"type":"informative","value":"Shows ability to send encrypted data to the internet"}],"sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Contains ability to create a new HTTP request (API string)"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Contains ability to create a HTTP or FTP session (API string)"},{"type":"informative","value":"Contacts server"},{"type":"informative","value":"Contacts domains"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Found potential URLs in memory dumps"}],"sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"tactic":"Command and Control","technique":"Mail Protocols","attack_id":"T1071.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/003","identifiers":[{"type":"informative","value":"Contains reference to Mail transfer protocol"}],"sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"GETs files from a webserver (HTTPS)"},{"type":"informative","value":"Found user-agent related strings"},{"type":"informative","value":"Found string related to HTTP headers"},{"type":"informative","value":"Contains reference to Windows internet services (API string)"},{"type":"informative","value":"GETs files from a webserver"},{"type":"informative","value":"Communicates with HTTP webserver (GET/POST requests)"},{"type":"informative","value":"Sends GET/POST requests (HTTPS)"}],"sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"Contains ability to perform Base64 encoding/decoding"},{"type":"informative","value":"HTTP requests contain Base64 strings"}],"sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Uses HTTPS for communication"},{"type":"informative","value":"Making HTTPS connections using secure TLS/SSL version"}],"sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"informative","value":"Contains ability to open a port and listen for incoming connection (API string)"},{"type":"informative","value":"References server/domain address with port number"}],"sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"informative","value":"Contains ability to download a file from a URL (API string)"},{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Drops ASP/PHP html files"},{"type":"informative","value":"Drops temp files"}],"sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"suspicious","value":"Sends UDP traffic"}],"sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over C2 Channel","attack_id":"T1041","attack_id_wiki":"https://attack.mitre.org/techniques/T1041","identifiers":[{"type":"suspicious","value":"Contains indicators of bot communication commands"}],"sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains reference to cryptographic keys"}],"sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to shutdown system"},{"type":"informative","value":"Contains ability to reboot/shutdown the operating system (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"},{"type":"informative","value":"Contains ability to close a handle to a service (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]}],"sandbox_signatures":[{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetSystemTimeAsFileTime@KERNEL32.dll at 37172-18399-006AB03A\n GetSystemTimeAsFileTime@KERNEL32.dll at 37172-19149-006ABB43","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1124","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"},{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"},{"report_type":"sandbox","report_id":"59d4b90c7ca3e1442d6d9793"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine timezone","description":"GetTimeZoneInformation@KERNEL32.dll at 37172-19119-006BE176","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1124","relevance":1,"id":"stream-48","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"},{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"},{"report_type":"sandbox","report_id":"59d4b90c7ca3e1442d6d9793"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"GetVersionExA@KERNEL32.dll at 37172-1-006A955C\n GetVersionExA@KERNEL32.dll at 37172-20880-0069F5AF","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"},{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"},{"report_type":"sandbox","report_id":"59d4b90c7ca3e1442d6d9793"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the system locale","description":"EnumSystemLocalesA@KERNEL32.dll at 37172-21542-006C5742\n GetUserDefaultLCID@KERNEL32.dll at 37172-21541-006C5161\n EnumSystemLocalesA@KERNEL32.dll at 37172-21548-006C5779\n EnumSystemLocalesA@KERNEL32.dll at 37172-21543-006C57FF","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-49","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"},{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"},{"report_type":"sandbox","report_id":"59d4b90c7ca3e1442d6d9793"}]},{"level":"informative","category":"Environment Awareness","name":"Makes a code branch decision directly after an API that is environment aware","description":"Found API call GetVersionExA@KERNEL32.dll directly followed by \"cmp ecx, 02h\" and \"je 006A95BCh\" at 37172-1-006A955C\n Found API call GetTimeZoneInformation@KERNEL32.dll directly followed by \"cmp eax, FFFFFFFFh\" and \"je 006BE37Ah\" at 37172-19119-006BE176\n Found API call GetVersionExA@KERNEL32.dll directly followed by \"cmp dword ptr [ebp-00000088h], 02h\" and \"xor ecx, ebp\" at 37172-20880-0069F5AF","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-39","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"},{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"},{"report_type":"sandbox","report_id":"59d4b90c7ca3e1442d6d9793"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"emule.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\IEXPLORE.EXE\")\n \"emule.exe\" (Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\IEXPLORE.EXE\")\n \"emule.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\IEXPLORE.EXE\"; Key: \"PATH\"; Value: \"00000000010000004800000043003A005C00500072006F006700720061006D002000460069006C00650073005C0049006E007400650072006E006500740020004500780070006C006F007200650072003B000000\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"},{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"level":"informative","category":"External Systems","name":"Sample was identified as clean by Antivirus engines","description":"0/15 Antivirus vendors marked sample as malicious (0% detection rate)\n 0/69 Antivirus vendors marked sample as malicious (0% detection rate)","origin":"External System","relevance":10,"id":"avtest-1","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"},{"report_type":"sandbox","report_id":"59d4b90c7ca3e1442d6d9793"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"porttest.emule-project.net\"\n \"www.emule-project.net\"\n \"pagead2.googlesyndication.com\"\n \"sflogo.sourceforge.net\"","origin":"Network Traffic","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"},{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"},{"report_type":"sandbox","report_id":"59d4b90c7ca3e1442d6d9793"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"152.199.19.161:443\"\n \"94.16.113.2:80\"\n \"216.58.198.194:80\"\n \"216.58.198.194:443\"\n \"216.105.38.13:80\"\n \"94.16.113.2:81\"\n \"216.58.213.130:443\"\n \"216.58.198.195:80\"\n \"172.217.22.131:80\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"},{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"c:\\Dev\\Eclipse\\workspace\\srchybrid\\Release\\emule.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"},{"report_type":"sandbox","report_id":"59d4b90c7ca3e1442d6d9793"}]},{"level":"informative","category":"General","name":"Creates a writable file in a temporary directory","description":"\"iexplore.exe\" created file \"%TEMP%\\~DF4196E44446430BCF.TMP\"\n \"iexplore.exe\" created file \"%TEMP%\\~DF25452A5E49C9EBEE.TMP\"\n \"iexplore.exe\" created file \"%TEMP%\\JavaDeployReg.log\"","origin":"API Call","relevance":1,"id":"api-4","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"$22","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"},{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"},{"report_type":"sandbox","report_id":"59d4b90c7ca3e1442d6d9793"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"Antivirus vendors marked dropped file \"urlblockindex_1_.bin\" as clean (type is \"data\")","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"level":"informative","category":"General","name":"GETs files from a webserver","description":"$23","origin":"Network Traffic","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"},{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"level":"informative","category":"General","name":"Launches a browser","description":"Launches browser \"iexplore.exe\" (UID: 00039858-00002248)\n Launches browser \"iexplore.exe\" (UID: 00039910-00003104)","origin":"Monitored Target","relevance":3,"id":"target-21","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"},{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"level":"informative","category":"General","name":"Loads rich edit control libraries","description":"\"emule.exe\" loaded module \"%WINDIR%\\SysWOW64\\riched20.dll\" at 739C0000","origin":"Loaded Module","mitre_attack_id":"T1179","id":"module-2","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"},{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"},{"report_type":"sandbox","report_id":"59d4b90c7ca3e1442d6d9793"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$24","origin":"Registry Access","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"},{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"iexplore.exe\" (UID: 00039858-00002248) was launched with new environment variables: \"PATH=\"%PROGRAMFILES%\\Internet Explorer;\"\"\n Process \"iexplore.exe\" (UID: 00039910-00003104) was launched with modified environment variables: \"CommonProgramFiles, PROCESSOR_ARCHITECTURE, ProgramFiles\"\n Process \"iexplore.exe\" (UID: 00039910-00003104) was launched with missing environment variables: \"PROCESSOR_ARCHITEW6432\"","origin":"Monitored Target","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"},{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"\"emule.exe\" searching for class \"Shell_TrayWnd\"\n \"emule.exe\" searching for class \"IEFrame\"","origin":"API Call","mitre_attack_id":"T1010","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"},{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"},{"report_type":"sandbox","report_id":"59d4b90c7ca3e1442d6d9793"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"iexplore.exe\" with commandline \"http://porttest.emule-project.net/connectiontest.php?tcpport=554 ...\" (UID: 00039858-00002248)\n Spawned process \"iexplore.exe\" with commandline \"SCODEF:2248 CREDAT:275457 /prefetch:2\" (UID: 00039910-00003104)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"},{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"iexplore.exe\" with commandline \"http://porttest.emule-project.net/connectiontest.php?tcpport=554 ...\" (UID: 00039858-00002248)\n Spawned process \"iexplore.exe\" with commandline \"SCODEF:2248 CREDAT:275457 /prefetch:2\" (UID: 00039910-00003104)","origin":"Monitored Target","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"},{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"level":"informative","category":"Installation/Persistance","name":"Connects to LPC ports","description":"\"emule.exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"$25","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"},{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"},{"report_type":"sandbox","report_id":"59d4b90c7ca3e1442d6d9793"}]},{"level":"informative","category":"Installation/Persistance","name":"Opens the MountPointManager (often used to detect additional infection locations)","description":"\"iexplore.exe\" opened \"\\Device\\MountPointManager\"","origin":"API Call","relevance":5,"id":"api-51","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"\"emule.exe\" touched file \"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls\"\n \"emule.exe\" touched file \"%WINDIR%\\SysWOW64\\rsaenh.dll\"\n \"emule.exe\" touched file \"%WINDIR%\\SysWOW64\\tzres.dll\"\n \"emule.exe\" touched file \"%WINDIR%\\AppPatch\\sysmain.sdb\"\n \"emule.exe\" touched file \"%WINDIR%\\SysWOW64\\EhStorShell.dll\"\n \"emule.exe\" touched file \"%WINDIR%\\SysWOW64\\en-US\\EhStorShell.dll.mui\"\n \"emule.exe\" touched file \"%WINDIR%\\winsxs\\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.7600.16385_en-us_581cd2bf5825dde9\\comctl32.dll.mui\"\n \"emule.exe\" touched file \"%WINDIR%\\SysWOW64\\imageres.dll\"","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"},{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"},{"report_type":"sandbox","report_id":"59d4b90c7ca3e1442d6d9793"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$26","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"},{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"},{"report_type":"sandbox","report_id":"59d4b90c7ca3e1442d6d9793"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"emule.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"},{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"emule.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1215","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"06cdf814387f627a4bd05a0c68211f715bfa952423e8e8a462e1f47c11a4d20e.bin\" was detected as \"Microsoft visual C++ 7.0\"","origin":"Static Parser","mitre_attack_id":"T1002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"},{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"},{"report_type":"sandbox","report_id":"59d4b90c7ca3e1442d6d9793"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries kernel debugger information","description":"\"emule.exe\" at 00030109-00003080-00000033-50628807806","origin":"API Call","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"level":"suspicious","category":"Cryptographic Related","name":"Found a cryptographic related string","description":"\"DES\" (Indicator: \"des\"; File: \"00030109-00003080.00000002.34270.00D2E000.00000002.mdmp\")","origin":"File/Memory","relevance":10,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"level":"suspicious","category":"Environment Awareness","name":"Possibly tries to evade analysis by sleeping many times","description":"\"emule.exe\" (Thread ID: 3532) slept \"520\" times (threshold: 500)","origin":"API Call","relevance":10,"id":"api-47","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\"emule.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"},{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"},{"report_type":"sandbox","report_id":"59d4b90c7ca3e1442d6d9793"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"emule.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"},{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"},{"report_type":"sandbox","report_id":"59d4b90c7ca3e1442d6d9793"}]},{"level":"suspicious","category":"General","name":"Contains ability to find and load resources of a specific module","description":"LoadResource@KERNEL32.dll at 37172-19226-0053F490\n LoadResource@KERNEL32.dll at 37172-22649-006D67E9","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-32","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"},{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"},{"report_type":"sandbox","report_id":"59d4b90c7ca3e1442d6d9793"}]},{"level":"suspicious","category":"General","name":"Reads configuration files","description":"\"emule.exe\" read file \"%LOCALAPPDATA%\\eMule\\config\\preferences.ini\"","origin":"API Call","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Modifies auto-execute functionality by setting/creating a value in the registry","description":"\"emule.exe\" (Access type: \"CREATE\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\")","origin":"Registry Access","mitre_attack_id":"T1060","relevance":8,"id":"registry-0","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"},{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"},{"report_type":"sandbox","report_id":"59d4b90c7ca3e1442d6d9793"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"Heuristic match: \"M-SEARCH * HTTP/1.1\nHOST: 239.255.255.250:1900\nST: %s\nMAN: \"ssdp:discover\"\nMX: %u\"\n \"239.255.255.250\"\n Heuristic match: \". .!.\".#.$.%.&.'.(.).*.+.\n.-.../.0.1.2.3.4.5.6.7.8.9.:.;.<.=.>.?.@.A.B.C.D.E.F.G.H.I.J.K.L.M.N.O.P.Q.R.S.T.U.V.W.X.Y.Z.[.\\.].^._.`.a.b.c.d.e.f.g.h.i.j.k.l.m.n.o.p.q.r.s.t.u.v.w.x.y.z.{.|.}.~.\", \"127.0.0.1\", \"255.255.255.255\"","origin":"File/Memory","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"},{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"},{"report_type":"sandbox","report_id":"59d4b90c7ca3e1442d6d9793"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 152.199.19.161 on port 443 is sent without HTTP header\n TCP traffic to 94.16.113.2 on port 80 is sent without HTTP header\n TCP traffic to 216.58.198.194 on port 80 is sent without HTTP header\n TCP traffic to 216.58.198.194 on port 443 is sent without HTTP header\n TCP traffic to 216.105.38.13 on port 80 is sent without HTTP header\n TCP traffic to 216.58.213.130 on port 443 is sent without HTTP header\n TCP traffic to 216.58.198.195 on port 80 is sent without HTTP header\n TCP traffic to 172.217.22.131 on port 80 is sent without HTTP header","origin":"Network Traffic","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains indicators of bot communication commands","description":"\"SrvrsMostWorkingServers=0\" (Indicator: \"servers=\")\n \"135\nConnNumReconnects=0\nConnPeakConnections=0\nConnTransferTime=0\nConnUploadTime=0\nConnDownloadTime=0\nConnServerDuration=0\nSrvrsMostWorkingServers=0\nSrvrsMostUsersOnline=0\nSrvrsMostFilesAvail=0\nSharedMostFilesShared=0\nSharedLargestShareSize=0\nShared\" (Indicator: \"servers=\")","origin":"File/Memory","mitre_attack_id":"T1094","relevance":10,"id":"string-29","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"},{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"level":"suspicious","category":"Remote Access Related","name":"Reads terminal service related keys (often RDP related)","description":"\"emule.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TERMINAL SERVER\"; Key: \"TSUSERENABLED\")","origin":"Registry Access","mitre_attack_id":"T1076","relevance":10,"id":"registry-61","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"},{"report_type":"sandbox","report_id":"59d4b90c7ca3e1442d6d9793"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"emule.exe\" opened \"%LOCALAPPDATA%\\eMule\\config\\downloads.tmp\" with delete access\n \"emule.exe\" opened \"%LOCALAPPDATA%\\eMule\\config\\server.met.new\" with delete access","origin":"API Call","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"RegCloseKey\n OpenProcessToken\n CryptEncryptMessage\n GetDriveTypeA\n WriteFile\n DeviceIoControl\n GetModuleFileNameA\n UnhandledExceptionFilter\n CreateThread\n ExitThread\n TerminateProcess\n GetTickCount\n VirtualProtect\n GetVersionExA\n LoadLibraryA\n GetStartupInfoA\n GetFileSize\n CreateFileA\n LockResource\n GetCommandLineW\n GetCommandLineA\n GetModuleHandleA\n Sleep\n VirtualAlloc\n GetCursorPos\n GetLastActivePopup\n HttpQueryInfoW\n InternetOpenW\n InternetQueryDataAvailable\n InternetQueryOptionW\n InternetConnectW\n InternetCrackUrlW\n InternetWriteFile\n InternetCloseHandle\n HttpSendRequestW\n InternetOpenUrlW\n InternetReadFile","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"},{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"},{"report_type":"sandbox","report_id":"59d4b90c7ca3e1442d6d9793"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"$27","origin":"Hook Detection","mitre_attack_id":"T1179","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"emule.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"},{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"},{"report_type":"sandbox","report_id":"59d4b90c7ca3e1442d6d9793"}]},{"level":"malicious","category":"Environment Awareness","name":"The input sample contains a known anti-VM trick","description":"Found VM detection artifact \"CPUID trick\" in \"06cdf814387f627a4bd05a0c68211f715bfa952423e8e8a462e1f47c11a4d20e.bin\" (Offset: 3733876)","origin":"Binary File","relevance":5,"id":"binary-8","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"},{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"},{"report_type":"sandbox","report_id":"59d4b90c7ca3e1442d6d9793"}]},{"level":"malicious","category":"Installation/Persistance","name":"Writes data to a remote process","description":"\"emule.exe\" wrote 32 bytes to a remote process \"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe\" (Handle: 1028)\n \"emule.exe\" wrote 52 bytes to a remote process \"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe\" (Handle: 1028)\n \"emule.exe\" wrote 4 bytes to a remote process \"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe\" (Handle: 1028)\n \"emule.exe\" wrote 8 bytes to a remote process \"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe\" (Handle: 1028)\n \"iexplore.exe\" wrote 32 bytes to a remote process \"%PROGRAMFILES%\\(x86)\\Internet Explorer\\iexplore.exe\" (Handle: 880)\n \"iexplore.exe\" wrote 52 bytes to a remote process \"%PROGRAMFILES%\\(x86)\\Internet Explorer\\iexplore.exe\" (Handle: 880)\n \"iexplore.exe\" wrote 8 bytes to a remote process \"%PROGRAMFILES%\\(x86)\\Internet Explorer\\iexplore.exe\" (Handle: 880)\n \"iexplore.exe\" wrote 4 bytes to a remote process \"%PROGRAMFILES%\\(x86)\\Internet Explorer\\iexplore.exe\" (Handle: 880)","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"level":"malicious","category":"Network Related","name":"Found more than one unique User-Agent","description":"Found the following User-Agents: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko\n Microsoft-CryptoAPI/6.1","origin":"Network Traffic","relevance":5,"id":"network-15","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"level":"malicious","category":"Network Related","name":"Malicious artifacts seen in the context of a contacted host","description":"$28","origin":"Network Traffic","relevance":10,"id":"network-21","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"level":"malicious","category":"Network Related","name":"Multiple malicious artifacts seen in the context of different hosts","description":"$29","origin":"Network Traffic","relevance":10,"id":"network-27","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Calls an API typically used to find a resource in a module","description":"$2a","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-140","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Calls an API typically used to load a resource in memory","description":"$2b","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"Found reference to API \"WaitForSingleObject\" (Indicator: \"WaitForSingleObject\"; Source: \"00000000-00002716.00000000.66373.0032E000.00000002.mdmp, 00000000-00002716.00000001.68293.72677000.00000002.mdmp\")\n Found reference to API \"WaitForMultipleObjects\" (Indicator: \"WaitForMultipleObjects\"; Source: \"00000000-00002716.00000000.66373.0032E000.00000002.mdmp\")\n Found reference to API \"SetTimer\" (Indicator: \"SetTimer\"; Source: \"00000000-00002716.00000000.66373.0032E000.00000002.mdmp, 00000000-00002716.00000001.68293.72677000.00000002.mdmp\")\n Found reference to API \"WaitForSingleObjectEx\" (Indicator: \"WaitForSingleObject\"; Source: \"00000000-00002716.00000001.68293.72677000.00000002.mdmp\")\n Found reference to API \"CreateTimerQueueTimer\" (Indicator: \"CreateTimerQueueTimer\"; Source: \"00000000-00002716.00000001.68293.72677000.00000002.mdmp\")","origin":"File/Memory","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to impersonate access tokens (API string)","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00002716.00000000.66373.0032E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-306","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to inject code into another process (API string)","description":"Found reference to API \"VirtualAlloc\" (Indicator: \"VirtualAlloc\"; Source: \"00000000-00002716.00000000.66373.0032E000.00000002.mdmp, 00000000-00002716.00000001.68293.72677000.00000002.mdmp\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00002716.00000000.66373.0032E000.00000002.mdmp\")\n Found reference to API \"VirtualFree\" (Indicator: \"VirtualFree\"; Source: \"00000000-00002716.00000000.66373.0032E000.00000002.mdmp, 00000000-00002716.00000001.68293.72677000.00000002.mdmp\")\n Found reference to API \"CreateThreadpoolTimer\" (Indicator: \"CreateThread\"; Source: \"00000000-00002716.00000001.68293.72677000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to load/free library (API string)","description":"$2c","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to modify registry key/value (API string)","description":"Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; Source: \"00000000-00002716.00000000.66373.0032E000.00000002.mdmp, 00000000-00002716.00000001.68293.72677000.00000002.mdmp\")\n Found reference to API \"RegSetValueW\" (Indicator: \"RegSetValue\"; Source: \"00000000-00002716.00000000.66373.0032E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-304","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to open a service (API string)","description":"Found reference to API \"OpenServiceW\" (Indicator: \"OpenService\"; Source: \"00000000-00002716.00000000.66373.0032E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":1,"id":"string-544","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to pass information to a window procedure (API string)","description":"Found reference to API \"CallWindowProcW\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00002716.00000000.66373.0032E000.00000002.mdmp, 00000000-00002716.00000001.68293.72677000.00000002.mdmp\")\n Found reference to API \"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00002716.00000000.66373.03390000.00000004.mdmp, 00000000-00002716.00000001.68293.03390000.00000004.mdmp, 00000000-00002716.00000002.70213.03390000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to perform Base64 encoding/decoding","description":"$2d","origin":"File/Memory","mitre_attack_id":"T1132","relevance":1,"id":"string-338","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains the ability to modify system service (API string)","description":"Found reference to API \"ControlService\" (Indicator: \"ControlService\"; Source: \"00000000-00002716.00000000.66373.0032E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-192","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Renames files","description":"\"emule.exe\" renamed original file\"C:\\Users\\%OSUSER%\\AppData\\Local\\eMule\\config\\downloads.tmp\" to \"%LOCALAPPDATA%\\eMule\\config\\downloads.txt\"","origin":"API Call","mitre_attack_id":"T1036","relevance":1,"id":"api-162","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"$2e","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to encrypt/encode message (API string)","description":"Found reference to API \"CryptEncryptMessage\" (Indicator: \"EncryptMessage\"; Source: \"00000000-00002716.00000000.66373.0032E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-213","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform AES/RC4 encryption (API string)","description":"Found reference to API \"CryptAcquireContext\" (Indicator: \"CryptAcquireContext\"; File: \"emule.exe\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-438","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to cryptographic keys","description":"$2f","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-280","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"level":"informative","category":"Cryptographic Related","name":"Found XOR operators (encryption/decryption)","description":"Found string \"! \" # $ % & ' ( ) * + \n - . / 0 1 2 3 4 5 6 7 8 9 : ; < = > ? @ A B C D E F G H I J K L M N O P Q R S T U V W X Y Z [ \\ ] ^ _ ` a b c d e f g h i j k l m n o p q r s t u v w x y z { | } ~\" (Indicator: \" ^ \"; Source: \"00000000-00002716.00000000.66373.005DD000.00000004.mdmp\n 00000000-00002716.00000001.68293.005DD000.00000004.mdmp\n 00000000-00002716.00000002.70213.005DD000.00000004.mdmp\n 00000000-00002716.00000002.70213.00605000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-624","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"level":"informative","category":"Cryptographic Related","name":"HTTP requests contain Base64 strings","description":"$30","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-60","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: Found XOR operators (encryption/decryption)\n Matched sigs: HTTP requests contain Base64 strings\n Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains ability to perform AES/RC4 encryption (API string)\n Matched sigs: Contains reference to cryptographic keys\n Matched sigs: Contains key cryptographic functions (API string)\n Matched sigs: Contains CRYPTO related strings\n Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: Contains ability to use Microsoft's Enhanced Cryptographic Provider\n Matched sigs: Contains ability to decrypt/decode data\n Matched sigs: Contains ability to encrypt/encode message (API string)\n Matched sigs: Found XOR operators (encryption/decryption)\n Matched sigs: Reads the cryptographic machine GUID\n Matched sigs: HTTP requests contain Base64 strings\n Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: Contains key cryptographic functions of the CryptoAPI","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Found XOR operators (encryption/decryption)\n Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: Found potential URL in binary/memory\n Matched sigs: Found potential IP address in binary/memory\n Matched sigs: Found potential URLs in memory dumps\n Matched sigs: Contains ability to create a new HTTP request (API string)\n Matched sigs: Contains ability to communicate with network (API string)\n Matched sigs: Contains ability to create a HTTP or FTP session (API string)\n Matched sigs: Contacts server\n Matched sigs: Contacts domains\n Matched sigs: Spawned process connects to a network","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API possibly used to retrieve a handle to the foreground window","description":"\"emule.exe\" called \"GetForegroundWindow\" (UID: 00000000-00002716)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-142","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get active windows title","description":"$31","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-151","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get handle of currently active window","description":"\"emule.exe\" called \"GetActiveWindow\" (UID: 00000000-00002716)","origin":"API Call","mitre_attack_id":"T1010","relevance":5,"id":"api-150","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"emule.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00002716)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$32","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"$33","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve default language settings","description":"\"emule.exe\" called \"GetSystemDefaultLangID\" (UID: 00000000-00002716)","origin":"API Call","mitre_attack_id":"T1614.001","relevance":3,"id":"api-149","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"emule.exe\" called \"GetLocaleInfoA\" with parameter \"1033\" - (UID: 00000000-00002716)\n \"emule.exe\" called \"GetLocaleInfoW\" with parameter \"0\" - (UID: 00000000-00002716)\n \"emule.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00002716)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to detect virtual environment (API)","description":"$34","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497","relevance":3,"id":"stream-87","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to enumerates all mounted drives","description":"GetDriveTypeA@KERNEL32.dll at 15639-19302-006C76CA","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1083","relevance":3,"id":"stream-66","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to find open windows (API string)","description":"Found reference to API \"FindWindowW\" (Indicator: \"FindWindowW\"; Source: \"00000000-00002716.00000000.66373.0032E000.00000002.mdmp\")\n Found reference to API \"FindWindowExW\" (Indicator: \"FindWindowExW\"; Source: \"00000000-00002716.00000000.66373.0032E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-413","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform scheduled transfer (API string)","description":"Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00002716.00000000.66373.0032E000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00002716.00000000.66373.0032E000.00000002.mdmp, 00000000-00002716.00000001.68293.72677000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query local/system time as file time","description":"GetSystemTimeAsFileTime@KERNEL32.dll at 15639-19149-006ABB43\n GetSystemTimeAsFileTime@KERNEL32.dll at 15639-18399-006AB03A\n FileTimeToLocalFileTime@KERNEL32.dll at 15639-23581-0069F435\n FileTimeToLocalFileTime@KERNEL32.dll at 15639-23178-0069F4BC\n FileTimeToLocalFileTime@KERNEL32.dll at 15639-19290-006AF88A","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1070.006","relevance":1,"id":"stream-71","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query system locale (API string)","description":"Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00002716.00000000.66373.0032E000.00000002.mdmp\")\n Found reference to API \"GetLocaleInfoA\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00002716.00000000.66373.0032E000.00000002.mdmp\")\n Found reference to API \"GetUserDefaultLCID\" (Indicator: \"GetUserDefaultLCID\"; Source: \"00000000-00002716.00000000.66373.0032E000.00000002.mdmp\")\n Found reference to API \"EnumSystemLocalesA\" (Indicator: \"EnumSystemLocales\"; Source: \"00000000-00002716.00000000.66373.0032E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query volume/memory size (API string)","description":"Found reference to API \"GetDiskFreeSpaceExA\" (Indicator: \"GetDiskFreeSpace\"; File: \"emule.exe\")\n Found reference to API \"GetDiskFreeSpaceExW\" (Indicator: \"GetDiskFreeSpace\"; File: \"emule.exe\")\n Found reference to API \"GetDiskFreeSpaceExW\" (Indicator: \"GetDiskFreeSpace\"; Source: \"00000000-00002716.00000000.66373.0032E000.00000002.mdmp\")\n Found reference to API \"GetDiskFreeSpaceExA\" (Indicator: \"GetDiskFreeSpace\"; Source: \"00000000-00002716.00000000.66373.0032E000.00000002.mdmp\")\n Found reference to API \"GetDiskFreeSpaceW\" (Indicator: \"GetDiskFreeSpace\"; Source: \"00000000-00002716.00000000.66373.0032E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-193","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"emule.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"emule.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve environment variable settings","description":"Found string \"Set external Kad Port to %u\" (Indicator: \"set \"; File: \"emule.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-326","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"FileTimeToSystemTime\" (Indicator: \"FileTimeToSystemTime\"; Source: \"00000000-00002716.00000000.66373.0032E000.00000002.mdmp\")\n Found reference to API \"FileTimeToLocalFileTime\" (Indicator: \"FileTimeToLocalFileTime\"; Source: \"00000000-00002716.00000000.66373.0032E000.00000002.mdmp\")\n Found reference to API \"GetFileTime\" (Indicator: \"GetFileTime\"; Source: \"00000000-00002716.00000000.66373.0032E000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00002716.00000000.66373.0032E000.00000002.mdmp, 00000000-00002716.00000001.68293.72677000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve information about the current system (API string)","description":"$35","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine time (API string)","description":"Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00002716.00000000.66373.0032E000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00002716.00000000.66373.0032E000.00000002.mdmp, 00000000-00002716.00000001.68293.72677000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine timezone (API string)","description":"Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; Source: \"00000000-00002716.00000000.66373.0032E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-248","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"$36","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve path in which Windows is installed (API string)","description":"Found reference to API \"GetWindowsDirectoryW\" (Indicator: \"GetWindowsDirectory\"; Source: \"00000000-00002716.00000000.66373.0032E000.00000002.mdmp\")\n Found reference to API \"GetWindowsDirectoryA\" (Indicator: \"GetWindowsDirectory\"; Source: \"00000000-00002716.00000000.66373.0032E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-312","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve system language (API string)","description":"Found reference to API \"GetUserDefaultUILanguage\" (Indicator: \"GetUserDefaultUILanguage\"; File: \"emule.exe\")\n Found reference to API \"GetSystemDefaultUILanguage\" (Indicator: \"GetSystemDefaultUILanguage\"; Source: \"00000000-00002716.00000000.66373.0032E000.00000002.mdmp\")\n Found reference to API \"GetUserDefaultUILanguage\" (Indicator: \"GetUserDefaultUILanguage\"; Source: \"00000000-00002716.00000000.66373.0032E000.00000002.mdmp\")\n Found reference to API \"GetKeyboardLayout\" (Indicator: \"GetKeyboardLayout\"; Source: \"00000000-00002716.00000001.68293.72677000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"DllGetVersion\" (Indicator: \"GetVersion\"; Source: \"00000000-00002716.00000000.66373.0032E000.00000002.mdmp\")\n Found reference to API \"GetVersionExW\" (Indicator: \"GetVersionExW\"; Source: \"00000000-00002716.00000000.66373.0032E000.00000002.mdmp, 00000000-00002716.00000001.68293.72677000.00000002.mdmp\")\n Found reference to API \"GetVersionExW\" (Indicator: \"GetVersion\"; Source: \"00000000-00002716.00000000.66373.0032E000.00000002.mdmp, 00000000-00002716.00000001.68293.72677000.00000002.mdmp\")\n Found reference to API \"GetVersionExA\" (Indicator: \"GetVersionExA\"; Source: \"00000000-00002716.00000000.66373.0032E000.00000002.mdmp\")\n Found reference to API \"GetVersionExA\" (Indicator: \"GetVersion\"; Source: \"00000000-00002716.00000000.66373.0032E000.00000002.mdmp\")\n Found reference to API \"GetVersion\" (Indicator: \"GetVersion\"; Source: \"00000000-00002716.00000000.66373.0032E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the current user information","description":"Observed string: \"quser\" (Indicator: \"quser\") in Source: emule.exe\n Observed string: \"quser\" (Indicator: \"quser\") in Source: 00000000-00002716.00000000.66373.0032E000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-432","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve volume information (API string)","description":"Found reference to API \"GetVolumeInformationW\" (Indicator: \"GetVolumeInformation\"; Source: \"00000000-00002716.00000000.66373.0032E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-162","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to verify if file exist on disk","description":"PathFileExistsW@SHLWAPI.dll at 15639-23656-0046F200","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1083","relevance":1,"id":"stream-124","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to verify if file exist on disk (API string)","description":"Found reference to API \"PathFileExistsW\" (Indicator: \"PathFileExist\"; Source: \"00000000-00002716.00000000.66373.0032E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-140","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"level":"informative","category":"Environment Awareness","name":"Queries list of installed browsers","description":"\"emule.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\CLIENTS\\STARTMENUINTERNET\\MICROSOFT EDGE\\CAPABILITIES\\URLASSOCIATIONS\"; Key: \"\"; Value: \"\")\n \"emule.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\CLIENTS\\STARTMENUINTERNET\\MICROSOFT EDGE\\CAPABILITIES\\URLASSOCIATIONS\"; Key: \"HTTP\"; Value: \"\")\n \"emule.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\CLIENTS\\STARTMENUINTERNET\\MICROSOFT EDGE\\CAPABILITIES\"; Key: \"\"; Value: \"\")\n \"emule.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\CLIENTS\\STARTMENUINTERNET\\MICROSOFT EDGE\\CAPABILITIES\"; Key: \"HIDDEN\"; Value: \"\")","origin":"Registry Access","mitre_attack_id":"T1005","relevance":1,"id":"registry-137","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"\"emule.exe\" called \"CreateDirectoryW\" with parameter %LOCALAPPDATA%\\eMule\\ (UID: 00000000-00002716)\n \"emule.exe\" called \"CreateDirectoryW\" with parameter %LOCALAPPDATA%\\eMule\\config\\ (UID: 00000000-00002716)\n \"emule.exe\" called \"CreateDirectoryW\" with parameter C:\\ (UID: 00000000-00002716)\n \"emule.exe\" called \"CreateDirectoryW\" with parameter %USERPROFILE%\\Downloads\\eMule\\ (UID: 00000000-00002716)\n \"emule.exe\" called \"CreateDirectoryW\" with parameter %USERPROFILE%\\Downloads\\eMule\\Incoming (UID: 00000000-00002716)\n \"emule.exe\" called \"CreateDirectoryW\" with parameter %USERPROFILE%\\Downloads\\eMule\\Temp (UID: 00000000-00002716)\n \"emule.exe\" called \"CreateDirectoryW\" with parameter %ALLUSERSPROFILE%\\eMule\\ (UID: 00000000-00002716)\n \"emule.exe\" called \"CreateDirectoryW\" with parameter %ALLUSERSPROFILE%\\eMule\\skins (UID: 00000000-00002716)\n \"emule.exe\" called \"CreateDirectoryW\" with parameter C:\\lang\\ (UID: 00000000-00002716)","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"\"emule.exe\" called \"CreateProcessW\" with parameter \"\"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --single-argument http://porttest.emule-project.net/connectiontest.\" - (UID: 00000000-00002716)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$37","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$38","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"level":"informative","category":"General","name":"Contains SQL queries","description":"\"Delete From Disk\tBootstrap\" (Source: 00000000-00002716.00000002.70213.00605000.00000002.mdmp, Indicator: \"delete from disk\tbootstrap\")","origin":"File/Memory","mitre_attack_id":"T1213","relevance":2,"id":"string-16","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"level":"informative","category":"General","name":"Contains ability to close a handle to a service (API string)","description":"Found reference to API \"CloseServiceHandle\" (Indicator: \"CloseServiceHandle\"; Source: \"00000000-00002716.00000000.66373.0032E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-242","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"Found reference to API \"CreateProcessAsUser failed\" (Indicator: \"CreateProcess\"; File: \"emule.exe\")\n Found reference to API \"CreateProcessAsUser failed\" (Indicator: \"CreateProcess\"; Source: \"00000000-00002716.00000000.66373.0032E000.00000002.mdmp\")\n Found reference to API \"CreateProcessAsUserW\" (Indicator: \"CreateProcess\"; Source: \"00000000-00002716.00000000.66373.0032E000.00000002.mdmp\")\n Found reference to API \"CreateProcessWithLogonW\" (Indicator: \"CreateProcess\"; Source: \"00000000-00002716.00000000.66373.0032E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00002716.00000000.66373.0032E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1074.001","relevance":1,"id":"string-423","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"level":"informative","category":"General","name":"Contains ability to create/control drivers (API string)","description":"Found reference to API \"DeviceIoControl\" (Indicator: \"DeviceIoControl\"; Source: \"00000000-00002716.00000000.66373.0032E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-220","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"level":"informative","category":"General","name":"Contains ability to create/load registry keys (API string)","description":"Found reference to API \"RegCreateKeyExW\" (Indicator: \"RegCreateKey\"; Source: \"00000000-00002716.00000000.66373.0032E000.00000002.mdmp, 00000000-00002716.00000001.68293.72677000.00000002.mdmp\")\n Found reference to API \"RegCreateKeyW\" (Indicator: \"RegCreateKey\"; Source: \"00000000-00002716.00000000.66373.0032E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-307","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"Pinger: IcmpCreateFile() failed, err: %u\" (Indicator: \"CreateFile\"; File: \"emule.exe\")\n Found reference to API \"Pinger: IcmpCreateFile() failed, err: %u\" (Indicator: \"CreateFile\"; Source: \"00000000-00002716.00000000.66373.0032E000.00000002.mdmp\")\n Found reference to API \"IcmpCreateFile\" (Indicator: \"CreateFile\"; Source: \"00000000-00002716.00000000.66373.0032E000.00000002.mdmp\")\n Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"00000000-00002716.00000000.66373.0032E000.00000002.mdmp\")\n Found reference to API \"CreateFileA\" (Indicator: \"CreateFile\"; Source: \"00000000-00002716.00000000.66373.0032E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"level":"informative","category":"General","name":"Contains ability to delay the execution of current thread","description":"SetTimer at 15639-23778-004D2F90\n SetTimer at 15639-23307-0059E150\n SetTimer at 15639-23770-004D37C0\n SetTimer at 15639-22845-00635B40\n WaitForSingleObject@KERNEL32.dll at 15639-19315-006CF6A9\n SetTimer at 15639-19201-005CB570","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497.003","relevance":3,"id":"stream-103","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00002716.00000000.66373.0032E000.00000002.mdmp, 00000000-00002716.00000001.68293.72677000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically load libraries","description":"LoadLibraryA@KERNEL32.dll at 15639-22677-006D1DE0","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":3,"id":"stream-108","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$39","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Found reference to API \"SecureShellExecute exception: %s!\" (Indicator: \"ShellExecute\"; File: \"emule.exe\")\n Found reference to API \"SecureShellExecute exception: %s!\" (Indicator: \"ShellExecute\"; Source: \"00000000-00002716.00000000.66373.0032E000.00000002.mdmp\")\n Found reference to API \"ShellExecuteExW\" (Indicator: \"ShellExecute\"; Source: \"00000000-00002716.00000000.66373.0032E000.00000002.mdmp\")\n Found reference to API \"ShellExecuteW\" (Indicator: \"ShellExecute\"; Source: \"00000000-00002716.00000000.66373.0032E000.00000002.mdmp\")\n Found reference to API \"yncShellExecute\" (Indicator: \"ShellExecute\"; Source: \"00000000-00002716.00000002.70213.07E40000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-240","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"$3a","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-550","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"level":"informative","category":"General","name":"Contains ability to move file or directory (API string)","description":"Found reference to API \"?MoveFileWithProgressW\" (Indicator: \"MoveFile\"; Source: \"00000000-00002716.00000000.66373.0032E000.00000002.mdmp\")\n Found reference to API \"MoveFileW\" (Indicator: \"MoveFile\"; Source: \"00000000-00002716.00000000.66373.0032E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1570","relevance":1,"id":"string-322","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00002716.00000000.66373.0032E000.00000002.mdmp\")\n Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00002716.00000000.66373.0032E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; Source: \"00000000-00002716.00000000.66373.0032E000.00000002.mdmp\")\n Found reference to API \"SuspendThread\" (Indicator: \"SuspendThread\"; Source: \"00000000-00002716.00000000.66373.0032E000.00000002.mdmp\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00002716.00000000.66373.0032E000.00000002.mdmp\")\n Found reference to API \"CreateThreadpoolTimer\" (Indicator: \"CreateThread\"; Source: \"00000000-00002716.00000001.68293.72677000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/open a process (API string)","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcess\"; Source: \"00000000-00002716.00000000.66373.0032E000.00000002.mdmp\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00002716.00000000.66373.0032E000.00000002.mdmp, 00000000-00002716.00000001.68293.72677000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00002716.00000000.66373.0032E000.00000002.mdmp, 00000000-00002716.00000001.68293.72677000.00000002.mdmp\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"00000000-00002716.00000000.66373.0032E000.00000002.mdmp, 00000000-00002716.00000001.68293.72677000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; Source: \"00000000-00002716.00000000.66373.0032E000.00000002.mdmp\")\n Found reference to API \"GetWindowThreadProcessId\" (Indicator: \"GetWindowThreadProcessId\"; Source: \"00000000-00002716.00000001.68293.72677000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-208","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"level":"informative","category":"General","name":"Contains ability to start a service (API string)","description":"Found reference to API \"StartServiceW\" (Indicator: \"StartService\"; Source: \"00000000-00002716.00000000.66373.0032E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-209","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"level":"informative","category":"General","name":"Contains reference to method used by Windows shell items (API string)","description":"Found reference to API \"SHFileOperationW\" (Indicator: \"SHFileOperation\"; Source: \"00000000-00002716.00000000.66373.0032E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-269","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$3b","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"level":"informative","category":"General","name":"Contains the ability to enumerate service (API string)","description":"Found reference to API \"QueryServiceStatusEx\" (Indicator: \"QueryServiceStatus\"; Source: \"00000000-00002716.00000000.66373.0032E000.00000002.mdmp\")\n Found reference to API \"OpenSCManagerW\" (Indicator: \"OpenSCManager\"; Source: \"00000000-00002716.00000000.66373.0032E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1007","relevance":1,"id":"string-191","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"\"emule.exe\" failed to load missing module \"C:\\emuleENU.dll\" - [base:0; Status:c0000135]\n \"emule.exe\" failed to load missing module \"C:\\emuleLOC.dll\" - [base:0; Status:c0000135]\n \"emule.exe\" failed to load missing module \"%WINDIR%\\System32\\Windows.UI.AppDefaults.dll\" - [base:0; Status:c0000135]","origin":"API Call","mitre_attack_id":"T1574.002","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"level":"informative","category":"General","name":"Found user-agent related strings","description":"Found string \"User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0; SLCC1)\" (Indicator: \"mozilla/4.0 (\"; File: \"emule.exe\")\n Found string \"User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0; SLCC1)\" (Indicator: \"user-agent: \"; File: \"emule.exe\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-127","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$3c","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"emule.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 73D20000\n \"emule.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 73020000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"emule.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 754F0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"emule.exe\" was detected as \"MFC\" and name: \"Library\"\n \"emule.exe\" was detected as \"EP:Microsoft Visual C/C++\" and name: \"Compiler\"\n \"emule.exe\" was detected as \"Microsoft Visual C++\" and name: \"Compiler\"\n \"emule.exe\" was detected as \"Microsoft Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"level":"informative","category":"General","name":"PE file contains Debug data directory","description":"\"emule.exe\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"","origin":"Static Parser","id":"static-146","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"emule.exe\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"emule.exe\" has an writable section named \".data\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"\"emule.exe\" file has an entrypoint instructions - \"push\t0x60,push\t0x78da28,call\t0x6b2360,mov\tedi, 0x94,mov\teax, edi,call\t0x6aa6b0,mov\tdword ptr [ebp - 0x18], esp,mov\tesi, esp,mov\tdword ptr [esi], edi,push\tesi,call\tdword ptr [0x71e3e0],mov\tecx, dword ptr [esi + 0x10],mov\tdword ptr [0x9f2118], ecx,mov\teax, dword ptr [esi + 4],mov\tdword ptr [0x9f2124], eax,mov\tedx, dword ptr [esi + 8],mov\tdword ptr [0x9f2128], edx,mov\tesi, dword ptr [esi + 0xc],and\tesi, 0x7fff,mov\tdword ptr [0x9f211c], esi,cmp\tecx, 2,je\t0x6a95bc,or\tesi, 0x8000,mov\tdword ptr [0x9f211c], esi,shl\teax, 8,\"","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"level":"informative","category":"General","name":"PE file has a big raw size section","description":"Raw size of \".text\" is \"0x31d000\" greater than 0x100000\n Raw size of \".rsrc\" is \"0x157000\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-125","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"level":"informative","category":"General","name":"PE file has a big virtual size section","description":"Virtual size of \".text\" is \"0x31c1d6\" greater than 0x100000\n Virtual size of \".data\" is \"0x225138\" greater than 0x100000\n Virtual size of \".rsrc\" is \"0x156b3c\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-124","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"consent.cookiebot.com\"\n \"consentcdn.cookiebot.com\"\n \"imgsct.cookiebot.com\"\n \"porttest.emule-project.net\"\n \"sflogo.sourceforge.net\"\n \"www.bing.com\"\n \"www.emule-project.com\"\n \"www.emule-project.net\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"level":"informative","category":"General","name":"References JavaScript(s)","description":"Found string \"Content-Type: text/javascript\" (Indicator: \"text/javascript\"; File: \"emule.exe\")\n Found string \"\" (Indicator: \"text/javascript\"; File: \"urlref_httpporttest.emule-project.netconnectiontest.phptcpport_46500_udpport_62123_lang_1033\")","origin":"File/Memory","mitre_attack_id":"T1059.007","relevance":1,"id":"string-626","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"level":"informative","category":"General","name":"Sets a windows hook","description":"\"emule.exe\" sets a windows hook with filter \"WH_CBT\" for thread ID 7568","origin":"API Call","mitre_attack_id":"T1056.004","relevance":10,"id":"api-71","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"emule.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"Pinger: LoadLibrary() failed: Unable to locate ICMP.DLL!\" (Indicator: \"LoadLibrary\"; File: \"emule.exe\")\n Found reference to API \"Pinger: LoadLibrary() failed: Unable to locate ICMP.DLL!\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00002716.00000000.66373.0032E000.00000002.mdmp\")\n Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00002716.00000000.66373.0032E000.00000002.mdmp, 00000000-00002716.00000001.68293.72677000.00000002.mdmp\")\n Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00002716.00000000.66373.0032E000.00000002.mdmp\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00002716.00000001.68293.72677000.00000002.mdmp\")\n Found reference to API \"LoadLibraryExA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00002716.00000001.68293.72677000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"emule.exe\" creates a thread in process \"-1\" (Handle: 4294967295)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"level":"informative","category":"Installation/Persistence","name":"Drops ASP/PHP html files","description":"\"urlref_httpporttest.emule-project.netconnectiontest.phptcpport_46500_udpport_62123_lang_1033\" has type \"HTML document ISO-8859 text with very long lines with CRLF LF line terminators\"- [targetUID: 00000000-00002716]","origin":"Binary File","mitre_attack_id":"T1105","id":"binary-49","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"level":"informative","category":"Installation/Persistence","name":"Drops temp files","description":"\"downloads.tmp\" has type \"Little-endian UTF-16 Unicode text with CRLF line terminators\" - Location: [%LOCALAPPDATA%\\eMule\\config\\downloads.tmp]","origin":"Binary File","mitre_attack_id":"T1105","relevance":1,"id":"binary-53","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$3d","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"emule.exe\" queries basic process information of the \"C:\\emule.exe\" (UID: 2716)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$3e","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"emule.exe\" reads file \"c:\\users\\%osuser%\\appdata\\local\\emule\\config\\preferences.ini\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: Possibly tries to evade analysis by sleeping many times\n Matched sigs: Contains ability to detect sandbox (imports API)\n Matched sigs: Contains ability to detect virtual environment (API)\n Matched sigs: Contains ability to delay the execution of current thread\n Matched sigs: The input sample contains a known anti-VM trick\n Matched sigs: Makes a code branch decision directly after an API that is environment aware","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"\"emule.exe\" trying to touch file \"C:\\Windows\\System32\\WOW64LOG.DLL\"\n \"emule.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\apphelp.dll\"\n \"emule.exe\" trying to touch file \"C:\\emule.exe\"\n \"emule.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\ntdll.dll\"\n \"emule.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\kernel32.dll\"\n \"emule.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\KernelBase.dll\"\n \"emule.exe\" trying to touch file \"C:\\Windows\\apppatch\\sysmain.sdb\"\n \"emule.exe\" trying to touch file \"C:\\EMULE.EXE.LOCAL\"\n \"emule.exe\" trying to touch file \"C:\\WINMM.DLL\"\n \"emule.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\winmm.dll\"\n \"emule.exe\" trying to touch file \"C:\\Windows\\WinSxS\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.16299.248_none_5d7c08dba7db7edd\\comctl32.dll\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$3f","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$40","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"emule.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\emule\\config\\preferences.ini\"\n \"emule.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\emule\\config\\cryptkey.dat\"\n \"emule.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\emule\\config\\downloads.tmp\"\n \"emule.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\emule\\config\\statistics.ini\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes log files","description":"\"emule.exe\" writes a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\eMule\\config\\cryptkey.dat\"\n \"emule.exe\" writes a file \"%LOCALAPPDATA%\\eMule\\config\\cryptkey.dat\"","origin":"API Call","mitre_attack_id":"T1074.001","relevance":1,"id":"api-159","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"level":"informative","category":"Network Related","name":"Communicates with HTTP webserver (GET/POST requests)","description":"Found http requests in header \"GET /connectiontest.php?tcpport=46500&udpport=62123&lang=1033\"","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-62","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"Found reference to API \"HttpQueryInfoW\" (Indicator: \"HttpQueryInfo\"; Source: \"00000000-00002716.00000000.66373.0032E000.00000002.mdmp\")\n Found reference to API \"InternetReadFile\" (Indicator: \"InternetReadFile\"; Source: \"00000000-00002716.00000000.66373.0032E000.00000002.mdmp\")\n Found reference to API \"HttpSendRequestW\" (Indicator: \"HttpSendRequest\"; Source: \"00000000-00002716.00000000.66373.0032E000.00000002.mdmp\")\n Found reference to API \"HttpOpenRequestW\" (Indicator: \"HttpOpenRequest\"; Source: \"00000000-00002716.00000000.66373.0032E000.00000002.mdmp\")\n Found reference to API \"InternetConnectW\" (Indicator: \"InternetConnect\"; Source: \"00000000-00002716.00000000.66373.0032E000.00000002.mdmp\")\n Found reference to API \"InternetOpenW\" (Indicator: \"InternetOpen\"; Source: \"00000000-00002716.00000000.66373.0032E000.00000002.mdmp\")\n Found reference to API \"InternetOpenUrlW\" (Indicator: \"InternetOpen\"; Source: \"00000000-00002716.00000000.66373.0032E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create a HTTP or FTP session (API string)","description":"Found reference to API \"InternetConnectW\" (Indicator: \"InternetConnect\"; Source: \"00000000-00002716.00000000.66373.0032E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-538","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create a new HTTP request (API string)","description":"Found reference to API \"HttpOpenRequestW\" (Indicator: \"HttpOpenRequest\"; Source: \"00000000-00002716.00000000.66373.0032E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-537","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create/connect to a named pipe (API string)","description":"Found reference to API \"PeekNamedPipe\" (Indicator: \"PeekNamedPipe\"; Source: \"00000000-00002716.00000000.66373.0032E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-210","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"level":"informative","category":"Network Related","name":"Contains ability to download a file from a URL (API string)","description":"Found reference to API \"InternetReadFile\" (Indicator: \"InternetReadFile\"; Source: \"00000000-00002716.00000000.66373.0032E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-241","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"level":"informative","category":"Network Related","name":"Contains ability to open a port and listen for incoming connection (API string)","description":"Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; File: \"emule.exe\")\n Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; Source: \"00000000-00002716.00000000.66373.0032E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1571","relevance":1,"id":"string-419","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"level":"informative","category":"Network Related","name":"Contains ability to retrieve internet settings (API string)","description":"Found reference to API \"InternetQueryOptionW\" (Indicator: \"InternetQueryOption\"; Source: \"00000000-00002716.00000000.66373.0032E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-314","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"level":"informative","category":"Network Related","name":"Contains reference to Mail transfer protocol","description":"Found string \"E-Mail Notification: Failed to connect to SMTP server '%s'\" (Indicator: \"smtp\"; File: \"emule.exe\")","origin":"File/Memory","mitre_attack_id":"T1071.003","relevance":1,"id":"string-499","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"level":"informative","category":"Network Related","name":"Contains reference to Windows internet services (API string)","description":"Found reference to API \"InternetOpenW\" (Indicator: \"InternetOpen\"; Source: \"00000000-00002716.00000000.66373.0032E000.00000002.mdmp\")\n Found reference to API \"InternetOpenUrlW\" (Indicator: \"InternetOpen\"; Source: \"00000000-00002716.00000000.66373.0032E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-539","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$41","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"level":"informative","category":"Network Related","name":"Found string related to HTTP headers","description":"$42","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-457","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"level":"informative","category":"Network Related","name":"GETs files from a webserver (HTTPS)","description":"$43","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":3,"id":"network-72","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: bd0bf25947d4a37404f0424edf4db9ad\n Observed JA3 fingerprint: 1fc1c530fdab845a0a2b05d0b5335bcb","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"level":"informative","category":"Network Related","name":"Making HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"level":"informative","category":"Network Related","name":"References server/domain address with port number","description":"Found ip/domain with port number \"http://192.168.243.38:2869\"Found ip/domain with port number \"http://192.168.243.212:2869\"Found ip/domain with port number \"http://192.168.241.228:2869\"Found ip/domain with port number \"http://192.168.243.111:2869\"Found ip/domain with port number \"http://192.168.243.163:2869\"Found ip/domain with port number \"http://192.168.241.242:2869\"","origin":"Indicator Combinations","mitre_attack_id":"T1571","id":"summary-25","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"level":"informative","category":"Network Related","name":"Sends GET/POST requests (HTTPS)","description":"$44","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-66","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"level":"informative","category":"Network Related","name":"Shows ability to send encrypted data to the internet","description":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network","origin":"Indicator Combinations","mitre_attack_id":"T1119","relevance":2,"id":"summary-27","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"level":"informative","category":"Network Related","name":"Uses HTTPS for communication","description":"HTTPS traffic to \"184.25.254.67\" on port \"443\"\n HTTPS traffic to \"94.16.113.2\" on port \"443\"\n HTTPS traffic to \"69.192.139.103\" on port \"443\"\n HTTPS traffic to \"172.64.150.145\" on port \"443\"\n HTTPS traffic to \"23.38.225.9\" on port \"443\"\n HTTPS traffic to \"184.25.254.88\" on port \"443\"\n HTTPS traffic to \"184.25.254.97\" on port \"443\"","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":3,"id":"network-38","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"Found string \"F+ncalrpc:[OLEA8CCDFCF38FC91B3B372136023F8]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00002716.00000001.68293.03390000.00000004.mdmp\")\n Found string \"+ncalrpc:[OLEA8CCDFCF38FC91B3B372136023F8]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00002716.00000001.68293.03390000.00000004.mdmp, 00000000-00002716.00000002.70213.03390000.00000004.mdmp\")\n Found string \"+ncalrpc:[OLEF08F38AB5A8C601C0466EF9F3B3A]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00002716.00000002.70213.03390000.00000004.mdmp\")\n Found string \"9ncalrpc:[epmapper,Security=Impersonation Dynamic False]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00002716.00000002.70213.07E40000.00000004.mdmp\")\n Found string \"F+ncalrpc:[OLEF08F38AB5A8C601C0466EF9F3B3A]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00002716.00000002.70213.07E40000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API possibly used to take screenshots","description":"$45","origin":"API Call","mitre_attack_id":"T1113","relevance":3,"id":"api-105","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"emule.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve user name","description":"\"emule.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"65538\"}\n \"emule.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"2\"}","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-135","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API's typically used for searching a directory for a files","description":"$46","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"Found string \"base64\" (Indicator: \"base64\"; Source: \"00000000-00002716.00000000.66373.0032E000.00000002.mdmp\")\n Found string \"IPF_Base64InkSerializedFormatWWW\" (Indicator: \"base64\"; Source: \"00000000-00002716.00000001.68293.72677000.00000002.mdmp\")\n Found string \"IPF_Base64GIFWWWh\" (Indicator: \"base64\"; Source: \"00000000-00002716.00000001.68293.72677000.00000002.mdmp\")\n Found string \"Specifies that ink be persisted by encoding the ISF as a base64 stream.WWWi\" (Indicator: \"base64\"; Source: \"00000000-00002716.00000001.68293.72677000.00000002.mdmp\")\n Found string \"Specifies that ink be persisted by using a base64 encoded fortified GIF.WW1\" (Indicator: \"base64\"; Source: \"00000000-00002716.00000001.68293.72677000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to access clipboard data (API string)","description":"Found reference to API \"GetClipboardData\" (Indicator: \"GetClipboardData\"; Source: \"00000000-00002716.00000000.66373.0032E000.00000002.mdmp\")\n Found reference to API \"OpenClipboard\" (Indicator: \"OpenClipboard\"; Source: \"00000000-00002716.00000000.66373.0032E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1115","relevance":1,"id":"string-188","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to capture screen (API string)","description":"$47","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to detect sandbox (imports API)","description":"Found GetCursorPos() in an import section (Source: emule.exe)","origin":"Static Parser","mitre_attack_id":"T1497","relevance":1,"id":"static-132","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to determine disk drive type (API string)","description":"Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveType\"; Source: \"00000000-00002716.00000000.66373.0032E000.00000002.mdmp\")\n Found reference to API \"GetDriveTypeA\" (Indicator: \"GetDriveType\"; Source: \"00000000-00002716.00000000.66373.0032E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-80","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"Found reference to API \"FindFirstFileW\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00002716.00000000.66373.0032E000.00000002.mdmp\")\n Found reference to API \"FindNextFileW\" (Indicator: \"FindNextFile\"; Source: \"00000000-00002716.00000000.66373.0032E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$48","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to find logical drives of the machine (API string)","description":"Found reference to API \"GetLogicalDriveStringsW\" (Indicator: \"GetLogicalDriveStrings\"; Source: \"00000000-00002716.00000000.66373.0032E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-84","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to query registry keys (API string)","description":"$49","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00002716.00000000.66373.0032E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve IPv4 TCP connection table (API string)","description":"Found reference to API \"GetTcpTable\" (Indicator: \"GetTcpTable\"; Source: \"00000000-00002716.00000000.66373.0032E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1049","relevance":1,"id":"string-119","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve SID for the specified name (API string)","description":"Found reference to API \"Run as unpriveleged user: Error: LookupAccountName()2 failed\" (Indicator: \"LookupAccountName\"; File: \"emule.exe\")\n Found reference to API \"Run as unpriveleged user: Error: LookupAccountName() failed,\" (Indicator: \"LookupAccountName\"; File: \"emule.exe\")\n Found reference to API \"Run as unpriveleged user: Error: LookupAccountName()2 failed\" (Indicator: \"LookupAccountName\"; Source: \"00000000-00002716.00000000.66373.0032E000.00000002.mdmp\")\n Found reference to API \"Run as unpriveleged user: Error: LookupAccountName() failed,\" (Indicator: \"LookupAccountName\"; Source: \"00000000-00002716.00000000.66373.0032E000.00000002.mdmp\")\n Found reference to API \"LookupAccountNameW\" (Indicator: \"LookupAccountName\"; Source: \"00000000-00002716.00000000.66373.0032E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1087","relevance":1,"id":"string-452","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00002716.00000000.66373.0032E000.00000002.mdmp, 00000000-00002716.00000001.68293.72677000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00002716.00000000.66373.0032E000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00002716.00000001.68293.72677000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00002716.00000000.66373.0032E000.00000002.mdmp, 00000000-00002716.00000001.68293.72677000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve data about the local computer (API string)","description":"Found reference to API \"InterlockedExchange\" (Indicator: \"InterlockedExchange\"; Source: \"00000000-00002716.00000000.66373.0032E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":3,"id":"string-115","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"$4a","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about operating system (API string)","description":"Found reference to API \"122349205891,2516,3025,,RtlGetNtProductType,NTDLL.dll,\"00:18:03.234\",RX=0,PX=0\" (Indicator: \"RtlGetNtProductType\"; Source: \"00000000-00002716.00000002.70213.03390000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about pressed keystrokes (API string)","description":"$4b","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-88","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the NetBIOS name of the local computer (API string)","description":"Found reference to API \"GetComputerNameW\" (Indicator: \"GetComputerName\"; Source: \"00000000-00002716.00000000.66373.0032E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-122","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00002716.00000000.66373.0032E000.00000002.mdmp, 00000000-00002716.00000001.68293.72677000.00000002.mdmp\")\n Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00002716.00000000.66373.0032E000.00000002.mdmp, 00000000-00002716.00000001.68293.72677000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the local name for a socket (API string)","description":"Found reference to API \"getsockname\" (Indicator: \"getsockname\"; File: \"emule.exe\")\n Found reference to API \"getsockname\" (Indicator: \"getsockname\"; Source: \"00000000-00002716.00000000.66373.0032E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-224","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; File: \"emule.exe\")\n Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; Source: \"00000000-00002716.00000000.66373.0032E000.00000002.mdmp, 00000000-00002716.00000001.68293.72677000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-131","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00002716.00000000.66373.0032E000.00000002.mdmp, 00000000-00002716.00000001.68293.72677000.00000002.mdmp\")\n Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount\"; Source: \"00000000-00002716.00000001.68293.72677000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve usernames and/or user information (API string)","description":"$4c","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieves the class object from a DLL object handler (API string)","description":"Found reference to API \"NdrDllGetClassObject\" (Indicator: \"DllGetClassObject\"; Source: \"00000000-00002716.00000001.68293.72677000.00000002.mdmp\")\n Found reference to API \"DllGetClassObject\" (Indicator: \"DllGetClassObject\"; Source: \"00000000-00002716.00000002.70213.72611000.00000020.mdmp\")","origin":"File/Memory","relevance":1,"id":"string-82","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"Found string \"Failed to set password\" (Indicator: \"password\"; File: \"emule.exe\")\n Found string \"password\" (Indicator: \"password\"; File: \"emule.exe\")\n Found string \"Failed to set password\" (Indicator: \"password\"; Source: \"00000000-00002716.00000000.66373.0032E000.00000002.mdmp\")\n Found string \"password\" (Indicator: \"password\"; Source: \"00000000-00002716.00000000.66373.0032E000.00000002.mdmp\")\n Found string \"Link not added. Wrong password.'Download parts needed for preview first\" (Indicator: \"password\"; Source: \"00000000-00002716.00000002.70213.00605000.00000002.mdmp\")\n Found string \"Enter your password here\tLogin Now-Are you sure to remove this server from list?\" (Indicator: \"password\"; Source: \"00000000-00002716.00000002.70213.00605000.00000002.mdmp\")\n Found string \"P\tfile is password protected\" (Indicator: \"password\"; Source: \"00000000-00002716.00000002.70213.00605000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found mail information locations related strings","description":"\"oftware\\Microsoft\\Office\\16.0\\Outlook\\Capabilities\" in Source: 00000000-00002716.00000002.70213.03390000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1114","relevance":1,"id":"string-129","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Imports GetCommandLine API","description":"Observed import api \"GetCommandLineA\" which can \"Retrieves the command-line string for the current process\" [Source: emule.exe]","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-88","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"Found string \":\\WINDOWS\\system32\\DRIVERS\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00002716.00000000.66373.03390000.00000004.mdmp, 00000000-00002716.00000001.68293.03390000.00000004.mdmp, 00000000-00002716.00000002.70213.03390000.00000004.mdmp\")\n Found string \"\\Device\\CdRom0\" (Indicator: \"\\Device\\\"; Source: \"00000000-00002716.00000002.70213.07E40000.00000004.mdmp\")\n Found string \"\\Device\\HarddiskVolume1\\??\\Volume{815ead30-0000-0000-0000-100000000000}0\" (Indicator: \"\\Device\\\"; Source: \"00000000-00002716.00000002.70213.07E40000.00000004.mdmp\")\n Found string \"\\Device\\HarddiskVolume2\" (Indicator: \"\\Device\\\"; Source: \"00000000-00002716.00000002.70213.07E40000.00000004.mdmp\")\n Found string \"\\Device\\HarddiskVolume1\" (Indicator: \"\\Device\\\"; Source: \"00000000-00002716.00000002.70213.07E40000.00000004.mdmp\")\n Found string \"vice\\CdRom0\\DosDevices\\D:\\??\\Volume{cf69d5ac-242f-11eb-9bff-806e6f6e6963}DO\" (Indicator: \"\\DosDevices\\\"; Source: \"00000000-00002716.00000002.70213.07E40000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"level":"informative","category":"System Security","name":"Contains ability to create process with token (API string)","description":"Found reference to API \"CreateProcessAsUser failed\" (Indicator: \"CreateProcessAsUser\"; File: \"emule.exe\")","origin":"File/Memory","mitre_attack_id":"T1134.002","relevance":1,"id":"string-168","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; Source: \"00000000-00002716.00000000.66373.0032E000.00000002.mdmp\")\n Found reference to API \"RemoveDirectoryW\" (Indicator: \"RemoveDirectory\"; Source: \"00000000-00002716.00000000.66373.0032E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete registry key/value (API string)","description":"Found reference to API \"RegDeleteKeyW\" (Indicator: \"RegDeleteKey\"; Source: \"00000000-00002716.00000000.66373.0032E000.00000002.mdmp, 00000000-00002716.00000002.70213.72611000.00000020.mdmp\")\n Found reference to API \"RegDeleteValueW\" (Indicator: \"RegDeleteValue\"; Source: \"00000000-00002716.00000000.66373.0032E000.00000002.mdmp, 00000000-00002716.00000001.68293.72677000.00000002.mdmp\")\n Found reference to API \"RegDeleteKeyExW\" (Indicator: \"RegDeleteKey\"; Source: \"00000000-00002716.00000002.70213.72611000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-230","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"level":"informative","category":"System Security","name":"Contains ability to hook/unhook windows functions (API string)","description":"Found reference to API \"SetWindowsHookExW\" (Indicator: \"SetWindowsHook\"; Source: \"00000000-00002716.00000000.66373.0032E000.00000002.mdmp, 00000000-00002716.00000001.68293.72677000.00000002.mdmp\")\n Found reference to API \"CallNextHookEx\" (Indicator: \"CallNextHook\"; Source: \"00000000-00002716.00000000.66373.0032E000.00000002.mdmp, 00000000-00002716.00000001.68293.72677000.00000002.mdmp\")\n Found reference to API \"UnhookWindowsHookEx\" (Indicator: \"UnhookWindowsHook\"; Source: \"00000000-00002716.00000000.66373.0032E000.00000002.mdmp, 00000000-00002716.00000001.68293.72677000.00000002.mdmp\")\n Found reference to API \"SetWinEventHook\" (Indicator: \"SetWinEventHook\"; Source: \"00000000-00002716.00000001.68293.72677000.00000002.mdmp\")\n Found reference to API \"UnhookWinEvent\" (Indicator: \"UnhookWinEvent\"; Source: \"00000000-00002716.00000001.68293.72677000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-91","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"Found reference to API \"SeShutdownPrivilege\" (Indicator: \"SeShutdownPrivilege\"; File: \"emule.exe\")\n Found reference to API \"SeShutdownPrivilege\" (Indicator: \"SeShutdownPrivilege\"; Source: \"00000000-00002716.00000000.66373.0032E000.00000002.mdmp\")\n Found reference to API \"AdjustTokenPrivileges\" (Indicator: \"AdjustTokenPrivileges\"; Source: \"00000000-00002716.00000000.66373.0032E000.00000002.mdmp\")\n Found reference to API \"LookupPrivilegeValueW\" (Indicator: \"LookupPrivilegeValue\"; Source: \"00000000-00002716.00000000.66373.0032E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify file attributes (API string)","description":"Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; Source: \"00000000-00002716.00000000.66373.0032E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1222","relevance":1,"id":"string-426","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify the user configuration/privilege (API string)","description":"Found reference to API \"SystemParametersInfoW\" (Indicator: \"SystemParametersInfo\"; Source: \"00000000-00002716.00000000.66373.0032E000.00000002.mdmp, 00000000-00002716.00000001.68293.72677000.00000002.mdmp\")\n Found reference to API \"SystemParametersInfoA\" (Indicator: \"SystemParametersInfo\"; Source: \"00000000-00002716.00000000.66373.0032E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1098","relevance":1,"id":"string-132","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"$4d","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"level":"informative","category":"System Security","name":"Contains ability to shutdown system","description":"Observed string: \"shutdown\" (Indicator: \"shutdown\") in Source: emule.exe\n Observed string: \"shutdown\" (Indicator: \"shutdown\") in Source: 00000000-00002716.00000000.66373.0032E000.00000002.mdmp\n Observed string: \"Shutdown eMule\" (Indicator: \"shutdown \") in Source: 00000000-00002716.00000002.70213.00605000.00000002.mdmp\n Observed string: \"Shutdown system\" (Indicator: \"shutdown \") in Source: 00000000-00002716.00000002.70213.00605000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1529","relevance":1,"id":"string-406","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"CorExitProcess\" (Indicator: \"ExitProcess\"; File: \"emule.exe\")\n Found reference to API \"CorExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00002716.00000000.66373.0032E000.00000002.mdmp\")\n Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00002716.00000000.66373.0032E000.00000002.mdmp\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00002716.00000000.66373.0032E000.00000002.mdmp, 00000000-00002716.00000001.68293.72677000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00002716.00000000.66373.0032E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$4e","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to reboot/shutdown the operating system (API string)","description":"Found reference to API \"ExitWindowsEx\" (Indicator: \"ExitWindows\"; Source: \"00000000-00002716.00000000.66373.0032E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1529","relevance":3,"id":"string-189","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"Found reference to API \"CreateMutexW\" (Indicator: \"CreateMutex\"; Source: \"00000000-00002716.00000000.66373.0032E000.00000002.mdmp\")\n Found reference to API \"ReleaseMutex\" (Indicator: \"ReleaseMutex\"; Source: \"00000000-00002716.00000000.66373.0032E000.00000002.mdmp, 00000000-00002716.00000001.68293.72677000.00000002.mdmp\")\n Found reference to API \"OpenMutexW\" (Indicator: \"OpenMutex\"; Source: \"00000000-00002716.00000001.68293.72677000.00000002.mdmp\")\n Found reference to API \"CreateMutexExW\" (Indicator: \"CreateMutex\"; Source: \"00000000-00002716.00000001.68293.72677000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-354","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"level":"informative","category":"Unusual Characteristics","name":"Detected known bank URL artifact","description":"\"http://www.filedonkey.com/search.html?\" (Source: emule.exe, Indicator: \"key.com\")\n \"http://www.filedonkey.com/search.html?\" (Source: 00000000-00002716.00000000.66373.0032E000.00000002.mdmp, Indicator: \"key.com\")","origin":"File/Memory","relevance":2,"id":"string-23","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"Dropped file: \"statistics.ini\" - Location: [%LOCALAPPDATA%\\eMule\\config\\statistics.ini]- [targetUID: 00000000-00002716]\n Dropped file: \"downloads.tmp\" - Location: [%LOCALAPPDATA%\\eMule\\config\\downloads.tmp]- [targetUID: 00000000-00002716]\n Dropped file: \"cryptkey.dat\" - Location: [%LOCALAPPDATA%\\eMule\\config\\cryptkey.dat]- [targetUID: 00000000-00002716]\n Dropped file: \"preferences.ini\" - Location: [%LOCALAPPDATA%\\eMule\\config\\preferences.ini]- [targetUID: 00000000-00002716]","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"level":"informative","category":"Unusual Characteristics","name":"Possibly uses a Windows Server utility","description":"\"#c:\\windows\\system32\\licensingui.exe\" (Indicator: \"licensingui.exe\")","origin":"File/Memory","relevance":10,"id":"string-65","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"emule.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"emule.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Possibly checks for known debuggers/analysis tools","description":"$4f","origin":"File/Memory","mitre_attack_id":"T1518.001","relevance":2,"id":"string-5","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"level":"suspicious","category":"General","name":"Reads configuration files (.ini files)","description":"\"emule.exe\" reads file \"C:\\Users\\%OSUSER%\\AppData\\Local\\eMule\\config\\preferences.ini\"","origin":"API Call","mitre_attack_id":"T1083","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"level":"suspicious","category":"General","name":"Sends UDP traffic","description":"\"UDP connection to 184.25.254.88\"\n \"UDP connection to 184.25.254.97\"","origin":"Network Traffic","mitre_attack_id":"T1095","relevance":7,"id":"network-5","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Contains ability to update the user profile","description":"SystemParametersInfoA@USER32.dll at 15639-20878-0069F7C0","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1098","relevance":5,"id":"stream-123","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Contains many references to file extensions (often found in ransomware)","description":"Found reference to a lot of file extensions in file \"00000000-00002716.00000000.66373.0032E000.00000002.mdmp\" : .backup\n .html\n .tiff\n .jpeg\n .mpeg\n .m2ts\n .flac\n .aiff\n .rar\n .zip\n .bak\n .backup\n .txt\n .mp3\n .dmp\n .wav\n .xml\n .xls\n .rtf\n .ppt\n .pps\n .pdf\n .html\n .dot\n .doc\n .css\n .mdf\n .bin\n .vbs\n .cmd\n .bat\n .tgz\n .tar\n .pak\n .arc\n .tiff\n .tif\n .tga\n .psd\n .png\n .pct\n .jpg\n .jpeg\n .jpe\n .gif\n .bmp\n .wmv\n .vob\n .swf\n .mpg\n .mpeg\n .mp4\n .mov\n .mkv\n .m4v\n .m2ts\n .flv\n .bik\n .avi\n .asf\n .3gp\n .3g2\n .wma\n .stm\n .ogg","origin":"File/Memory","relevance":10,"id":"string-52","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used for keylogging","description":"\"emule.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"1\"}","origin":"API Call","mitre_attack_id":"T1056.001","relevance":10,"id":"api-40","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to open the clipboard","description":"OpenClipboard@USER32.dll at 15639-23762-0043BB50\n OpenClipboard@USER32.dll at 15639-23612-0043E450\n OpenClipboard@USER32.dll at 15639-23760-0043E680","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1115","relevance":10,"id":"stream-0","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"},{"report_type":"sandbox","report_id":"59d4b90c7ca3e1442d6d9793"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve keyboard strokes","description":"GetKeyState@USER32.dll at 15639-23851-00623FD7\n GetAsyncKeyState@USER32.dll at 15639-23287-0061C190\n GetKeyState@USER32.dll at 15639-23010-00631360\n GetKeyState@USER32.dll at 15639-23820-00627940\n GetAsyncKeyState@USER32.dll at 15639-24035-005986A0\n GetKeyState@USER32.dll at 15639-23704-0062C280\n GetKeyState@USER32.dll at 15639-24050-006217D0","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1056.001","relevance":8,"id":"stream-12","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"},{"report_type":"sandbox","report_id":"59d4b90c7ca3e1442d6d9793"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Found system commands related strings","description":"$50","origin":"File/Memory","mitre_attack_id":"T1082","relevance":3,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Creates a process in suspended mode (likely for process injection)","description":"\"emule.exe\" called \"CreateProcessW\" with parameter \"\"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --single-argument http://porttest.emule-project.net/connectiontest.\" - (UID: 00000000-00002716)","origin":"API Call","mitre_attack_id":"T1055","relevance":10,"id":"api-129","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"level":"malicious","category":"General","name":"Calls an API typically used to execute an application","description":"\"emule.exe\" called \"ShellExecuteW\" with parameter http://porttest.emule-project.net/connectiontest.php?tcpport=46500&udpport=62123&lang=1033 (UID: 00000000-00002716)","origin":"API Call","mitre_attack_id":"T1106","relevance":10,"id":"api-117","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"level":"malicious","category":"General","name":"Contains ability to start/interact with device drivers","description":"DeviceIoControl@KERNEL32.dll at 15639-23991-00489ED0","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1547.006","relevance":8,"id":"stream-21","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"},{"report_type":"sandbox","report_id":"59d4b90c7ca3e1442d6d9793"}]},{"level":"malicious","category":"Installation/Persistence","name":"Sets a computer-based training (CBT) hook","description":"\"emule.exe\" sets a callback procedure (2e446b) using filter \"WH_CBT\" for process ID: a9c","origin":"API Call","mitre_attack_id":"T1056.004","relevance":10,"id":"api-74","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.dll at 14978-28564-004626A0","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"59d4b90c7ca3e1442d6d9793"}]},{"level":"informative","category":"Environment Awareness","name":"Possibly tries to detect the presence of a debugger","description":"GetProcessHeap@KERNEL32.dll at 14978-28258-004BA920","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"59d4b90c7ca3e1442d6d9793"}]},{"level":"suspicious","category":"Pattern Matching","name":"Contains ability to download files from the internet","description":"InternetReadFile@WININET.dll at 14978-29248-00553C30\n InternetReadFile@WININET.dll at 14978-29714-006E6B87\n InternetReadFile@WININET.dll at 14978-29712-006E6970","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-17","sources":[{"report_type":"sandbox","report_id":"59d4b90c7ca3e1442d6d9793"}]},{"level":"malicious","category":"Installation/Persistance","name":"Scans for the windows taskbar (often used for explorer injection)","description":"\"\" searching for class \"Shell_TrayWnd\"","origin":"API Call","relevance":5,"id":"api-17","sources":[{"report_type":"sandbox","report_id":"59d4b90c7ca3e1442d6d9793"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Contains ability to reboot/shutdown the operating system","description":"ExitWindowsEx@USER32.dll at 14978-26825-0053D400\n ExitWindowsEx@USER32.dll at 14978-28547-0046D520","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-23","sources":[{"report_type":"sandbox","report_id":"59d4b90c7ca3e1442d6d9793"}]}],"incidents":[{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 7 domains and 7 hosts"}],"sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"},{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"},{"report_type":"sandbox","report_id":"59d4b90c7ca3e1442d6d9793"}]},{"name":"Spyware","details_count":5,"details":[{"detail":"Sets a computer-based training (CBT) hook"},{"detail":"Contains ability to open the clipboard"},{"detail":"Contains ability to open the clipboard"},{"detail":"Contains ability to retrieve keyboard strokes"},{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"},{"report_type":"sandbox","report_id":"59d4b90c7ca3e1442d6d9793"}]},{"name":"Persistence","details_count":1,"details":[{"detail":"Modifies auto-execute functionality by setting/creating a value in the registry"}],"sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"},{"report_type":"sandbox","report_id":"59d4b90c7ca3e1442d6d9793"}]},{"name":"Fingerprint","details_count":2,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Queries process information"}],"sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"},{"report_type":"sandbox","report_id":"59d4b90c7ca3e1442d6d9793"}]},{"name":"Evasive","details_count":2,"details":[{"detail":"Possibly tries to evade analysis by sleeping many times"},{"detail":"The input sample contains a known anti-VM trick"}],"sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"name":"Remote Access","details_count":1,"details":[{"detail":"Reads terminal service related keys (often RDP related)"}],"sources":[{"report_type":"sandbox","report_id":"59d4b90c7ca3e1442d6d9793"}]}]},"activity":{"stats":{"process_count":24,"spawned_processes_count":24,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":59,"imported_dlls_count":243,"dropped_files_count":0,"extracted_files_count":23,"files_written_count":201,"files_deleted_count":0,"registry_keys_created_count":14,"registry_keys_modified_count":0,"registry_keys_deleted_count":15,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":29,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":16,"dns_resolutions_count":12,"contacted_urls_count":42,"http_requests_count":42},"behavior_tags":["alma","almanahe","dropper","expiro","floxif","locker","ransomware","trojan","windows-server-utility"],"sample_flags":["Network Traffic","Extracted Files","TOR analysis"],"sandbox_reports":[{"id":"65dc1ef594972b4d46023100","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"clean","contacted_countries":["DEU","USA"],"submit_name":"emule.exe","analysis_start_time":"2024-02-26T05:17:42+00:00","indicators_count":{"informative":205,"suspicious":46,"malicious":5},"tags":["Network Traffic","Extracted Files"],"is_in_unified_schema":true},{"id":"5c529ff17ca3e12c2a31d958","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"clean","contacted_countries":["DEU","SYR","USA"],"submit_name":"emule.exe","analysis_start_time":"2019-01-31T08:25:13+00:00","indicators_count":{"informative":29,"suspicious":27,"malicious":5},"tags":["Network Traffic","Extracted Files","TOR analysis"],"is_in_unified_schema":true},{"id":"59d4b90c7ca3e1442d6d9793","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"clean","threat_score":70,"contacted_countries":["SYR"],"submit_name":"emule.exe","analysis_start_time":"2017-10-04T11:32:00+00:00","indicators_count":{"informative":17,"suspicious":15,"malicious":4},"tags":["Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"152.199.19.161","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"address":"94.16.113.2","port":80,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"},{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"address":"216.58.198.194","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"address":"216.58.198.194","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"address":"216.105.38.13","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"address":"94.16.113.2","port":81,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"address":"216.58.213.130","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"address":"216.58.198.195","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"address":"172.217.22.131","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"address":"184.25.254.67","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"address":"94.16.113.2","port":443,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"address":"69.192.139.103","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"address":"172.64.150.145","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"address":"23.38.225.9","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"address":"184.25.254.88","port":443,"protocol":"UDP","country":"United States","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"address":"184.25.254.97","port":443,"protocol":"UDP","country":"United States","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]}],"dns_resolutions":[{"domain":"crl.pki.goog","address":"172.217.22.131","ttl":300,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"domain":"ocsp.pki.goog","address":"216.58.198.195","ttl":300,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"domain":"pagead2.googlesyndication.com","address":"216.58.198.194","ttl":300,"country":"United States","registrar_name":"MarkMonitor, Inc.","registrar_organization":"Google Inc.","registrar_creation_date":"2003-01-21T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"domain":"porttest.emule-project.net","address":"94.16.113.2","ttl":3600,"country":"Germany","registrar_name":"ENOM, INC.","registrar_organization":"-","registrar_name_servers":"DNS1.NAME-SERVICES.COM","registrar_creation_date":"2002-09-11T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"},{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"domain":"sflogo.sourceforge.net","address":"216.105.38.13","ttl":3600,"country":"United States","registrar_name":"TUCOWS, INC.","registrar_organization":"SourceForge Media, LLC","registrar_name_servers":"NS1.DNSMADEEASY.COM","registrar_creation_date":"1999-08-08T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"},{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"domain":"vcdns2.emule-project.org","address":"5.0.50.0","ttl":3600,"country":"Syrian Arab Republic","registrar_name":"eNom, Inc.","registrar_organization":"-","registrar_name_servers":"DNS1.NAME-SERVICES.COM","registrar_creation_date":"2002-10-20T12:32:14+00:00","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"},{"report_type":"sandbox","report_id":"59d4b90c7ca3e1442d6d9793"}]},{"domain":"www.emule-project.net","address":"94.16.113.2","ttl":3600,"country":"Germany","registrar_name":"ENOM, INC.","registrar_organization":"-","registrar_name_servers":"DNS1.NAME-SERVICES.COM","registrar_creation_date":"2002-09-11T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"},{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"domain":"consent.cookiebot.com","address":"69.192.139.103","ttl":474,"country":"United States","registrar_name":"GoDaddy.com, LLC","registrar_organization":"Cybot ApS","registrar_name_servers":"PDNS05.DOMAINCONTROL.COM","registrar_creation_date":"2010-01-21T20:19:58+00:00","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"domain":"consentcdn.cookiebot.com","address":"23.38.225.9","ttl":2960,"country":"United States","registrar_name":"GoDaddy.com, LLC","registrar_organization":"Cybot ApS","registrar_name_servers":"PDNS05.DOMAINCONTROL.COM","registrar_creation_date":"2010-01-21T20:19:58+00:00","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"domain":"imgsct.cookiebot.com","address":"23.38.225.9","ttl":3443,"country":"United States","registrar_name":"GoDaddy.com, LLC","registrar_organization":"Cybot ApS","registrar_name_servers":"PDNS05.DOMAINCONTROL.COM","registrar_creation_date":"2010-01-21T20:19:58+00:00","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"domain":"www.bing.com","address":"184.25.254.67","ttl":3613,"country":"United States","registrar_name":"MarkMonitor, Inc.","registrar_organization":"Microsoft Corporation","registrar_name_servers":"NS1.MSEDGE.NET","registrar_creation_date":"1996-01-29T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"domain":"www.emule-project.com","address":"94.16.113.2","ttl":3601,"country":"Germany","registrar_name":"ENOM, INC.","registrar_organization":"REDACTED FOR PRIVACY","registrar_name_servers":"DNS1.NAME-SERVICES.COM","registrar_creation_date":"2002-09-11T14:19:08+00:00","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]}],"http_requests":[{"host":"porttest.emule-project.net","host_ip":"94.16.113.2:80","url":"/connectiontest.php?tcpport=55479&udpport=8987&lang=1033","method":"GET","header":"GET /connectiontest.php?tcpport=55479&udpport=8987&lang=1033 HTTP/1.1\nAccept: text/html, application/xhtml+xml, */*\nAccept-Language: en-US\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko\nAccept-Encoding: gzip, deflate\nHost: porttest.emule-project.net\nDNT: 1\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"host":"www.emule-project.net","host_ip":"94.16.113.2:80","url":"/home/perl/general.cgi?rm=porttest&tcpport=55479&udpport=8987&lang=1033&l=1","method":"GET","header":"GET /home/perl/general.cgi?rm=porttest&tcpport=55479&udpport=8987&lang=1033&l=1 HTTP/1.1\nAccept: text/html, application/xhtml+xml, */*\nAccept-Language: en-US\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko\nAccept-Encoding: gzip, deflate\nDNT: 1\nConnection: Keep-Alive\nHost: www.emule-project.net","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"host":"www.emule-project.net","host_ip":"94.16.113.2:80","url":"/home/emule.css","method":"GET","header":"GET /home/emule.css HTTP/1.1\nAccept: text/css, */*\nReferer: http://www.emule-project.net/home/perl/general.cgi?rm=porttest&tcpport=55479&udpport=8987&lang=1033&l=1\nAccept-Language: en-US\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko\nAccept-Encoding: gzip, deflate\nHost: www.emule-project.net\nDNT: 1\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"host":"www.emule-project.net","host_ip":"94.16.113.2:80","url":"/home/img/top_bg.gif","method":"GET","header":"GET /home/img/top_bg.gif HTTP/1.1\nAccept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5\nReferer: http://www.emule-project.net/home/perl/general.cgi?rm=porttest&tcpport=55479&udpport=8987&lang=1033&l=1\nAccept-Language: en-US\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko\nAccept-Encoding: gzip, deflate\nHost: www.emule-project.net\nDNT: 1\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"host":"www.emule-project.net","host_ip":"94.16.113.2:80","url":"/home/img/logo_top.jpg","method":"GET","header":"GET /home/img/logo_top.jpg HTTP/1.1\nAccept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5\nReferer: http://www.emule-project.net/home/perl/general.cgi?rm=porttest&tcpport=55479&udpport=8987&lang=1033&l=1\nAccept-Language: en-US\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko\nAccept-Encoding: gzip, deflate\nHost: www.emule-project.net\nDNT: 1\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"host":"www.emule-project.net","host_ip":"94.16.113.2:80","url":"/home/img/logo.jpg","method":"GET","header":"GET /home/img/logo.jpg HTTP/1.1\nAccept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5\nReferer: http://www.emule-project.net/home/perl/general.cgi?rm=porttest&tcpport=55479&udpport=8987&lang=1033&l=1\nAccept-Language: en-US\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko\nAccept-Encoding: gzip, deflate\nHost: www.emule-project.net\nDNT: 1\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"host":"www.emule-project.net","host_ip":"94.16.113.2:80","url":"/images/de.jpg","method":"GET","header":"GET /images/de.jpg HTTP/1.1\nAccept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5\nReferer: http://www.emule-project.net/home/perl/general.cgi?rm=porttest&tcpport=55479&udpport=8987&lang=1033&l=1\nAccept-Language: en-US\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko\nAccept-Encoding: gzip, deflate\nHost: www.emule-project.net\nDNT: 1\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"host":"www.emule-project.net","host_ip":"94.16.113.2:80","url":"/images/uk.jpg","method":"GET","header":"GET /images/uk.jpg HTTP/1.1\nAccept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5\nReferer: http://www.emule-project.net/home/perl/general.cgi?rm=porttest&tcpport=55479&udpport=8987&lang=1033&l=1\nAccept-Language: en-US\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko\nAccept-Encoding: gzip, deflate\nHost: www.emule-project.net\nDNT: 1\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"host":"pagead2.googlesyndication.com","host_ip":"216.58.198.194:80","url":"/pagead/show_ads.js","method":"GET","header":"GET /pagead/show_ads.js HTTP/1.1\nAccept: application/javascript, */*;q=0.8\nReferer: http://www.emule-project.net/home/perl/general.cgi?rm=porttest&tcpport=55479&udpport=8987&lang=1033&l=1\nAccept-Language: en-US\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko\nAccept-Encoding: gzip, deflate\nHost: pagead2.googlesyndication.com\nDNT: 1\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"host":"www.emule-project.net","host_ip":"94.16.113.2:80","url":"/images/fr.gif","method":"GET","header":"GET /images/fr.gif HTTP/1.1\nAccept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5\nReferer: http://www.emule-project.net/home/perl/general.cgi?rm=porttest&tcpport=55479&udpport=8987&lang=1033&l=1\nAccept-Language: en-US\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko\nAccept-Encoding: gzip, deflate\nHost: www.emule-project.net\nDNT: 1\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"host":"www.emule-project.net","host_ip":"94.16.113.2:80","url":"/images/he.jpg","method":"GET","header":"GET /images/he.jpg HTTP/1.1\nAccept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5\nReferer: http://www.emule-project.net/home/perl/general.cgi?rm=porttest&tcpport=55479&udpport=8987&lang=1033&l=1\nAccept-Language: en-US\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko\nAccept-Encoding: gzip, deflate\nHost: www.emule-project.net\nDNT: 1\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"host":"www.emule-project.net","host_ip":"94.16.113.2:80","url":"/images/cht.gif","method":"GET","header":"GET /images/cht.gif HTTP/1.1\nAccept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5\nReferer: http://www.emule-project.net/home/perl/general.cgi?rm=porttest&tcpport=55479&udpport=8987&lang=1033&l=1\nAccept-Language: en-US\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko\nAccept-Encoding: gzip, deflate\nHost: www.emule-project.net\nDNT: 1\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"host":"www.emule-project.net","host_ip":"94.16.113.2:80","url":"/images/es.gif","method":"GET","header":"GET /images/es.gif HTTP/1.1\nAccept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5\nReferer: http://www.emule-project.net/home/perl/general.cgi?rm=porttest&tcpport=55479&udpport=8987&lang=1033&l=1\nAccept-Language: en-US\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko\nAccept-Encoding: gzip, deflate\nHost: www.emule-project.net\nDNT: 1\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"host":"www.emule-project.net","host_ip":"94.16.113.2:80","url":"/images/itaflag.jpg","method":"GET","header":"GET /images/itaflag.jpg HTTP/1.1\nAccept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5\nReferer: http://www.emule-project.net/home/perl/general.cgi?rm=porttest&tcpport=55479&udpport=8987&lang=1033&l=1\nAccept-Language: en-US\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko\nAccept-Encoding: gzip, deflate\nHost: www.emule-project.net\nDNT: 1\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"host":"www.emule-project.net","host_ip":"94.16.113.2:80","url":"/images/pl.gif","method":"GET","header":"GET /images/pl.gif HTTP/1.1\nAccept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5\nReferer: http://www.emule-project.net/home/perl/general.cgi?rm=porttest&tcpport=55479&udpport=8987&lang=1033&l=1\nAccept-Language: en-US\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko\nAccept-Encoding: gzip, deflate\nHost: www.emule-project.net\nDNT: 1\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"host":"www.emule-project.net","host_ip":"94.16.113.2:80","url":"/home/img/mid_bg.gif","method":"GET","header":"GET /home/img/mid_bg.gif HTTP/1.1\nAccept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5\nReferer: http://www.emule-project.net/home/perl/general.cgi?rm=porttest&tcpport=55479&udpport=8987&lang=1033&l=1\nAccept-Language: en-US\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko\nAccept-Encoding: gzip, deflate\nHost: www.emule-project.net\nDNT: 1\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"host":"www.emule-project.net","host_ip":"94.16.113.2:80","url":"/images/lt.gif","method":"GET","header":"GET /images/lt.gif HTTP/1.1\nAccept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5\nReferer: http://www.emule-project.net/home/perl/general.cgi?rm=porttest&tcpport=55479&udpport=8987&lang=1033&l=1\nAccept-Language: en-US\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko\nAccept-Encoding: gzip, deflate\nHost: www.emule-project.net\nDNT: 1\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"host":"pagead2.googlesyndication.com","host_ip":"216.58.198.194:80","url":"/pagead/js/r20190128/r20180604/show_ads_impl.js","method":"GET","header":"GET /pagead/js/r20190128/r20180604/show_ads_impl.js HTTP/1.1\nAccept: application/javascript, */*;q=0.8\nReferer: http://www.emule-project.net/home/perl/general.cgi?rm=porttest&tcpport=55479&udpport=8987&lang=1033&l=1\nAccept-Language: en-US\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko\nAccept-Encoding: gzip, deflate\nHost: pagead2.googlesyndication.com\nDNT: 1\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"host":"sflogo.sourceforge.net","host_ip":"216.105.38.13:80","url":"/sflogo.php?group_id=53489&type=12","method":"GET","header":"GET /sflogo.php?group_id=53489&type=12 HTTP/1.1\nAccept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5\nReferer: http://www.emule-project.net/home/perl/general.cgi?rm=porttest&tcpport=55479&udpport=8987&lang=1033&l=1\nAccept-Language: en-US\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko\nAccept-Encoding: gzip, deflate\nHost: sflogo.sourceforge.net\nDNT: 1\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"host":"www.emule-project.net","host_ip":"94.16.113.2:80","url":"/images/ee.gif","method":"GET","header":"GET /images/ee.gif HTTP/1.1\nAccept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5\nReferer: http://www.emule-project.net/home/perl/general.cgi?rm=porttest&tcpport=55479&udpport=8987&lang=1033&l=1\nAccept-Language: en-US\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko\nAccept-Encoding: gzip, deflate\nHost: www.emule-project.net\nDNT: 1\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"host":"www.emule-project.net","host_ip":"94.16.113.2:80","url":"/images/dk.gif","method":"GET","header":"GET /images/dk.gif HTTP/1.1\nAccept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5\nReferer: http://www.emule-project.net/home/perl/general.cgi?rm=porttest&tcpport=55479&udpport=8987&lang=1033&l=1\nAccept-Language: en-US\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko\nAccept-Encoding: gzip, deflate\nHost: www.emule-project.net\nDNT: 1\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"host":"www.emule-project.net","host_ip":"94.16.113.2:80","url":"/images/se.gif","method":"GET","header":"GET /images/se.gif HTTP/1.1\nAccept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5\nReferer: http://www.emule-project.net/home/perl/general.cgi?rm=porttest&tcpport=55479&udpport=8987&lang=1033&l=1\nAccept-Language: en-US\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko\nAccept-Encoding: gzip, deflate\nHost: www.emule-project.net\nDNT: 1\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"host":"www.emule-project.net","host_ip":"94.16.113.2:80","url":"/images/nl.gif","method":"GET","header":"GET /images/nl.gif HTTP/1.1\nAccept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5\nReferer: http://www.emule-project.net/home/perl/general.cgi?rm=porttest&tcpport=55479&udpport=8987&lang=1033&l=1\nAccept-Language: en-US\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko\nAccept-Encoding: gzip, deflate\nHost: www.emule-project.net\nDNT: 1\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"host":"www.emule-project.net","host_ip":"94.16.113.2:80","url":"/home/img/bar_left_long.png","method":"GET","header":"GET /home/img/bar_left_long.png HTTP/1.1\nAccept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5\nReferer: http://www.emule-project.net/home/perl/general.cgi?rm=porttest&tcpport=55479&udpport=8987&lang=1033&l=1\nAccept-Language: en-US\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko\nAccept-Encoding: gzip, deflate\nHost: www.emule-project.net\nDNT: 1\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"host":"www.emule-project.net","host_ip":"94.16.113.2:80","url":"/home/img/bar_bg.gif","method":"GET","header":"GET /home/img/bar_bg.gif HTTP/1.1\nAccept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5\nReferer: http://www.emule-project.net/home/perl/general.cgi?rm=porttest&tcpport=55479&udpport=8987&lang=1033&l=1\nAccept-Language: en-US\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko\nAccept-Encoding: gzip, deflate\nHost: www.emule-project.net\nDNT: 1\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"host":"www.emule-project.net","host_ip":"94.16.113.2:80","url":"/images/br.gif","method":"GET","header":"GET /images/br.gif HTTP/1.1\nAccept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5\nReferer: http://www.emule-project.net/home/perl/general.cgi?rm=porttest&tcpport=55479&udpport=8987&lang=1033&l=1\nAccept-Language: en-US\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko\nAccept-Encoding: gzip, deflate\nHost: www.emule-project.net\nDNT: 1\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"host":"www.emule-project.net","host_ip":"94.16.113.2:80","url":"/images/fcz.gif","method":"GET","header":"GET /images/fcz.gif HTTP/1.1\nAccept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5\nReferer: http://www.emule-project.net/home/perl/general.cgi?rm=porttest&tcpport=55479&udpport=8987&lang=1033&l=1\nAccept-Language: en-US\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko\nAccept-Encoding: gzip, deflate\nHost: www.emule-project.net\nDNT: 1\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"host":"www.emule-project.net","host_ip":"94.16.113.2:80","url":"/images/fpt.gif","method":"GET","header":"GET /images/fpt.gif HTTP/1.1\nAccept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5\nReferer: http://www.emule-project.net/home/perl/general.cgi?rm=porttest&tcpport=55479&udpport=8987&lang=1033&l=1\nAccept-Language: en-US\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko\nAccept-Encoding: gzip, deflate\nHost: www.emule-project.net\nDNT: 1\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"host":"www.emule-project.net","host_ip":"94.16.113.2:80","url":"/images/fru.gif","method":"GET","header":"GET /images/fru.gif HTTP/1.1\nAccept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5\nReferer: http://www.emule-project.net/home/perl/general.cgi?rm=porttest&tcpport=55479&udpport=8987&lang=1033&l=1\nAccept-Language: en-US\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko\nAccept-Encoding: gzip, deflate\nHost: www.emule-project.net\nDNT: 1\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"host":"www.emule-project.net","host_ip":"94.16.113.2:80","url":"/images/fca.gif","method":"GET","header":"GET /images/fca.gif HTTP/1.1\nAccept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5\nReferer: http://www.emule-project.net/home/perl/general.cgi?rm=porttest&tcpport=55479&udpport=8987&lang=1033&l=1\nAccept-Language: en-US\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko\nAccept-Encoding: gzip, deflate\nHost: www.emule-project.net\nDNT: 1\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"host":"www.emule-project.net","host_ip":"94.16.113.2:80","url":"/images/ftr.gif","method":"GET","header":"GET /images/ftr.gif HTTP/1.1\nAccept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5\nReferer: http://www.emule-project.net/home/perl/general.cgi?rm=porttest&tcpport=55479&udpport=8987&lang=1033&l=1\nAccept-Language: en-US\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko\nAccept-Encoding: gzip, deflate\nHost: www.emule-project.net\nDNT: 1\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"host":"www.emule-project.net","host_ip":"94.16.113.2:80","url":"/images/ffi.gif","method":"GET","header":"GET /images/ffi.gif HTTP/1.1\nAccept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5\nReferer: http://www.emule-project.net/home/perl/general.cgi?rm=porttest&tcpport=55479&udpport=8987&lang=1033&l=1\nAccept-Language: en-US\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko\nAccept-Encoding: gzip, deflate\nHost: www.emule-project.net\nDNT: 1\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"host":"www.emule-project.net","host_ip":"94.16.113.2:80","url":"/images/fro.gif","method":"GET","header":"GET /images/fro.gif HTTP/1.1\nAccept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5\nReferer: http://www.emule-project.net/home/perl/general.cgi?rm=porttest&tcpport=55479&udpport=8987&lang=1033&l=1\nAccept-Language: en-US\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko\nAccept-Encoding: gzip, deflate\nHost: www.emule-project.net\nDNT: 1\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"host":"www.emule-project.net","host_ip":"94.16.113.2:80","url":"/images/fgr.gif","method":"GET","header":"GET /images/fgr.gif HTTP/1.1\nAccept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5\nReferer: http://www.emule-project.net/home/perl/general.cgi?rm=porttest&tcpport=55479&udpport=8987&lang=1033&l=1\nAccept-Language: en-US\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko\nAccept-Encoding: gzip, deflate\nHost: www.emule-project.net\nDNT: 1\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"host":"www.emule-project.net","host_ip":"94.16.113.2:80","url":"/images/fcs.gif","method":"GET","header":"GET /images/fcs.gif HTTP/1.1\nAccept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5\nReferer: http://www.emule-project.net/home/perl/general.cgi?rm=porttest&tcpport=55479&udpport=8987&lang=1033&l=1\nAccept-Language: en-US\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko\nAccept-Encoding: gzip, deflate\nHost: www.emule-project.net\nDNT: 1\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"host":"www.emule-project.net","host_ip":"94.16.113.2:80","url":"/images/chs.gif","method":"GET","header":"GET /images/chs.gif HTTP/1.1\nAccept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5\nReferer: http://www.emule-project.net/home/perl/general.cgi?rm=porttest&tcpport=55479&udpport=8987&lang=1033&l=1\nAccept-Language: en-US\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko\nAccept-Encoding: gzip, deflate\nHost: www.emule-project.net\nDNT: 1\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"host":"www.emule-project.net","host_ip":"94.16.113.2:80","url":"/home/img/url.gif","method":"GET","header":"GET /home/img/url.gif HTTP/1.1\nAccept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5\nReferer: http://www.emule-project.net/home/perl/general.cgi?rm=porttest&tcpport=55479&udpport=8987&lang=1033&l=1\nAccept-Language: en-US\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko\nAccept-Encoding: gzip, deflate\nHost: www.emule-project.net\nDNT: 1\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"host":"ocsp.pki.goog","host_ip":"216.58.198.195:80","url":"/gsr2/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBTgXIsxbvr2lBkPpoIEVRE6gHlCnAQUm%2BIHV2ccHsBqBt5ZtJot39wZhi4CDQHjqTAc%2FHIGOD%2BaUx0%3D","method":"GET","header":"GET /gsr2/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBTgXIsxbvr2lBkPpoIEVRE6gHlCnAQUm%2BIHV2ccHsBqBt5ZtJot39wZhi4CDQHjqTAc%2FHIGOD%2BaUx0%3D HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: ocsp.pki.goog","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"host":"ocsp.pki.goog","host_ip":"216.58.198.195:80","url":"/GTSGIAG3/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCCBfmzgQo%2Fsv7","method":"GET","header":"GET /GTSGIAG3/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCCBfmzgQo%2Fsv7 HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: ocsp.pki.goog","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"host":"www.emule-project.net","host_ip":"94.16.113.2:80","url":"/emule.ico","method":"GET","header":"GET /emule.ico HTTP/1.1\nAccept: */*\nAccept-Encoding: gzip, deflate\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko\nHost: www.emule-project.net\nDNT: 1\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"host":"crl.pki.goog","host_ip":"172.217.22.131:80","url":"/GTSGIAG3.crl","method":"GET","header":"GET /GTSGIAG3.crl HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: crl.pki.goog","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"host":"porttest.emule-project.net","host_ip":"94.16.113.2:80","url":"/connectiontest.php?tcpport=46500&udpport=62123&lang=1033","method":"GET","response_code":"302","response_phrase":"Found","header":"GET /connectiontest.php?tcpport=46500&udpport=62123&lang=1033 HTTP/1.1\nHost: porttest.emule-project.net\nConnection: keep-alive\nUpgrade-Insecure-Requests: 1\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.56\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9\nAccept-Encoding: gzip, deflate\nAccept-Language: en-US,en;q=0.9","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}],"processes":[{"pid":2716,"ppid":0,"name":"emule.exe","command_line":"","sha256":"06cdf814387f627a4bd05a0c68211f715bfa952423e8e8a462e1f47c11a4d20e","normalized_path":"C:\\emule.exe","uid":"00000000-00002716","icon":"$51"},{"pid":8124,"ppid":2716,"name":"msedge.exe","command_line":"--single-argument http://porttest.emule-project.net/connectiontest.php?tcpport=46500&udpport=62123&lang=1033","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00002716","uid":"00000000-00008124"},{"pid":676,"ppid":8124,"name":"msedge.exe","command_line":"--type=crashpad-handler \"--user-data-dir=%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler \"--database=%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Crashpad\" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=107.0.5304.110 \"--annotation=exe=%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --annotation=plat=Win64 \"--annotation=prod=Microsoft Edge\" --annotation=ver=107.0.1418.56 --initial-client-data=0xd4,0xd8,0xdc,0xb0,0x160,0x7ffef94bb208,0x7ffef94bb218,0x7ffef94bb228","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00008124","uid":"00000000-00000676"},{"pid":1676,"ppid":8124,"name":"msedge.exe","command_line":"--type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1860 --field-trial-handle=1980,i,8935094828527701091,10985869509646602304,131072 /prefetch:2","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00008124","uid":"00000000-00001676"},{"pid":1972,"ppid":8124,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1944 --field-trial-handle=1980,i,8935094828527701091,10985869509646602304,131072 /prefetch:3","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00008124","uid":"00000000-00001972"},{"pid":2052,"ppid":8124,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2112 --field-trial-handle=1980,i,8935094828527701091,10985869509646602304,131072 /prefetch:8","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00008124","uid":"00000000-00002052"},{"pid":2884,"ppid":8124,"name":"msedge.exe","command_line":"--type=renderer --display-capture-permissions-policy-allowed --js-flags=--ms-user-locale= --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --time-ticks-at-unix-epoch=-1708923763054815 --launch-time-ticks=1107647732 --mojo-platform-channel-handle=2744 --field-trial-handle=1980,i,8935094828527701091,10985869509646602304,131072 /prefetch:1","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00008124","uid":"00000000-00002884"},{"pid":2292,"ppid":8124,"name":"msedge.exe","command_line":"--type=renderer --display-capture-permissions-policy-allowed --js-flags=--ms-user-locale= --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --time-ticks-at-unix-epoch=-1708923763054815 --launch-time-ticks=1108067430 --mojo-platform-channel-handle=2800 --field-trial-handle=1980,i,8935094828527701091,10985869509646602304,131072 /prefetch:1","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00008124","uid":"00000000-00002292"},{"pid":7184,"ppid":8124,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3352 --field-trial-handle=1980,i,8935094828527701091,10985869509646602304,131072 /prefetch:8","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00008124","uid":"00000000-00007184"},{"pid":7472,"ppid":8124,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=4952 --field-trial-handle=1980,i,8935094828527701091,10985869509646602304,131072 /prefetch:8","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00008124","uid":"00000000-00007472"},{"pid":6960,"ppid":8124,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=4996 --field-trial-handle=1980,i,8935094828527701091,10985869509646602304,131072 /prefetch:8","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00008124","uid":"00000000-00006960"},{"pid":2376,"ppid":8124,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4908 --field-trial-handle=1980,i,8935094828527701091,10985869509646602304,131072 /prefetch:8","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00008124","uid":"00000000-00002376"},{"pid":3732,"ppid":8124,"name":"msedge.exe","command_line":"--type=renderer --display-capture-permissions-policy-allowed --js-flags=--ms-user-locale= --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --time-ticks-at-unix-epoch=-1708923763054815 --launch-time-ticks=1113635664 --mojo-platform-channel-handle=4264 --field-trial-handle=1980,i,8935094828527701091,10985869509646602304,131072 /prefetch:1","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00008124","uid":"00000000-00003732"},{"pid":4520,"ppid":8124,"name":"msedge.exe","command_line":"--type=renderer --display-capture-permissions-policy-allowed --js-flags=--ms-user-locale= --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --time-ticks-at-unix-epoch=-1708923763054815 --launch-time-ticks=1115822086 --mojo-platform-channel-handle=5492 --field-trial-handle=1980,i,8935094828527701091,10985869509646602304,131072 /prefetch:1","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00008124","uid":"00000000-00004520"},{"pid":4924,"ppid":8124,"name":"msedge.exe","command_line":"--type=renderer --display-capture-permissions-policy-allowed --js-flags=--ms-user-locale= --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=13 --time-ticks-at-unix-epoch=-1708923763054815 --launch-time-ticks=1116355082 --mojo-platform-channel-handle=5680 --field-trial-handle=1980,i,8935094828527701091,10985869509646602304,131072 /prefetch:1","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00008124","uid":"00000000-00004924"},{"pid":3460,"ppid":8124,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6036 --field-trial-handle=1980,i,8935094828527701091,10985869509646602304,131072 /prefetch:8","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00008124","uid":"00000000-00003460"},{"pid":3964,"ppid":8124,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6204 --field-trial-handle=1980,i,8935094828527701091,10985869509646602304,131072 /prefetch:8","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00008124","uid":"00000000-00003964"},{"pid":7716,"ppid":8124,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2464 --field-trial-handle=1980,i,8935094828527701091,10985869509646602304,131072 /prefetch:8","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00008124","uid":"00000000-00007716"},{"pid":3292,"ppid":8124,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5440 --field-trial-handle=1980,i,8935094828527701091,10985869509646602304,131072 /prefetch:8","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00008124","uid":"00000000-00003292"},{"pid":4836,"ppid":8124,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1812 --field-trial-handle=1980,i,8935094828527701091,10985869509646602304,131072 /prefetch:8","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00008124","uid":"00000000-00004836"},{"pid":8068,"ppid":8124,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2304 --field-trial-handle=1980,i,8935094828527701091,10985869509646602304,131072 /prefetch:8","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00008124","uid":"00000000-00008068"},{"pid":7520,"ppid":8124,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5388 --field-trial-handle=1980,i,8935094828527701091,10985869509646602304,131072 /prefetch:8","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00008124","uid":"00000000-00007520"},{"pid":6444,"ppid":8124,"name":"msedge.exe","command_line":"--type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.16299.192 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6080 --field-trial-handle=1980,i,8935094828527701091,10985869509646602304,131072 /prefetch:2","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00008124","uid":"00000000-00006444"},{"pid":1156,"ppid":8124,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4152 --field-trial-handle=1980,i,8935094828527701091,10985869509646602304,131072 /prefetch:8","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00008124","uid":"00000000-00001156"}],"all_imported_dlls":["ole32.dll","riched20.dll","msvcr110.dll","KernelBase.dll","wship6.dll","imagehlp.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","clbcatq.dll","xmllite.dll","dhcpcsvc6.dll","wshqos.dll","wow64win.dll","user32.dll","ATL90.dll","ieproxy.dll","cryptnet.dll","deploy.dll","advapi32.dll","version.dll","cryptsp.dll","secur32.dll","ieui.dll","wintrust.dll","urlmon.dll","winnsi.dll","NapiNSP.dll","netapi32.dll","gpapi.dll","d2d1.dll","api-ms-win-downlevel-version-l1-1-0.dll","apphelp.dll","FWPUCLNT.DLL","tiptsf.dll","rpcss.dll","URLREDIR.DLL","wow64.dll","ssdpapi.dll","msvcrt.dll","iertutil.dll","crypt32.dll","nsi.dll","FileSyncShell.dll","comdlg32.dll","VxSSL64.dll","shell32.dll","profapi.dll","msvcr100.dll","WSHTCPIP.DLL","icmp.dll","ieframe.dll","mscoreei.dll","msasn1.dll","devobj.dll","msvcp90.dll","mswsock.dll","nlaapi.dll","mscoree.dll","npmproxy.dll","jp2ssv.dll","IPHLPAPI.DLL","asycfilt.dll","RpcRtRemote.dll","ntmarta.dll","cfgmgr32.dll","GrooveIntlResource.dll","netprofm.dll","mlang.dll","MSOHEV.DLL","api-ms-win-downlevel-shell32-l1-1-0.dll","dhcpcsvc.dll","shlwapi.dll","api-ms-win-downlevel-user32-l1-1-0.dll","GdiPlus.dll","Telemetry.dll","ExplorerFrame.dll","api-ms-win-downlevel-ole32-l1-1-0.dll","msvcp110.dll","dwmapi.dll","wow64cpu.dll","sechost.dll","cabinet.dll","msvcr90.dll","imm32.dll","ws2_32.dll","WindowsCodecs.dll","oleaccrc.dll","msctf.dll","oleaut32.dll","tzres.dll","wkscli.dll","oleacc.dll","kernel32.dll","dnsapi.dll","bcryptprimitives.dll","gdi32.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","bcrypt.dll","msimtf.dll","rsaenh.dll","uxtheme.dll","setupapi.dll","netutils.dll","DWrite.dll","sspicli.dll","wininet.dll","LoggingPlatform.dll","duser.dll","jscript9.dll","usp10.dll","rasadhlp.dll","ncrypt.dll","Wldap32.dll","mscorwks.dll","api-ms-win-downlevel-advapi32-l2-1-0.dll","srvcli.dll","dxgi.dll","psapi.dll","GROOVEEX.DLL","upnp.dll","api-ms-win-downlevel-shlwapi-l2-1-0.dll","d3d11.dll","winrnr.dll","credssp.dll","msimg32.dll","EhStorShell.dll","sxs.dll","IEShims.dll","d3d10warp.dll","rpcrt4.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll","sqmapi.dll","userenv.dll","winmm.dll","pnrpnsp.dll","comctl32.dll","winhttp.dll","propsys.dll","dui70.dll","schannel.dll","SensApi.dll","mshtml.dll","ntdll.dll","cryptbase.dll","lpk.dll","imageres.dll","ssv.dll","normaliz.dll","wsock32.dll","webio.dll","wtsapi32.dll","onramp.dll","twinapi.appcore.dll","edputil.dll","microsoft_apis.dll","fwpolicyiomgr.dll","BitsProxy.dll","D3D12.dll","winmmbase.dll","dcomp.dll","dpapi.dll","actxprxy.dll","msls31.dll","ntasn1.dll","FirewallAPI.dll","libEGL.dll","DataExchange.dll","Windows.System.Profile.RetailInfo.dll","Windows.Networking.Connectivity.dll","CompPkgSup.dll","UIAutomationCore.dll","msvcp110_win.dll","atlthunk.dll","wldp.dll","PCPKsp.dll","rmclient.dll","Windows.System.UserProfile.DiagnosticsSettings.dll","WinTypes.dll","aepic.dll","srumapi.dll","telclient.dll","mf.dll","gdi32full.dll","Windows.UI.dll","vk_swiftshader.dll","Windows.Security.Authentication.Web.Core.dll","wlanapi.dll","cldapi.dll","libGLESv2.dll","SHCore.dll","powrprof.dll","CoreMessaging.dll","samcli.dll","DolbyDecMFT.dll","win32u.dll","thumbcache.dll","msvproc.dll","Windows.Shell.ServiceHostBuilder.dll","mfplat.dll","linkinfo.dll","vulkan-1.dll","dxilconv.dll","combase.dll","Windows.Media.dll","directmanipulation.dll","vaultcli.dll","dxva2.dll","dbghelp.dll","ResourcePolicyClient.dll","VxSSL32.dll","TextInputFramework.dll","dmcmnutils.dll","winsta.dll","kernel.appcore.dll","twinapi.dll","RTWorkQ.dll","tbs.dll","msvcp_win.dll","fltLib.dll","d3dcompiler_47.dll","msedge_elf.dll","msedge.dll","ffmpeg.dll","Windows.Security.Authentication.OnlineId.dll","msmpeg2vdec.dll","ucrtbase.dll","OneCoreUAPCommonProxyStub.dll","wevtapi.dll","KBDUS.DLL","oneds.dll","Windows.System.Profile.PlatformDiagnosticsAndUsageDataSettings.dll","dsreg.dll","mfperfhelper.dll","CoreUIComponents.dll","mfsensorgroup.dll","fwbase.dll","windows.storage.dll","Windows.Web.dll","mdmregistration.dll","mscms.dll","OneCoreCommonProxyStub.dll","ntshrui.dll","cscapi.dll","slc.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"urlblockindex_1_.bin","sha256":"775853600060162c4b4e5f883f9fd5a278e61c471b3ee1826396b6d129499aa7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"name":"imagestore.dat","sha256":"616a66d1ced7475a69ceb931da5741461ca823706d1e8dca6d143cb0f80c5762","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"name":"AC_BootstrapIPs.dat","sha256":"b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"name":"AC_SearchStrings.dat","sha256":"b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"name":"AC_ServerMetURLs.dat","sha256":"b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"name":"StoredSearches.met","sha256":"a26b67b1db9740f5039a173b79286088d12d65542acbca924654728a3ad13277","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"name":"cancelled.met","sha256":"e3f92e100f978415262ceeebe1c4ceff593dd2d5410cfa6cb9703de2cc7abc25","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"name":"clients.met","sha256":"5b6913fb226d74222e31ba1e9be64274eb3dba34a83c4d252608711a18ee6fcf","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"name":"cryptkey.dat","sha256":"96da2e158414f8459abde23cb172d040e41a9818cbadf3b9d730ba74069f8213","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"},{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"},{"report_type":"sandbox","report_id":"59d4b90c7ca3e1442d6d9793"}]},{"name":"downloads.tmp","sha256":"c9b2cc9e782467bf123709aecc3b709a78d670f003fd83364102b7aa8a9bff16","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"},{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"},{"report_type":"sandbox","report_id":"59d4b90c7ca3e1442d6d9793"}]},{"name":"emfriends.met","sha256":"83eafc118ee2ef9073ef3ce2a22a49fe47a950df022806a23ab07bb889db1d6f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"name":"known.met","sha256":"83eafc118ee2ef9073ef3ce2a22a49fe47a950df022806a23ab07bb889db1d6f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"name":"preferences.dat","sha256":"041ebb253ea231ee86b55a7625068de58c37dfc454251deba1f4a7c64b558294","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"name":"preferences.ini","sha256":"6e687b9a398acf1a240d4148a7f359fc97cbefd27b6c336ba642e12eafeaa523","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"},{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"name":"server.met.new","sha256":"f2a60a2ad320884dd6d93675c9cd39918a6b2f1300b41188c75e1f0c2e77ab27","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"name":"shareddir.dat","sha256":"b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"name":"sharedfiles.dat","sha256":"b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"name":"statistics.ini","sha256":"32628018d9d5e55e2cc383512cca35beb70ffdd34935e274dccdd14e0f76897d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"},{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"},{"report_type":"sandbox","report_id":"59d4b90c7ca3e1442d6d9793"}]},{"name":"01B16CDBADE7DB774141D7E30D50EC69","sha256":"7552116ea670e00b65be37d3d0a0e12603ae6958abe220f818ada5f081bf3158","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"name":"6BADA8974A10C4BD62CC921D13E43B18_BEB37ABADF39714871232B4792417E04","sha256":"f6f8fca28025d8d113113dcdf35e15756a84f9e712fea4281500251cb5eeeed5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"name":"CFE86DBBE02D859DC92F1E17E0574EE8_FDB452422670E72EDD3FB3D65568F821","sha256":"7dc8284c51c9a38dc1bf03bd28857ea5336e8f5c564eddbb1c9082ee43c93738","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"name":"urlref_httpporttest.emule-project.netconnectiontest.phptcpport_46500_udpport_62123_lang_1033","sha256":"7f3580ec2ad653e29cf1c54725361e8103df9206a90db3220d3abdf7eeb4d9de","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"name":"known2_64.met","sha256":"dbc1b4c900ffe48d575b5da5c638040125f65db0fe3e24494b76ea986457d986","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59d4b90c7ca3e1442d6d9793"}]}],"files_written":[{"path":"%LOCALAPPDATA%\\eMule","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"path":"%LOCALAPPDATA%\\eMule\\config","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"path":"%USERPROFILE%\\Downloads\\eMule","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"},{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"path":"%LOCALAPPDATA%\\eMule\\config\\preferences.ini","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"},{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"path":"%ALLUSERSPROFILE%\\eMule","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"},{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"path":"%ALLUSERSPROFILE%\\eMule\\skins","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"},{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"},{"report_type":"sandbox","report_id":"59d4b90c7ca3e1442d6d9793"}]},{"path":"C:\\lang","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"path":"%LOCALAPPDATA%\\eMule\\config\\addresses.dat","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"},{"report_type":"sandbox","report_id":"59d4b90c7ca3e1442d6d9793"}]},{"path":"%WINDIR%\\SysWOW64\\tzres.dll","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\OneDrive\\17.3.4604.0120\\FileSyncShell.dll","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"path":"%WINDIR%\\SysWOW64\\EhStorShell.dll","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\EhStorShell.dll.mui","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"path":"%PROGRAMFILES(X86)%\\MICROS~2\\Office14\\GROOVEEX.DLL","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"path":"%LOCALAPPDATA%\\eMule\\config\\cryptkey.dat","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"},{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"},{"report_type":"sandbox","report_id":"59d4b90c7ca3e1442d6d9793"}]},{"path":"%WINDIR%\\winsxs\\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.7600.16385_en-us_581cd2bf5825dde9\\comctl32.dll.mui","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"path":"%WINDIR%\\SysWOW64\\imageres.dll","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"path":"%LOCALAPPDATA%\\eMule\\config\\ipfilter.dat","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"},{"report_type":"sandbox","report_id":"59d4b90c7ca3e1442d6d9793"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\user32.dll.mui","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"path":"%LOCALAPPDATA%\\eMule\\config\\server.met","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"},{"report_type":"sandbox","report_id":"59d4b90c7ca3e1442d6d9793"}]},{"path":"%LOCALAPPDATA%\\eMule\\config\\staticservers.dat","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"},{"report_type":"sandbox","report_id":"59d4b90c7ca3e1442d6d9793"}]},{"path":"%LOCALAPPDATA%\\eMule\\config\\statistics.ini","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"},{"report_type":"sandbox","report_id":"59d4b90c7ca3e1442d6d9793"}]},{"path":"C:\\http:\\porttest.emule-project.net\\connectiontest.php?tcpport=55479&udpport=8987&lang=1033","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"path":"%PROGRAMFILES%\\(x86)\\Internet Explorer\\en\\IEXPLORE.EXE.mui","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\Recovery\\High\\Active","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"path":"%TEMP%\\~DF4196E44446430BCF.TMP","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"path":"C:","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\counters.dat","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"path":"%PROGRAMFILES%\\(x86)\\Internet Explorer\\iexplore.exe","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\Recovery\\High\\Active\\{8B54D663-2538-11E9-A156-0A0027C19E6D}.dat","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"path":"%TEMP%\\~DF25452A5E49C9EBEE.TMP","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"path":"%WINDIR%\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"path":"%PROGRAMFILES(X86)%\\MICROS~2\\Office14\\URLREDIR.DLL","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"path":"%PROGRAMFILES%\\(x86)\\Java\\jre1.8.0_151\\lib\\plugin.jar","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"path":"%PROGRAMFILES%\\(x86)\\Java\\jre1.8.0_151\\bin\\javaws.exe","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"path":"%TEMP%\\JavaDeployReg.log","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"path":"%WINDIR%\\SysWOW64\\ieframe.dll","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"path":"%WINDIR%\\SysWOW64\\wshqos.dll","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"path":"%WINDIR%\\SysWOW64\\stdole2.tlb","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"path":"%WINDIR%\\System32\\en-US\\KernelBase.dll.mui","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\6BADA8974A10C4BD62CC921D13E43B18_D9817BD5013875AD517DA73475345203","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\6BADA8974A10C4BD62CC921D13E43B18_A7A8E86FCB076C144BD04C40841E7074","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\82CB34DD3343FE727DF8890D352E0D8F","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Q38I0BE9\\general[1].htm","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{846EE342-7039-11DE-9D20-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{C3450F58-7060-4AEA-B0A0-C245927D78D0}","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Q38I0BE9\\emule[1].css","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Q38I0BE9\\top_bg[1].gif","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\MSIMGSIZ.DAT","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Q38I0BE9\\logo_top[1].jpg","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Q38I0BE9\\logo[1].jpg","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Q38I0BE9\\uk[1].jpg","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Q38I0BE9\\he[1].jpg","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Q38I0BE9\\fr[1].gif","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\O2FDR7TK\\www.emule-project[1].xml","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\6BADA8974A10C4BD62CC921D13E43B18_D9817BD5013875AD517DA73475345203","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Q38I0BE9\\itaflag[1].jpg","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Q38I0BE9\\es[1].gif","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework64\\v2.0.50727\\clr.dll","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework64\\v2.0.50727\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"path":"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe.config","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"path":"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Q38I0BE9\\cht[1].gif","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Q38I0BE9\\lt[1].gif","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Q38I0BE9\\sflogo[1].png","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Q38I0BE9\\f[1].txt","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Q38I0BE9\\f[2].txt","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Q38I0BE9\\se[1].gif","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Q38I0BE9\\nl[1].gif","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Q38I0BE9\\bar_bg[1].gif","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\Recovery\\High\\Active\\RecoveryStore.{8B54D661-2538-11E9-A156-0A0027C19E6D}.dat","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Q38I0BE9\\fcz[1].gif","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\CFE86DBBE02D859DC92F1E17E0574EE8_7F4AA74A3B6AAF7E85F2F3FE1488680F","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\85B3F147E3624A14E6A20DB4F6C2C5D9","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Q38I0BE9\\fpt[1].gif","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Q38I0BE9\\ftr[1].gif","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Q38I0BE9\\ffi[1].gif","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Q38I0BE9\\result_err[1].gif","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Q38I0BE9\\fcs[1].gif","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Q38I0BE9\\spacer[1].gif","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\6BADA8974A10C4BD62CC921D13E43B18_BEB37ABADF39714871232B4792417E04","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\6BADA8974A10C4BD62CC921D13E43B18_BEB37ABADF39714871232B4792417E04","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\6BADA8974A10C4BD62CC921D13E43B18_49FC544F04082FD9F64F9EFB226AF8B5","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\CFE86DBBE02D859DC92F1E17E0574EE8_FDB452422670E72EDD3FB3D65568F821","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\CFE86DBBE02D859DC92F1E17E0574EE8_FDB452422670E72EDD3FB3D65568F821","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\F5F320A94D4D2B4465D8F17E2BB2D351_076E7A8AF2B6A87E9FF4CDB56F13E95B","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\F5F320A94D4D2B4465D8F17E2BB2D351_71F81B2C26F0861960A62C12D0AD963A","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Q38I0BE9\\ca-pub-9652609043628988[1].js","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"path":"C:\\share","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\01B16CDBADE7DB774141D7E30D50EC69","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\01B16CDBADE7DB774141D7E30D50EC69","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"path":"%WINDIR%\\System32\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\UrlBlockManager\\urlblocklist.bin","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Low","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\Low","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History\\Low","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"path":"%APPDATA%\\Adobe\\Flash Player\\NativeCache","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"path":"%APPDATA%\\Microsoft\\Internet Explorer\\UserData\\Low","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"path":"%USERPROFILE%\\Favorites","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\Tracking Protection","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Feeds","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\TabRoaming","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\PlayReady","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\PrivacIE","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\PrivacIE\\Low","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\DNTException","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\DNTException\\Low","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\IECompatCache","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\IECompatCache\\Low","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\IECompatUACache","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\IECompatUACache\\Low","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"path":"%TEMP%\\Low","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"path":"%WINDIR%\\SysWOW64\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"path":"%WINDIR%\\System32\\oleaccrc.dll","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"path":"%WINDIR%\\System32\\en-US\\msctf.dll.mui","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"path":"%WINDIR%\\Fonts\\StaticCache.dat","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\YHKITAO6.txt","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"path":"%WINDIR%\\System32\\wshqos.dll","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\KernelBase.dll.mui","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"path":"%USERPROFILE%\\Favorites\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"path":"%USERPROFILE%\\Desktop\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Q38I0BE9\\de[1].jpg","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\msctf.dll.mui","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"path":"%WINDIR%\\Fonts\\verdana.ttf","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"path":"%WINDIR%\\Fonts\\verdanab.ttf","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"path":"%WINDIR%\\Fonts\\verdanaz.ttf","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\jscript9.dll.mui","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\2M2KC0IU\\urlblockindex[1].bin","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"path":"%WINDIR%\\Fonts\\verdanai.ttf","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Q38I0BE9\\pl[1].gif","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Q38I0BE9\\mid_bg[1].gif","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Q38I0BE9\\ee[1].gif","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Q38I0BE9\\dk[1].gif","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Q38I0BE9\\bar_left_long[1].png","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Q38I0BE9\\ct_frame[1].htm","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"path":"%WINDIR%\\Fonts\\timesbd.ttf","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Q38I0BE9\\br[1].gif","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\AJM3J0V2.txt","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\24I82KXY.txt","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Q38I0BE9\\fru[1].gif","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Q38I0BE9\\fca[1].gif","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Q38I0BE9\\connecting[1].gif","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Q38I0BE9\\fgr[1].gif","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Q38I0BE9\\fro[1].gif","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Q38I0BE9\\chs[1].gif","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Q38I0BE9\\url[1].gif","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\F5F320A94D4D2B4465D8F17E2BB2D351_E61776D8705D1081B4DA593DC5A8D494","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\2M2KC0IU","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\2M2KC0IU\\favicon[1].ico","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\F5F320A94D4D2B4465D8F17E2BB2D351_BD1810A3B2A05E2206B968470A21359C","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\F5F320A94D4D2B4465D8F17E2BB2D351_BD1810A3B2A05E2206B968470A21359C","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\2M2KC0IU\\favicon[1].png","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\2M2KC0IU\\favicon[2].png","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000005.db","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"path":"C:\\Users\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"path":"C:\\Users","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"},{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"path":"%USERPROFILE%\\AppData","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"},{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"path":"%LOCALAPPDATA%\\Microsoft","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"path":"%WINDIR%\\SysWOW64\\shell32.dll","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\shell32.dll.mui","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Q38I0BE9\\emule[1].ico","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\imagestore\\js9ur7b\\imagestore.dat","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"path":"%LOCALAPPDATA%\\eMule\\config\\shareddir.dat","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"},{"report_type":"sandbox","report_id":"59d4b90c7ca3e1442d6d9793"}]},{"path":"%LOCALAPPDATA%\\eMule\\config\\known.met","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"},{"report_type":"sandbox","report_id":"59d4b90c7ca3e1442d6d9793"}]},{"path":"%LOCALAPPDATA%\\eMule\\config\\cancelled.met","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"path":"%LOCALAPPDATA%\\eMule\\config\\sharedfiles.dat","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"},{"report_type":"sandbox","report_id":"59d4b90c7ca3e1442d6d9793"}]},{"path":"%LOCALAPPDATA%\\eMule\\config\\AC_SearchStrings.dat","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"},{"report_type":"sandbox","report_id":"59d4b90c7ca3e1442d6d9793"}]},{"path":"%LOCALAPPDATA%\\eMule\\config\\AC_ServerMetURLs.dat","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"},{"report_type":"sandbox","report_id":"59d4b90c7ca3e1442d6d9793"}]},{"path":"%LOCALAPPDATA%\\eMule\\config\\AC_BootstrapIPs.dat","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"},{"report_type":"sandbox","report_id":"59d4b90c7ca3e1442d6d9793"}]},{"path":"%LOCALAPPDATA%\\eMule\\config\\StoredSearches.met","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"},{"report_type":"sandbox","report_id":"59d4b90c7ca3e1442d6d9793"}]},{"path":"%LOCALAPPDATA%\\eMule\\config\\preferences.dat","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"},{"report_type":"sandbox","report_id":"59d4b90c7ca3e1442d6d9793"}]},{"path":"%USERPROFILE%\\Downloads\\eMule\\Incoming","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"},{"report_type":"sandbox","report_id":"59d4b90c7ca3e1442d6d9793"}]},{"path":"%USERPROFILE%\\Downloads\\eMule\\Temp","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"path":"%LOCALAPPDATA%\\eMule\\config\\clients.met","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"},{"report_type":"sandbox","report_id":"59d4b90c7ca3e1442d6d9793"}]},{"path":"%LOCALAPPDATA%\\eMule\\config\\emfriends.met","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"},{"report_type":"sandbox","report_id":"59d4b90c7ca3e1442d6d9793"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Explorer","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls","sources":[{"report_type":"sandbox","report_id":"59d4b90c7ca3e1442d6d9793"}]},{"path":"%WINDIR%\\system32\\tzres.dll","sources":[{"report_type":"sandbox","report_id":"59d4b90c7ca3e1442d6d9793"}]},{"path":"%WINDIR%\\system32\\en-US\\tzres.dll.mui","sources":[{"report_type":"sandbox","report_id":"59d4b90c7ca3e1442d6d9793"}]},{"path":"%WINDIR%\\system32\\en-US\\SETUPAPI.dll.mui","sources":[{"report_type":"sandbox","report_id":"59d4b90c7ca3e1442d6d9793"}]},{"path":"PIPE\\srvsvc","sources":[{"report_type":"sandbox","report_id":"59d4b90c7ca3e1442d6d9793"}]},{"path":"%WINDIR%\\system32\\imageres.dll","sources":[{"report_type":"sandbox","report_id":"59d4b90c7ca3e1442d6d9793"}]},{"path":"%WINDIR%\\system32\\en-US\\imageres.dll.mui","sources":[{"report_type":"sandbox","report_id":"59d4b90c7ca3e1442d6d9793"}]},{"path":"%WINDIR%\\Fonts\\staticcache.dat","sources":[{"report_type":"sandbox","report_id":"59d4b90c7ca3e1442d6d9793"}]},{"path":"%WINDIR%\\system32\\en-US\\USER32.dll.mui","sources":[{"report_type":"sandbox","report_id":"59d4b90c7ca3e1442d6d9793"}]},{"path":"%WINDIR%\\system32\\en-US\\MSCTF.dll.mui","sources":[{"report_type":"sandbox","report_id":"59d4b90c7ca3e1442d6d9793"}]},{"path":"%WINDIR%\\WinSxS\\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.7600.16385_en-us_581cd2bf5825dde9\\COMCTL32.dll.mui","sources":[{"report_type":"sandbox","report_id":"59d4b90c7ca3e1442d6d9793"}]},{"path":"%LOCALAPPDATA%\\eMule\\config\\known2_64.met","sources":[{"report_type":"sandbox","report_id":"59d4b90c7ca3e1442d6d9793"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"key":"HKLMHKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\DESKTOP\\NAMESPACE\\\\","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\DESKTOP\\NAMESPACE\\\\","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"key":"HKLMHKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\DESKTOP\\NAMESPACE\\DELEGATEFOLDERS\\\\","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"key":"HKCU\\SOFTWARE\\CLASSES\\ED2K\\SHELL\\OPEN\\COMMAND\\","sources":[{"report_type":"sandbox","report_id":"59d4b90c7ca3e1442d6d9793"}]},{"key":"HKCU\\SOFTWARE\\","sources":[{"report_type":"sandbox","report_id":"59d4b90c7ca3e1442d6d9793"}]},{"key":"HKCU\\SOFTWARE\\CLASSES\\","sources":[{"report_type":"sandbox","report_id":"59d4b90c7ca3e1442d6d9793"}]},{"key":"HKCU\\ED2K\\","sources":[{"report_type":"sandbox","report_id":"59d4b90c7ca3e1442d6d9793"}]},{"key":"HKCU\\ED2K\\SHELL\\","sources":[{"report_type":"sandbox","report_id":"59d4b90c7ca3e1442d6d9793"}]},{"key":"HKCU\\ED2K\\SHELL\\OPEN\\","sources":[{"report_type":"sandbox","report_id":"59d4b90c7ca3e1442d6d9793"}]},{"key":"HKCU\\ED2K\\SHELL\\OPEN\\COMMAND\\","sources":[{"report_type":"sandbox","report_id":"59d4b90c7ca3e1442d6d9793"}]},{"key":"HKCU\\SOFTWARE\\CLASSES\\ED2K\\DEFAULTICON\\","sources":[{"report_type":"sandbox","report_id":"59d4b90c7ca3e1442d6d9793"}]},{"key":"HKCU\\SOFTWARE\\CLASSES\\ED2K\\","sources":[{"report_type":"sandbox","report_id":"59d4b90c7ca3e1442d6d9793"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\\","sources":[{"report_type":"sandbox","report_id":"59d4b90c7ca3e1442d6d9793"}]}],"keys_modified":null,"keys_deleted":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\PROXYSERVER\\PROXYSERVER","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\PROXYOVERRIDE\\PROXYOVERRIDE","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\AUTOCONFIGURL\\AUTOCONFIGURL","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\AUTODETECT\\AUTODETECT","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\PROXYBYPASS\\PROXYBYPASS","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\PROXYBYPASS\\PROXYBYPASS","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\INTRANETNAME\\INTRANETNAME","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\INTRANETNAME\\INTRANETNAME","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\RECOVERY\\ADMINACTIVE\\{00000000-0000-0000-0000-000000000000}\\{00000000-0000-0000-0000-000000000000}","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\TABBEDBROWSING\\NEWTABPAGE\\MFV\\MFV","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\{33AAD629-D83F-4FBC-8D2F-FD1B2305E4FB}\\WPADDETECTEDURL\\WPADDETECTEDURL","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\0A-00-27-00-00-00\\WPADDETECTEDURL\\WPADDETECTEDURL","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"key":"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\PROXYBYPASS\\PROXYBYPASS","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"key":"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\INTRANETNAME\\INTRANETNAME","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\\EMULEAUTOSTART\\EMULEAUTOSTART","sources":[{"report_type":"sandbox","report_id":"59d4b90c7ca3e1442d6d9793"}]}]},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\EMULE-{4EADC6FC-516F-4b7c-9066-97D893649570}:4662","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"},{"report_type":"sandbox","report_id":"59d4b90c7ca3e1442d6d9793"}]},{"name":"EMULE-{4EADC6FC-516F-4b7c-9066-97D893649570}:4662","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"},{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"},{"report_type":"sandbox","report_id":"59d4b90c7ca3e1442d6d9793"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\!BrowserEmulation!SharedMemory!Mutex","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\VERMGMTBlockListFileMutex","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\URLBLOCK_FILEMAPSWITCH_MUTEX_2248","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\URLBLOCK_HASHFILESWITCH_MUTEX","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\URLBLOCK_DOWNLOAD_MUTEX","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_8c8_IE_EarlyTabStart_0xae8_Mutex","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_8c8_ConnHashTable<2248>_HashTable_Mutex","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\{5312EE61-79E3-4A24-BFE1-132B85B23C3A}","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_8c8_IESQMMUTEX_0_303","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_8c8_IESQMMUTEX_0_331","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\{66D0969A-1E86-44CF-B4EC-3806DDDA3B5D}","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"name":"{5312EE61-79E3-4A24-BFE1-132B85B23C3A}","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"name":"IsoScope_8c8_IESQMMUTEX_0_519","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"name":"IsoScope_8c8_ConnHashTable<2248>_HashTable_Mutex","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"name":"IsoScope_8c8_IE_EarlyTabStart_0xae8_Mutex","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"name":"Local\\!BrowserEmulation!SharedMemory!Mutex","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"name":"Local\\URLBLOCK_HASHFILESWITCH_MUTEX","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"name":"IsoScope_8c8_IESQMMUTEX_0_303","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"name":"Local\\VERMGMTBlockListFileMutex","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"name":"UpdatingNewTabPageData","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"name":"Local\\URLBLOCK_DOWNLOAD_MUTEX","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"name":"IsoScope_8c8_IESQMMUTEX_0_331","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"name":"Local\\URLBLOCK_FILEMAPSWITCH_MUTEX_2248","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"name":"{66D0969A-1E86-44CF-B4EC-3806DDDA3B5D}","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_8c8_IESQMMUTEX_0_519","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\UpdatingNewTabPageData","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"name":"Local\\InternetExplorerDOMStoreQuota","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"name":"Local\\MSIMGSIZECacheMutex","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"name":"Local\\http://www.emule-project.net/","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"name":"IsoScope_8c8_IESQMMUTEX_0_274","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\MSIMGSIZECacheMutex","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_8c8_IESQMMUTEX_0_274","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\http://www.emule-project.net/","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\InternetExplorerDOMStoreQuota","sources":[{"report_type":"sandbox","report_id":"5c529ff17ca3e12c2a31d958"}]},{"name":"Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_256.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"name":"Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_wide.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"name":"Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_wide_alternate.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"name":"Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_sr.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"name":"Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!IconCacheInit","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"name":"Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_custom_stream.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"name":"Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_768.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"name":"Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_1920.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"name":"Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwWriterMutex","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"name":"Local\\SM0:2716:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"name":"Local\\SM0:2716:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"name":"Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_exif.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"name":"Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_2560.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"name":"Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_16.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"name":"SM0:2716:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"name":"Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_32.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"name":"Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_1280.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"name":"Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_48.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]},{"name":"Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_96.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"65dc1ef594972b4d46023100"}]}]}},"report_ids":{"sandbox_job_ids":["59d4b90c7ca3e1442d6d9793","65dc1ef594972b4d46023100","5c529ff17ca3e12c2a31d958"]}}}]]}] 1b:null 1f:[["$","title","0",{"children":"Clean Sample 06cdf814387f… — Score 0/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Clean verdict for sample 06cdf814387f…. Threat score 0/100. 0/25 AV engines flagged this file. 11 malicious and 26 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/06cdf814387f627a4bd05a0c68211f715bfa952423e8e8a462e1f47c11a4d20e"}],["$","meta","4",{"property":"og:title","content":"Clean Sample 06cdf814387f… — Score 0/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Clean verdict for sample 06cdf814387f…. Threat score 0/100. 0/25 AV engines flagged this file. 11 malicious and 26 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/06cdf814387f627a4bd05a0c68211f715bfa952423e8e8a462e1f47c11a4d20e"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Clean Sample 06cdf814387f… — Score 0/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Clean verdict for sample 06cdf814387f…. Threat score 0/100. 0/25 AV engines flagged this file. 11 malicious and 26 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L52","11",{}]]